dshmarket 1.66.19 → 1.66.21

package/lib/types/verify.d.ts

@@ -180,6 +180,43 @@ export interface BundleCheck {
     /** Populated only when the file was found AND failed to parse. */
     reason: string | null;
 }
+/**
+ * Every namespace a client bundle asks its config from (#810).
+ *
+ * One level of constant propagation, as asked for in the report: the plugin
+ * that started this writes `var NAMESPACE = "dsh-comfyui-canvas"` and calls
+ * `configForms.get(NAMESPACE)`, so a literal-only scan would miss the very
+ * case the check exists for. A name assigned twice is dropped rather than
+ * guessed at — which value it holds at the call site is not decidable from
+ * text alone, and a wrong guess here would be reported as a plugin defect.
+ */
+export declare function configFormNamespaces(source: string): string[];
+/** A package whose client asks for a namespace nothing in the composition serves (#810). */
+export interface UnservedConfigNamespace {
+    /** The installed package whose client bundle asks. */
+    name: string;
+    /** The namespaces it asks for that no loader entry id answers to. */
+    namespaces: string[];
+    /** Entry ids this package's own patch declares — the value it meant. */
+    ownEntryIds: string[];
+}
+/**
+ * Installed plugins whose client reads its config from a name nothing serves
+ * (#810).
+ *
+ * `served` is the entry id set of the WHOLE composition — deliberately not
+ * this package's own ids: a package may legitimately mount another one
+ * (carrier form), and judging by own ids alone would flag those. `ownIdsOf`
+ * answers what the package itself declares, which is the value to write
+ * instead — the report asked for the correct spelling to be shown, not just
+ * the mistake.
+ *
+ * The scan reads one bundle per installed plugin. Measured against the same
+ * cost the syntax sweep above already pays (0.40ms per plugin on a 385KB
+ * bundle), so a 30-plugin profile is ~12ms — this runs on a request a user
+ * made, not in a loop.
+ */
+export declare function findUnservedConfigNamespaces(profile: string, served: ReadonlySet<string>, ownIdsOf: (name: string) => string[], explicitDir?: string): UnservedConfigNamespace[];
 /**
  * Every installed plugin whose client bundle will not parse (#222 by
  * @MicroMilo).

