dshmarket 1.66.20 → 1.66.21

package/lib/profile.js

@@ -8,7 +8,7 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { JSON_SCHEMA, load } from 'js-yaml';
 import { resolveDshHome } from './home-paths.js';
-import { githubRemoteIdentities, githubRepoIdentities, isGitHostedSpec, repoOfTarget } from './sources.js';
+import { githubRemoteIdentities, githubRepoIdentities, hostedRepoKey, isGitHostedSpec, repoOfTarget } from './sources.js';
 /**
  * Whether a profile name follows DSH's own directory-name contract.
  *
@@ -680,9 +680,20 @@ export function readLockCommits(profile, explicitDir) {
  * by pnpm's `path:` selector, so the spec's subpath has to match too — and
  * when the spec names no subpath while several entries of that remote do,
  * there is no answer rather than the first sibling's commit (#632).
+ *
+ * The key on both sides of the comparison is `hostedRepoKey`, the identity
+ * the rest of the market already compares specs by (#851). This function
+ * used to derive its own, and that second spelling lost every install pnpm
+ * writes the shorthand back for: it demanded an `https?://` prefix or a
+ * `.git` suffix, so `github:owner/repo` keyed to nothing at all, and it kept
+ * the `.git` suffix, so the spec side `https://github.com/o/r` could never
+ * equal the lockfile side pnpm writes as `git@github.com:o/r.git`. A floating
+ * shorthand therefore had no commit, and with no commit the update route
+ * refuses to roll back — the market reports "cannot confirm the commit before
+ * the update" for a lockfile that states it plainly.
  */
 export function readGitResolutionCommit(profile, spec, explicitDir) {
-    const want = normalizeGitRepoKey(spec);
+    const want = hostedRepoKey(spec);
     if (want === null)
         return null;
     const wantPath = gitSubpathSelector(spec);
@@ -695,7 +706,7 @@ export function readGitResolutionCommit(profile, spec, explicitDir) {
             const repo = /\brepo:\s*([^\s,}]+)/.exec(body);
             if (commit === null || repo === null)
                 continue;
-            if (normalizeGitRepoKey(repo[1]) !== want)
+            if (hostedRepoKey(repo[1]) !== want)
                 continue;
             const entryPath = /\bpath:\s*([^\s,}]+)/.exec(body)?.[1]?.replace(/^\/+|\/+$/g, '').toLowerCase() ?? null;
             if (wantPath !== null) {
@@ -722,23 +733,6 @@ function gitSubpathSelector(spec) {
     const trimmed = selector.replace(/^\/+|\/+$/g, '').toLowerCase();
     return trimmed === '' ? null : trimmed;
 }
-/** Lowercased transport-agnostic key for comparing two git remote spellings. */
-function normalizeGitRepoKey(spec) {
-    let remote = spec.trim().replace(/^git\+/i, '');
-    const scp = /^git@([^:]+):(.+)$/.exec(remote);
-    if (scp !== null)
-        remote = `https://${scp[1]}/${scp[2].replace(/^\/*/, '')}`;
-    const hash = remote.indexOf('#');
-    if (hash !== -1)
-        remote = remote.slice(0, hash);
-    const query = remote.indexOf('?');
-    if (query !== -1)
-        remote = remote.slice(0, query);
-    remote = remote.replace(/\/+$/, '').toLowerCase();
-    if (!/^https?:\/\//.test(remote) && !remote.includes('.git'))
-        return null;
-    return remote;
-}
 /** True when the installed package's manifest declares a dsh plugin surface. */
 export function hasDshManifest(dir) {
     try {
@@ -859,32 +853,52 @@ export function parsePatchRows(text) {
         // and the market uninstalled the newcomer over a clash the host does
         // not have.
         let payloadIndent = null;
-        /** Index of the `- ` line that opens the row holding `from`. */
+        const isDash = (index) => /^-(?:\s|$)/u.test(rows[index].trimmed);
+        /**
+         * Column where a line's key text starts: its indent plus any `- ` marker.
+         * A row's keys share this column whether written on the marker line or
+         * below it, however many spaces follow the `-`.
+         */
+        const keyCol = (index) => {
+            // A bare `-` puts the row's keys on the lines below it.
+            if (rows[index].trimmed === '-') {
+                const next = rows[index + 1];
+                return next !== undefined && next.indent > rows[index].indent ? next.indent : rows[index].indent + 2;
+            }
+            const dash = /^-\s+/u.exec(rows[index].trimmed);
+            return rows[index].indent + (dash === null ? 0 : dash[0].length);
+        };
