dshmarket 1.66.19 → 1.66.21

package/client/client.js

@@ -685,6 +685,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			toggleFail: "切换失败",
 			deprecatedBadge: "已废弃",
 			deprecatedWarn: "该插件已被目录标记为废弃，不建议新用户安装。",
+			configNamespaceNotice: "{0} 的设置面板读不到配置：它按「{1}」读取，而这个环境里没有这个名字的条目 id。它自己的条目是「{2}」，插件客户端应该改成读那个——这是插件自身的问题，市场无法代改。",
 			brokenPluginTitle: "{0} 更新失败后被移除了",
 			brokenPluginBody: "DSH 正在运行时无法更新，而更新前的版本也已经损坏。为避免下次启动卡住，市场把它从 profile 里移除。插件目录还在原处，退出 DSH 后重新安装即可。",
 			brokenPluginTitleCancelled: "{0} 取消更新后被移除了",
@@ -788,6 +789,12 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			checkResidualsHint: "这些目录不被任何插件使用，也不影响启动，是更新中断后留下的。退出 DSH 后可以删除，或重新安装对应的插件。",
 			checkResidualTmp: "pnpm 临时目录",
 			checkResidualIncomplete: "残缺的包目录（缺少 package.json）",
+			checkConfigNamespaces: "设置面板读不到配置的插件",
+			checkConfigNamespacesEmpty: "没有发现这类插件。",
+			checkConfigNamespacesHint: "插件面板按「条目 id」读自己的配置，写错名字不会报错，只会静默读不到值：面板空白、存不进去，插件会退回它写死的默认值（画布类插件因此白屏）。这是插件客户端里的名字写错了，市场改不了它，需要插件作者改一行代码。",
+			checkConfigNamespaceRow: "它按「{0}」读配置，但这不是任何条目 id",
+			checkConfigNamespaceOwn: "它自己的条目 id",
+			checkConfigNamespaceNone: "它自己没有声明任何条目 id",
 			checkOrphans: "无效的配置条目",
 			checkOrphansEmpty: "没有无效配置条目",
 			orphanInsertNotArray: "格式错误",
@@ -1394,6 +1401,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			toggleFail: "Toggle failed",
 			deprecatedBadge: "Deprecated",
 			deprecatedWarn: "This plugin is marked as deprecated by the catalog; new users are advised against installing it.",
+			configNamespaceNotice: "{0}'s settings panel cannot read its config: it asks for \"{1}\", and no entry id in this environment has that name. Its own entry is \"{2}\", which is what the plugin's client should ask for — the mistake is in the plugin, and the market cannot change it.",
 			brokenPluginTitle: "{0} was removed after a failed update",
 			brokenPluginBody: "The running DSH blocked the update, and the version it was replacing was already damaged. The market removed it from the profile so the next start does not fail. Its directory is untouched — quit DSH and install it again.",
 			brokenPluginTitleCancelled: "{0} was removed after an update was cancelled",
@@ -1497,6 +1505,12 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			checkResidualsHint: "No plugin uses these directories and they do not stop DSH from starting: an interrupted update left them behind. Quit DSH, then delete them or reinstall the affected plugin.",
 			checkResidualTmp: "pnpm temp directory",
 			checkResidualIncomplete: "incomplete package (no package.json)",
+			checkConfigNamespaces: "Plugins whose settings read the wrong name",
+			checkConfigNamespacesEmpty: "No plugin does this.",
+			checkConfigNamespacesHint: "A plugin panel reads its own config by ENTRY ID. A wrong name there reports nothing: the panel is blank and cannot save, and the plugin falls back to whatever default it hardcoded (a canvas panel shows a white screen). The name is wrong inside the plugin's own client bundle — the market cannot fix it, its author has to change one line.",
+			checkConfigNamespaceRow: "it reads its config from \"{0}\", which is not an entry id",
+			checkConfigNamespaceOwn: "its own entry id",
+			checkConfigNamespaceNone: "it declares no entry id of its own",
 			checkOrphans: "Invalid config entries",
 			checkOrphansEmpty: "No invalid config entries",
 			orphanInsertNotArray: "malformed",
@@ -6012,6 +6026,32 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 							}, residual.path))
 						})]
 					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(Section, {
+						title: t("checkConfigNamespaces"),
+						count: report.configNamespaces?.length ?? 0,
+						empty: t("checkConfigNamespacesEmpty"),
+						overview: report.configNamespaces?.[0]?.name,
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: Market_module_css_default.panelNote,