package/lib/verify.js

@@ -532,6 +532,117 @@ export function clientBundlePath(exportsField, depth = 0) {
     }
     return null;
 }
+/**
+ * One assignment of a string literal to a name, and the `configForms.get`
+ * call sites (#810).
+ *
+ * The namespace a client asks its config from is a PROFILE ENTRY ID, not a
+ * package name. A client that writes the package name reads nothing: the
+ * settings document has no entry under it, the call returns empty, and the
+ * plugin degrades silently — blank or unwritable settings forms, and in the
+ * reported case a panel stuck on a hardcoded fallback port. Nothing logs it,
+ * and nothing on the market side noticed.
+ *
+ * `configForms.get` is matched by name, so an aliased receiver
+ * (`const forms = ctx.configForms; forms.get("x")`) is not seen — the same
+ * honesty as the syntax check above: this reports what it can prove, and
+ * says nothing otherwise.
+ */
+const STRING_ASSIGNMENT = /(?:^|[^\w$.])(?:var|let|const)?\s*([A-Za-z_$][\w$]*)\s*=\s*(['"])([^'"\\\n]*)\2/gu;
+const CONFIG_FORMS_GET = /configForms\s*\.\s*get\s*\(\s*(?:([A-Za-z_$][\w$]*)|(['"])([^'"\\\n]*)\2)\s*\)/gu;
+/** A value that is a plain loader entry id: a backslash means it is not one. */
+function plainNamespace(value) {
+    return value !== '' && value.length <= 200 && !value.includes('\\') && /^[\w@/.:-]+$/u.test(value) ? value : null;
+}
+/**
+ * Every namespace a client bundle asks its config from (#810).
+ *
+ * One level of constant propagation, as asked for in the report: the plugin
+ * that started this writes `var NAMESPACE = "dsh-comfyui-canvas"` and calls
+ * `configForms.get(NAMESPACE)`, so a literal-only scan would miss the very
+ * case the check exists for. A name assigned twice is dropped rather than
+ * guessed at — which value it holds at the call site is not decidable from
+ * text alone, and a wrong guess here would be reported as a plugin defect.
+ */
+export function configFormNamespaces(source) {
+    // Measured on a 750KB bundle: these scans cost ~9ms, because both walk
+    // every character, and this runs on a request the market polls. Almost no
+    // client mentions configForms at all, and — an order of magnitude rarer —
+    // almost none of those calls a method on it: for both, this pair of plain
+    // substring searches IS the whole cost (0.23ms measured), and only a client
+    // that actually asks for a config pays for a scan.
+    if (!source.includes('configForms') || !source.includes('configForms.get'))
+        return [];
+    const constants = new Map();
+    for (const match of source.matchAll(STRING_ASSIGNMENT)) {
+        const name = match[1];
+        const value = plainNamespace(match[3]);
+        constants.set(name, constants.has(name) || value === null ? null : value);
+    }
+    const namespaces = new Set();
+    for (const match of source.matchAll(CONFIG_FORMS_GET)) {
+        // A namespace is a loader entry id: no escapes, no whitespace runs, no
+        // arbitrary length. Anything else is not this pattern and stays out.
+        const value = plainNamespace(match[3] ?? '') ?? constants.get(match[1]) ?? null;
+        if (value !== null)
+            namespaces.add(value);
+    }
+    return [...namespaces];
+}
+/** The client bundle of an installed package, read; null when it has none to read. */
+function readClientBundle(profile, name, explicitDir) {
+    const root = join(profileDir(profile, explicitDir), 'node_modules', name);
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (manifest.dsh?.client === undefined)
+        return null;
+    const exportsField = manifest.exports;
+    const relative = exportsField !== null && typeof exportsField === 'object' && !Array.isArray(exportsField)
+        ? clientBundlePath(exportsField['./client'])
+        : null;
+    if (relative === null)
+        return null;
+    try {
+        return readFileSync(join(root, relative), 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Installed plugins whose client reads its config from a name nothing serves
+ * (#810).
+ *
+ * `served` is the entry id set of the WHOLE composition — deliberately not
+ * this package's own ids: a package may legitimately mount another one
+ * (carrier form), and judging by own ids alone would flag those. `ownIdsOf`
+ * answers what the package itself declares, which is the value to write
+ * instead — the report asked for the correct spelling to be shown, not just
+ * the mistake.
+ *
+ * The scan reads one bundle per installed plugin. Measured against the same
+ * cost the syntax sweep above already pays (0.40ms per plugin on a 385KB
+ * bundle), so a 30-plugin profile is ~12ms — this runs on a request a user
+ * made, not in a loop.
+ */
+export function findUnservedConfigNamespaces(profile, served, ownIdsOf, explicitDir) {
+    const found = [];
+    for (const name of Object.keys(readInstalled(profile, explicitDir))) {
+        const source = readClientBundle(profile, name, explicitDir);
+        if (source === null)
+            continue;
+        const unserved = configFormNamespaces(source).filter(namespace => !served.has(namespace));
+        if (unserved.length === 0)
+            continue;
+        found.push({ name, namespaces: unserved, ownEntryIds: ownIdsOf(name) });
+    }
+    return found;
+}
 /**
  * Whether a package's client bundle still parses as JavaScript (#222).
  *
@@ -598,34 +709,15 @@ export function newlyBrokenBundles(before, after) {
     return after.filter(entry => !seen.has(entry.name));
 }
 export function checkClientBundle(profile, name, explicitDir) {
-    const root = join(profileDir(profile, explicitDir), 'node_modules', name);
-    let manifest;
-    try {
-        manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
-    }
-    catch {
-        return { ok: true, reason: null };
-    }
-    if (manifest.dsh?.client === undefined)
+    // Declared but absent is verifyActivation's territory (a missing entry
+    // artifact is already `broken` there); duplicating it here would report one
+    // problem twice in two different vocabularies — so the reader's null covers
+    // both "no client bundle" and "declared but unreadable" with the same ok.
+    const source = readClientBundle(profile, name, explicitDir);
+    if (source === null)
         return { ok: true, reason: null };
-    const exportsField = manifest.exports;
-    const relative = exportsField !== null && typeof exportsField === 'object' && !Array.isArray(exportsField)
-        ? clientBundlePath(exportsField['./client'])
-        : null;
-    if (relative === null)
-        return { ok: true, reason: null };
-    let source;
-    try {
-        source = readFileSync(join(root, relative), 'utf8');
-    }
-    catch {
-        // Declared but absent is verifyActivation's territory (a missing entry
-        // artifact is already `broken` there); duplicating it here would report
-        // one problem twice in two different vocabularies.
-        return { ok: true, reason: null };
-    }
     try {
-        new Script(source, { filename: relative });
+        new Script(source, { filename: `${name}/client` });
         return { ok: true, reason: null };
     }
     catch (error) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.19",
+  "version": "1.66.21",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/client/Diagnostics.tsx

