dshmarket 1.66.10 → 1.66.11

package/lib/check.js

@@ -924,47 +924,80 @@ export function buildBundleLayers(profileDirectory, bundleNames, specs, dshInsta
  * @param dshInstall - install directory the analysis located, or null.
  * @returns the overlay layer, or null when this installation declares none.
  */
-function installOverlayLayer(dshInstall) {
+function installOverlayLayer(dshInstall, profileDirectory, declaredBundles) {
     for (const directory of desktopApplicationRoots(dshInstall)) {
-        let manifest;
-        try {
-            manifest = JSON.parse(readFileSync(join(directory, 'package.json'), 'utf8'));
-        }
-        catch {
-            continue;
-        }
-        const declared = manifest.dsh?.bundle?.patch;
-        const declaredList = typeof declared === 'string'
-            ? [declared]
-            : Array.isArray(declared)
-                ? declared.filter((relative) => typeof relative === 'string')
-                : [];
-        if (declaredList.length === 0)
-            continue;
-        // A bundle patch alone does not make a directory an installation: ANY
-        // package can declare one — this repository does, and so does every plugin
-        // repo. Without this bound the ancestor walk accepted the nearest such
-        // project above the install directory and composed its rows as if they
-        // were the installation's own, which invents rows and can mask a real
-        // orphan warning (#749 review). A DSH installation ships the in-box web
-        // bundle, and the launcher splices this very overlay directly behind that
-        // bundle's layer — where it is absent, the launcher applies no overlay
-        // either, so composing one here would describe a composition nobody runs.
-        if (readNodeModulesVersion(directory, '@deepseek-ai/dsh-web-app') === null)
-            continue;
-        const label = typeof manifest.name === 'string' && manifest.name !== '' ? manifest.name : 'install-overlay';
-        const paths = declaredList.map(relative => join(directory, relative));
-        if (paths.some(path => !existsSync(path))) {
-            return { label, kind: 'bundle', patches: [], parseError: 'declared patch is missing' };
-        }
-        const parsed = paths.map(path => parsePatchFile(path));
-        if (parsed.some(patches => patches === null)) {
-            return { label, kind: 'bundle', patches: [], parseError: 'patch file is not a valid entry list' };
+        // A DSH installation ships the in-box web bundle, and the launcher splices
+        // this very overlay directly behind that bundle's layer — where it is
+        // absent, the launcher applies no overlay either, so composing one here
+        // would describe a composition nobody runs (#749 review).
+        const layer = overlayFromDirectory(directory, manifest => readNodeModulesVersion(directory, '@deepseek-ai/dsh-web-app') !== null);
+        if (layer !== null)
+            return layer;
+    }
+    // The official Desktop shell plugin's own patch (#807). On a build that packs
+    // the whole runtime into one app.asar, no application-root candidate declares
+    // it: the asar's root is `@deepseek-ai/dsh-desktop` and the nested
+    // `app.asar/dsh` is `@deepseek-ai/dsh-desktop-runtime`, neither with a
+    // `dsh.bundle.patch`, while the file that really supplies the shell's rows
+    // (`desktop-shell`, `desktop-notifications`, …) is this package's own
+    // `cordis.patch.yml`. Without it every user-patch row aimed at a shell row is
+    // reported as an orphan, and a user who believes the warning deletes rows
+    // that carry the window material and the notification preferences.
+    //
+    // Bounded by identity, not by location: the candidate must BE that package,
+    // resolved from the profile's own module search, and must declare a patch.
+    // A profile that lists it in `dsh.profile.bundles` gets it as an ordinary
+    // bundle layer instead — composing both would add every row twice.
+    if (!declaredBundles.includes(DESKTOP_SHELL_PLUGIN)) {
+        const directory = resolvePackageDir(join(profileDirectory, 'package.json'), DESKTOP_SHELL_PLUGIN);
+        if (directory !== null) {
+            return overlayFromDirectory(directory, manifest => manifest.name === DESKTOP_SHELL_PLUGIN);
         }
-        return { label, kind: 'bundle', patches: parsed.flatMap(patches => patches), parseError: null };
     }
     return null;
 }
+/** The official Desktop shell plugin, whose patch the launcher applies by hand (#807). */
+const DESKTOP_SHELL_PLUGIN = 'dsh-plugin-desktop';
+/**
+ * The overlay one candidate directory declares, or null when it declares none.
+ *
+ * `accept` is the caller's bound on what may stand in for the installation;
+ * resolution and parsing are shared, because a second parsing path would be a
+ * second set of answers about the same file.
+ */
+function overlayFromDirectory(directory, accept) {
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(directory, 'package.json'), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+    const declared = manifest.dsh?.bundle?.patch;
+    const declaredList = typeof declared === 'string'
+        ? [declared]
+        : Array.isArray(declared)
+            ? declared.filter((relative) => typeof relative === 'string')
+            : [];
+    // A bundle patch alone does not make a directory an installation: ANY package
+    // can declare one — this repository does, and so does every plugin repo.
+    // Without the caller's bound the ancestor walk accepted the nearest such
+    // project above the install directory and composed its rows as if they were
+    // the installation's own, which invents rows and can mask a real orphan
+    // warning (#749 review).
+    if (declaredList.length === 0 || !accept(manifest))
+        return null;
+    const label = typeof manifest.name === 'string' && manifest.name !== '' ? manifest.name : 'install-overlay';
+    const paths = declaredList.map(relative => join(directory, relative));
+    if (paths.some(path => !existsSync(path))) {
+        return { label, kind: 'bundle', patches: [], parseError: 'declared patch is missing' };
+    }
+    const parsed = paths.map(path => parsePatchFile(path));
+    if (parsed.some(patches => patches === null)) {
+        return { label, kind: 'bundle', patches: [], parseError: 'patch file is not a valid entry list' };
+    }
+    return { label, kind: 'bundle', patches: parsed.flatMap(patches => patches), parseError: null };
+}
 /**
  * Which directories in `node_modules` are leftovers (#663).
  *
@@ -1080,7 +1113,7 @@ export function analyzeProfile(profileDirectory, options = {}) {
     // The installation's own overlay rides directly behind the bundle the
     // Desktop launcher keys off, exactly where the launcher splices it — see
     // installOverlayLayer.
-    const installOverlay = installOverlayLayer(dshInstall);
+    const installOverlay = installOverlayLayer(dshInstall, profileDirectory, bundleNames);
     if (installOverlay !== null) {
         const overlayAfter = bundleLayers.findIndex(layer => layer.label === '@deepseek-ai/dsh-web-app');
         if (overlayAfter < 0)