+							children: t("checkConfigNamespacesHint")
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: Market_module_css_default.diagList,
+							children: (report.configNamespaces ?? []).map((finding) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: Market_module_css_default.diagRow,
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: Market_module_css_default.nm,
+									children: finding.name
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+									className: Market_module_css_default.spec,
+									children: [
+										finding.namespaces.map((namespace) => t("checkConfigNamespaceRow").replace("{0}", namespace)).join("；"),
+										" — ",
+										finding.ownEntryIds.length > 0 ? `${t("checkConfigNamespaceOwn")}: ${finding.ownEntryIds.join(", ")}` : t("checkConfigNamespaceNone")
+									]
+								})]
+							}, finding.name))
+						})]
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(CollapsibleSection, {
 						title: t("orderSection"),
 						count: order.length,
@@ -8415,6 +8455,12 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const catalogVersionTip = (0, react.useMemo)(() => catalogUpdated === null ? t("catalogVersionUndated") : t("catalogVersionDated").replace("{0}", catalogUpdated), [catalogUpdated, t]);
 			/** Non-live activation results from the last operation, shown as a banner. */
 			const [activationWarnings, setActivationWarnings] = (0, react.useState)([]);
+			/**
+			* Installed plugins whose client asks for a config namespace nothing serves
+			* (#810). Server-computed, because the answer needs one client bundle read
+			* per plugin and the client cannot see a bundle's contents.
+			*/
+			const [configNamespaceIssues, setConfigNamespaceIssues] = (0, react.useState)([]);
 			const [hostDependencyFindings, setHostDependencyFindings] = (0, react.useState)([]);
 			/** Plugin name awaiting uninstall confirmation (Modal). */
 			const [removeConfirm, setRemoveConfirm] = (0, react.useState)(null);
@@ -8596,6 +8642,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					if (body.notes !== null && typeof body.notes === "object" && !Array.isArray(body.notes)) setNotes(body.notes);
 					if (Array.isArray(body.patchDisabled)) setPatchDisabledNames(body.patchDisabled);
 					if (Array.isArray(body.unbundled)) setUnbundledNames(body.unbundled);
+					setConfigNamespaceIssues(Array.isArray(body.configNamespaces) ? body.configNamespaces.filter((item) => typeof item === "object" && item !== null && typeof item.name === "string" && Array.isArray(item.namespaces)) : []);
 					if (body.groups && typeof body.groups === "object") setGroups(body.groups);
 					if (Array.isArray(body.groupOrder)) setGroupOrder(body.groupOrder);
 					if (Array.isArray(body.favorites)) setFavoriteUrls(body.favorites.filter((url) => typeof url === "string"));
@@ -12074,6 +12121,16 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 									] }, name))
 								})]
 							}),
+							tab === "installed" && configNamespaceIssues.length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: Market_module_css_default.banner,
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(IconWarningOutline16, {
+									size: 14,
+									className: Market_module_css_default.bannerIcon
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: Market_module_css_default.grow,
+									children: configNamespaceIssues.map((finding) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { children: t("configNamespaceNotice").replace("{0}", finding.name).replace("{1}", finding.namespaces.join("、")).replace("{2}", finding.ownEntryIds.join("、") || "—") }, finding.name))
+								})]
+							}),
 							tab === "installed" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(HostDependencyDiagnostics, {
 								findings: hostDependencyFindings,
 								t

