dshmarket 1.66.1 → 1.66.3

package/client/client.js

@@ -272,6 +272,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			capRedInstallScriptScripts: "安装时会立刻运行 {0}，不需要你打开插件",
 			capRedCoreTamper: "会改动 DSH 自带的组件",
 			capRedCoreTamperDetail: "会改动 DSH 自带的组件（{0}）",
+			capRedCoreOverride: "会覆盖 DSH 自带的组件（{0}）",
+			capRedCoreDisable: "会禁用 DSH 自带的组件（{0}）",
 			favoriteAdd: "加入收藏",
 			favoriteRemove: "取消收藏",
 			favoritesEmpty: "还没有收藏。在「发现」或「主题」里点书签图标即可收藏。",
@@ -920,6 +922,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			capRedInstallScriptScripts: "runs {0} the moment you install — you do not have to open the plugin",
 			capRedCoreTamper: "replaces parts of DSH itself",
 			capRedCoreTamperDetail: "replaces parts of DSH itself ({0})",
+			capRedCoreOverride: "overrides a part of DSH itself ({0})",
+			capRedCoreDisable: "disables a part of DSH itself ({0})",
 			favoriteAdd: "Add to favorites",
 			favoriteRemove: "Remove from favorites",
 			favoritesEmpty: "No favorites yet. Click the bookmark icon in Discover or Themes to add one.",
@@ -9764,6 +9768,11 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				if (literalIp !== null) return t("capRedLiteralIp").replace("{0}", literalIp[1]);
 				const installScript = /^runs code at install time(?: \((.+)\))?$/.exec(line);
 				if (installScript !== null) return installScript[1] === void 0 ? t("capRedInstallScript") : t("capRedInstallScriptScripts").replace("{0}", installScript[1]);
+				const coreVerb = /^tampers with a core bundle \((overrides|disables) bundle (.+)\)$/.exec(line);
+				if (coreVerb !== null) {
+					const key = coreVerb[1] === "overrides" ? "capRedCoreOverride" : "capRedCoreDisable";
+					return t(key).replace("{0}", coreVerb[2]);
+				}
 				const coreTamper = /^tampers with a core bundle(?: \((.+)\))?$/.exec(line);
 				if (coreTamper !== null) return coreTamper[1] === void 0 ? t("capRedCoreTamper") : t("capRedCoreTamperDetail").replace("{0}", coreTamper[1]);
 				return line;