+        /** Index of the `- ` line that opens the row holding `from`, or -1. */
         const rowStart = (from) => {
-            const isRowStart = (index) => /^-\s/u.test(rows[index].trimmed) || rows[index].trimmed === '-';
-            if (isRowStart(from))
-                return from;
-            for (let j = from - 1; j >= 0; j--) {
-                if (isRowStart(j))
+            const col = keyCol(from);
+            for (let j = from; j >= 0; j--) {
+                if (isDash(j) && keyCol(j) === col)
                     return j;
+                // Shallower than the row's keys: left the row without finding its marker.
+                if (rows[j].indent < col)
+                    return -1;
             }
-            return 0;
+            return -1;
         };
         /**
          * Whether the insert row holding the `config:` at `from` declares
          * `group: true`. YAML gives a mapping's keys no order, so this reads the
-         * whole row — its own `- ` marker plus the key lines at the marker's body
-         * indentation — rather than only what happened to be written above.
+         * whole row — its own `- ` marker plus the key lines at the row's key
+         * column — rather than only what happened to be written above.
          */
         const rowDeclaresGroup = (from) => {
             const start = rowStart(from);
+            if (start === -1)
+                return false;
             const markerIndent = rows[start].indent;
+            const col = keyCol(start);
             for (let j = start; j < rows.length; j++) {
                 const row = rows[j];
                 if (j > start && row.indent <= markerIndent)
                     break;
-                // The row's own keys; a config body sits deeper than these.
-                if (j > start && row.indent !== markerIndent + 2)
+                // Only the row's own keys: a config body, or a list under another
+                // key, is not at the key column or starts with its own `- `.
+                if (j > start && (row.indent !== col || isDash(j)))
                     continue;
                 if (/^\s*-?\s*group:\s*['"]?true['"]?\s*$/u.test(row.line))
                     return true;
@@ -912,15 +926,22 @@ export function parsePatchRows(text) {
                 payloadIndent = null;
                 continue;
             }
-            // Exactly one `config:` shape carries loader rows: a `group: true` row
-            // whose config is a LIST, because its children are entries. That is
-            // the rule userPatchPackageReferences has always applied to this same
-            // shape — a plain plugin may use a list of `{ name: … }` as ordinary
-            // options, and those must stay payload. Anything else here is payload
-            // too, so the block is skipped rather than counted.
-            if (insertIndent !== null && indent > insertIndent && /^\s*-?\s*config:\s*$/u.test(line)) {
-                if (!(rowDeclaresGroup(i) && valueIsList(i, indent)))
-                    payloadIndent = indent;
+            // Exactly one block under a row carries loader rows: the `config:` of a
+            // `group: true` row whose config is a LIST, because its children are
+            // entries. That is the rule userPatchPackageReferences has always
+            // applied to this same shape — a plain plugin may use a list of
+            // `{ name: … }` as ordinary options, and those must stay payload. Any
+            // other block-valued key (`config:`, `tags:`, …) holds data too, so the
+            // block is skipped rather than counted.
+            // Inside a payload, a nested key is more payload: it must not move the
+            // payload's edge, or the payload ends early and its ids count.
+            const blockKey = /^\s*-?\s*([A-Za-z_][\w.-]*):\s*$/u.exec(line);
+            if (payloadIndent === null && insertIndent !== null && indent > insertIndent && blockKey !== null) {
+                // The key's own column, not the line's: when the key sits on a `- `
+                // line, the row's later keys share its column and are not payload.
+                const col = keyCol(i);
+                if (!(blockKey[1] === 'config' && rowDeclaresGroup(i) && valueIsList(i, col)))
+                    payloadIndent = col;
                 continue;
             }
             const name = /^\s*-?\s*name:\s*['"]?([^'"\s]+)/.exec(line);