package/lib/profile.js

@@ -8,7 +8,7 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { JSON_SCHEMA, load } from 'js-yaml';
 import { resolveDshHome } from './home-paths.js';
-import { githubRemoteIdentities, githubRepoIdentities, isGitHostedSpec, repoOfTarget } from './sources.js';
+import { githubRemoteIdentities, githubRepoIdentities, hostedRepoKey, isGitHostedSpec, repoOfTarget } from './sources.js';
 /**
  * Whether a profile name follows DSH's own directory-name contract.
  *
@@ -680,9 +680,20 @@ export function readLockCommits(profile, explicitDir) {
  * by pnpm's `path:` selector, so the spec's subpath has to match too — and
  * when the spec names no subpath while several entries of that remote do,
  * there is no answer rather than the first sibling's commit (#632).
+ *
+ * The key on both sides of the comparison is `hostedRepoKey`, the identity
+ * the rest of the market already compares specs by (#851). This function
+ * used to derive its own, and that second spelling lost every install pnpm
+ * writes the shorthand back for: it demanded an `https?://` prefix or a
+ * `.git` suffix, so `github:owner/repo` keyed to nothing at all, and it kept
+ * the `.git` suffix, so the spec side `https://github.com/o/r` could never
+ * equal the lockfile side pnpm writes as `git@github.com:o/r.git`. A floating
+ * shorthand therefore had no commit, and with no commit the update route
+ * refuses to roll back — the market reports "cannot confirm the commit before
+ * the update" for a lockfile that states it plainly.
  */
 export function readGitResolutionCommit(profile, spec, explicitDir) {
-    const want = normalizeGitRepoKey(spec);
+    const want = hostedRepoKey(spec);
     if (want === null)
         return null;
     const wantPath = gitSubpathSelector(spec);
@@ -695,7 +706,7 @@ export function readGitResolutionCommit(profile, spec, explicitDir) {
             const repo = /\brepo:\s*([^\s,}]+)/.exec(body);
             if (commit === null || repo === null)
                 continue;
-            if (normalizeGitRepoKey(repo[1]) !== want)
+            if (hostedRepoKey(repo[1]) !== want)
                 continue;
             const entryPath = /\bpath:\s*([^\s,}]+)/.exec(body)?.[1]?.replace(/^\/+|\/+$/g, '').toLowerCase() ?? null;
             if (wantPath !== null) {
@@ -722,23 +733,6 @@ function gitSubpathSelector(spec) {
     const trimmed = selector.replace(/^\/+|\/+$/g, '').toLowerCase();
     return trimmed === '' ? null : trimmed;
 }
-/** Lowercased transport-agnostic key for comparing two git remote spellings. */
-function normalizeGitRepoKey(spec) {
-    let remote = spec.trim().replace(/^git\+/i, '');
-    const scp = /^git@([^:]+):(.+)$/.exec(remote);
-    if (scp !== null)
-        remote = `https://${scp[1]}/${scp[2].replace(/^\/*/, '')}`;
-    const hash = remote.indexOf('#');
-    if (hash !== -1)
-        remote = remote.slice(0, hash);
-    const query = remote.indexOf('?');
-    if (query !== -1)
-        remote = remote.slice(0, query);
-    remote = remote.replace(/\/+$/, '').toLowerCase();
-    if (!/^https?:\/\//.test(remote) && !remote.includes('.git'))
-        return null;
-    return remote;
-}
 /** True when the installed package's manifest declares a dsh plugin surface. */
 export function hasDshManifest(dir) {
     try {
@@ -859,32 +853,52 @@ export function parsePatchRows(text) {
         // and the market uninstalled the newcomer over a clash the host does
         // not have.
         let payloadIndent = null;
-        /** Index of the `- ` line that opens the row holding `from`. */
+        const isDash = (index) => /^-(?:\s|$)/u.test(rows[index].trimmed);
+        /**
+         * Column where a line's key text starts: its indent plus any `- ` marker.
+         * A row's keys share this column whether written on the marker line or
+         * below it, however many spaces follow the `-`.
+         */
+        const keyCol = (index) => {
+            // A bare `-` puts the row's keys on the lines below it.
+            if (rows[index].trimmed === '-') {
+                const next = rows[index + 1];
+                return next !== undefined && next.indent > rows[index].indent ? next.indent : rows[index].indent + 2;
+            }
+            const dash = /^-\s+/u.exec(rows[index].trimmed);
+            return rows[index].indent + (dash === null ? 0 : dash[0].length);
+        };
