dshmarket 1.66.19 → 1.66.21

package/src/routes.ts

@@ -56,7 +56,7 @@ import { readJsonBody, refuseUnadmitted, sameOrigin, sendJson } from './http.ts'
 import { resolveDshHome } from './home-paths.ts'
 import { detectedDebugger, detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest, type RecoveryHandoffConfig, restartReachableFrom } from './restart.ts'
 import type { RecoveryPlugin } from './recovery.ts'
-import { activationAfterReplace, brokenClientBundles, bundlePatchIsEmpty, checkClientBundle, defaultHostRuntimeFacts, hasHostHalf, hostPeerGate, newlyBrokenBundles, peerGateRemedy, verifyActivation } from './verify.ts'
+import { activationAfterReplace, brokenClientBundles, bundlePatchIsEmpty, checkClientBundle, defaultHostRuntimeFacts, findUnservedConfigNamespaces, hasHostHalf, hostPeerGate, newlyBrokenBundles, peerGateRemedy, verifyActivation } from './verify.ts'
 import {
   carrierDisableIds, disableRow, enableRow, findUserPatchPath, foreignRowIds, isProtectedModule, packagePatchFlags,
   readUserPatchState, removeRowBlocks, rowIdsForPackage, userPatchPackageReferences,
@@ -701,6 +701,16 @@ export function mountMarketRoutes(
    * newer decision than the market's list (the market removes a name from
    * its list BEFORE writing its own enable row), so the list follows it.
    *
+   * Scoped to THIS profile's layer, deliberately (#519). DSH also composes a
+   * home-level layer, and a third-party manager that wrote its switches there
+   * asked us to follow that too. We do not: the market writes the profile
+   * layer and nothing else, so following a layer it cannot write would give
+   * the user a switch that appears to work and silently reverts at the next
+   * boot — worse than a boundary they can see. What a home-level decision
+   * DOES get is a name in the log when the market overrides it (see
+   * `noteHomeLayerConflict`), so nobody has to guess why a plugin came back
+   * off.
+   *
    * @returns true when the package was re-enabled elsewhere and has been
    *   dropped from the market's disable list.
    */
@@ -714,6 +724,27 @@ export function mountMarketRoutes(
     return true
   }
 
