dshmarket 1.66.2 → 1.66.4

package/lib/changelog.js

@@ -21,7 +21,7 @@ import { fileFromTarball } from './catalog-npm.js';
 import { marketFetch } from './net.js';
 import { activeRegion, routesFor } from './regions.js';
 import { profileDir, readInstalled, readInstalledRepoEvidence, readLockCommits } from './profile.js';
-import { lookupRepoFromUrl, repoOf, repoOfTarget } from './sources.js';
+import { lookupRepoFromUrl, parseSourceUrl, repoOf, repoOfTarget } from './sources.js';
 import { checkUpdates } from './updates.js';
 import { loadRegistry } from './registry.js';
 const UPDATES_PACKAGE = 'dsh-plugin-updates';
@@ -170,6 +170,55 @@ export async function npmPublishTimes(name) {
     timesCache.set(name, { at: Date.now(), data });
     return data;
 }
+/** A probe entry the dialog can actually render — an empty object is a miss. */
+function usableNotes(entry) {
+    if (entry === undefined)
+        return false;
+    if (entry.release != null && (entry.release.body !== '' || entry.release.tag !== null))
+        return true;
+    return (entry.commits?.length ?? 0) > 0;
+}
+/**
+ * The catalog row for an npm install.
+ *
+ * The profile dependency key is the npm package name. The catalog `name`
+ * often is not: a monorepo entry is `repo#subpath`, and a scoped package's
+ * catalog name drops the scope (#746). `npm` is the identity the install
+ * used, so it wins; a bare `name` match remains for entries that publish
+ * under their catalog name. Several hits are disambiguated by the installed
+ * repository, and an ambiguous set is left unresolved (#598).
+ */
+function catalogEntryForNpmInstall(plugins, name, evidence) {
+    const byNpm = plugins.filter(p => p.npm === name);
+    const candidates = byNpm.length > 0 ? byNpm : plugins.filter(p => p.name === name);
+    if (candidates.length <= 1)
+        return candidates[0];
+    const identities = evidence().identities;
+    const matches = candidates.filter(p => identities.some(id => repoOf(p.url)?.toLowerCase() === id.split('#')[0].toLowerCase()));
+    return matches.length === 1 ? matches[0] : undefined;
+}
+/**
+ * The catalog row for a `github:…#path:` install.
+ *
+ * `repoKeyOf` keeps only the repository root, while a monorepo entry's notes
+ * are stored under its `/tree/<ref>/<subpath>` url (#746). The spec's subpath
+ * selects the row. Two rows with one subpath are not guessed between.
+ */
+function catalogEntryForGitSubpath(plugins, spec) {
+    const identity = repoOfTarget(spec);
+    const marker = identity?.indexOf('#path:/') ?? -1;
+    if (identity === null || marker === -1)
+        return undefined;
+    const repo = identity.slice(0, marker);
+    const subpath = identity.slice(marker + '#path:/'.length);
+    const matches = plugins.filter(p => {
+        const source = parseSourceUrl(p.url);
+        return source?.subpath != null
+            && source.repo.toLowerCase() === repo
+            && source.subpath.toLowerCase() === subpath;
+    });
+    return matches.length === 1 ? matches[0] : undefined;
+}
 /**
  * Resolve the notes for one installed plugin, or `{ kind: 'none' }`.
  *
@@ -185,52 +234,46 @@ export async function updateNotesFor(profile, explicitDir, name) {
     }
     try {
         const payload = await loadUpdateNotes();
-        let key = repoKeyOf(spec);
-        // If the spec is a Release asset URL (catalog format), try to extract
-        // the repo from the URL directly. This handles npm-installed plugins
-        // whose profile spec is the npm name but the catalog entry uses a
-        // Release asset tarball URL.
-        if (key === null) {
-            key = lookupRepoFromUrl(spec);
-        }
-        // If the spec is an npm package name (not a GitHub URL), look up the
-        // catalog to find the corresponding GitHub repo URL.
-        if (key === null) {
+        // A Release-asset spec carries the repo in the URL itself. An npm
+        // version range carries nothing, so `specKey` stays null and the catalog
+        // lookup below is what finds the repository.
+        const specKey = repoKeyOf(spec) ?? lookupRepoFromUrl(spec);
+        let key = specKey;
+        let entry = key === null ? undefined : entryForRepo(payload, key);
+        // The catalog is how an npm install, or a `#path:` install whose notes