+        /** Index of the `- ` line that opens the row holding `from`, or -1. */
         const rowStart = (from) => {
-            const isRowStart = (index) => /^-\s/u.test(rows[index].trimmed) || rows[index].trimmed === '-';
-            if (isRowStart(from))
-                return from;
-            for (let j = from - 1; j >= 0; j--) {
-                if (isRowStart(j))
+            const col = keyCol(from);
+            for (let j = from; j >= 0; j--) {
+                if (isDash(j) && keyCol(j) === col)
                     return j;
+                // Shallower than the row's keys: left the row without finding its marker.
+                if (rows[j].indent < col)
+                    return -1;
             }
-            return 0;
+            return -1;
         };
         /**
          * Whether the insert row holding the `config:` at `from` declares
          * `group: true`. YAML gives a mapping's keys no order, so this reads the
-         * whole row — its own `- ` marker plus the key lines at the marker's body
-         * indentation — rather than only what happened to be written above.
+         * whole row — its own `- ` marker plus the key lines at the row's key
+         * column — rather than only what happened to be written above.
          */
         const rowDeclaresGroup = (from) => {
             const start = rowStart(from);
+            if (start === -1)
+                return false;
             const markerIndent = rows[start].indent;
+            const col = keyCol(start);
             for (let j = start; j < rows.length; j++) {
                 const row = rows[j];
                 if (j > start && row.indent <= markerIndent)
                     break;
-                // The row's own keys; a config body sits deeper than these.
-                if (j > start && row.indent !== markerIndent + 2)
+                // Only the row's own keys: a config body, or a list under another
+                // key, is not at the key column or starts with its own `- `.
+                if (j > start && (row.indent !== col || isDash(j)))
                     continue;
                 if (/^\s*-?\s*group:\s*['"]?true['"]?\s*$/u.test(row.line))
                     return true;
@@ -912,15 +926,22 @@ export function parsePatchRows(text) {
                 payloadIndent = null;
                 continue;
             }
-            // Exactly one `config:` shape carries loader rows: a `group: true` row
-            // whose config is a LIST, because its children are entries. That is
-            // the rule userPatchPackageReferences has always applied to this same
-            // shape — a plain plugin may use a list of `{ name: … }` as ordinary
-            // options, and those must stay payload. Anything else here is payload
-            // too, so the block is skipped rather than counted.
-            if (insertIndent !== null && indent > insertIndent && /^\s*-?\s*config:\s*$/u.test(line)) {
-                if (!(rowDeclaresGroup(i) && valueIsList(i, indent)))
-                    payloadIndent = indent;
+            // Exactly one block under a row carries loader rows: the `config:` of a
+            // `group: true` row whose config is a LIST, because its children are
+            // entries. That is the rule userPatchPackageReferences has always
+            // applied to this same shape — a plain plugin may use a list of
+            // `{ name: … }` as ordinary options, and those must stay payload. Any
+            // other block-valued key (`config:`, `tags:`, …) holds data too, so the
+            // block is skipped rather than counted.
+            // Inside a payload, a nested key is more payload: it must not move the
+            // payload's edge, or the payload ends early and its ids count.
+            const blockKey = /^\s*-?\s*([A-Za-z_][\w.-]*):\s*$/u.exec(line);
+            if (payloadIndent === null && insertIndent !== null && indent > insertIndent && blockKey !== null) {
+                // The key's own column, not the line's: when the key sits on a `- `
+                // line, the row's later keys share its column and are not payload.
+                const col = keyCol(i);
+                if (!(blockKey[1] === 'config' && rowDeclaresGroup(i) && valueIsList(i, col)))
+                    payloadIndent = col;
                 continue;
             }
             const name = /^\s*-?\s*name:\s*['"]?([^'"\s]+)/.exec(line);