package/lib/changelog.js

@@ -21,7 +21,7 @@ import { fileFromTarball } from './catalog-npm.js';
 import { marketFetch } from './net.js';
 import { activeRegion, routesFor } from './regions.js';
 import { profileDir, readInstalled, readInstalledRepoEvidence, readLockCommits } from './profile.js';
-import { lookupRepoFromUrl, repoOf, repoOfTarget } from './sources.js';
+import { lookupRepoFromUrl, parseSourceUrl, repoOf, repoOfTarget } from './sources.js';
 import { checkUpdates } from './updates.js';
 import { loadRegistry } from './registry.js';
 const UPDATES_PACKAGE = 'dsh-plugin-updates';
@@ -170,6 +170,55 @@ export async function npmPublishTimes(name) {
     timesCache.set(name, { at: Date.now(), data });
     return data;
 }
+/** A probe entry the dialog can actually render — an empty object is a miss. */
+function usableNotes(entry) {
+    if (entry === undefined)
+        return false;
+    if (entry.release != null && (entry.release.body !== '' || entry.release.tag !== null))
+        return true;
+    return (entry.commits?.length ?? 0) > 0;
+}
+/**
+ * The catalog row for an npm install.
+ *
+ * The profile dependency key is the npm package name. The catalog `name`
+ * often is not: a monorepo entry is `repo#subpath`, and a scoped package's
+ * catalog name drops the scope (#746). `npm` is the identity the install
+ * used, so it wins; a bare `name` match remains for entries that publish
+ * under their catalog name. Several hits are disambiguated by the installed
+ * repository, and an ambiguous set is left unresolved (#598).
+ */
+function catalogEntryForNpmInstall(plugins, name, evidence) {
+    const byNpm = plugins.filter(p => p.npm === name);
+    const candidates = byNpm.length > 0 ? byNpm : plugins.filter(p => p.name === name);
+    if (candidates.length <= 1)
+        return candidates[0];
+    const identities = evidence().identities;
+    const matches = candidates.filter(p => identities.some(id => repoOf(p.url)?.toLowerCase() === id.split('#')[0].toLowerCase()));
+    return matches.length === 1 ? matches[0] : undefined;
+}
+/**
+ * The catalog row for a `github:…#path:` install.
+ *
+ * `repoKeyOf` keeps only the repository root, while a monorepo entry's notes
+ * are stored under its `/tree/<ref>/<subpath>` url (#746). The spec's subpath
+ * selects the row. Two rows with one subpath are not guessed between.
+ */
+function catalogEntryForGitSubpath(plugins, spec) {
+    const identity = repoOfTarget(spec);
+    const marker = identity?.indexOf('#path:/') ?? -1;
+    if (identity === null || marker === -1)
+        return undefined;
+    const repo = identity.slice(0, marker);
+    const subpath = identity.slice(marker + '#path:/'.length);
+    const matches = plugins.filter(p => {
+        const source = parseSourceUrl(p.url);
+        return source?.subpath != null
+            && source.repo.toLowerCase() === repo
+            && source.subpath.toLowerCase() === subpath;
+    });
+    return matches.length === 1 ? matches[0] : undefined;
+}
 /**
  * Resolve the notes for one installed plugin, or `{ kind: 'none' }`.
  *
@@ -185,52 +234,46 @@ export async function updateNotesFor(profile, explicitDir, name) {
     }
     try {
         const payload = await loadUpdateNotes();
-        let key = repoKeyOf(spec);
-        // If the spec is a Release asset URL (catalog format), try to extract
-        // the repo from the URL directly. This handles npm-installed plugins
-        // whose profile spec is the npm name but the catalog entry uses a
-        // Release asset tarball URL.
-        if (key === null) {
-            key = lookupRepoFromUrl(spec);
-        }
-        // If the spec is an npm package name (not a GitHub URL), look up the
-        // catalog to find the corresponding GitHub repo URL.
-        if (key === null) {
+        // A Release-asset spec carries the repo in the URL itself. An npm
+        // version range carries nothing, so `specKey` stays null and the catalog
+        // lookup below is what finds the repository.
+        const specKey = repoKeyOf(spec) ?? lookupRepoFromUrl(spec);
+        let key = specKey;
+        let entry = key === null ? undefined : entryForRepo(payload, key);
+        // The catalog is how an npm install, or a `#path:` install whose notes
+        // live under a /tree/ url, finds a key the spec itself does not name.
+        // A root github spec already is that key. Loading the catalog on a root
+        // miss would wait out its timeout to answer "no notes".
+        const needsCatalog = specKey === null || (repoOfTarget(spec)?.includes('#path:/') ?? false);
+        if (!usableNotes(entry) && needsCatalog) {
             try {
                 const registry = await loadRegistry();
-                const candidates = registry.plugins.filter(p => p.name === name);
-                let plugin;
-                if (candidates.length === 1) {
-                    plugin = candidates[0];
-                }
-                else if (candidates.length > 1) {
-                    // Same-named packages exist in the catalog; a bare name match can
-                    // pick someone else's repo and answer "no notes" for a plugin that
-                    // ships updates data under its own repository (#598). The installed
-                    // package declares its repository, so prefer the catalog entry that
-                    // agrees with it; only a unique agreement is trusted — an ambiguous
-                    // name falls through to npm publish times, which are honest for any
-                    // installed npm package.
-                    const evidence = readInstalledRepoEvidence(profile, name, spec, explicitDir);
-                    const matches = candidates.filter(p => evidence.identities.some(id => repoOf(p.url)?.toLowerCase() === id.split('#')[0].toLowerCase()));
-                    if (matches.length === 1)
-                        plugin = matches[0];
-                }
+                const plugin = specKey === null
+                    ? catalogEntryForNpmInstall(registry.plugins, name, () => readInstalledRepoEvidence(profile, name, spec, explicitDir))
+                    : catalogEntryForGitSubpath(registry.plugins, spec);
                 if (plugin !== undefined) {
-                    key = plugin.url;
+                    const catalogEntry = entryForRepo(payload, plugin.url);
+                    // An empty row does not become the key. Publish times for an npm
+                    // install follow from `specKey` staying null, and a subpath install
+                    // keeps the root key so the miss stays `none`.
+                    if (usableNotes(catalogEntry)) {
+                        key = plugin.url;
+                        entry = catalogEntry;
+                    }
                 }
             }
             catch {
-                // Catalog unavailable; fall through to npm times.
+                // Catalog unavailable; the tiers below still answer.
             }
         }
-        const entry = key === null ? undefined : entryForRepo(payload, key);
         // Both tiers below need the installed sha for github-kind installs.
         // For Release asset URLs and catalog lookups, checkUpdates doesn't
         // recognize the spec, so we read the lockfile directly using the repo key.
+        // `repoOf` drops a `/tree/<ref>/<subpath>` suffix; slicing the url at `#`
+        // would look the commit up under `owner/repo/tree/...` and miss it.
         let current = null;
         if (key !== null && key.startsWith('https://github.com/')) {
-            const repo = key.slice('https://github.com/'.length).split('#')[0].toLowerCase();
+            const repo = (repoOf(key) ?? key.slice('https://github.com/'.length).split('#')[0]).toLowerCase();
             current = readLockCommits(profile, activeProfileDir).get(`github.com/${repo}`) ?? null;
         }
         else {
@@ -243,8 +286,9 @@ export async function updateNotesFor(profile, explicitDir, name) {
         if (entry?.commits !== undefined && entry.commits.length > 0) {
             return { kind: 'commits', commits: sliceCommitsAt(entry.commits, current) };
         }
-        if (key === null) {
-            // Not a github-sourced plugin at all: npm times are the only tier left.
+        if (specKey === null) {
+            // The install spec did not name a repository. Publish times remain
+            // when the catalog row is missing or its probe has no notes.
             return { kind: 'npm', npmTimes: await npmPublishTimes(name) };
         }
         // A github plugin whose repo answered nothing — releases 404 AND the log