+        // live under a /tree/ url, finds a key the spec itself does not name.
+        // A root github spec already is that key. Loading the catalog on a root
+        // miss would wait out its timeout to answer "no notes".
+        const needsCatalog = specKey === null || (repoOfTarget(spec)?.includes('#path:/') ?? false);
+        if (!usableNotes(entry) && needsCatalog) {
             try {
                 const registry = await loadRegistry();
-                const candidates = registry.plugins.filter(p => p.name === name);
-                let plugin;
-                if (candidates.length === 1) {
-                    plugin = candidates[0];
-                }
-                else if (candidates.length > 1) {
-                    // Same-named packages exist in the catalog; a bare name match can
-                    // pick someone else's repo and answer "no notes" for a plugin that
-                    // ships updates data under its own repository (#598). The installed
-                    // package declares its repository, so prefer the catalog entry that
-                    // agrees with it; only a unique agreement is trusted — an ambiguous
-                    // name falls through to npm publish times, which are honest for any
-                    // installed npm package.
-                    const evidence = readInstalledRepoEvidence(profile, name, spec, explicitDir);
-                    const matches = candidates.filter(p => evidence.identities.some(id => repoOf(p.url)?.toLowerCase() === id.split('#')[0].toLowerCase()));
-                    if (matches.length === 1)
-                        plugin = matches[0];
-                }
+                const plugin = specKey === null
+                    ? catalogEntryForNpmInstall(registry.plugins, name, () => readInstalledRepoEvidence(profile, name, spec, explicitDir))
+                    : catalogEntryForGitSubpath(registry.plugins, spec);
                 if (plugin !== undefined) {
-                    key = plugin.url;
+                    const catalogEntry = entryForRepo(payload, plugin.url);
+                    // An empty row does not become the key. Publish times for an npm
+                    // install follow from `specKey` staying null, and a subpath install
+                    // keeps the root key so the miss stays `none`.
+                    if (usableNotes(catalogEntry)) {
+                        key = plugin.url;
+                        entry = catalogEntry;
+                    }
                 }
             }
             catch {
-                // Catalog unavailable; fall through to npm times.
+                // Catalog unavailable; the tiers below still answer.
             }
         }
-        const entry = key === null ? undefined : entryForRepo(payload, key);
         // Both tiers below need the installed sha for github-kind installs.
         // For Release asset URLs and catalog lookups, checkUpdates doesn't
         // recognize the spec, so we read the lockfile directly using the repo key.
+        // `repoOf` drops a `/tree/<ref>/<subpath>` suffix; slicing the url at `#`
+        // would look the commit up under `owner/repo/tree/...` and miss it.
         let current = null;
         if (key !== null && key.startsWith('https://github.com/')) {
-            const repo = key.slice('https://github.com/'.length).split('#')[0].toLowerCase();
+            const repo = (repoOf(key) ?? key.slice('https://github.com/'.length).split('#')[0]).toLowerCase();
             current = readLockCommits(profile, activeProfileDir).get(`github.com/${repo}`) ?? null;
         }
         else {
@@ -243,8 +286,9 @@ export async function updateNotesFor(profile, explicitDir, name) {
         if (entry?.commits !== undefined && entry.commits.length > 0) {
             return { kind: 'commits', commits: sliceCommitsAt(entry.commits, current) };
         }
-        if (key === null) {
-            // Not a github-sourced plugin at all: npm times are the only tier left.
+        if (specKey === null) {
+            // The install spec did not name a repository. Publish times remain
+            // when the catalog row is missing or its probe has no notes.
             return { kind: 'npm', npmTimes: await npmPublishTimes(name) };
         }
         // A github plugin whose repo answered nothing — releases 404 AND the log