package/lib/routes.js

@@ -224,6 +224,28 @@ function blockedBuilds(result) {
     printedBuildKeys.set(pending, parsePrepareKey(result.stdout, result.stderr));
     return [pending];
 }
+/**
+ * Whether a FAILED run failed BECAUSE pnpm skipped a build script (#754).
+ *
+ * `blockedBuilds` answers a different question — "did pnpm skip anything" —
+ * and pnpm reports skipped builds for transitive dependencies on almost any
+ * run. So a failure with an unrelated cause (a peer-resolution refusal, a 404,
+ * an OOM) still came back carrying the approve-and-retry banner, and pressing
+ * it re-ran the same command to the same failure. The reporter's case is the
+ * sharp end: the skipped package was a transitive `@types/*` that is not in
+ * the profile and not in the catalog, so approval had nothing to approve and
+ * the button answered `no installed packages given` — while the real cause
+ * (`generation peer validation failed`) was buried under it.
+ *
+ * The classifier already decides this from pnpm's own output, so ask it rather
+ * than pattern-matching a second time. `git-prepare-not-allowed` is the same
+ * refusal for a git dependency, which is the other code the approval path can
+ * clear.
+ */
+function failedOnBlockedBuilds(result) {
+    const code = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)?.code;
+    return code === 'ignored-builds' || code === 'git-prepare-not-allowed';
+}
 /**
  * Register the market's HTTP routes.
  * @param host - Acquired webServer + shell services.
@@ -4526,7 +4548,10 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         // build-required dep fails the add with ERR_PNPM_IGNORED_BUILDS.
                         // Reporting the blocked packages here gives the client the same
                         // approve-and-retry banner the install flow has had since #6.
-                        const ignoredBuilds = ok || cancelled ? undefined : blockedBuilds(result);
+                        // Same rule as the install route (#754): a failure that merely
+                        // MENTIONS a skipped build is not a failure ABOUT one, and offering
+                        // to approve it sends the user to press a button that cannot help.
+                        const ignoredBuilds = ok || cancelled || !failedOnBlockedBuilds(result) ? undefined : blockedBuilds(result);
                         if (ok)
                             clearBrokenPlugin(name);
                         // A package still installed but no longer in dsh.profile.bundles
@@ -5884,7 +5909,10 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         if (ok)
                             clearBrokenPlugin(entry.name);
                         logEvent(ok || cancelled ? 'info' : 'error', 'install', `${target} exit=${String(result.exitCode)}${result.timedOut ? ' TIMEOUT' : ''}${cancelled ? ' CANCELLED' : ''}${ok ? ` hot=${String(hot)}` : cancelled ? '' : ` err=${failureDetail(result)}`}`);
-                        const ignoredBuilds = blockedBuilds(result);
+                        // On success a skipped build is a notice (#6); after a FAILURE the
+                        // list is what offers the approve-and-retry banner, so it is sent
+                        // only when the blocked build IS why the run failed (#754).
+                        const ignoredBuilds = ok || cancelled || failedOnBlockedBuilds(result) ? blockedBuilds(result) : undefined;
                         sendJson(response, ok || cancelled ? 200 : result.busy === true ? 409 : 502, {
                             ok,
                             cancelled: cancelled || undefined,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.10",
+  "version": "1.66.11",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/check.ts

@@ -1145,45 +1145,88 @@ export function buildBundleLayers(
  * @param dshInstall - install directory the analysis located, or null.
  * @returns the overlay layer, or null when this installation declares none.
  */
-function installOverlayLayer(dshInstall: string | null): LayerInput | null {