package/lib/recovery.js

@@ -938,6 +938,16 @@ export async function runRecovery(config, facts = { exitCode: null, bound: false
     const servePort = options.port ?? config.port;
     /** Write errors from the previous apply; they travel into the next payload. */
     let writeErrors = [];
+    // A port that ANSWERS is proof the host came up, and it needs no pid to say
+    // so (#854). The helper's pid is the process IT spawned, which on Windows is
+    // the `powershell.exe` wrapper rather than the node host that binds — so the
+    // guard below cannot be trusted on its own, and a helper that gave up late
+    // handed this surface a pid that was already gone while the host was still
+    // starting. Asking the socket settles it either way.
+    if (servePort !== null && servePort !== 0 && await portListening(servePort)) {
+        note(config, `port ${String(servePort)} is already answering — the host came up after all; leaving it alone`);
+        return 'booted';
+    }
     // The replacement is not necessarily dead just because it has not bound the
     // port: on a slow host it is still starting. It gets the same grace as a
     // released port before the surface takes the port out from under it (#719).

package/lib/regions.js

@@ -160,6 +160,28 @@ export function rememberGithubRoute(service, route) {
 export function resetGithubRoutePreferences() {
     preferredGithubRoutes.clear();
 }
+/**
+ * Put a user's own prefix in front, and keep the region's other routes (#850).
+ *
+ * Heading rather than replacing, because a public proxy dying is the whole
+ * reason the setting exists — the reporter's was one of these mirrors, and it
+ * took the rest of the chain with it: `gh-proxy.com` stopped serving on
+ * 2026-10-13, and every GitHub-sourced update then failed on a timeout rather
+ * than trying the next candidate. Replacing the list buys one attempt per
+ * mirror outage; heading it buys one, and then the chain that was already
+ * measured to work.
+ *
+ * The proxy is also dropped from the tail if it is already there, so a user
+ * who accepted the value the settings UI pre-suggests gets exactly the
+ * region's own table back rather than the same prefix twice.
+ *
+ * The direct escape is never dropped: `githubRoutes` promises every list ends
+ * in one, and dropping it would turn a dead mirror into an outage instead of
+ * a slow request.
+ */
+function withCustomProxy(proxy, base) {
+    return [proxy, ...base.filter(route => route !== proxy)];
+}
 /**
  * The routes for a region, with environment overrides applied.
  *
@@ -183,7 +205,11 @@ export function routesFor(region, env = process.env) {
             raw: [...base.githubRoutes.raw],
             avatar: [...base.githubRoutes.avatar],
         }
-        : { git: [githubProxy, null], raw: [githubProxy, null], avatar: [githubProxy, null] };
+        : {
+            git: withCustomProxy(githubProxy, base.githubRoutes.git),
+            raw: withCustomProxy(githubProxy, base.githubRoutes.raw),
+            avatar: withCustomProxy(githubProxy, base.githubRoutes.avatar),
+        };
     return {
         npmRegistry: registry,
         githubProxy: githubProxy ?? base.githubProxy,