package/lib/check.js

@@ -1008,7 +1008,21 @@ export function analyzeProfile(profileDirectory, options = {}) {
             if (seenDeps.has(key))
                 continue;
             seenDeps.add(key);
-            const hoisted = readProfileVisibleVersion(profileDirectory, name);
+            // A HOST-PLANE peer never takes its version from the shared workspace
+            // root: `<profiles>/node_modules` is shared by every profile, and on a
+            // machine that also runs a second DSH installation — a global npm CLI
+            // beside the Desktop app — that tree is the OTHER installation's
+            // closure. Reading a host version from it reported a healthy install as
+            // "introduced host-compatibility risks … vs 0.1.5-rc.2" and offered a
+            // rollback, while the running host was 0.1.7-rc.2 (#726). What the
+            // plugin itself resolves still counts (a nested copy, a profile-local
+            // one), and the located installation is asked as `host` below; with
+            // neither, the version is unknown rather than wrong — the rule #676
+            // settled for bundles. Non-host peers keep the hoisted fallback.
+            const hostPlane = name.startsWith('@deepseek-ai/');
+            const hoisted = hostPlane
+                ? readNodeModulesVersion(profileDirectory, name)
+                : readProfileVisibleVersion(profileDirectory, name);
             const nested = readNodeModulesVersion(pluginDir, name);
             const host = dshInstall !== null ? readNodeModulesVersion(dshInstall, name) : null;
             // Node resolves a plugin's peer from its OWN node_modules first

package/lib/index.js

@@ -158,12 +158,26 @@ export function apply(ctx, config) {
             // every install (#702). A third-party shell announces itself through
             // `desktopProfiles`, and this whole block runs only when that service
             // is absent, so this never takes a third-party shell's profile.
+            const configured = config?.profile;
+            const configuredDesktop = configured !== undefined && configured.toLowerCase() === 'desktop';
             const officialElectron = launched !== undefined && launched.name.toLowerCase() === 'desktop';
-            if (officialElectron && config?.profile === undefined) {
-                const runtime = createOfficialDesktopRuntime(() => hostCtx.get('pluginManager'), launched.name, launched.dir);
+            // An explicitly configured `profile: desktop` takes this branch too. The
+            // CLI refuses that profile by NAME, so routing it there — which is what
+            // an operator's own workaround for a host that hides `profileContext`
+            // does (#744) — makes every install fail for certain. The configuration
+            // still wins over the launcher for the name; it just cannot win a branch
+            // that is guaranteed to fail.
+            if (configuredDesktop || (configured === undefined && officialElectron)) {
+                const profileName = configured ?? launched.name;
+                // The launcher owns where a profile lives — and its directory rides
+                // along only when the launcher is the one that named this profile.
+                const profileDirectory = launched !== undefined && launched.name.toLowerCase() === profileName.toLowerCase()
+                    ? launched.dir
+                    : undefined;
+                const runtime = createOfficialDesktopRuntime(() => hostCtx.get('pluginManager'), profileName, profileDirectory);
                 const resolved = {
-                    profile: launched.name,
-                    profileDirectory: launched.dir,
+                    profile: profileName,
+                    ...(profileDirectory === undefined ? {} : { profileDirectory }),
                     desktopHost: true,
                     allowRestart: false,
                     maxSnapshots: config?.maxSnapshots,