@@ -135,6 +135,16 @@ interface CheckReport {
    * failure — informational, and the only place that names what is on disk.
    */
   residuals?: ResidualDirectory[]
+  /**
+   * Installed plugins whose client reads its config from a name no loader
+   * entry serves (#810). Attached by the /check route, which is the only
+   * caller that pays for reading one client bundle per installed plugin.
+   */
+  configNamespaces?: Array<{
+    name: string
+    namespaces: string[]
+    ownEntryIds: string[]
+  }>
 }
 
 /**
@@ -840,6 +850,35 @@ export function Diagnostics(props: { t: Translate }) {
         </div>
       </Section>
 
+      {/* A client that reads its config from a name no loader entry serves
+          (#810). This one IS a defect — the plugin's settings are blank or
+          unwritable right now — but it is the plugin's own, not the
+          profile's, so it stays out of the summary warnings: nothing the user
+          can do to this profile fixes it. The section title says whose
+          problem it is and the hint says who has to change it. */}
+      <Section
+        title={t('checkConfigNamespaces')}
+        count={report.configNamespaces?.length ?? 0}
+        empty={t('checkConfigNamespacesEmpty')}
+        overview={report.configNamespaces?.[0]?.name}
+      >
+        <p className={css.panelNote}>{t('checkConfigNamespacesHint')}</p>
+        <div className={css.diagList}>
+          {(report.configNamespaces ?? []).map(finding => (
+            <div key={finding.name} className={css.diagRow}>
+              <span className={css.nm}>{finding.name}</span>
+              <span className={css.spec}>
+                {finding.namespaces.map(namespace => t('checkConfigNamespaceRow').replace('{0}', namespace)).join('；')}
+                {' — '}
+                {finding.ownEntryIds.length > 0
+                  ? `${t('checkConfigNamespaceOwn')}: ${finding.ownEntryIds.join(', ')}`
+                  : t('checkConfigNamespaceNone')}
+              </span>
+            </div>
+          ))}
+        </div>
+      </Section>
+
       {/* issue #98 phase 2 (step 1): community-bundle ordering */}
       <CollapsibleSection title={t('orderSection')} count={order.length} open={orderOpen} onToggle={() => setOrderOpen(o => !o)}>
         <p className={css.panelNote}>{t('orderDragHint')}</p>