+function installOverlayLayer(
+  dshInstall: string | null,
+  profileDirectory: string,
+  declaredBundles: readonly string[],
+): LayerInput | null {
   for (const directory of desktopApplicationRoots(dshInstall)) {
-    let manifest: { name?: unknown; dsh?: { bundle?: { patch?: unknown } } }
-    try {
-      manifest = JSON.parse(readFileSync(join(directory, 'package.json'), 'utf8')) as typeof manifest
-    } catch {
-      continue
-    }
-    const declared = manifest.dsh?.bundle?.patch
-    const declaredList = typeof declared === 'string'
-      ? [declared]
-      : Array.isArray(declared)
-        ? declared.filter((relative): relative is string => typeof relative === 'string')
-        : []
-    if (declaredList.length === 0) continue
-    // A bundle patch alone does not make a directory an installation: ANY
-    // package can declare one — this repository does, and so does every plugin
-    // repo. Without this bound the ancestor walk accepted the nearest such
-    // project above the install directory and composed its rows as if they
-    // were the installation's own, which invents rows and can mask a real
-    // orphan warning (#749 review). A DSH installation ships the in-box web
-    // bundle, and the launcher splices this very overlay directly behind that
-    // bundle's layer — where it is absent, the launcher applies no overlay
-    // either, so composing one here would describe a composition nobody runs.
-    if (readNodeModulesVersion(directory, '@deepseek-ai/dsh-web-app') === null) continue
-    const label = typeof manifest.name === 'string' && manifest.name !== '' ? manifest.name : 'install-overlay'
-    const paths = declaredList.map(relative => join(directory, relative))
-    if (paths.some(path => !existsSync(path))) {
-      return { label, kind: 'bundle', patches: [], parseError: 'declared patch is missing' }
-    }
-    const parsed = paths.map(path => parsePatchFile(path))
-    if (parsed.some(patches => patches === null)) {
-      return { label, kind: 'bundle', patches: [], parseError: 'patch file is not a valid entry list' }
+    // A DSH installation ships the in-box web bundle, and the launcher splices
+    // this very overlay directly behind that bundle's layer — where it is
+    // absent, the launcher applies no overlay either, so composing one here
+    // would describe a composition nobody runs (#749 review).
+    const layer = overlayFromDirectory(directory, manifest =>
+      readNodeModulesVersion(directory, '@deepseek-ai/dsh-web-app') !== null)
+    if (layer !== null) return layer
+  }
+  // The official Desktop shell plugin's own patch (#807). On a build that packs
+  // the whole runtime into one app.asar, no application-root candidate declares
+  // it: the asar's root is `@deepseek-ai/dsh-desktop` and the nested
+  // `app.asar/dsh` is `@deepseek-ai/dsh-desktop-runtime`, neither with a
+  // `dsh.bundle.patch`, while the file that really supplies the shell's rows
+  // (`desktop-shell`, `desktop-notifications`, …) is this package's own
+  // `cordis.patch.yml`. Without it every user-patch row aimed at a shell row is
+  // reported as an orphan, and a user who believes the warning deletes rows
+  // that carry the window material and the notification preferences.
+  //
+  // Bounded by identity, not by location: the candidate must BE that package,
+  // resolved from the profile's own module search, and must declare a patch.
+  // A profile that lists it in `dsh.profile.bundles` gets it as an ordinary
+  // bundle layer instead — composing both would add every row twice.
+  if (!declaredBundles.includes(DESKTOP_SHELL_PLUGIN)) {
+    const directory = resolvePackageDir(join(profileDirectory, 'package.json'), DESKTOP_SHELL_PLUGIN)
+    if (directory !== null) {
+      return overlayFromDirectory(directory, manifest => manifest.name === DESKTOP_SHELL_PLUGIN)
     }
-    return { label, kind: 'bundle', patches: parsed.flatMap(patches => patches), parseError: null }
   }
   return null
 }
 