package/lib/install.js

@@ -8,7 +8,7 @@ import { closeSync, existsSync, lstatSync, openSync, readlinkSync, readSync, rmS
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { findDshInstallDir } from './dsh-install.js';
 import { classifyPnpmFailure, HOST_NAMESPACE_RE } from './pnpm-compat.js';
-import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, normalizeReleaseAgeExcludes, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.js';
+import { conflictingEntryIds, dropFromManifest, hasDshManifest, hasLoadableEntry, mergeDuplicateReleaseAgeExcludes, pluginSubdirs, profileDir, readInstalled, readManifestDeps, readProfileBundles, dropUnparseableBuildKeys } from './profile.js';
 import { logEvent } from './log.js';
 import { cleanOrphanedStore } from './store.js';
 /**
@@ -119,18 +119,16 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
     const marketFlags = options.marketFlags !== false;
     /** The option a recovery step needed and this host does not accept (#732). */
     let unavailableOption = null;
-    // Before the FIRST run, not after a failure: the two shapes pnpm writes into
-    // `minimumReleaseAgeExclude` (a shadowed duplicate rule, #732; a version
-    // union, #733) hurt pnpm while it RESOLVES the dependency graph, and the
-    // union one aborts the process on an 80 GiB allocation with no error output
-    // at all — nothing to classify, so a repair that waited for a failure would
-    // never fire. Every verb that resolves the graph is covered, not just add and
-    // remove: an `install` or an in-place `update` consults the same key.
+    // Before the FIRST run, not after a failure: the shadowed duplicate rule
+    // (#732) hurts pnpm while it RESOLVES the dependency graph, so merging it
+    // first is what keeps the command from failing at all — and it costs one
+    // small file read. Every verb that resolves the graph is covered, not just
+    // add and remove: an `install` or an in-place `update` reads the same key.
     const verb = pluginArgs.find(argument => !argument.startsWith('-'));
     if (verb === 'add' || verb === 'remove' || verb === 'install' || verb === 'update') {
-        const normalized = normalizeReleaseAgeExcludes(profile, profileDirectory);
-        if (normalized.length > 0) {
-            logEvent('warn', 'install', `minimumReleaseAgeExclude held a form pnpm cannot read back for ${normalized.join(', ')} (a shadowed duplicate rule, #732, or a version union, which pnpm 12.4.1 aborts on — #733) — rewrote each as one bare package name before running`);
+        const merged = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory);
+        if (merged.length > 0) {
+            logEvent('warn', 'install', `minimumReleaseAgeExclude held several rules for ${merged.join(', ')}, and pnpm honours only the FIRST per name (#732) — merged each package's rules into one, before running`);
         }
     }
     let result = await run(profile, pluginArgs);
@@ -169,9 +167,9 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             // (#732) or extending a version union (#733). Either way the same
             // rewrite fixes it, needs no option at all, and so also works on the
             // desktop bridge that refuses options. Retry the SAME argv afterwards.
-            const normalized = normalizeReleaseAgeExcludes(profile, profileDirectory);
-            if (normalized.length > 0) {
-                logEvent('warn', 'install', `pnpm wrote a minimumReleaseAgeExclude entry it cannot read back for ${normalized.join(', ')} (#732/#733) — rewrote each as one bare package name and retrying once`);
+            const mergedNow = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory);
+            if (mergedNow.length > 0) {
+                logEvent('warn', 'install', `pnpm appended a second minimumReleaseAgeExclude rule for ${mergedNow.join(', ')} and honours only the first, shadowing its own entry (#732) — merged them into one and retrying once`);
                 result = await run(profile, pluginArgs);
             }
             else if (options.releaseAgeBypass === false) {