package/src/client/MarketSection.tsx

@@ -2207,6 +2207,12 @@ export function MarketSection(props: MarketSectionProps) {
   )
   /** Non-live activation results from the last operation, shown as a banner. */
   const [activationWarnings, setActivationWarnings] = useState<{ name: string; info: ActivationInfo }[]>([])
+  /**
+   * Installed plugins whose client asks for a config namespace nothing serves
+   * (#810). Server-computed, because the answer needs one client bundle read
+   * per plugin and the client cannot see a bundle's contents.
+   */
+  const [configNamespaceIssues, setConfigNamespaceIssues] = useState<Array<{ name: string; namespaces: string[]; ownEntryIds: string[] }>>([])
   const [hostDependencyFindings, setHostDependencyFindings] = useState<SharedHostPackageDependencyFinding[]>([])
   /** Plugin name awaiting uninstall confirmation (Modal). */
   const [removeConfirm, setRemoveConfirm] = useState<string | null>(null)
@@ -2398,6 +2404,12 @@ export function MarketSection(props: MarketSectionProps) {
         }
         if (Array.isArray(body.patchDisabled)) setPatchDisabledNames(body.patchDisabled)
         if (Array.isArray(body.unbundled)) setUnbundledNames(body.unbundled)
+        setConfigNamespaceIssues(Array.isArray(body.configNamespaces)
+          ? body.configNamespaces.filter((item: unknown): item is { name: string; namespaces: string[]; ownEntryIds: string[] } =>
+              typeof item === 'object' && item !== null
+              && typeof (item as { name?: unknown }).name === 'string'
+              && Array.isArray((item as { namespaces?: unknown }).namespaces))
+          : [])
         if (body.groups && typeof body.groups === 'object') setGroups(body.groups)
         if (Array.isArray(body.groupOrder)) setGroupOrder(body.groupOrder)
         if (Array.isArray(body.favorites)) setFavoriteUrls(body.favorites.filter((url: unknown): url is string => typeof url === 'string'))
@@ -5806,6 +5818,21 @@ export function MarketSection(props: MarketSectionProps) {
             </span>
           </div>
         )}
+        {tab === 'installed' && configNamespaceIssues.length > 0 && (
+          <div className={css.banner}>
+            <IconWarningOutline16 size={14} className={css.bannerIcon} />
+            <span className={css.grow}>
+              {configNamespaceIssues.map(finding => (
+                <div key={finding.name}>
+                  {t('configNamespaceNotice')
+                    .replace('{0}', finding.name)
+                    .replace('{1}', finding.namespaces.join('、'))
+                    .replace('{2}', finding.ownEntryIds.join('、') || '—')}
+                </div>
+              ))}
+            </span>
+          </div>
+        )}
         {tab === 'installed' && <HostDependencyDiagnostics findings={hostDependencyFindings} t={t} />}
         {tab === 'installed' && brokenPluginNames.length > 0 && (
           <div className={css.brokenPluginNotice}>