package/lib/recovery.js

@@ -938,6 +938,16 @@ export async function runRecovery(config, facts = { exitCode: null, bound: false
     const servePort = options.port ?? config.port;
     /** Write errors from the previous apply; they travel into the next payload. */
     let writeErrors = [];
+    // A port that ANSWERS is proof the host came up, and it needs no pid to say
+    // so (#854). The helper's pid is the process IT spawned, which on Windows is
+    // the `powershell.exe` wrapper rather than the node host that binds — so the
+    // guard below cannot be trusted on its own, and a helper that gave up late
+    // handed this surface a pid that was already gone while the host was still
+    // starting. Asking the socket settles it either way.
+    if (servePort !== null && servePort !== 0 && await portListening(servePort)) {
+        note(config, `port ${String(servePort)} is already answering — the host came up after all; leaving it alone`);
+        return 'booted';
+    }
     // The replacement is not necessarily dead just because it has not bound the
     // port: on a slow host it is still starting. It gets the same grace as a
     // released port before the surface takes the port out from under it (#719).

package/lib/regions.js

@@ -160,6 +160,28 @@ export function rememberGithubRoute(service, route) {
 export function resetGithubRoutePreferences() {
     preferredGithubRoutes.clear();
 }
+/**
+ * Put a user's own prefix in front, and keep the region's other routes (#850).
+ *
+ * Heading rather than replacing, because a public proxy dying is the whole
+ * reason the setting exists — the reporter's was one of these mirrors, and it
+ * took the rest of the chain with it: `gh-proxy.com` stopped serving on
+ * 2026-10-13, and every GitHub-sourced update then failed on a timeout rather
+ * than trying the next candidate. Replacing the list buys one attempt per
+ * mirror outage; heading it buys one, and then the chain that was already
+ * measured to work.
+ *
+ * The proxy is also dropped from the tail if it is already there, so a user
+ * who accepted the value the settings UI pre-suggests gets exactly the
+ * region's own table back rather than the same prefix twice.
+ *
+ * The direct escape is never dropped: `githubRoutes` promises every list ends
+ * in one, and dropping it would turn a dead mirror into an outage instead of
+ * a slow request.
+ */
+function withCustomProxy(proxy, base) {
+    return [proxy, ...base.filter(route => route !== proxy)];
+}
 /**
  * The routes for a region, with environment overrides applied.
  *
@@ -183,7 +205,11 @@ export function routesFor(region, env = process.env) {
             raw: [...base.githubRoutes.raw],
             avatar: [...base.githubRoutes.avatar],
         }
-        : { git: [githubProxy, null], raw: [githubProxy, null], avatar: [githubProxy, null] };
+        : {
+            git: withCustomProxy(githubProxy, base.githubRoutes.git),
+            raw: withCustomProxy(githubProxy, base.githubRoutes.raw),
+            avatar: withCustomProxy(githubProxy, base.githubRoutes.avatar),
+        };
     return {
         npmRegistry: registry,
         githubProxy: githubProxy ?? base.githubProxy,

package/lib/restart.js

@@ -481,19 +481,39 @@ export function restartHelperSource(spawned, launch, logs, port, recovery = null
         // seen from the other side. A replacement that EXITS still ends this
         // early (the `exited` break below), so a genuinely failed boot is not
         // made slower by the wider backstop.
+        '  const startedAt = Date.now()',
         '  const upBy = Date.now() + 45000 + SETTLE_MS',
+        // #854: the window is a budget for "has it come up", NOT a verdict on
+        // "is it dead". A cold start right after the market rewrote node_modules
+        // can outlast it (measured on Windows: bind at ~63s with a scanner on the
+        // fresh files), and handing the port over while the replacement is still
+        // RUNNING is what turns a slow boot into the deadlock #719 removed: the
+        // surface takes port 3080, the host reaches its own bind and dies on
+        // EADDRINUSE, and nothing can come back. So a replacement that has NOT
+        // exited keeps the port, up to a hard cap; one that has exited still ends
+        // the wait immediately, which is the failed-boot case.
+        '  const hardBy = Date.now() + 240000',
         '  let steadySince = null',
-        '  while (Date.now() < upBy) {',
+        '  let announcedWait = false',
+        '  while (true) {',
         '    if (await listening()) {',
         '      if (steadySince === null) steadySince = Date.now()',
         '      else if (Date.now() - steadySince >= SETTLE_MS) return',
         '    } else {',
         '      steadySince = null',
         '      if (exited !== null) break',
+        '      const now = Date.now()',
+        '      if (now >= hardBy) break',
+        '      if (now >= upBy && !announcedWait) {',
+        '        announcedWait = true',
+        // The numbers are computed, not typed twice: a log line that drifts from
+        // the constants it describes is worse than no line at all.
+        '        note(`the replacement is still starting after ${String(Math.round((upBy - startedAt) / 1000))}s and has not exited — waiting up to ${String(Math.round((hardBy - startedAt) / 1000))}s for it rather than taking its port (it would die on EADDRINUSE)`)',
+        '      }',
         '    }',
         '    await sleep(500)',
         '  }',
-        '  note(`the replacement never came up on port ${port}${exited === null ? "" : ` (it exited with code ${exited})`} — see the output log beside this one`)',
+        '  note(`the replacement never came up on port ${port}${exited === null ? " (it is still running, so the recovery surface waits for it to exit before binding)" : ` (it exited with code ${exited})`} — see the output log beside this one`)',
         // The host is not coming back on its own. Everything the user can still
         // do about it lives in the recovery surface, so start it while the
         // browser tab that asked for the restart is still open.