package/lib/net.js

@@ -9,24 +9,35 @@
  * took 9.9s direct on a reporter's machine, seconds from the 15s timeout,
  * while their proxy sat unused a millisecond away.
  *
- * `setGlobalDispatcher` from the `undici` PACKAGE cannot fix this, because
- * `globalThis.fetch` runs on Node's INTERNAL copy of undici — a different
- * instance. Verified: with a dispatcher installed, a global fetch still
- * produced no CONNECT at a local proxy, while undici's own fetch produced
- * `CONNECT awesome-dsh-plugin.com:443`.
+ * Every market request therefore calls undici's own fetch and carries a
+ * dispatcher this module created. Two measurements say why, and they are
+ * not the same fact:
  *
- * So the market calls undici's fetch with an explicit dispatcher. The scope
- * is deliberate: only requests made by this module change, and the host's
- * own networking is left exactly as the host configured it.
+ * - On Node 25, `setGlobalDispatcher` from the undici package does not
+ *   steer global fetch. With a dispatcher installed that way, a global
+ *   fetch produced no CONNECT at a local proxy, while undici's own fetch
+ *   produced `CONNECT awesome-dsh-plugin.com:443`.
+ * - On Node 22 the two stacks share one symbol (#742). Global fetch reads
+ *   `Symbol.for('undici.globalDispatcher.1')`. The host's first import of
+ *   undici 8 (`web_fetch`) finds `.2` empty, installs its dispatcher, and
+ *   writes a `Dispatcher1Wrapper` onto `.1`. After that, global fetch
+ *   returns gzip bodies with null headers, and `JSON.parse` fails on the
+ *   catalog. undici 7's fetch reads `.1` too, so calling it with no
+ *   dispatcher fails the same way.
+ *
+ * The dispatcher is `EnvHttpProxyAgent` when a proxy is configured, and a
+ * plain `Agent` otherwise. Only requests made here take it. The host's own
+ * networking stays as the host configured it.
  */
-import { EnvHttpProxyAgent, fetch as undiciFetch } from 'undici';
+import { Agent, EnvHttpProxyAgent, fetch as undiciFetch } from 'undici';
 /**
  * The proxy this process would use for the catalog, if any.
  *
  * The standard variables mirror `EnvHttpProxyAgent`'s own resolution
  * deliberately, rather than picking the order that reads best, because the
- * same answer does two jobs: it decides whether to route through undici at
- * all, and it is what the failure message CLAIMS was tried. A helper that
+ * same answer does two jobs: it decides whether the request goes through
+ * the proxy agent or the direct one, and it is what the failure message
+ * CLAIMS was tried. A helper that
  * named a proxy undici would not have used would put a false statement in
  * every bug report. `npm_config_*` is an additional source on top of that:
  * npm holds its proxy in its own config namespace (a machine set up with
@@ -70,29 +81,30 @@ function proxyFromEnv() {
     return { http, https };
 }
 /**
- * Built once and reused: an agent per request would drop connection reuse,
- * and this one reads NO_PROXY as well, so a host that excludes its own
+ * Built once and reused: an agent per request would drop connection reuse.
+ * The proxy agent also reads NO_PROXY, so a host that excludes its own
  * registry mirror keeps being excluded.
  */
-let agent = null;
+let proxyAgent = null;
+let directAgent = null;
 /**
- * Fetch through the proxy this machine is configured to use.
- *
- * Falls back to the global fetch when no proxy is set, which keeps the
- * ordinary case on the runtime's own path rather than routing it through a
- * second HTTP stack for no reason.
+ * Fetch through the proxy this machine is configured to use, or directly
+ * through this module's own agent when it has none. Both paths pass the
+ * dispatcher described on this module.
  */
 export async function marketFetch(url, init) {
     const { http, https } = proxyFromEnv();
-    if (http === null && https === null)
-        return await fetch(url, init);
+    if (http === null && https === null) {
+        directAgent ??= new Agent();
+        return await undiciFetch(url, { ...init, dispatcher: directAgent });
+    }
     // Pass the resolved proxies explicitly. EnvHttpProxyAgent itself reads
     // only http(s)_proxy out of the environment, so a proxy that lives in
     // npm_config_* must be handed over directly — otherwise the agent would
     // silently go direct while configuredProxy() claims a proxy was used.
-    agent ??= new EnvHttpProxyAgent({
+    proxyAgent ??= new EnvHttpProxyAgent({
         httpProxy: http ?? undefined,
         httpsProxy: https ?? undefined,
     });
-    return await undiciFetch(url, { ...init, dispatcher: agent });
+    return await undiciFetch(url, { ...init, dispatcher: proxyAgent });
 }

package/lib/official-desktop.js

@@ -20,7 +20,11 @@ function detail(error) {
     return JSON.stringify(error);
 }
 /** Never fall back to `dsh plugin --profile desktop`: that CLI is forbidden. */
-export function createOfficialDesktopRuntime(managerLookup, profileName, _profileDirectory) {
+export function createOfficialDesktopRuntime(managerLookup, profileName, 
+// Unused by the manager bridge — it takes the profile by NAME — and optional
+// because an explicitly configured `profile: desktop` may be the only thing
+// that names this profile, with no launcher directory to go with it (#744).
+_profileDirectory) {
     let disposed = false;
     let active;
     const runPlugin = (profile, argv) => {