package/lib/check.js

@@ -1008,7 +1008,21 @@ export function analyzeProfile(profileDirectory, options = {}) {
             if (seenDeps.has(key))
                 continue;
             seenDeps.add(key);
-            const hoisted = readProfileVisibleVersion(profileDirectory, name);
+            // A HOST-PLANE peer never takes its version from the shared workspace
+            // root: `<profiles>/node_modules` is shared by every profile, and on a
+            // machine that also runs a second DSH installation — a global npm CLI
+            // beside the Desktop app — that tree is the OTHER installation's
+            // closure. Reading a host version from it reported a healthy install as
+            // "introduced host-compatibility risks … vs 0.1.5-rc.2" and offered a
+            // rollback, while the running host was 0.1.7-rc.2 (#726). What the
+            // plugin itself resolves still counts (a nested copy, a profile-local
+            // one), and the located installation is asked as `host` below; with
+            // neither, the version is unknown rather than wrong — the rule #676
+            // settled for bundles. Non-host peers keep the hoisted fallback.
+            const hostPlane = name.startsWith('@deepseek-ai/');
+            const hoisted = hostPlane
+                ? readNodeModulesVersion(profileDirectory, name)
+                : readProfileVisibleVersion(profileDirectory, name);
             const nested = readNodeModulesVersion(pluginDir, name);
             const host = dshInstall !== null ? readNodeModulesVersion(dshInstall, name) : null;
             // Node resolves a plugin's peer from its OWN node_modules first

package/lib/index.js

@@ -158,12 +158,26 @@ export function apply(ctx, config) {
             // every install (#702). A third-party shell announces itself through
             // `desktopProfiles`, and this whole block runs only when that service
             // is absent, so this never takes a third-party shell's profile.
+            const configured = config?.profile;
+            const configuredDesktop = configured !== undefined && configured.toLowerCase() === 'desktop';
             const officialElectron = launched !== undefined && launched.name.toLowerCase() === 'desktop';
-            if (officialElectron && config?.profile === undefined) {
-                const runtime = createOfficialDesktopRuntime(() => hostCtx.get('pluginManager'), launched.name, launched.dir);
+            // An explicitly configured `profile: desktop` takes this branch too. The
+            // CLI refuses that profile by NAME, so routing it there — which is what
+            // an operator's own workaround for a host that hides `profileContext`
+            // does (#744) — makes every install fail for certain. The configuration
+            // still wins over the launcher for the name; it just cannot win a branch
+            // that is guaranteed to fail.
+            if (configuredDesktop || (configured === undefined && officialElectron)) {
+                const profileName = configured ?? launched.name;
+                // The launcher owns where a profile lives — and its directory rides
+                // along only when the launcher is the one that named this profile.
+                const profileDirectory = launched !== undefined && launched.name.toLowerCase() === profileName.toLowerCase()
+                    ? launched.dir
+                    : undefined;
+                const runtime = createOfficialDesktopRuntime(() => hostCtx.get('pluginManager'), profileName, profileDirectory);
                 const resolved = {
-                    profile: launched.name,
-                    profileDirectory: launched.dir,
+                    profile: profileName,
+                    ...(profileDirectory === undefined ? {} : { profileDirectory }),
                     desktopHost: true,
                     allowRestart: false,
                     maxSnapshots: config?.maxSnapshots,