+/** The official Desktop shell plugin, whose patch the launcher applies by hand (#807). */
+const DESKTOP_SHELL_PLUGIN = 'dsh-plugin-desktop'
+
+/**
+ * The overlay one candidate directory declares, or null when it declares none.
+ *
+ * `accept` is the caller's bound on what may stand in for the installation;
+ * resolution and parsing are shared, because a second parsing path would be a
+ * second set of answers about the same file.
+ */
+function overlayFromDirectory(
+  directory: string,
+  accept: (manifest: { name?: unknown }) => boolean,
+): LayerInput | null {
+  let manifest: { name?: unknown; dsh?: { bundle?: { patch?: unknown } } }
+  try {
+    manifest = JSON.parse(readFileSync(join(directory, 'package.json'), 'utf8')) as typeof manifest
+  } catch {
+    return null
+  }
+  const declared = manifest.dsh?.bundle?.patch
+  const declaredList = typeof declared === 'string'
+    ? [declared]
+    : Array.isArray(declared)
+      ? declared.filter((relative): relative is string => typeof relative === 'string')
+      : []
+  // A bundle patch alone does not make a directory an installation: ANY package
+  // can declare one — this repository does, and so does every plugin repo.
+  // Without the caller's bound the ancestor walk accepted the nearest such
+  // project above the install directory and composed its rows as if they were
+  // the installation's own, which invents rows and can mask a real orphan
+  // warning (#749 review).
+  if (declaredList.length === 0 || !accept(manifest)) return null
+  const label = typeof manifest.name === 'string' && manifest.name !== '' ? manifest.name : 'install-overlay'
+  const paths = declaredList.map(relative => join(directory, relative))
+  if (paths.some(path => !existsSync(path))) {
+    return { label, kind: 'bundle', patches: [], parseError: 'declared patch is missing' }
+  }
+  const parsed = paths.map(path => parsePatchFile(path))
+  if (parsed.some(patches => patches === null)) {
+    return { label, kind: 'bundle', patches: [], parseError: 'patch file is not a valid entry list' }
+  }
+  return { label, kind: 'bundle', patches: parsed.flatMap(patches => patches), parseError: null }
+}
+
 /**
  * Which directories in `node_modules` are leftovers (#663).
  *
@@ -1299,7 +1342,7 @@ export function analyzeProfile(profileDirectory: string, options: CheckOptions =
   // The installation's own overlay rides directly behind the bundle the
   // Desktop launcher keys off, exactly where the launcher splices it — see
   // installOverlayLayer.
-  const installOverlay = installOverlayLayer(dshInstall)
+  const installOverlay = installOverlayLayer(dshInstall, profileDirectory, bundleNames)
   if (installOverlay !== null) {
     const overlayAfter = bundleLayers.findIndex(layer => layer.label === '@deepseek-ai/dsh-web-app')
     if (overlayAfter < 0) bundleLayers.push(installOverlay)