package/lib/pnpm-compat.js

@@ -270,6 +270,34 @@ export function classifyPnpmFailure(output, exitCode) {
             message: `profile 里的一个 pnpm 补丁打不上了${which}。pnpm 会继续把这个包装上，但装的是没打补丁的原版——通常下次启动才会以「插件加载失败」暴露出来。多半是包升级后挪动了补丁指向的文件（例如补丁改的是 client/client.js，而新版本发的是 lib/client.js）。请更新或删掉这个补丁文件，以及 profile package.json 里 pnpm.patchedDependencies 中对应的那一条 / a pnpm patch in this profile no longer applies${whichEn}. pnpm still installs the package, but unpatched — which usually surfaces at the next boot as "failed to load plugins" rather than here. The usual cause is the package moving the file the patch targets (for example a patch against client/client.js when the release now ships lib/client.js). Update or remove that patch file and its entry under pnpm.patchedDependencies in the profile's package.json`,
         };
     }
+    // #740 by @lws2004: the other half of the story above. `patchedDependencies`
+    // keys on `pkg@exactVersion`, and once the installed version moves past that
+    // key pnpm 12 treats the stale patch as a HARD error: it writes NOTHING at
+    // all. So an update of that plugin is refused in full — the version stays
+    // where it was, the market's own log holds only exit=1, and the user reads
+    // "the update did not apply" for what is really a patch that no longer
+    // matches. Unlike ERR_PNPM_PATCH_FAILED there is no unpatched install to
+    // discover later, which makes this the more confusing of the two. The patch
+    // is the user's, so the market names the entries and says where to fix them
+    // rather than guessing a retarget.
+    if (output.includes('ERR_PNPM_UNUSED_PATCH')) {
+        // `[^\n"]+`: the same sentence also arrives inside the ndjson stream,
+        // where it ends at a quote rather than at the line — matching to the line
+        // end there captured `"}}` as part of the package name.
+        const unused = /The following patches were not used:\s*([^\n"]+)/
+            .exec(withDecodedPnpmDiagnostics(output))?.[1];
+        const named = unused === undefined
+            ? []
+            : unused.split(',').map(entry => entry.trim()).filter(entry => entry !== '');
+        const which = named.length === 0 ? '' : `（${named.join('、')}）`;
+        const whichEn = named.length === 0 ? '' : ` (${named.join(', ')})`;
+        return {
+            code: 'unused-patch',
+            recoverable: false,
+            pkg: named.length === 1 ? named[0] : undefined,
+            message: `profile 里的 pnpm 补丁有一条已经用不上了${which}：patchedDependencies 是按「包名@精确版本」钉的，而这次要装的版本已经越过它，pnpm 12 因此判定整条命令失败——它什么都没写，所以看起来像「点了更新没反应」。要么把补丁更新到新版本、并把 profile package.json 里 pnpm.patchedDependencies 的键改成「包名@新版本」，要么在新版本已经自带这个修复时直接删掉这一条和对应的补丁文件 / a pnpm patch in this profile is no longer used${whichEn}: patchedDependencies keys on "package@exactVersion", and the version being installed has moved past that key, so pnpm 12 fails the WHOLE command and writes nothing at all — which is why the update looks like it simply did not apply. Either retarget the patch to the new version and change its pnpm.patchedDependencies key in the profile's package.json to "package@newVersion", or — when the new release already carries that fix — drop the entry and its patch file`,
+        };
+    }
     if (output.includes('ERR_PNPM_ADDING_TO_ROOT')) {
         return {
             code: 'adding-to-root',