package/lib/install.js

@@ -119,6 +119,18 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
     const marketFlags = options.marketFlags !== false;
     /** The option a recovery step needed and this host does not accept (#732). */
     let unavailableOption = null;
+    // Before the FIRST run, not after a failure: the shadowed duplicate rule
+    // (#732) hurts pnpm while it RESOLVES the dependency graph, so merging it
+    // first is what keeps the command from failing at all — and it costs one
+    // small file read. Every verb that resolves the graph is covered, not just
+    // add and remove: an `install` or an in-place `update` reads the same key.
+    const verb = pluginArgs.find(argument => !argument.startsWith('-'));
+    if (verb === 'add' || verb === 'remove' || verb === 'install' || verb === 'update') {
+        const merged = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory);
+        if (merged.length > 0) {
+            logEvent('warn', 'install', `minimumReleaseAgeExclude held several rules for ${merged.join(', ')}, and pnpm honours only the FIRST per name (#732) — merged each package's rules into one, before running`);
+        }
+    }
     let result = await run(profile, pluginArgs);
     const ok = (r) => r.exitCode === 0 && !r.timedOut && !r.cancelled;
     if (!ok(result) && !result.cancelled) {
@@ -149,23 +161,28 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             }
         }
         else if (failure?.code === 'release-age-violation'
-            && options.releaseAgeBypass !== false
-            && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
-            && !pluginArgs.includes(RELEASE_AGE_OVERRIDE)) {
-            // #732 first, because it is the breakage itself: pnpm appends a second
-            // `minimumReleaseAgeExclude` rule for a package that already has one and
-            // then honours only the FIRST per name, so its own new entry is shadowed
-            // and verification fails for every later command in that profile.
-            // Merging the duplicates repairs the file and needs no option at all, so
-            // it is the one recovery that also works on the desktop bridge.
-            const mergedDuplicates = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory);
-            if (mergedDuplicates.length > 0) {
-                logEvent('warn', 'install', `pnpm appended a second minimumReleaseAgeExclude rule for ${mergedDuplicates.join(', ')} and honours only the first, shadowing its own entry (#732) — merged the duplicates and retrying once`);
+            && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')) {
+            // The repair ran before this command, so a rewrite here means pnpm wrote
+            // one of the two broken shapes DURING it — appending a shadowed rule
+            // (#732) or extending a version union (#733). Either way the same
+            // rewrite fixes it, needs no option at all, and so also works on the
+            // desktop bridge that refuses options. Retry the SAME argv afterwards.
+            const mergedNow = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory);
+            if (mergedNow.length > 0) {
+                logEvent('warn', 'install', `pnpm appended a second minimumReleaseAgeExclude rule for ${mergedNow.join(', ')} and honours only the first, shadowing its own entry (#732) — merged them into one and retrying once`);
                 result = await run(profile, pluginArgs);
             }
+            else if (options.releaseAgeBypass === false) {
+                // The caller declined the bypass (#594), and the duplicates were not
+                // what failed: this violation is the profile's own policy doing its
+                // job, so the command stands as it is.
+            }
             else if (!marketFlags) {
                 unavailableOption = RELEASE_AGE_OVERRIDE;
             }
+            else if (pluginArgs.includes(RELEASE_AGE_OVERRIDE)) {
+                // Already carrying it (a caller's forced retry): nothing left to add.
+            }
             else {
                 logEvent('warn', 'install', `a too-young release blocks pnpm's lockfile verification (#39) — retrying once with ${RELEASE_AGE_OVERRIDE}`);
                 result = await run(profile, [pluginArgs[0], RELEASE_AGE_OVERRIDE, ...pluginArgs.slice(1)]);