package/lib/restart.js

@@ -481,19 +481,39 @@ export function restartHelperSource(spawned, launch, logs, port, recovery = null
         // seen from the other side. A replacement that EXITS still ends this
         // early (the `exited` break below), so a genuinely failed boot is not
         // made slower by the wider backstop.
+        '  const startedAt = Date.now()',
         '  const upBy = Date.now() + 45000 + SETTLE_MS',
+        // #854: the window is a budget for "has it come up", NOT a verdict on
+        // "is it dead". A cold start right after the market rewrote node_modules
+        // can outlast it (measured on Windows: bind at ~63s with a scanner on the
+        // fresh files), and handing the port over while the replacement is still
+        // RUNNING is what turns a slow boot into the deadlock #719 removed: the
+        // surface takes port 3080, the host reaches its own bind and dies on
+        // EADDRINUSE, and nothing can come back. So a replacement that has NOT
+        // exited keeps the port, up to a hard cap; one that has exited still ends
+        // the wait immediately, which is the failed-boot case.
+        '  const hardBy = Date.now() + 240000',
         '  let steadySince = null',
-        '  while (Date.now() < upBy) {',
+        '  let announcedWait = false',
+        '  while (true) {',
         '    if (await listening()) {',
         '      if (steadySince === null) steadySince = Date.now()',
         '      else if (Date.now() - steadySince >= SETTLE_MS) return',
         '    } else {',
         '      steadySince = null',
         '      if (exited !== null) break',
+        '      const now = Date.now()',
+        '      if (now >= hardBy) break',
+        '      if (now >= upBy && !announcedWait) {',
+        '        announcedWait = true',
+        // The numbers are computed, not typed twice: a log line that drifts from
+        // the constants it describes is worse than no line at all.
+        '        note(`the replacement is still starting after ${String(Math.round((upBy - startedAt) / 1000))}s and has not exited — waiting up to ${String(Math.round((hardBy - startedAt) / 1000))}s for it rather than taking its port (it would die on EADDRINUSE)`)',
+        '      }',
         '    }',
         '    await sleep(500)',
         '  }',
-        '  note(`the replacement never came up on port ${port}${exited === null ? "" : ` (it exited with code ${exited})`} — see the output log beside this one`)',
+        '  note(`the replacement never came up on port ${port}${exited === null ? " (it is still running, so the recovery surface waits for it to exit before binding)" : ` (it exited with code ${exited})`} — see the output log beside this one`)',
         // The host is not coming back on its own. Everything the user can still
         // do about it lives in the recovery surface, so start it while the
         // browser tab that asked for the restart is still open.

package/lib/types/profile.d.ts

@@ -232,6 +232,17 @@ export declare function readLockCommits(profile: string, explicitDir?: string):
  * by pnpm's `path:` selector, so the spec's subpath has to match too — and
  * when the spec names no subpath while several entries of that remote do,
  * there is no answer rather than the first sibling's commit (#632).
+ *
+ * The key on both sides of the comparison is `hostedRepoKey`, the identity
+ * the rest of the market already compares specs by (#851). This function
+ * used to derive its own, and that second spelling lost every install pnpm
+ * writes the shorthand back for: it demanded an `https?://` prefix or a
+ * `.git` suffix, so `github:owner/repo` keyed to nothing at all, and it kept
+ * the `.git` suffix, so the spec side `https://github.com/o/r` could never
+ * equal the lockfile side pnpm writes as `git@github.com:o/r.git`. A floating
+ * shorthand therefore had no commit, and with no commit the update route
+ * refuses to roll back — the market reports "cannot confirm the commit before
+ * the update" for a lockfile that states it plainly.
  */
 export declare function readGitResolutionCommit(profile: string, spec: string, explicitDir?: string): string | null;
 /** True when the installed package's manifest declares a dsh plugin surface. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.20",
+  "version": "1.66.21",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/profile.ts

@@ -9,7 +9,7 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
 import { isDeepStrictEqual } from 'node:util'
 import { JSON_SCHEMA, load } from 'js-yaml'
 import { resolveDshHome } from './home-paths.ts'
-import { githubRemoteIdentities, githubRepoIdentities, isGitHostedSpec, repoOfTarget } from './sources.ts'
+import { githubRemoteIdentities, githubRepoIdentities, hostedRepoKey, isGitHostedSpec, repoOfTarget } from './sources.ts'
 