package/lib/profile.js

@@ -1222,42 +1222,45 @@ function splitReleaseAgeExclude(entry) {
     return { name, selector };
 }
 /**
- * Make a profile's `minimumReleaseAgeExclude` readable again (#732, #733).
+ * Make a profile's `minimumReleaseAgeExclude` readable again (#732).
  *
- * pnpm WRITES this key in forms it then mishandles, and two separate defects
- * come out of that:
+ * pnpm appends a second rule for a package that already has one, while its
+ * `evaluateVersionPolicy` honours only the FIRST rule per package name — so
+ * its own new entry is dead, the young version stays unexcluded, and every
+ * later command in that profile fails lockfile verification with
+ * ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION, including commands that have nothing
+ * to do with that package.
  *
- * - pnpm 11.7.0 appends a second rule for a package that already has one,
- *   while its `evaluateVersionPolicy` honours only the FIRST rule per name.
- *   Its own new entry is therefore dead, and every later command in that
- *   profile fails lockfile verification with
- *   ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION — including commands that have
- *   nothing to do with that package (#732).
- * - pnpm 12.4.1 folds the versions it approves into a `name@v1 || v2 || …`
- *   union, a form its OWN validator rejects ("Invalid versions union … Use
- *   exact versions only"), and evaluating one aborts the process on a single
- *   80 GiB allocation that takes the machine down for minutes (#733). The
- *   entries are evaluated lazily, so this fires on any later install that
- *   age-checks that package, with no pnpm error output to explain it.
+ * (#733 reported a separate, unexplained 80 GiB allocation abort on pnpm
+ * 12.4.1 that its author first tied to the union spelling. Review on that
+ * issue — and the reporter's own follow-up, which could no longer reproduce it
+ * — settled that `name@a || b` is a documented pnpm form, that the validator's
+ * "Use exact versions only" is about ranges and name patterns, and that the
+ * abort is not this market's to fix. Do not "repair" a union into a bare name
+ * on the strength of it: see below.)
  *
- * Both are avoided by writing each such package as ONE BARE NAME. A bare name
- * cannot be shadowed (the first rule for it is already all of it), it stops
- * pnpm's auto-collect for that package outright, and it carries no union for
- * the parser to evaluate. It is also a wider statement than a version list —
- * the package stops being age-gated at all — so it is spent only on entries
- * pnpm has already written in one of those two broken forms, never on a
- * package the file lists as a single exact version. A pure duplicate of one
- * exact version collapses to that one line, which changes no policy at all.
+ * pnpm WRITES this key itself, and one of the forms it writes is what breaks a
+ * profile (#732): pnpm 11.7.0 APPENDS a second rule for a package that already
+ * has one, while its `evaluateVersionPolicy` honours only the FIRST rule per
+ * package name. Its own new entry is therefore dead, the young version stays
+ * unexcluded, and every later command in that profile fails lockfile
+ * verification with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION — installs, updates
+ * and uninstalls alike, including ones that have nothing to do with that
+ * package. Merging the same-name rules into one makes the file readable again.
  *
- * A file holding nothing but bare names and single exact versions is left
- * untouched, as is one whose block this cannot read exactly (a flow list, an
- * inline comment, a line it would have to guess at).
+ * The merge keeps the UNION of the versions the file already lists
+ * (`name@1.2.3 || 1.4.0`), which is a documented pnpm spelling. What this
+ * deliberately does NOT do is collapse a version list to a bare package name:
+ * a bare name exempts EVERY version of that package from the cooldown, which
+ * is wider than what the file says, and the market pins exact versions
+ * precisely so a fresh install cannot silently land on an older release
+ * (#594). A form the file cannot be read exactly from is left alone.
  *
- * @returns the package names whose entry was rewritten; empty when the file
+ * @returns the package names whose rules were merged; empty when the file
  *   needed no repair or could not be repaired, in which case it is left
  *   byte-for-byte as it was.
  */
-export function normalizeReleaseAgeExcludes(profile, explicitDir) {
+export function mergeDuplicateReleaseAgeExcludes(profile, explicitDir) {
     const file = join(profileDir(profile, explicitDir), 'pnpm-workspace.yaml');
     let yaml;
     try {
@@ -1310,12 +1313,16 @@ export function normalizeReleaseAgeExcludes(profile, explicitDir) {
         const group = byName.get(name);
         if (group === undefined)
             return '';
-        // A bare name already covers every version, so it stays bare; a union or
-        // several rules for one name cannot both be read, so they become one.
-        const bare = group.allVersions
-            || group.originals.some(selector => selector.includes('||'))
-            || group.selectors.size > 1;
-        const text = bare ? name : `${name}@${[...group.selectors][0]}`;
+        // A bare name already covers every version, so it stays bare and nothing
+        // is widened; one rule stays exactly as it was written, union included.
+        // Several rules for one name are the #732 breakage — only the first is
+        // ever read — so they become one, as the union of the versions the file
+        // already lists.
+        const text = group.allVersions
+            ? name
+            : group.count === 1
+                ? `${name}@${group.originals[0] ?? ''}`
+                : `${name}@${[...group.selectors].join(' || ')}`;
         // `@` cannot start a plain scalar in YAML, so a scoped name is written
         // quoted — the way pnpm itself writes one.
         const quoted = group.quoted || text.startsWith('@');