package/lib/net.js

@@ -9,24 +9,35 @@
  * took 9.9s direct on a reporter's machine, seconds from the 15s timeout,
  * while their proxy sat unused a millisecond away.
  *
- * `setGlobalDispatcher` from the `undici` PACKAGE cannot fix this, because
- * `globalThis.fetch` runs on Node's INTERNAL copy of undici — a different
- * instance. Verified: with a dispatcher installed, a global fetch still
- * produced no CONNECT at a local proxy, while undici's own fetch produced
- * `CONNECT awesome-dsh-plugin.com:443`.
+ * Every market request therefore calls undici's own fetch and carries a
+ * dispatcher this module created. Two measurements say why, and they are
+ * not the same fact:
  *
- * So the market calls undici's fetch with an explicit dispatcher. The scope
- * is deliberate: only requests made by this module change, and the host's
- * own networking is left exactly as the host configured it.
+ * - On Node 25, `setGlobalDispatcher` from the undici package does not
+ *   steer global fetch. With a dispatcher installed that way, a global
+ *   fetch produced no CONNECT at a local proxy, while undici's own fetch
+ *   produced `CONNECT awesome-dsh-plugin.com:443`.
+ * - On Node 22 the two stacks share one symbol (#742). Global fetch reads
+ *   `Symbol.for('undici.globalDispatcher.1')`. The host's first import of
+ *   undici 8 (`web_fetch`) finds `.2` empty, installs its dispatcher, and
+ *   writes a `Dispatcher1Wrapper` onto `.1`. After that, global fetch
+ *   returns gzip bodies with null headers, and `JSON.parse` fails on the
+ *   catalog. undici 7's fetch reads `.1` too, so calling it with no
+ *   dispatcher fails the same way.
+ *
+ * The dispatcher is `EnvHttpProxyAgent` when a proxy is configured, and a
+ * plain `Agent` otherwise. Only requests made here take it. The host's own
+ * networking stays as the host configured it.
  */
-import { EnvHttpProxyAgent, fetch as undiciFetch } from 'undici';
+import { Agent, EnvHttpProxyAgent, fetch as undiciFetch } from 'undici';
 /**
  * The proxy this process would use for the catalog, if any.
  *
  * The standard variables mirror `EnvHttpProxyAgent`'s own resolution
  * deliberately, rather than picking the order that reads best, because the
- * same answer does two jobs: it decides whether to route through undici at
- * all, and it is what the failure message CLAIMS was tried. A helper that
+ * same answer does two jobs: it decides whether the request goes through
+ * the proxy agent or the direct one, and it is what the failure message
+ * CLAIMS was tried. A helper that
  * named a proxy undici would not have used would put a false statement in
  * every bug report. `npm_config_*` is an additional source on top of that:
  * npm holds its proxy in its own config namespace (a machine set up with
@@ -70,29 +81,30 @@ function proxyFromEnv() {
     return { http, https };
 }
 /**
- * Built once and reused: an agent per request would drop connection reuse,
- * and this one reads NO_PROXY as well, so a host that excludes its own
+ * Built once and reused: an agent per request would drop connection reuse.
+ * The proxy agent also reads NO_PROXY, so a host that excludes its own
  * registry mirror keeps being excluded.
  */
-let agent = null;
+let proxyAgent = null;
+let directAgent = null;
 /**
- * Fetch through the proxy this machine is configured to use.
- *
- * Falls back to the global fetch when no proxy is set, which keeps the
- * ordinary case on the runtime's own path rather than routing it through a
- * second HTTP stack for no reason.
+ * Fetch through the proxy this machine is configured to use, or directly
+ * through this module's own agent when it has none. Both paths pass the
+ * dispatcher described on this module.
  */
 export async function marketFetch(url, init) {
     const { http, https } = proxyFromEnv();
-    if (http === null && https === null)
-        return await fetch(url, init);
+    if (http === null && https === null) {
+        directAgent ??= new Agent();
+        return await undiciFetch(url, { ...init, dispatcher: directAgent });
+    }
     // Pass the resolved proxies explicitly. EnvHttpProxyAgent itself reads
     // only http(s)_proxy out of the environment, so a proxy that lives in
     // npm_config_* must be handed over directly — otherwise the agent would
     // silently go direct while configuredProxy() claims a proxy was used.
-    agent ??= new EnvHttpProxyAgent({
+    proxyAgent ??= new EnvHttpProxyAgent({
         httpProxy: http ?? undefined,
         httpsProxy: https ?? undefined,
     });
-    return await undiciFetch(url, { ...init, dispatcher: agent });
+    return await undiciFetch(url, { ...init, dispatcher: proxyAgent });
 }