 /**
  * Whether a profile name follows DSH's own directory-name contract.
@@ -727,13 +727,24 @@ export function readLockCommits(profile: string, explicitDir?: string): Map<stri
  * by pnpm's `path:` selector, so the spec's subpath has to match too — and
  * when the spec names no subpath while several entries of that remote do,
  * there is no answer rather than the first sibling's commit (#632).
+ *
+ * The key on both sides of the comparison is `hostedRepoKey`, the identity
+ * the rest of the market already compares specs by (#851). This function
+ * used to derive its own, and that second spelling lost every install pnpm
+ * writes the shorthand back for: it demanded an `https?://` prefix or a
+ * `.git` suffix, so `github:owner/repo` keyed to nothing at all, and it kept
+ * the `.git` suffix, so the spec side `https://github.com/o/r` could never
+ * equal the lockfile side pnpm writes as `git@github.com:o/r.git`. A floating
+ * shorthand therefore had no commit, and with no commit the update route
+ * refuses to roll back — the market reports "cannot confirm the commit before
+ * the update" for a lockfile that states it plainly.
  */
 export function readGitResolutionCommit(
   profile: string,
   spec: string,
   explicitDir?: string,
 ): string | null {
-  const want = normalizeGitRepoKey(spec)
+  const want = hostedRepoKey(spec)
   if (want === null) return null
   const wantPath = gitSubpathSelector(spec)
   const matches: string[] = []
@@ -746,7 +757,7 @@ export function readGitResolutionCommit(
       const commit = /\bcommit:\s*([0-9a-f]{40})\b/i.exec(body)
       const repo = /\brepo:\s*([^\s,}]+)/.exec(body)
       if (commit === null || repo === null) continue
-      if (normalizeGitRepoKey(repo[1]!) !== want) continue
+      if (hostedRepoKey(repo[1]!) !== want) continue
       const entryPath = /\bpath:\s*([^\s,}]+)/.exec(body)?.[1]?.replace(/^\/+|\/+$/g, '').toLowerCase() ?? null
       if (wantPath !== null) {
         if (entryPath === wantPath) return commit[1]!.toLowerCase()
@@ -770,20 +781,6 @@ function gitSubpathSelector(spec: string): string | null {
   return trimmed === '' ? null : trimmed
 }
 
-/** Lowercased transport-agnostic key for comparing two git remote spellings. */
-function normalizeGitRepoKey(spec: string): string | null {
-  let remote = spec.trim().replace(/^git\+/i, '')
-  const scp = /^git@([^:]+):(.+)$/.exec(remote)
-  if (scp !== null) remote = `https://${scp[1]}/${scp[2]!.replace(/^\/*/, '')}`
-  const hash = remote.indexOf('#')
-  if (hash !== -1) remote = remote.slice(0, hash)
-  const query = remote.indexOf('?')
-  if (query !== -1) remote = remote.slice(0, query)
-  remote = remote.replace(/\/+$/, '').toLowerCase()
-  if (!/^https?:\/\//.test(remote) && !remote.includes('.git')) return null
-  return remote
-}
-
 /** True when the installed package's manifest declares a dsh plugin surface. */
 export function hasDshManifest(dir: string): boolean {
   try {
@@ -904,30 +901,48 @@ export function parsePatchRows(text: string): { names: string[]; ids: string[];
     // and the market uninstalled the newcomer over a clash the host does
     // not have.
     let payloadIndent: number | null = null
-    /** Index of the `- ` line that opens the row holding `from`. */
+    const isDash = (index: number): boolean => /^-(?:\s|$)/u.test(rows[index].trimmed)
+    /**
+     * Column where a line's key text starts: its indent plus any `- ` marker.
+     * A row's keys share this column whether written on the marker line or
+     * below it, however many spaces follow the `-`.
+     */
+    const keyCol = (index: number): number => {
+      // A bare `-` puts the row's keys on the lines below it.
+      if (rows[index].trimmed === '-') {
+        const next = rows[index + 1]
+        return next !== undefined && next.indent > rows[index].indent ? next.indent : rows[index].indent + 2
+      }
+      const dash = /^-\s+/u.exec(rows[index].trimmed)
+      return rows[index].indent + (dash === null ? 0 : dash[0].length)
