dshmarket 1.66.12 → 1.66.13

package/UPDATE-API-V1.md

@@ -78,6 +78,14 @@ short update-check cache.
 
 Mutation requests require the same-origin protection used by the Market UI.
 
+Every endpoint here — reads included — also sits behind DSH's own browser
+login, on any host that has one (`dsh web` from 0.1.2-alpha.2 on): a request
+without the host's session cookie is answered `401`, and one from an untrusted
+origin `403`, exactly as DSH answers for its own API (#603). A plugin UI running
+in the DSH page sends that cookie with every same-origin `fetch`, so it needs no
+change. A script or tool calling these endpoints from outside the browser is the
+anonymous client this refuses; there is no separate token for it.
+
 ```http
 POST /dsh-market/api/v1/updates
 Content-Type: application/json

package/lib/http.js

@@ -32,6 +32,39 @@ export function sendJson(response, status, payload) {
  * undeclared name is still refused.
  */
 let trustedHostsSource = () => [];
+let requestGateSource = () => undefined;
+/** Point the market at the host's request gate. Returns the previous source. */
+export function setRequestGateSource(source) {
+    const previous = requestGateSource;
+    requestGateSource = source;
+    return previous;
+}
+/**
+ * Answer the request with the host's rejection, if it has one.
+ * @returns true when the request was refused and answered here.
+ */
+export function refuseUnadmitted(request, response) {
+    const gate = requestGateSource();
+    if (gate === undefined)
+        return false;
+    let status;
+    try {
+        status = gate(request);
+    }
+    catch {
+        // A gate that throws has not admitted anything. Failing open here would
+        // turn a host bug into the exposure this exists to close.
+        status = 403;
+    }
+    if (status === undefined)
+        return false;
+    sendJson(response, status, {
+        error: status === 401
+            ? '需要先登录 DSH：请重新打开 dsh web 启动时打印的那个网址。 / DSH login required: reopen the URL dsh web printed at startup.'
+            : '这个请求来自不受信任的地址，已拒绝。 / This request came from an untrusted origin and was refused.',
+    });
+    return true;
+}
 /** Point the fence at the host's declared authorities. Returns the previous source. */
 export function setTrustedHostsSource(source) {
     const previous = trustedHostsSource;

package/lib/index.js

@@ -6,7 +6,7 @@ import { dirname, isAbsolute } from 'node:path';
 import { createDesktopPluginRuntime, setHostPackageManager } from './dsh-cli.js';
 import { createOfficialDesktopRuntime } from './official-desktop.js';
 import { isDshProfileName } from './profile.js';
-import { setTrustedHostsSource } from './http.js';
+import { setRequestGateSource, setTrustedHostsSource } from './http.js';
 import { mountMarketRoutes } from './routes.js';
 import { installDesktopMarketSettings, installMarketSettings } from './settings.js';
 export const name = 'dsh-market';
@@ -51,6 +51,22 @@ function launchedProfile(context) {
         return undefined;
     return { name, dir };
 }
+/**
+ * The launcher's `profileContext` in one line, for the exported log (#744).
+ *
+ * Only the facts that decide the branch: whether the service is there, and
+ * whether its shape is one `launchedProfile` accepts. Never the directory
+ * itself — the log already carries the profile path where it is needed.
+ */
+export function describeProfileContext(value) {
+    if (value === undefined || value === null)
+        return 'absent';
+    const launched = launchedProfile(value);
+    if (launched !== undefined)
+        return `present (name ${launched.name})`;
+    const shape = value;
+    return `present but unusable (name: ${typeof shape.name}, dir: ${typeof shape.dir})`;
+}
 /**
  * The package manager the launcher published for this profile, if any.
  *
@@ -129,9 +145,22 @@ export function useTrustedHosts(ctx) {
             ? connection.trustedHosts.filter((entry) => typeof entry === 'string')
             : [];
     });
+    // The same service carries the host's request gate (#603): its fence plus
+    // its browser login, the check its own API runs. Read per request for the
+    // same reason as the authorities above.
+    const previousGate = setRequestGateSource(() => {
+        const connection = ctx.get('connection');
+        const gate = connection?.requestRejection;
+        return typeof gate === 'function'
+            ? (request => gate.call(connection, request))
+            : undefined;
+    });
     // The setter returns the PREVIOUS source, not a restore closure — the same
     // contract as setBuildEnvSource in dsh-cli.ts.
-    return () => { setTrustedHostsSource(previous); };
+    return () => {
+        setTrustedHostsSource(previous);
+        setRequestGateSource(previousGate);
+    };
 }
 export function apply(ctx, config) {
     ctx.inject(['webServer', 'loader'], (hostCtx) => {
@@ -144,14 +173,18 @@ export function apply(ctx, config) {
             // its name, and never with somebody else's.
             const profileContext = ctx.get('profileContext');
             const launched = launchedProfile(profileContext);
-            // The official Electron app owns this profile. Its CLI explicitly
-            // refuses `--profile desktop`; use the app's pluginManager service.
+            // The official Electron app owns this profile. Its CLI refuses
+            // `--profile desktop` (outright up to dsh 0.2.0-rc.1; from rc.2 it
+            // admits only Desktop's own carrier, and only with Desktop fully quit —
+            // never from inside the running app this market lives in), so use the
+            // app's pluginManager service.
             // Looking it up at request time lets the market mount before the
             // service while still failing closed if it never becomes available.
             // The dsh CLI refuses a profile by NAME — `profile.toLowerCase() ===
-            // "desktop"` (@deepseek-ai/dsh 0.1.7-alpha.2) — so a launched profile
-            // with that name can never be changed through `dsh plugin`, whatever
-            // the install layout. Detection follows the same rule rather than the
+            // "desktop"` (@deepseek-ai/dsh 0.1.7-alpha.2; from 0.2.0-rc.2 it lets
+            // only Desktop's own carrier through, with the app quit) — so from
+            // inside a running Desktop a launched profile with that name can never
+            // be changed through `dsh plugin`, whatever the install layout. Detection follows the same rule rather than the