package/lib/official-desktop.js

@@ -20,7 +20,11 @@ function detail(error) {
     return JSON.stringify(error);
 }
 /** Never fall back to `dsh plugin --profile desktop`: that CLI is forbidden. */
-export function createOfficialDesktopRuntime(managerLookup, profileName, _profileDirectory) {
+export function createOfficialDesktopRuntime(managerLookup, profileName, 
+// Unused by the manager bridge — it takes the profile by NAME — and optional
+// because an explicitly configured `profile: desktop` may be the only thing
+// that names this profile, with no launcher directory to go with it (#744).
+_profileDirectory) {
     let disposed = false;
     let active;
     const runPlugin = (profile, argv) => {

package/lib/pnpm-compat.js

@@ -270,6 +270,34 @@ export function classifyPnpmFailure(output, exitCode) {
             message: `profile 里的一个 pnpm 补丁打不上了${which}。pnpm 会继续把这个包装上，但装的是没打补丁的原版——通常下次启动才会以「插件加载失败」暴露出来。多半是包升级后挪动了补丁指向的文件（例如补丁改的是 client/client.js，而新版本发的是 lib/client.js）。请更新或删掉这个补丁文件，以及 profile package.json 里 pnpm.patchedDependencies 中对应的那一条 / a pnpm patch in this profile no longer applies${whichEn}. pnpm still installs the package, but unpatched — which usually surfaces at the next boot as "failed to load plugins" rather than here. The usual cause is the package moving the file the patch targets (for example a patch against client/client.js when the release now ships lib/client.js). Update or remove that patch file and its entry under pnpm.patchedDependencies in the profile's package.json`,
         };
     }
+    // #740 by @lws2004: the other half of the story above. `patchedDependencies`
+    // keys on `pkg@exactVersion`, and once the installed version moves past that
+    // key pnpm 12 treats the stale patch as a HARD error: it writes NOTHING at
+    // all. So an update of that plugin is refused in full — the version stays
+    // where it was, the market's own log holds only exit=1, and the user reads
+    // "the update did not apply" for what is really a patch that no longer
+    // matches. Unlike ERR_PNPM_PATCH_FAILED there is no unpatched install to
+    // discover later, which makes this the more confusing of the two. The patch
+    // is the user's, so the market names the entries and says where to fix them
+    // rather than guessing a retarget.
+    if (output.includes('ERR_PNPM_UNUSED_PATCH')) {
+        // `[^\n"]+`: the same sentence also arrives inside the ndjson stream,
+        // where it ends at a quote rather than at the line — matching to the line
+        // end there captured `"}}` as part of the package name.
+        const unused = /The following patches were not used:\s*([^\n"]+)/
+            .exec(withDecodedPnpmDiagnostics(output))?.[1];
+        const named = unused === undefined
+            ? []
+            : unused.split(',').map(entry => entry.trim()).filter(entry => entry !== '');
+        const which = named.length === 0 ? '' : `（${named.join('、')}）`;
+        const whichEn = named.length === 0 ? '' : ` (${named.join(', ')})`;
+        return {
+            code: 'unused-patch',
+            recoverable: false,
+            pkg: named.length === 1 ? named[0] : undefined,
+            message: `profile 里的 pnpm 补丁有一条已经用不上了${which}：patchedDependencies 是按「包名@精确版本」钉的，而这次要装的版本已经越过它，pnpm 12 因此判定整条命令失败——它什么都没写，所以看起来像「点了更新没反应」。要么把补丁更新到新版本、并把 profile package.json 里 pnpm.patchedDependencies 的键改成「包名@新版本」，要么在新版本已经自带这个修复时直接删掉这一条和对应的补丁文件 / a pnpm patch in this profile is no longer used${whichEn}: patchedDependencies keys on "package@exactVersion", and the version being installed has moved past that key, so pnpm 12 fails the WHOLE command and writes nothing at all — which is why the update looks like it simply did not apply. Either retarget the patch to the new version and change its pnpm.patchedDependencies key in the profile's package.json to "package@newVersion", or — when the new release already carries that fix — drop the entry and its patch file`,
+        };
+    }
     if (output.includes('ERR_PNPM_ADDING_TO_ROOT')) {
         return {
             code: 'adding-to-root',