package/src/client/locales.ts

@@ -497,6 +497,7 @@ export const zh = {
   // A plugin the market had to stop declaring (#663). Plain about what
   // happened, because the user's plugin is simply gone from the list and
   // nothing else in the UI can explain that.
+  configNamespaceNotice: '{0} 的设置面板读不到配置：它按「{1}」读取，而这个环境里没有这个名字的条目 id。它自己的条目是「{2}」，插件客户端应该改成读那个——这是插件自身的问题，市场无法代改。',
   brokenPluginTitle: '{0} 更新失败后被移除了',
   brokenPluginBody: 'DSH 正在运行时无法更新，而更新前的版本也已经损坏。为避免下次启动卡住，市场把它从 profile 里移除。插件目录还在原处，退出 DSH 后重新安装即可。',
   brokenPluginTitleCancelled: '{0} 取消更新后被移除了',
@@ -603,6 +604,12 @@ export const zh = {
   checkResidualsHint: '这些目录不被任何插件使用，也不影响启动，是更新中断后留下的。退出 DSH 后可以删除，或重新安装对应的插件。',
   checkResidualTmp: 'pnpm 临时目录',
   checkResidualIncomplete: '残缺的包目录（缺少 package.json）',
+  checkConfigNamespaces: '设置面板读不到配置的插件',
+  checkConfigNamespacesEmpty: '没有发现这类插件。',
+  checkConfigNamespacesHint: '插件面板按「条目 id」读自己的配置，写错名字不会报错，只会静默读不到值：面板空白、存不进去，插件会退回它写死的默认值（画布类插件因此白屏）。这是插件客户端里的名字写错了，市场改不了它，需要插件作者改一行代码。',
+  checkConfigNamespaceRow: '它按「{0}」读配置，但这不是任何条目 id',
+  checkConfigNamespaceOwn: '它自己的条目 id',
+  checkConfigNamespaceNone: '它自己没有声明任何条目 id',
   checkOrphans: '无效的配置条目',
   checkOrphansEmpty: '没有无效配置条目',
   // Orphan patch reason → badge label (issue #98 supplement).
@@ -1217,6 +1224,7 @@ export const en: Record<MarketKey, string> = {
   toggleFail: 'Toggle failed',
   deprecatedBadge: 'Deprecated',
   deprecatedWarn: 'This plugin is marked as deprecated by the catalog; new users are advised against installing it.',
+  configNamespaceNotice: '{0}\'s settings panel cannot read its config: it asks for "{1}", and no entry id in this environment has that name. Its own entry is "{2}", which is what the plugin\'s client should ask for — the mistake is in the plugin, and the market cannot change it.',
   brokenPluginTitle: '{0} was removed after a failed update',
   brokenPluginBody: 'The running DSH blocked the update, and the version it was replacing was already damaged. The market removed it from the profile so the next start does not fail. Its directory is untouched — quit DSH and install it again.',
   brokenPluginTitleCancelled: '{0} was removed after an update was cancelled',
@@ -1323,6 +1331,12 @@ export const en: Record<MarketKey, string> = {
   checkResidualsHint: 'No plugin uses these directories and they do not stop DSH from starting: an interrupted update left them behind. Quit DSH, then delete them or reinstall the affected plugin.',
   checkResidualTmp: 'pnpm temp directory',
   checkResidualIncomplete: 'incomplete package (no package.json)',
+  checkConfigNamespaces: 'Plugins whose settings read the wrong name',
+  checkConfigNamespacesEmpty: 'No plugin does this.',
+  checkConfigNamespacesHint: 'A plugin panel reads its own config by ENTRY ID. A wrong name there reports nothing: the panel is blank and cannot save, and the plugin falls back to whatever default it hardcoded (a canvas panel shows a white screen). The name is wrong inside the plugin\'s own client bundle — the market cannot fix it, its author has to change one line.',