             // app.asar anchor shape an earlier draft keyed on: the official desktop
             // host is not published, its layout could not be checked, and a host
             // that missed the anchor test fell straight back to the CLI and failed
@@ -162,7 +195,8 @@ export function apply(ctx, config) {
             const configuredDesktop = configured !== undefined && configured.toLowerCase() === 'desktop';
             const officialElectron = launched !== undefined && launched.name.toLowerCase() === 'desktop';
             // An explicitly configured `profile: desktop` takes this branch too. The
-            // CLI refuses that profile by NAME, so routing it there — which is what
+            // CLI refuses that profile by NAME (see above — from inside the running
+            // app on every version), so routing it there — which is what
             // an operator's own workaround for a host that hides `profileContext`
             // does (#744) — makes every install fail for certain. The configuration
             // still wins over the launcher for the name; it just cannot win a branch
@@ -178,6 +212,11 @@ export function apply(ctx, config) {
                 const resolved = {
                     profile: profileName,
                     ...(profileDirectory === undefined ? {} : { profileDirectory }),
+                    origin: {
+                        profileSource: configured !== undefined ? 'configured (cordis.yml), official desktop branch' : 'launcher profileContext, official desktop branch',
+                        launcherAtStart: describeProfileContext(profileContext),
+                        launcherNow: () => describeProfileContext(ctx.get('profileContext')),
+                    },
                     desktopHost: true,
                     allowRestart: false,
                     maxSnapshots: config?.maxSnapshots,
@@ -209,6 +248,14 @@ export function apply(ctx, config) {
             const resolved = {
                 profile: config?.profile ?? launched?.name ?? argvProfile() ?? 'web',
                 ...(useLaunchedDir ? { profileDirectory: launched.dir } : {}),
+                origin: {
+                    profileSource: config?.profile !== undefined ? 'configured (cordis.yml)'
+                        : launched !== undefined ? 'launcher profileContext'
+                            : argvProfile() !== undefined ? '--profile flag'
+                                : 'default (no configured profile, no launcher profileContext, no --profile flag)',
+                    launcherAtStart: describeProfileContext(profileContext),
+                    launcherNow: () => describeProfileContext(ctx.get('profileContext')),
+                },
                 // Left UNDEFINED when unconfigured, deliberately: `?? true` here
                 // would turn "the operator said nothing" into "the operator said
                 // yes", and restartAllowed() could no longer tell them apart — which
@@ -244,6 +291,11 @@ export function apply(ctx, config) {
             const resolved = {
                 profile: current.name,
                 profileDirectory: current.dir,
+                origin: {
+                    profileSource: 'desktop shell (desktopProfiles)',
+                    launcherAtStart: describeProfileContext(ctx.get('profileContext')),
+                    launcherNow: () => describeProfileContext(ctx.get('profileContext')),
+                },
                 // The shell owns the window and the process lifecycle here; the
                 // capability bits report that, and an explicit profile directory no
                 // longer implies it (#639).

package/lib/install.js

@@ -133,7 +133,25 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
     }
     let result = await run(profile, pluginArgs);
     const ok = (r) => r.exitCode === 0 && !r.timedOut && !r.cancelled;
-    if (!ok(result) && !result.cancelled) {
+    // A shadowed rule written DURING the run is its own evidence (#732). The
+    // file was merged just before the run, so a duplicate now means pnpm — or
+    // the host driving it — appended one while this command ran, and every
+    // retry would trip on it. The repair below in the release-age branch only
+    // fired when pnpm's error text reached us; the official desktop host hands
+    // back its own message and `packageResult.output`, which need not carry
+    // `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION`, so the line the host had just
+    // appended stayed dead (@Mlte0907, 1.66.7). The merge is a no-op when
+    // nothing is duplicated, so asking it costs one file read.
+    let repairedDuringRun = false;
+    if (!ok(result) && !result.cancelled && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')) {
+        const mergedNow = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory);
+        if (mergedNow.length > 0) {
+            repairedDuringRun = true;
+            logEvent('warn', 'install', `a second minimumReleaseAgeExclude rule for ${mergedNow.join(', ')} was appended during the run, and pnpm honours only the first, shadowing it (#732) — merged them into one and retrying once`);
+            result = await run(profile, pluginArgs);
+        }
+    }
+    if (!ok(result) && !result.cancelled && !repairedDuringRun) {
         const failure = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode);
         if (failure?.code === 'unparseable-build-key') {
             // The profile's own allowBuilds block is what fails, so no retry of the

package/lib/official-desktop.js

@@ -19,7 +19,16 @@ function detail(error) {
         return 'plugin manager did not explain the failure';
     return JSON.stringify(error);
 }
-/** Never fall back to `dsh plugin --profile desktop`: that CLI is forbidden. */
+/**
+ * Never fall back to `dsh plugin --profile desktop`.
+ *
+ * Up to dsh 0.2.0-rc.1 the CLI refused that profile outright. From rc.2 it
+ * accepts it only when Desktop's own carrier invokes it, with Desktop fully
+ * quit — it takes a 120 s lock on the profile's package.json and says "fully
+ * quit it before running". The market only ever runs inside a live Desktop, so
+ * for the market the answer is the same on every version: the app's own
+ * plugin manager is the only door.
+ */
 export function createOfficialDesktopRuntime(managerLookup, profileName, 
 // Unused by the manager bridge — it takes the profile by NAME — and optional
 // because an explicitly configured `profile: desktop` may be the only thing