package/src/routes.ts

@@ -315,6 +315,29 @@ function blockedBuilds(result: { ignoredBuilds?: unknown; stdout: string; stderr
   return [pending]
 }
 
+/**
+ * Whether a FAILED run failed BECAUSE pnpm skipped a build script (#754).
+ *
+ * `blockedBuilds` answers a different question — "did pnpm skip anything" —
+ * and pnpm reports skipped builds for transitive dependencies on almost any
+ * run. So a failure with an unrelated cause (a peer-resolution refusal, a 404,
+ * an OOM) still came back carrying the approve-and-retry banner, and pressing
+ * it re-ran the same command to the same failure. The reporter's case is the
+ * sharp end: the skipped package was a transitive `@types/*` that is not in
+ * the profile and not in the catalog, so approval had nothing to approve and
+ * the button answered `no installed packages given` — while the real cause
+ * (`generation peer validation failed`) was buried under it.
+ *
+ * The classifier already decides this from pnpm's own output, so ask it rather
+ * than pattern-matching a second time. `git-prepare-not-allowed` is the same
+ * refusal for a git dependency, which is the other code the approval path can
+ * clear.
+ */
+function failedOnBlockedBuilds(result: { exitCode: number | null; stdout: string; stderr: string }): boolean {
+  const code = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)?.code
+  return code === 'ignored-builds' || code === 'git-prepare-not-allowed'
+}
+
 /**
  * Register the market's HTTP routes.
  * @param host - Acquired webServer + shell services.
@@ -4709,7 +4732,10 @@ sendJson(response, 200, { updates })
             // build-required dep fails the add with ERR_PNPM_IGNORED_BUILDS.
             // Reporting the blocked packages here gives the client the same
             // approve-and-retry banner the install flow has had since #6.
-            const ignoredBuilds = ok || cancelled ? undefined : blockedBuilds(result)
+            // Same rule as the install route (#754): a failure that merely
+            // MENTIONS a skipped build is not a failure ABOUT one, and offering
+            // to approve it sends the user to press a button that cannot help.
+            const ignoredBuilds = ok || cancelled || !failedOnBlockedBuilds(result) ? undefined : blockedBuilds(result)
             if (ok) clearBrokenPlugin(name)
             // A package still installed but no longer in dsh.profile.bundles
             // after this run stops loading and says nothing (#720). The market
@@ -6068,7 +6094,10 @@ sendJson(response, 200, { updates })
             if (ok) clearBrokenPlugin(entry.name)
             logEvent(ok || cancelled ? 'info' : 'error', 'install',
               `${target} exit=${String(result.exitCode)}${result.timedOut ? ' TIMEOUT' : ''}${cancelled ? ' CANCELLED' : ''}${ok ? ` hot=${String(hot)}` : cancelled ? '' : ` err=${failureDetail(result)}`}`)
-            const ignoredBuilds = blockedBuilds(result)
+            // On success a skipped build is a notice (#6); after a FAILURE the
+            // list is what offers the approve-and-retry banner, so it is sent
+            // only when the blocked build IS why the run failed (#754).
+            const ignoredBuilds = ok || cancelled || failedOnBlockedBuilds(result) ? blockedBuilds(result) : undefined
             sendJson(response, ok || cancelled ? 200 : result.busy === true ? 409 : 502, {
               ok,
               cancelled: cancelled || undefined,