package/lib/profile.js

@@ -1222,27 +1222,41 @@ function splitReleaseAgeExclude(entry) {
     return { name, selector };
 }
 /**
- * Merge one package's several `minimumReleaseAgeExclude` entries into one
- * (#732).
+ * Make a profile's `minimumReleaseAgeExclude` readable again (#732).
  *
- * pnpm 11.7.0 APPENDS an entry when it lets a version through a profile's
- * `minimumReleaseAge` instead of folding it into the rule that already names
- * that package — and its own `evaluateVersionPolicy` then honours only the
- * FIRST rule per package name. The entry pnpm just wrote is therefore
- * shadowed by the older one, the young version stays unexcluded, and pnpm
- * fails lockfile verification with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION on
- * EVERY later command in that profile: installs, updates and uninstalls
- * alike, including ones that have nothing to do with the package. Reported
- * as #732, where the market's own self-update planted exactly that pair and
- * every plugin operation on the desktop profile stopped working.
+ * pnpm appends a second rule for a package that already has one, while its
+ * `evaluateVersionPolicy` honours only the FIRST rule per package name — so
+ * its own new entry is dead, the young version stays unexcluded, and every
+ * later command in that profile fails lockfile verification with
+ * ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION, including commands that have nothing
+ * to do with that package.
  *
- * Merging keeps the union of what the file already says, so nothing is
- * loosened or tightened: the entries pnpm wrote were meant to be read, and
- * after the merge they are. A file with no same-name duplicate is untouched,
- * as is one whose block this cannot read exactly (a flow list, an inline
- * comment, a line it would have to guess at).
+ * (#733 reported a separate, unexplained 80 GiB allocation abort on pnpm
+ * 12.4.1 that its author first tied to the union spelling. Review on that
+ * issue — and the reporter's own follow-up, which could no longer reproduce it
+ * — settled that `name@a || b` is a documented pnpm form, that the validator's
+ * "Use exact versions only" is about ranges and name patterns, and that the
+ * abort is not this market's to fix. Do not "repair" a union into a bare name
+ * on the strength of it: see below.)
  *
- * @returns the package names whose entries were merged; empty when the file
+ * pnpm WRITES this key itself, and one of the forms it writes is what breaks a
+ * profile (#732): pnpm 11.7.0 APPENDS a second rule for a package that already
+ * has one, while its `evaluateVersionPolicy` honours only the FIRST rule per
+ * package name. Its own new entry is therefore dead, the young version stays
+ * unexcluded, and every later command in that profile fails lockfile
+ * verification with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION — installs, updates
+ * and uninstalls alike, including ones that have nothing to do with that
+ * package. Merging the same-name rules into one makes the file readable again.
+ *
+ * The merge keeps the UNION of the versions the file already lists
+ * (`name@1.2.3 || 1.4.0`), which is a documented pnpm spelling. What this
+ * deliberately does NOT do is collapse a version list to a bare package name:
+ * a bare name exempts EVERY version of that package from the cooldown, which
+ * is wider than what the file says, and the market pins exact versions
+ * precisely so a fresh install cannot silently land on an older release
+ * (#594). A form the file cannot be read exactly from is left alone.
+ *
+ * @returns the package names whose rules were merged; empty when the file
  *   needed no repair or could not be repaired, in which case it is left
  *   byte-for-byte as it was.
  */
@@ -1274,40 +1288,58 @@ export function mergeDuplicateReleaseAgeExcludes(profile, explicitDir) {
         const rule = splitReleaseAgeExclude(m[1]);
         if (rule === null)
             return [];
-        entries.push({ rule, quoted: /^['"]/.test(m[1]) });
+        entries.push({ rule, quoted: /^['"]/.test(m[1]), line });
     }
     const byName = new Map();
     const order = [];
-    for (const { rule, quoted } of entries) {
+    for (const { rule, quoted, line } of entries) {
         let group = byName.get(rule.name);
         if (group === undefined) {
-            group = { selectors: new Set(), allVersions: false, quoted: false, count: 0 };
+            group = { selectors: new Set(), originals: [], lines: [], allVersions: false, quoted: false, count: 0 };
             byName.set(rule.name, group);
             order.push(rule.name);
         }
         group.count += 1;
         group.quoted = group.quoted || quoted;
+        group.originals.push(rule.selector ?? '');
+        group.lines.push(line);
         if (rule.selector === null)
             group.allVersions = true;
         else
             group.selectors.add(rule.selector);
     }
-    const merged = order.filter(name => (byName.get(name)?.count ?? 0) > 1);
-    if (merged.length === 0)
-        return [];
-    const lines = order.map(name => {
+    /** The one line this package's entry is written as. */
+    const produced = (name) => {
         const group = byName.get(name);
         if (group === undefined)
             return '';
-        const text = group.allVersions ? name : `${name}@${[...group.selectors].join(' || ')}`;
+        // A bare name already covers every version, so it stays bare and nothing
+        // is widened; one rule stays exactly as it was written, union included.
+        // Several rules for one name are the #732 breakage — only the first is
+        // ever read — so they become one, as the union of the versions the file
+        // already lists.
+        const text = group.allVersions
+            ? name
+            : group.count === 1
+                ? `${name}@${group.originals[0] ?? ''}`
+                : `${name}@${[...group.selectors].join(' || ')}`;
         // `@` cannot start a plain scalar in YAML, so a scoped name is written
         // quoted — the way pnpm itself writes one.
         const quoted = group.quoted || text.startsWith('@');
         return `${indent}- ${quoted ? `'${text.replaceAll("'", "''")}'` : text}`;
+    };
+    const rewritten = order.filter(name => {
+        const group = byName.get(name);
+        if (group === undefined)
+            return false;
+        return group.count > 1 || group.lines[0] !== produced(name);
     });
+    if (rewritten.length === 0)
+        return [];
+    const lines = order.map(produced);
     const blockText = `minimumReleaseAgeExclude:${eol}${lines.join(eol)}${eol}`;
     // A function replacement: `$&` and friends in a string replacement would
     // be read as capture references.
     writeFileSync(file, yaml.replace(blockRe, () => blockText));
-    return merged;
+    return rewritten;
 }