+  checkConfigNamespaceRow: 'it reads its config from "{0}", which is not an entry id',
+  checkConfigNamespaceOwn: 'its own entry id',
+  checkConfigNamespaceNone: 'it declares no entry id of its own',
   checkOrphans: 'Invalid config entries',
   checkOrphansEmpty: 'No invalid config entries',
   // Orphan patch reason → badge label (issue #98 supplement).

package/src/profile.ts

@@ -9,7 +9,7 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
 import { isDeepStrictEqual } from 'node:util'
 import { JSON_SCHEMA, load } from 'js-yaml'
 import { resolveDshHome } from './home-paths.ts'
-import { githubRemoteIdentities, githubRepoIdentities, isGitHostedSpec, repoOfTarget } from './sources.ts'
+import { githubRemoteIdentities, githubRepoIdentities, hostedRepoKey, isGitHostedSpec, repoOfTarget } from './sources.ts'
 
 /**
  * Whether a profile name follows DSH's own directory-name contract.
@@ -727,13 +727,24 @@ export function readLockCommits(profile: string, explicitDir?: string): Map<stri
  * by pnpm's `path:` selector, so the spec's subpath has to match too — and
  * when the spec names no subpath while several entries of that remote do,
  * there is no answer rather than the first sibling's commit (#632).
+ *
+ * The key on both sides of the comparison is `hostedRepoKey`, the identity
+ * the rest of the market already compares specs by (#851). This function
+ * used to derive its own, and that second spelling lost every install pnpm
+ * writes the shorthand back for: it demanded an `https?://` prefix or a
+ * `.git` suffix, so `github:owner/repo` keyed to nothing at all, and it kept
+ * the `.git` suffix, so the spec side `https://github.com/o/r` could never
+ * equal the lockfile side pnpm writes as `git@github.com:o/r.git`. A floating
+ * shorthand therefore had no commit, and with no commit the update route
+ * refuses to roll back — the market reports "cannot confirm the commit before
+ * the update" for a lockfile that states it plainly.
  */
 export function readGitResolutionCommit(
   profile: string,
   spec: string,
   explicitDir?: string,
 ): string | null {
-  const want = normalizeGitRepoKey(spec)
+  const want = hostedRepoKey(spec)
   if (want === null) return null
   const wantPath = gitSubpathSelector(spec)
   const matches: string[] = []
@@ -746,7 +757,7 @@ export function readGitResolutionCommit(
       const commit = /\bcommit:\s*([0-9a-f]{40})\b/i.exec(body)
       const repo = /\brepo:\s*([^\s,}]+)/.exec(body)
       if (commit === null || repo === null) continue
-      if (normalizeGitRepoKey(repo[1]!) !== want) continue
+      if (hostedRepoKey(repo[1]!) !== want) continue
       const entryPath = /\bpath:\s*([^\s,}]+)/.exec(body)?.[1]?.replace(/^\/+|\/+$/g, '').toLowerCase() ?? null
       if (wantPath !== null) {
         if (entryPath === wantPath) return commit[1]!.toLowerCase()
@@ -770,20 +781,6 @@ function gitSubpathSelector(spec: string): string | null {
   return trimmed === '' ? null : trimmed
 }
 