package/lib/routes.js

@@ -43,7 +43,7 @@ import { createThemeManager } from './themes.js';
 import { readJsonBody, refuseUnadmitted, sameOrigin, sendJson } from './http.js';
 import { resolveDshHome } from './home-paths.js';
 import { detectedDebugger, detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest, restartReachableFrom } from './restart.js';
-import { activationAfterReplace, brokenClientBundles, bundlePatchIsEmpty, checkClientBundle, defaultHostRuntimeFacts, hasHostHalf, hostPeerGate, newlyBrokenBundles, peerGateRemedy, verifyActivation } from './verify.js';
+import { activationAfterReplace, brokenClientBundles, bundlePatchIsEmpty, checkClientBundle, defaultHostRuntimeFacts, findUnservedConfigNamespaces, hasHostHalf, hostPeerGate, newlyBrokenBundles, peerGateRemedy, verifyActivation } from './verify.js';
 import { carrierDisableIds, disableRow, enableRow, findUserPatchPath, foreignRowIds, isProtectedModule, packagePatchFlags, readUserPatchState, removeRowBlocks, rowIdsForPackage, userPatchPackageReferences, } from './patch.js';
 import { createProfileBackup, downloadWebdav, MAX_BACKUP_BYTES, mergeRestoreManifest, restoreProfileBackup, unportableDeps, uploadWebdav, } from './backup.js';
 import { createGist, fitsGistLimit, GistError, gistErrorCode, parseGistId, readGist, resolveGistTokenSource, updateGist, verifyGistToken, } from './gist.js';
@@ -578,6 +578,16 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
      * newer decision than the market's list (the market removes a name from
      * its list BEFORE writing its own enable row), so the list follows it.
      *
+     * Scoped to THIS profile's layer, deliberately (#519). DSH also composes a
+     * home-level layer, and a third-party manager that wrote its switches there
+     * asked us to follow that too. We do not: the market writes the profile
+     * layer and nothing else, so following a layer it cannot write would give
+     * the user a switch that appears to work and silently reverts at the next
+     * boot — worse than a boundary they can see. What a home-level decision
+     * DOES get is a name in the log when the market overrides it (see
+     * `noteHomeLayerConflict`), so nobody has to guess why a plugin came back
+     * off.
+     *
      * @returns true when the package was re-enabled elsewhere and has been
      *   dropped from the market's disable list.
      */
@@ -591,6 +601,27 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         logEvent('info', 'toggle', `${name}: its rows were re-enabled outside the market (#696) — following that instead of switching it back off`);
         return true;
     }
+    /**
+     * Say so when the market overrides an enable recorded in the HOME patch
+     * layer (#519).
+     *
+     * The market keeps a plugin off from its own record; a decision in the
+     * profile layer is followed instead (`followOutsideEnable`), but the home
+     * layer is not read for it — see there for why. The cost of that boundary
+     * is a plugin that turns off again on every boot while another manager's
+     * layer says it should be on: a perfectly reasonable thing for a user to be
+     * confused by, and its only explanation today was silence.
+     */
+    function noteHomeLayerConflict(name) {
+        const homePatchPath = join(resolveDshHome(), 'cordis.patch.yml');
+        const home = readUserPatchState(homePatchPath);
+        if (home.forced.length === 0)
+            return;
+        const flags = packagePatchFlags(host, activeProfileDir, [name], home);
+        if (!flags.forced.includes(name) || flags.disabled.includes(name))
+            return;
+        logEvent('warn', 'toggle', `${name}: kept off by this market's own record, while ${homePatchPath} enables it — that layer is not the one the market writes, so the market will not follow it. Move the row into this profile's cordis.patch.yml to make it stick (#519)`);
+    }
     // Client-only packages (dsh.client without dsh.bundle) are invisible to the
     // bundle layer in every boot; the market shim-mounts them so their client
     // bundles are actually served.
@@ -604,6 +635,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         for (const name of [...disabled]) {
             if (followOutsideEnable(name))
                 continue;
+            noteHomeLayerConflict(name);
             if (await themes.setEntryDisabled(name, true))
                 logEvent('info', 'boot', `plugin kept off: ${name}`);