package/lib/types/net.d.ts

@@ -9,23 +9,34 @@
  * took 9.9s direct on a reporter's machine, seconds from the 15s timeout,
  * while their proxy sat unused a millisecond away.
  *
- * `setGlobalDispatcher` from the `undici` PACKAGE cannot fix this, because
- * `globalThis.fetch` runs on Node's INTERNAL copy of undici — a different
- * instance. Verified: with a dispatcher installed, a global fetch still
- * produced no CONNECT at a local proxy, while undici's own fetch produced
- * `CONNECT awesome-dsh-plugin.com:443`.
+ * Every market request therefore calls undici's own fetch and carries a
+ * dispatcher this module created. Two measurements say why, and they are
+ * not the same fact:
  *
- * So the market calls undici's fetch with an explicit dispatcher. The scope
- * is deliberate: only requests made by this module change, and the host's
- * own networking is left exactly as the host configured it.
+ * - On Node 25, `setGlobalDispatcher` from the undici package does not
+ *   steer global fetch. With a dispatcher installed that way, a global
+ *   fetch produced no CONNECT at a local proxy, while undici's own fetch
+ *   produced `CONNECT awesome-dsh-plugin.com:443`.
+ * - On Node 22 the two stacks share one symbol (#742). Global fetch reads
+ *   `Symbol.for('undici.globalDispatcher.1')`. The host's first import of
+ *   undici 8 (`web_fetch`) finds `.2` empty, installs its dispatcher, and
+ *   writes a `Dispatcher1Wrapper` onto `.1`. After that, global fetch
+ *   returns gzip bodies with null headers, and `JSON.parse` fails on the
+ *   catalog. undici 7's fetch reads `.1` too, so calling it with no
+ *   dispatcher fails the same way.
+ *
+ * The dispatcher is `EnvHttpProxyAgent` when a proxy is configured, and a
+ * plain `Agent` otherwise. Only requests made here take it. The host's own
+ * networking stays as the host configured it.
  */
 /**
  * The proxy this process would use for the catalog, if any.
  *
  * The standard variables mirror `EnvHttpProxyAgent`'s own resolution
  * deliberately, rather than picking the order that reads best, because the
- * same answer does two jobs: it decides whether to route through undici at
- * all, and it is what the failure message CLAIMS was tried. A helper that
+ * same answer does two jobs: it decides whether the request goes through
+ * the proxy agent or the direct one, and it is what the failure message
+ * CLAIMS was tried. A helper that
  * named a proxy undici would not have used would put a false statement in
  * every bug report. `npm_config_*` is an additional source on top of that:
  * npm holds its proxy in its own config namespace (a machine set up with
@@ -46,11 +57,9 @@
  */
 export declare function configuredProxy(): string | null;
 /**
- * Fetch through the proxy this machine is configured to use.
- *
- * Falls back to the global fetch when no proxy is set, which keeps the
- * ordinary case on the runtime's own path rather than routing it through a
- * second HTTP stack for no reason.
+ * Fetch through the proxy this machine is configured to use, or directly
+ * through this module's own agent when it has none. Both paths pass the
+ * dispatcher described on this module.
  */
 export declare function marketFetch(url: string, init?: {
     signal?: AbortSignal;

package/lib/types/official-desktop.d.ts

@@ -22,5 +22,5 @@ export interface OfficialPluginManagerLike {
  */
 export declare const OFFICIAL_PAGE_HINT = "\u5B98\u65B9\u684C\u9762\u5BA2\u6237\u7AEF\u7684\u8FD9\u4E2A\u63D2\u4EF6\u64CD\u4F5C\u9700\u8981\u5728\u300C\u8BBE\u7F6E \u2192 \u63D2\u4EF6\u300D\u91CC\u5B8C\u6210\uFF1B\u5E02\u573A\u65E0\u6CD5\u901A\u8FC7\u547D\u4EE4\u884C\u4FEE\u6539\u684C\u9762\u7AEF\u7684 profile\u3002 / On the official desktop app, do this from Settings \u2192 Plugins; the market cannot change the desktop profile through the command line.";
 /** Never fall back to `dsh plugin --profile desktop`: that CLI is forbidden. */
-export declare function createOfficialDesktopRuntime(managerLookup: () => OfficialPluginManagerLike | undefined, profileName: string, _profileDirectory: string): DesktopPluginRuntime;
+export declare function createOfficialDesktopRuntime(managerLookup: () => OfficialPluginManagerLike | undefined, profileName: string, _profileDirectory?: string): DesktopPluginRuntime;
 export {};

package/lib/types/pnpm-compat.d.ts

@@ -33,7 +33,7 @@ export declare function pluginArgsFor(profileDir: string, pluginArgs: string[]):
  */
 export declare const HOST_NAMESPACE_RE: RegExp;
 export interface PnpmFailure {
-    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch' | 'fetch-404' | 'no-matching-version' | 'transient-network' | 'fetch-timeout' | 'unexpected-store' | 'patch-failed' | 'missing-tarball-integrity' | 'windows-file-locked' | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key' | 'native-oom' | 'ssh-auth-failed';
+    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch' | 'fetch-404' | 'no-matching-version' | 'transient-network' | 'fetch-timeout' | 'unexpected-store' | 'patch-failed' | 'unused-patch' | 'missing-tarball-integrity' | 'windows-file-locked' | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key' | 'native-oom' | 'ssh-auth-failed';
     /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
     message: string;
     /** True when re-running `pnpm install` in the profile is the documented recovery. */