-/** Lowercased transport-agnostic key for comparing two git remote spellings. */
-function normalizeGitRepoKey(spec: string): string | null {
-  let remote = spec.trim().replace(/^git\+/i, '')
-  const scp = /^git@([^:]+):(.+)$/.exec(remote)
-  if (scp !== null) remote = `https://${scp[1]}/${scp[2]!.replace(/^\/*/, '')}`
-  const hash = remote.indexOf('#')
-  if (hash !== -1) remote = remote.slice(0, hash)
-  const query = remote.indexOf('?')
-  if (query !== -1) remote = remote.slice(0, query)
-  remote = remote.replace(/\/+$/, '').toLowerCase()
-  if (!/^https?:\/\//.test(remote) && !remote.includes('.git')) return null
-  return remote
-}
-
 /** True when the installed package's manifest declares a dsh plugin surface. */
 export function hasDshManifest(dir: string): boolean {
   try {
@@ -904,30 +901,48 @@ export function parsePatchRows(text: string): { names: string[]; ids: string[];
     // and the market uninstalled the newcomer over a clash the host does
     // not have.
     let payloadIndent: number | null = null
-    /** Index of the `- ` line that opens the row holding `from`. */
+    const isDash = (index: number): boolean => /^-(?:\s|$)/u.test(rows[index].trimmed)
+    /**
+     * Column where a line's key text starts: its indent plus any `- ` marker.
+     * A row's keys share this column whether written on the marker line or
+     * below it, however many spaces follow the `-`.
+     */
+    const keyCol = (index: number): number => {
+      // A bare `-` puts the row's keys on the lines below it.
+      if (rows[index].trimmed === '-') {
+        const next = rows[index + 1]
+        return next !== undefined && next.indent > rows[index].indent ? next.indent : rows[index].indent + 2
+      }
+      const dash = /^-\s+/u.exec(rows[index].trimmed)
+      return rows[index].indent + (dash === null ? 0 : dash[0].length)
+    }
+    /** Index of the `- ` line that opens the row holding `from`, or -1. */
     const rowStart = (from: number): number => {
-      const isRowStart = (index: number): boolean =>
-        /^-\s/u.test(rows[index].trimmed) || rows[index].trimmed === '-'
-      if (isRowStart(from)) return from
-      for (let j = from - 1; j >= 0; j--) {
-        if (isRowStart(j)) return j
+      const col = keyCol(from)
+      for (let j = from; j >= 0; j--) {
+        if (isDash(j) && keyCol(j) === col) return j
+        // Shallower than the row's keys: left the row without finding its marker.
+        if (rows[j].indent < col) return -1
       }
-      return 0
+      return -1
     }
     /**
      * Whether the insert row holding the `config:` at `from` declares
      * `group: true`. YAML gives a mapping's keys no order, so this reads the
-     * whole row — its own `- ` marker plus the key lines at the marker's body
-     * indentation — rather than only what happened to be written above.
+     * whole row — its own `- ` marker plus the key lines at the row's key
+     * column — rather than only what happened to be written above.
      */
     const rowDeclaresGroup = (from: number): boolean => {
       const start = rowStart(from)
+      if (start === -1) return false
       const markerIndent = rows[start].indent
+      const col = keyCol(start)
       for (let j = start; j < rows.length; j++) {
         const row = rows[j]
         if (j > start && row.indent <= markerIndent) break
-        // The row's own keys; a config body sits deeper than these.
-        if (j > start && row.indent !== markerIndent + 2) continue
+        // Only the row's own keys: a config body, or a list under another
+        // key, is not at the key column or starts with its own `- `.
+        if (j > start && (row.indent !== col || isDash(j))) continue
         if (/^\s*-?\s*group:\s*['"]?true['"]?\s*$/u.test(row.line)) return true
       }
       return false
@@ -951,14 +966,21 @@ export function parsePatchRows(text: string): { names: string[]; ids: string[];
         payloadIndent = null
         continue
       }
-      // Exactly one `config:` shape carries loader rows: a `group: true` row
-      // whose config is a LIST, because its children are entries. That is
-      // the rule userPatchPackageReferences has always applied to this same
-      // shape — a plain plugin may use a list of `{ name: … }` as ordinary
-      // options, and those must stay payload. Anything else here is payload
-      // too, so the block is skipped rather than counted.
-      if (insertIndent !== null && indent > insertIndent && /^\s*-?\s*config:\s*$/u.test(line)) {
-        if (!(rowDeclaresGroup(i) && valueIsList(i, indent))) payloadIndent = indent
+      // Exactly one block under a row carries loader rows: the `config:` of a
+      // `group: true` row whose config is a LIST, because its children are
+      // entries. That is the rule userPatchPackageReferences has always
+      // applied to this same shape — a plain plugin may use a list of
+      // `{ name: … }` as ordinary options, and those must stay payload. Any
+      // other block-valued key (`config:`, `tags:`, …) holds data too, so the
+      // block is skipped rather than counted.
+      // Inside a payload, a nested key is more payload: it must not move the
+      // payload's edge, or the payload ends early and its ids count.
+      const blockKey = /^\s*-?\s*([A-Za-z_][\w.-]*):\s*$/u.exec(line)
+      if (payloadIndent === null && insertIndent !== null && indent > insertIndent && blockKey !== null) {
+        // The key's own column, not the line's: when the key sits on a `- `
+        // line, the row's later keys share its column and are not payload.
+        const col = keyCol(i)
+        if (!(blockKey[1] === 'config' && rowDeclaresGroup(i) && valueIsList(i, col))) payloadIndent = col
         continue
       }
       const name = /^\s*-?\s*name:\s*['"]?([^'"\s]+)/.exec(line)