         }
@@ -2452,6 +2484,34 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                     packageName,
                     manifest,
                 })));
+                // #810: a client that reads its config from a name no loader entry
+                // answers to reads NOTHING — blank or unwritable settings, and in the
+                // reported case a panel stuck on a hardcoded fallback port — with no
+                // error anywhere. Judged against everything this profile can be seen
+                // to serve: each installed package's own patch rows (read once, for
+                // the set AND for the "write this instead" value), the user patch's
+                // rows — its inserts, plus the disables and force-enables, which both
+                // name existing entry ids — and whatever the loader is running now.
+                //
+                // The gap: host-layer ids the market never reads a patch for. A plugin
+                // reading a HOST entry's config by literal would be flagged wrongly
+                // here, where the diagnostics page — which composes the host layers
+                // too — can settle that difference.
+                const ownEntryIds = new Map(Object.keys(installed).map(packageName => [packageName, bundlePatchInsertedIds(join(activeProfileDir, 'node_modules', packageName))]));
+                const servedEntryIds = new Set([...patch.inserts, ...patch.disables, ...patch.forced]);
+                for (const ids of ownEntryIds.values())
+                    for (const id of ids)
+                        servedEntryIds.add(id);
+                for (const entry of host.loader.entries()) {
+                    const id = entry.options?.id;
+                    if (id === undefined || id === '')
+                        continue;
+                    servedEntryIds.add(id);
+                    const bare = id.split(':').pop();
+                    if (bare !== undefined)
+                        servedEntryIds.add(bare);
+                }
+                const configNamespaces = findUnservedConfigNamespaces(activeProfileDir, servedEntryIds, name => ownEntryIds.get(name) ?? [], activeProfileDir);
                 sendJson(response, 200, {
                     profile: config.profile,
                     installed,
@@ -2479,6 +2539,9 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                     brokenPlugins: marketState.brokenPlugins ?? {},
                     patchForced: patchFlags.forced,
                     bundles: readProfileBundles(activeProfileDir).filter(name => !INBOX_BUNDLES.has(name)),
+                    // Only packages with a finding appear, so a healthy profile sends
+                    // nothing and the row renders nothing.
+                    configNamespaces: configNamespaces.length > 0 ? configNamespaces : undefined,
                 });
             },
         }),
@@ -2503,7 +2566,20 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             ? classifyPeer(row.plugin, row.name, row.range, row.resolved, row.optional === true)
                             : { kind: 'none' };
                     }
-                    sendJson(response, 200, report);
+                    // #810: a client that reads its config from a name no loader entry
+                    // answers to. Attached here rather than computed inside
+                    // `analyzeProfile` because that function is documented as safe on
+                    // every market open and this reads one bundle per installed plugin —
+                    // the diagnostics page is a page the user opened on purpose.
+                    //
+                    // Judged against the COMPOSITION's ids, not the package's own: a
+                    // package may mount another one (carrier form), and judging by own
+                    // ids would flag it.
+                    const served = new Set(report.rows.map(row => row.id));
+                    sendJson(response, 200, {
+                        ...report,
+                        configNamespaces: findUnservedConfigNamespaces(activeProfileDir, served, name => report.rows.filter(row => row.layer === name).map(row => row.id), activeProfileDir),
+                    });
                 }
                 catch (error) {
                     sendJson(response, 500, { error: error instanceof Error ? error.message : String(error) });