+  /**
+   * Say so when the market overrides an enable recorded in the HOME patch
+   * layer (#519).
+   *
+   * The market keeps a plugin off from its own record; a decision in the
+   * profile layer is followed instead (`followOutsideEnable`), but the home
+   * layer is not read for it — see there for why. The cost of that boundary
+   * is a plugin that turns off again on every boot while another manager's
+   * layer says it should be on: a perfectly reasonable thing for a user to be
+   * confused by, and its only explanation today was silence.
+   */
+  function noteHomeLayerConflict(name: string): void {
+    const homePatchPath = join(resolveDshHome(), 'cordis.patch.yml')
+    const home = readUserPatchState(homePatchPath)
+    if (home.forced.length === 0) return
+    const flags = packagePatchFlags(host, activeProfileDir, [name], home)
+    if (!flags.forced.includes(name) || flags.disabled.includes(name)) return
+    logEvent('warn', 'toggle',
+      `${name}: kept off by this market's own record, while ${homePatchPath} enables it — that layer is not the one the market writes, so the market will not follow it. Move the row into this profile's cordis.patch.yml to make it stick (#519)`)
+  }
+
   // Client-only packages (dsh.client without dsh.bundle) are invisible to the
   // bundle layer in every boot; the market shim-mounts them so their client
   // bundles are actually served.
@@ -725,6 +756,7 @@ export function mountMarketRoutes(
     // shims for disabled plugins were already skipped by mountClientOnlyDeps.
     for (const name of [...disabled]) {
       if (followOutsideEnable(name)) continue
+      noteHomeLayerConflict(name)
       if (await themes.setEntryDisabled(name, true)) logEvent('info', 'boot', `plugin kept off: ${name}`)
     }
   })
@@ -2656,6 +2688,37 @@ export function mountMarketRoutes(
           packageName,
           manifest,
         })))
+        // #810: a client that reads its config from a name no loader entry
+        // answers to reads NOTHING — blank or unwritable settings, and in the
+        // reported case a panel stuck on a hardcoded fallback port — with no
+        // error anywhere. Judged against everything this profile can be seen
+        // to serve: each installed package's own patch rows (read once, for
+        // the set AND for the "write this instead" value), the user patch's
+        // rows — its inserts, plus the disables and force-enables, which both
+        // name existing entry ids — and whatever the loader is running now.
+        //
+        // The gap: host-layer ids the market never reads a patch for. A plugin
+        // reading a HOST entry's config by literal would be flagged wrongly
+        // here, where the diagnostics page — which composes the host layers
+        // too — can settle that difference.
+        const ownEntryIds = new Map(Object.keys(installed).map(
+          packageName => [packageName, bundlePatchInsertedIds(join(activeProfileDir, 'node_modules', packageName))] as const,
+        ))
+        const servedEntryIds = new Set<string>([...patch.inserts, ...patch.disables, ...patch.forced])
+        for (const ids of ownEntryIds.values()) for (const id of ids) servedEntryIds.add(id)
+        for (const entry of host.loader.entries()) {
+          const id = entry.options?.id
+          if (id === undefined || id === '') continue
+          servedEntryIds.add(id)
+          const bare = id.split(':').pop()
+          if (bare !== undefined) servedEntryIds.add(bare)
+        }
+        const configNamespaces = findUnservedConfigNamespaces(
+          activeProfileDir,
+          servedEntryIds,
+          name => ownEntryIds.get(name) ?? [],
+          activeProfileDir,
+        )
         sendJson(response, 200, {
           profile: config.profile,
           installed,
@@ -2683,6 +2746,9 @@ export function mountMarketRoutes(
           brokenPlugins: marketState.brokenPlugins ?? {},
           patchForced: patchFlags.forced,
           bundles: readProfileBundles(activeProfileDir).filter(name => !INBOX_BUNDLES.has(name)),
+          // Only packages with a finding appear, so a healthy profile sends
+          // nothing and the row renders nothing.
+          configNamespaces: configNamespaces.length > 0 ? configNamespaces : undefined,
         })
       },
     }),
@@ -2708,7 +2774,25 @@ export function mountMarketRoutes(
               ? classifyPeer(row.plugin, row.name, row.range, row.resolved, row.optional === true)
               : { kind: 'none' }
           }
-          sendJson(response, 200, report)
+          // #810: a client that reads its config from a name no loader entry
+          // answers to. Attached here rather than computed inside
+          // `analyzeProfile` because that function is documented as safe on
+          // every market open and this reads one bundle per installed plugin —
+          // the diagnostics page is a page the user opened on purpose.
+          //
+          // Judged against the COMPOSITION's ids, not the package's own: a
+          // package may mount another one (carrier form), and judging by own
+          // ids would flag it.
+          const served = new Set(report.rows.map(row => row.id))
+          sendJson(response, 200, {
+            ...report,
+            configNamespaces: findUnservedConfigNamespaces(
+              activeProfileDir,
+              served,
+              name => report.rows.filter(row => row.layer === name).map(row => row.id),
+              activeProfileDir,
+            ),
+          })
         } catch (error) {
           sendJson(response, 500, { error: error instanceof Error ? error.message : String(error) })
         }

package/src/themes.ts

@@ -5,6 +5,7 @@
  * persisted across restarts.
  */
 
+import { readFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { loadRegistry, pluginCategories } from './registry.ts'
 import { hotMount, hotUnmount, listHotMounts, writeDisabled } from './hot.ts'
@@ -12,7 +13,7 @@ import { logEvent } from './log.ts'
 import { LifecyclePendingError, LifecycleWaitError, waitForLifecycle } from './lifecycle.ts'
 import { nameMatchesPackage } from './entry-identity.ts'
 import { bundlePatchInsertedIds, profileDir, readInstalled } from './profile.ts'
-import { repoOf } from './sources.ts'
+import { parseSourceUrl, repoOfTarget } from './sources.ts'
 