package/src/recovery.ts

@@ -1088,6 +1088,16 @@ export async function runRecovery(
   const servePort = options.port ?? config.port
   /** Write errors from the previous apply; they travel into the next payload. */
   let writeErrors: string[] = []
+  // A port that ANSWERS is proof the host came up, and it needs no pid to say
+  // so (#854). The helper's pid is the process IT spawned, which on Windows is
+  // the `powershell.exe` wrapper rather than the node host that binds — so the
+  // guard below cannot be trusted on its own, and a helper that gave up late
+  // handed this surface a pid that was already gone while the host was still
+  // starting. Asking the socket settles it either way.
+  if (servePort !== null && servePort !== 0 && await portListening(servePort)) {
+    note(config, `port ${String(servePort)} is already answering — the host came up after all; leaving it alone`)
+    return 'booted'
+  }
   // The replacement is not necessarily dead just because it has not bound the
   // port: on a slow host it is still starting. It gets the same grace as a
   // released port before the surface takes the port out from under it (#719).

package/src/regions.ts

@@ -211,6 +211,29 @@ export function resetGithubRoutePreferences(): void {
   preferredGithubRoutes.clear()
 }
 
+/**
+ * Put a user's own prefix in front, and keep the region's other routes (#850).
+ *
+ * Heading rather than replacing, because a public proxy dying is the whole
+ * reason the setting exists — the reporter's was one of these mirrors, and it
+ * took the rest of the chain with it: `gh-proxy.com` stopped serving on
+ * 2026-10-13, and every GitHub-sourced update then failed on a timeout rather
+ * than trying the next candidate. Replacing the list buys one attempt per
+ * mirror outage; heading it buys one, and then the chain that was already
+ * measured to work.
+ *
+ * The proxy is also dropped from the tail if it is already there, so a user
+ * who accepted the value the settings UI pre-suggests gets exactly the
+ * region's own table back rather than the same prefix twice.
+ *
+ * The direct escape is never dropped: `githubRoutes` promises every list ends
+ * in one, and dropping it would turn a dead mirror into an outage instead of
+ * a slow request.
+ */
+function withCustomProxy(proxy: string, base: GithubRoute[]): GithubRoute[] {
+  return [proxy, ...base.filter(route => route !== proxy)]
+}
+
 /**
  * The routes for a region, with environment overrides applied.
  *
@@ -234,7 +257,11 @@ export function routesFor(region: Region, env: NodeJS.ProcessEnv = process.env):
         raw: [...base.githubRoutes.raw],
         avatar: [...base.githubRoutes.avatar],
       }
-    : { git: [githubProxy, null], raw: [githubProxy, null], avatar: [githubProxy, null] }
+    : {
+        git: withCustomProxy(githubProxy, base.githubRoutes.git),
+        raw: withCustomProxy(githubProxy, base.githubRoutes.raw),
+        avatar: withCustomProxy(githubProxy, base.githubRoutes.avatar),
+      }
   return {
     npmRegistry: registry,
     githubProxy: githubProxy ?? base.githubProxy,

package/src/restart.ts

@@ -516,19 +516,39 @@ export function restartHelperSource(
     // seen from the other side. A replacement that EXITS still ends this
     // early (the `exited` break below), so a genuinely failed boot is not
     // made slower by the wider backstop.
+    '  const startedAt = Date.now()',
     '  const upBy = Date.now() + 45000 + SETTLE_MS',
+    // #854: the window is a budget for "has it come up", NOT a verdict on
+    // "is it dead". A cold start right after the market rewrote node_modules
+    // can outlast it (measured on Windows: bind at ~63s with a scanner on the
+    // fresh files), and handing the port over while the replacement is still
+    // RUNNING is what turns a slow boot into the deadlock #719 removed: the
+    // surface takes port 3080, the host reaches its own bind and dies on
+    // EADDRINUSE, and nothing can come back. So a replacement that has NOT
+    // exited keeps the port, up to a hard cap; one that has exited still ends
+    // the wait immediately, which is the failed-boot case.
+    '  const hardBy = Date.now() + 240000',
     '  let steadySince = null',
-    '  while (Date.now() < upBy) {',
+    '  let announcedWait = false',
+    '  while (true) {',
     '    if (await listening()) {',
     '      if (steadySince === null) steadySince = Date.now()',
     '      else if (Date.now() - steadySince >= SETTLE_MS) return',
     '    } else {',
     '      steadySince = null',
     '      if (exited !== null) break',
+    '      const now = Date.now()',
+    '      if (now >= hardBy) break',
+    '      if (now >= upBy && !announcedWait) {',
+    '        announcedWait = true',
+    // The numbers are computed, not typed twice: a log line that drifts from
+    // the constants it describes is worse than no line at all.
+    '        note(`the replacement is still starting after ${String(Math.round((upBy - startedAt) / 1000))}s and has not exited — waiting up to ${String(Math.round((hardBy - startedAt) / 1000))}s for it rather than taking its port (it would die on EADDRINUSE)`)',
+    '      }',
     '    }',
     '    await sleep(500)',
     '  }',
-    '  note(`the replacement never came up on port ${port}${exited === null ? "" : ` (it exited with code ${exited})`} — see the output log beside this one`)',
+    '  note(`the replacement never came up on port ${port}${exited === null ? " (it is still running, so the recovery surface waits for it to exit before binding)" : ` (it exited with code ${exited})`} — see the output log beside this one`)',
     // The host is not coming back on its own. Everything the user can still
     // do about it lives in the recovery surface, so start it while the
     // browser tab that asked for the restart is still open.