+    }
+    /** Index of the `- ` line that opens the row holding `from`, or -1. */
     const rowStart = (from: number): number => {
-      const isRowStart = (index: number): boolean =>
-        /^-\s/u.test(rows[index].trimmed) || rows[index].trimmed === '-'
-      if (isRowStart(from)) return from
-      for (let j = from - 1; j >= 0; j--) {
-        if (isRowStart(j)) return j
+      const col = keyCol(from)
+      for (let j = from; j >= 0; j--) {
+        if (isDash(j) && keyCol(j) === col) return j
+        // Shallower than the row's keys: left the row without finding its marker.
+        if (rows[j].indent < col) return -1
       }
-      return 0
+      return -1
     }
     /**
      * Whether the insert row holding the `config:` at `from` declares
      * `group: true`. YAML gives a mapping's keys no order, so this reads the
-     * whole row — its own `- ` marker plus the key lines at the marker's body
-     * indentation — rather than only what happened to be written above.
+     * whole row — its own `- ` marker plus the key lines at the row's key
+     * column — rather than only what happened to be written above.
      */
     const rowDeclaresGroup = (from: number): boolean => {
       const start = rowStart(from)
+      if (start === -1) return false
       const markerIndent = rows[start].indent
+      const col = keyCol(start)
       for (let j = start; j < rows.length; j++) {
         const row = rows[j]
         if (j > start && row.indent <= markerIndent) break
-        // The row's own keys; a config body sits deeper than these.
-        if (j > start && row.indent !== markerIndent + 2) continue
+        // Only the row's own keys: a config body, or a list under another
+        // key, is not at the key column or starts with its own `- `.
+        if (j > start && (row.indent !== col || isDash(j))) continue
         if (/^\s*-?\s*group:\s*['"]?true['"]?\s*$/u.test(row.line)) return true
       }
       return false
@@ -951,14 +966,21 @@ export function parsePatchRows(text: string): { names: string[]; ids: string[];
         payloadIndent = null
         continue
       }
-      // Exactly one `config:` shape carries loader rows: a `group: true` row
-      // whose config is a LIST, because its children are entries. That is
-      // the rule userPatchPackageReferences has always applied to this same
-      // shape — a plain plugin may use a list of `{ name: … }` as ordinary
-      // options, and those must stay payload. Anything else here is payload
-      // too, so the block is skipped rather than counted.
-      if (insertIndent !== null && indent > insertIndent && /^\s*-?\s*config:\s*$/u.test(line)) {
-        if (!(rowDeclaresGroup(i) && valueIsList(i, indent))) payloadIndent = indent
+      // Exactly one block under a row carries loader rows: the `config:` of a
+      // `group: true` row whose config is a LIST, because its children are
+      // entries. That is the rule userPatchPackageReferences has always
+      // applied to this same shape — a plain plugin may use a list of
+      // `{ name: … }` as ordinary options, and those must stay payload. Any
+      // other block-valued key (`config:`, `tags:`, …) holds data too, so the
+      // block is skipped rather than counted.
+      // Inside a payload, a nested key is more payload: it must not move the
+      // payload's edge, or the payload ends early and its ids count.
+      const blockKey = /^\s*-?\s*([A-Za-z_][\w.-]*):\s*$/u.exec(line)
+      if (payloadIndent === null && insertIndent !== null && indent > insertIndent && blockKey !== null) {
+        // The key's own column, not the line's: when the key sits on a `- `
+        // line, the row's later keys share its column and are not payload.
+        const col = keyCol(i)
+        if (!(blockKey[1] === 'config' && rowDeclaresGroup(i) && valueIsList(i, col))) payloadIndent = col
         continue
       }
       const name = /^\s*-?\s*name:\s*['"]?([^'"\s]+)/.exec(line)