 /** The slice of a cordis loader entry the market needs for live enable/disable. */
 export interface LoaderEntry {
@@ -34,6 +35,29 @@ export interface ThemeManager {
   activateTheme(name: string): Promise<boolean>
 }
 
+/**
+ * Whether an installed package declares itself a skin.
+ *
+ * The market's own criterion for "this is a theme" is the catalog, and the
+ * catalog does not list every skin a monorepo ships: the reporter's second
+ * skin is absent from it entirely, while the MANAGER that ships with them is
+ * a package from the same repo. Judging by repo alone made the manager a
+ * theme, so activating any other theme switched it off — and with it the
+ * user's own skin-management UI (#519). Both skins ship `skin.json` at their
+ * root (it names the package and its wiring); the manager ships none, which
+ * is the distinction the reporter pointed at.
+ */
+function hasSkinManifest(profileDirectory: string, name: string): boolean {
+  try {
+    const manifest = JSON.parse(
+      readFileSync(join(profileDirectory, 'node_modules', name, 'skin.json'), 'utf8'),
+    ) as { id?: unknown }
+    return typeof manifest.id === 'string' && manifest.id !== ''
+  } catch {
+    return false
+  }
+}
+
 /**
  * Whether a loader entry belongs to `packageName`.
  *
@@ -83,16 +107,41 @@ export function createThemeManager(
       const registry = await loadRegistry()
       const themeEntries = registry.plugins.filter(p => pluginCategories(p).includes('theme'))
       const themeNames = new Set(themeEntries.map(p => p.name))
-      const themeRepos = new Set(
-        themeEntries.map(p => repoOf(p.url)).filter((r): r is string => r !== null).map(r => r.toLowerCase()),
-      )
+      // Repo → the subdirectories its catalog entries point at, plus whether
+      // any entry is the repo itself. One repository can ship several PACKAGES
+      // — a skin manager and its skins — and matching by repo alone made every
+      // one of them a theme, so activating another theme switched the manager
+      // off too, taking the user's own management UI with it (#519).
+      const themeRepos = new Map<string, { root: boolean; subpaths: Set<string> }>()
+      for (const entry of themeEntries) {
+        const parsed = parseSourceUrl(entry.url)
+        if (parsed === null) continue
+        const key = parsed.repo.toLowerCase()
+        const record = themeRepos.get(key) ?? { root: false, subpaths: new Set<string>() }
+        if (parsed.subpath === null) record.root = true
+        else record.subpaths.add(parsed.subpath.toLowerCase())
+        themeRepos.set(key, record)
+      }
       for (const [name, spec] of Object.entries(readInstalled(profile, activeProfileDir))) {
         if (themeNames.has(name)) {
           names.add(name)
           continue
         }
-        const match = /github:([^#\s]+)/.exec(String(spec).toLowerCase())
-        if (match !== null && themeRepos.has(match[1])) names.add(name)
+        const identity = repoOfTarget(String(spec).toLowerCase())
+        if (identity === null) continue
+        const at = identity.indexOf('#path:/')
+        const repo = at === -1 ? identity : identity.slice(0, at)
+        const subpath = at === -1 ? null : identity.slice(at + '#path:/'.length)
+        const record = themeRepos.get(repo)
+        if (record === undefined) continue
+        // Only a repo whose themes ALL live in subdirectories can be told
+        // apart this way. A catalog entry at the repo root says nothing about
+        // subdirectories, so that shape keeps the permissive match it had —
+        // which is also what keeps a monorepo skin working when the entry
+        // points at the repo.
+        if (subpath !== null && !record.root && record.subpaths.size > 0
+          && !record.subpaths.has(subpath) && !hasSkinManifest(activeProfileDir, name)) continue
+        names.add(name)
       }
     } catch { /* registry unavailable — nothing classifies as a theme */ }
     return names