package/lib/themes.js

@@ -4,6 +4,7 @@
  * the loader, and keeping exactly one theme active with the choice
  * persisted across restarts.
  */
+import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { loadRegistry, pluginCategories } from './registry.js';
 import { hotMount, hotUnmount, listHotMounts, writeDisabled } from './hot.js';
@@ -11,7 +12,28 @@ import { logEvent } from './log.js';
 import { LifecyclePendingError, LifecycleWaitError, waitForLifecycle } from './lifecycle.js';
 import { nameMatchesPackage } from './entry-identity.js';
 import { bundlePatchInsertedIds, profileDir, readInstalled } from './profile.js';
-import { repoOf } from './sources.js';
+import { parseSourceUrl, repoOfTarget } from './sources.js';
+/**
+ * Whether an installed package declares itself a skin.
+ *
+ * The market's own criterion for "this is a theme" is the catalog, and the
+ * catalog does not list every skin a monorepo ships: the reporter's second
+ * skin is absent from it entirely, while the MANAGER that ships with them is
+ * a package from the same repo. Judging by repo alone made the manager a
+ * theme, so activating any other theme switched it off — and with it the
+ * user's own skin-management UI (#519). Both skins ship `skin.json` at their
+ * root (it names the package and its wiring); the manager ships none, which
+ * is the distinction the reporter pointed at.
+ */
+function hasSkinManifest(profileDirectory, name) {
+    try {
+        const manifest = JSON.parse(readFileSync(join(profileDirectory, 'node_modules', name, 'skin.json'), 'utf8'));
+        return typeof manifest.id === 'string' && manifest.id !== '';
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Whether a loader entry belongs to `packageName`.
  *
@@ -53,15 +75,47 @@ export function createThemeManager(host, profile, disabledThemes, explicitDir) {
             const registry = await loadRegistry();
             const themeEntries = registry.plugins.filter(p => pluginCategories(p).includes('theme'));
             const themeNames = new Set(themeEntries.map(p => p.name));
-            const themeRepos = new Set(themeEntries.map(p => repoOf(p.url)).filter((r) => r !== null).map(r => r.toLowerCase()));
+            // Repo → the subdirectories its catalog entries point at, plus whether
+            // any entry is the repo itself. One repository can ship several PACKAGES
+            // — a skin manager and its skins — and matching by repo alone made every
+            // one of them a theme, so activating another theme switched the manager
+            // off too, taking the user's own management UI with it (#519).
+            const themeRepos = new Map();
+            for (const entry of themeEntries) {
+                const parsed = parseSourceUrl(entry.url);
+                if (parsed === null)
+                    continue;
+                const key = parsed.repo.toLowerCase();
+                const record = themeRepos.get(key) ?? { root: false, subpaths: new Set() };
+                if (parsed.subpath === null)
+                    record.root = true;
+                else
+                    record.subpaths.add(parsed.subpath.toLowerCase());
+                themeRepos.set(key, record);
+            }
             for (const [name, spec] of Object.entries(readInstalled(profile, activeProfileDir))) {
                 if (themeNames.has(name)) {
                     names.add(name);
                     continue;
                 }
-                const match = /github:([^#\s]+)/.exec(String(spec).toLowerCase());
-                if (match !== null && themeRepos.has(match[1]))
-                    names.add(name);
+                const identity = repoOfTarget(String(spec).toLowerCase());
+                if (identity === null)
+                    continue;
+                const at = identity.indexOf('#path:/');
+                const repo = at === -1 ? identity : identity.slice(0, at);
+                const subpath = at === -1 ? null : identity.slice(at + '#path:/'.length);
+                const record = themeRepos.get(repo);
+                if (record === undefined)
+                    continue;
+                // Only a repo whose themes ALL live in subdirectories can be told
+                // apart this way. A catalog entry at the repo root says nothing about
+                // subdirectories, so that shape keeps the permissive match it had —
+                // which is also what keeps a monorepo skin working when the entry
+                // points at the repo.
+                if (subpath !== null && !record.root && record.subpaths.size > 0
+                    && !record.subpaths.has(subpath) && !hasSkinManifest(activeProfileDir, name))
+                    continue;
+                names.add(name);
             }
         }
         catch { /* registry unavailable — nothing classifies as a theme */ }

package/lib/types/profile.d.ts

@@ -232,6 +232,17 @@ export declare function readLockCommits(profile: string, explicitDir?: string):
  * by pnpm's `path:` selector, so the spec's subpath has to match too — and
  * when the spec names no subpath while several entries of that remote do,
  * there is no answer rather than the first sibling's commit (#632).
+ *
+ * The key on both sides of the comparison is `hostedRepoKey`, the identity
+ * the rest of the market already compares specs by (#851). This function
+ * used to derive its own, and that second spelling lost every install pnpm
+ * writes the shorthand back for: it demanded an `https?://` prefix or a
+ * `.git` suffix, so `github:owner/repo` keyed to nothing at all, and it kept
+ * the `.git` suffix, so the spec side `https://github.com/o/r` could never
+ * equal the lockfile side pnpm writes as `git@github.com:o/r.git`. A floating
+ * shorthand therefore had no commit, and with no commit the update route
+ * refuses to roll back — the market reports "cannot confirm the commit before
+ * the update" for a lockfile that states it plainly.
  */
 export declare function readGitResolutionCommit(profile: string, spec: string, explicitDir?: string): string | null;
 /** True when the installed package's manifest declares a dsh plugin surface. */