package/src/recovery.ts

@@ -1088,6 +1088,16 @@ export async function runRecovery(
   const servePort = options.port ?? config.port
   /** Write errors from the previous apply; they travel into the next payload. */
   let writeErrors: string[] = []
+  // A port that ANSWERS is proof the host came up, and it needs no pid to say
+  // so (#854). The helper's pid is the process IT spawned, which on Windows is
+  // the `powershell.exe` wrapper rather than the node host that binds — so the
+  // guard below cannot be trusted on its own, and a helper that gave up late
+  // handed this surface a pid that was already gone while the host was still
+  // starting. Asking the socket settles it either way.
+  if (servePort !== null && servePort !== 0 && await portListening(servePort)) {
+    note(config, `port ${String(servePort)} is already answering — the host came up after all; leaving it alone`)
+    return 'booted'
+  }
   // The replacement is not necessarily dead just because it has not bound the
   // port: on a slow host it is still starting. It gets the same grace as a
   // released port before the surface takes the port out from under it (#719).

package/src/regions.ts

@@ -211,6 +211,29 @@ export function resetGithubRoutePreferences(): void {
   preferredGithubRoutes.clear()
 }
 
+/**
+ * Put a user's own prefix in front, and keep the region's other routes (#850).
+ *
+ * Heading rather than replacing, because a public proxy dying is the whole
+ * reason the setting exists — the reporter's was one of these mirrors, and it
+ * took the rest of the chain with it: `gh-proxy.com` stopped serving on
+ * 2026-10-13, and every GitHub-sourced update then failed on a timeout rather
+ * than trying the next candidate. Replacing the list buys one attempt per
+ * mirror outage; heading it buys one, and then the chain that was already
+ * measured to work.
+ *
+ * The proxy is also dropped from the tail if it is already there, so a user
+ * who accepted the value the settings UI pre-suggests gets exactly the
+ * region's own table back rather than the same prefix twice.
+ *
+ * The direct escape is never dropped: `githubRoutes` promises every list ends
+ * in one, and dropping it would turn a dead mirror into an outage instead of
+ * a slow request.
+ */
+function withCustomProxy(proxy: string, base: GithubRoute[]): GithubRoute[] {
+  return [proxy, ...base.filter(route => route !== proxy)]
+}
+
 /**
  * The routes for a region, with environment overrides applied.
  *
@@ -234,7 +257,11 @@ export function routesFor(region: Region, env: NodeJS.ProcessEnv = process.env):
         raw: [...base.githubRoutes.raw],
         avatar: [...base.githubRoutes.avatar],
       }
-    : { git: [githubProxy, null], raw: [githubProxy, null], avatar: [githubProxy, null] }
+    : {
+        git: withCustomProxy(githubProxy, base.githubRoutes.git),
+        raw: withCustomProxy(githubProxy, base.githubRoutes.raw),
+        avatar: withCustomProxy(githubProxy, base.githubRoutes.avatar),
+      }
   return {
     npmRegistry: registry,
     githubProxy: githubProxy ?? base.githubProxy,

package/src/restart.ts

@@ -516,19 +516,39 @@ export function restartHelperSource(
     // seen from the other side. A replacement that EXITS still ends this
     // early (the `exited` break below), so a genuinely failed boot is not
     // made slower by the wider backstop.
+    '  const startedAt = Date.now()',
     '  const upBy = Date.now() + 45000 + SETTLE_MS',
+    // #854: the window is a budget for "has it come up", NOT a verdict on
+    // "is it dead". A cold start right after the market rewrote node_modules
+    // can outlast it (measured on Windows: bind at ~63s with a scanner on the
+    // fresh files), and handing the port over while the replacement is still
+    // RUNNING is what turns a slow boot into the deadlock #719 removed: the
+    // surface takes port 3080, the host reaches its own bind and dies on
+    // EADDRINUSE, and nothing can come back. So a replacement that has NOT
+    // exited keeps the port, up to a hard cap; one that has exited still ends
+    // the wait immediately, which is the failed-boot case.
+    '  const hardBy = Date.now() + 240000',
     '  let steadySince = null',
-    '  while (Date.now() < upBy) {',
+    '  let announcedWait = false',
+    '  while (true) {',
     '    if (await listening()) {',
     '      if (steadySince === null) steadySince = Date.now()',
     '      else if (Date.now() - steadySince >= SETTLE_MS) return',
     '    } else {',
     '      steadySince = null',
     '      if (exited !== null) break',
+    '      const now = Date.now()',
+    '      if (now >= hardBy) break',
+    '      if (now >= upBy && !announcedWait) {',
+    '        announcedWait = true',
+    // The numbers are computed, not typed twice: a log line that drifts from
+    // the constants it describes is worse than no line at all.
+    '        note(`the replacement is still starting after ${String(Math.round((upBy - startedAt) / 1000))}s and has not exited — waiting up to ${String(Math.round((hardBy - startedAt) / 1000))}s for it rather than taking its port (it would die on EADDRINUSE)`)',
+    '      }',
     '    }',
     '    await sleep(500)',
     '  }',
-    '  note(`the replacement never came up on port ${port}${exited === null ? "" : ` (it exited with code ${exited})`} — see the output log beside this one`)',
+    '  note(`the replacement never came up on port ${port}${exited === null ? " (it is still running, so the recovery surface waits for it to exit before binding)" : ` (it exited with code ${exited})`} — see the output log beside this one`)',
     // The host is not coming back on its own. Everything the user can still
     // do about it lives in the recovery surface, so start it while the
     // browser tab that asked for the restart is still open.