package/src/verify.ts

@@ -615,6 +615,129 @@ export interface BundleCheck {
   reason: string | null
 }
 
+/**
+ * One assignment of a string literal to a name, and the `configForms.get`
+ * call sites (#810).
+ *
+ * The namespace a client asks its config from is a PROFILE ENTRY ID, not a
+ * package name. A client that writes the package name reads nothing: the
+ * settings document has no entry under it, the call returns empty, and the
+ * plugin degrades silently — blank or unwritable settings forms, and in the
+ * reported case a panel stuck on a hardcoded fallback port. Nothing logs it,
+ * and nothing on the market side noticed.
+ *
+ * `configForms.get` is matched by name, so an aliased receiver
+ * (`const forms = ctx.configForms; forms.get("x")`) is not seen — the same
+ * honesty as the syntax check above: this reports what it can prove, and
+ * says nothing otherwise.
+ */
+const STRING_ASSIGNMENT = /(?:^|[^\w$.])(?:var|let|const)?\s*([A-Za-z_$][\w$]*)\s*=\s*(['"])([^'"\\\n]*)\2/gu
+const CONFIG_FORMS_GET = /configForms\s*\.\s*get\s*\(\s*(?:([A-Za-z_$][\w$]*)|(['"])([^'"\\\n]*)\2)\s*\)/gu
+
+/** A value that is a plain loader entry id: a backslash means it is not one. */
+function plainNamespace(value: string): string | null {
+  return value !== '' && value.length <= 200 && !value.includes('\\') && /^[\w@/.:-]+$/u.test(value) ? value : null
+}
+
+/**
+ * Every namespace a client bundle asks its config from (#810).
+ *
+ * One level of constant propagation, as asked for in the report: the plugin
+ * that started this writes `var NAMESPACE = "dsh-comfyui-canvas"` and calls
+ * `configForms.get(NAMESPACE)`, so a literal-only scan would miss the very
+ * case the check exists for. A name assigned twice is dropped rather than
+ * guessed at — which value it holds at the call site is not decidable from
+ * text alone, and a wrong guess here would be reported as a plugin defect.
+ */
+export function configFormNamespaces(source: string): string[] {
+  // Measured on a 750KB bundle: these scans cost ~9ms, because both walk
+  // every character, and this runs on a request the market polls. Almost no
+  // client mentions configForms at all, and — an order of magnitude rarer —
+  // almost none of those calls a method on it: for both, this pair of plain
+  // substring searches IS the whole cost (0.23ms measured), and only a client
+  // that actually asks for a config pays for a scan.
+  if (!source.includes('configForms') || !source.includes('configForms.get')) return []
+  const constants = new Map<string, string | null>()
+  for (const match of source.matchAll(STRING_ASSIGNMENT)) {
+    const name = match[1]!
+    const value = plainNamespace(match[3]!)
+    constants.set(name, constants.has(name) || value === null ? null : value)
+  }
+  const namespaces = new Set<string>()
+  for (const match of source.matchAll(CONFIG_FORMS_GET)) {
+    // A namespace is a loader entry id: no escapes, no whitespace runs, no
+    // arbitrary length. Anything else is not this pattern and stays out.
+    const value = plainNamespace(match[3] ?? '') ?? constants.get(match[1]!) ?? null
+    if (value !== null) namespaces.add(value)
+  }
+  return [...namespaces]
+}
+
+/** A package whose client asks for a namespace nothing in the composition serves (#810). */
+export interface UnservedConfigNamespace {
+  /** The installed package whose client bundle asks. */
+  name: string
+  /** The namespaces it asks for that no loader entry id answers to. */
+  namespaces: string[]
+  /** Entry ids this package's own patch declares — the value it meant. */
+  ownEntryIds: string[]
+}
+
+/** The client bundle of an installed package, read; null when it has none to read. */
+function readClientBundle(profile: string, name: string, explicitDir?: string): string | null {
+  const root = join(profileDir(profile, explicitDir), 'node_modules', name)
+  let manifest: { dsh?: { client?: unknown }; exports?: unknown }
+  try {
+    manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')) as typeof manifest
+  } catch {
+    return null
+  }
+  if (manifest.dsh?.client === undefined) return null
+  const exportsField = manifest.exports
+  const relative = exportsField !== null && typeof exportsField === 'object' && !Array.isArray(exportsField)
+    ? clientBundlePath((exportsField as Record<string, unknown>)['./client'])
+    : null
+  if (relative === null) return null
+  try {
+    return readFileSync(join(root, relative), 'utf8')
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Installed plugins whose client reads its config from a name nothing serves
+ * (#810).
+ *
+ * `served` is the entry id set of the WHOLE composition — deliberately not
+ * this package's own ids: a package may legitimately mount another one
+ * (carrier form), and judging by own ids alone would flag those. `ownIdsOf`
+ * answers what the package itself declares, which is the value to write
+ * instead — the report asked for the correct spelling to be shown, not just
+ * the mistake.
+ *
+ * The scan reads one bundle per installed plugin. Measured against the same
+ * cost the syntax sweep above already pays (0.40ms per plugin on a 385KB
+ * bundle), so a 30-plugin profile is ~12ms — this runs on a request a user
+ * made, not in a loop.
+ */
+export function findUnservedConfigNamespaces(
+  profile: string,
+  served: ReadonlySet<string>,
+  ownIdsOf: (name: string) => string[],
+  explicitDir?: string,
+): UnservedConfigNamespace[] {
+  const found: UnservedConfigNamespace[] = []
+  for (const name of Object.keys(readInstalled(profile, explicitDir))) {
+    const source = readClientBundle(profile, name, explicitDir)
+    if (source === null) continue
+    const unserved = configFormNamespaces(source).filter(namespace => !served.has(namespace))
+    if (unserved.length === 0) continue
+    found.push({ name, namespaces: unserved, ownEntryIds: ownIdsOf(name) })
+  }
+  return found
+}
+
 /**
  * Whether a package's client bundle still parses as JavaScript (#222).
  *
@@ -686,30 +809,14 @@ export function newlyBrokenBundles(
 }
 