package/lib/routes.js

@@ -3691,7 +3691,15 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                                                     && capturedNpmVersion(lockfileCapture.snapshot, name) !== beforeVersion
                                                     ? {
                                                         available: false,
-                                                        detail: `更新前安装的是 v${beforeVersion}，但 pnpm-lock.yaml 中的版本与它不一致，因此无法证明精确来源，自动回滚不可用。需要时请手工重新安装 ${name}@${beforeVersion}。 / The installed version before the update was v${beforeVersion}, but pnpm-lock.yaml does not match it, so the exact source cannot be proven and automatic rollback is unavailable. Reinstall ${name}@${beforeVersion} manually if needed.`,
+                                                        // Name all three: the version on disk, the version
+                                                        // the lockfile records, and the one a rollback
+                                                        // would install (#732). The old wording named the
+                                                        // first two only by implication, and a user who
+                                                        // reads "the exact source cannot be proven" has
+                                                        // nothing to act on — the reproducer's way out was
+                                                        // to align package.json with the installed build,
+                                                        // which is what this now says.
+                                                        detail: `更新前 node_modules 里装的是 v${beforeVersion}，但 pnpm-lock.yaml 里 ${name} 记的是 ${capturedNpmVersion(lockfileCapture.snapshot, name) ?? '（没有记录）'}，两者不一致，无法证明精确来源，因此自动回滚不可用（要回滚的是 ${name}@${beforeVersion}）。需要时请手工重新安装 ${name}@${beforeVersion}，或先把 package.json 与 pnpm-lock.yaml 对齐到 v${beforeVersion}。 / The build on disk before the update was v${beforeVersion}, but pnpm-lock.yaml records ${capturedNpmVersion(lockfileCapture.snapshot, name) ?? 'nothing'} for ${name}: they disagree, so the exact source cannot be proven and automatic rollback is unavailable. Reinstall ${name}@${beforeVersion} manually if needed, or align package.json and pnpm-lock.yaml with v${beforeVersion} first.`,
                                                         lockfileBefore: lockfileCapture.snapshot,
                                                     }
                                                     : !supportsExactRollbackTarget(`${name}@${beforeVersion}`)