 export function checkClientBundle(profile: string, name: string, explicitDir?: string): BundleCheck {
-  const root = join(profileDir(profile, explicitDir), 'node_modules', name)
-  let manifest: { dsh?: { client?: unknown }; exports?: unknown }
-  try {
-    manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')) as typeof manifest
-  } catch {
-    return { ok: true, reason: null }
-  }
-  if (manifest.dsh?.client === undefined) return { ok: true, reason: null }
-  const exportsField = manifest.exports
-  const relative = exportsField !== null && typeof exportsField === 'object' && !Array.isArray(exportsField)
-    ? clientBundlePath((exportsField as Record<string, unknown>)['./client'])
-    : null
-  if (relative === null) return { ok: true, reason: null }
-  let source: string
-  try {
-    source = readFileSync(join(root, relative), 'utf8')
-  } catch {
-    // Declared but absent is verifyActivation's territory (a missing entry
-    // artifact is already `broken` there); duplicating it here would report
-    // one problem twice in two different vocabularies.
-    return { ok: true, reason: null }
-  }
+  // Declared but absent is verifyActivation's territory (a missing entry
+  // artifact is already `broken` there); duplicating it here would report one
+  // problem twice in two different vocabularies — so the reader's null covers
+  // both "no client bundle" and "declared but unreadable" with the same ok.
+  const source = readClientBundle(profile, name, explicitDir)
+  if (source === null) return { ok: true, reason: null }
   try {
-    new Script(source, { filename: relative })
+    new Script(source, { filename: `${name}/client` })
     return { ok: true, reason: null }
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error)