dshmarket 1.66.21 → 1.66.23

package/lib/install.js

@@ -328,10 +328,16 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
         // no options from us — but the classified message above says the market
         // retried. Say that it did not, or the user reads a retry that never
         // happened and looks for the wrong cause.
-        result = {
-            ...result,
-            stderr: `${result.stderr}\n\n这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`,
-        };
+        //
+        // The wait on a fresh release is the one of these where "no retry" leaves
+        // the user with nothing to do at all: the plugin IS published, pnpm just
+        // will not take it yet, and the door the market would open on a plain
+        // `dsh web` host is shut here — so say when the same button starts
+        // working, and what to use meanwhile (#852).
+        const note = unavailableOption === RELEASE_AGE_OVERRIDE
+            ? `这个插件的新版本比本 profile 的 minimumReleaseAge（新版本等待期）还新，pnpm 因此拒绝了本次改动（改别的插件也一样）。官方桌面端由应用自己执行安装，不接受市场的临时放行参数（${unavailableOption}），所以这里没有自动重试。**等这个版本过了等待期再更新一次即可**；想现在就更新，可以在普通的 dsh web 里装。 / The plugin's new version is younger than this profile's minimumReleaseAge, so pnpm refused this change (a change to another plugin too). The official desktop app runs the install itself and takes no one-shot bypass from the market (${unavailableOption}), so no automatic retry happens here. **Update again once the version is past the wait**; to update right now, install from plain dsh web.`
+            : `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`;
+        result = { ...result, stderr: `${result.stderr}\n\n${note}` };
     }
     return result;
 }
@@ -426,7 +432,27 @@ export function failureDetail(result, limit = 300) {
         const code = result.pnpmErrorCode === undefined ? '' : `${result.pnpmErrorCode}: `;
         return `${code}${result.pnpmError}`.slice(0, limit);
     }
-    return (result.stderr || result.stdout).slice(-limit);
+    const text = (result.stderr || result.stdout).trim();
+    if (text.length <= limit)
+        return text;
+    const tail = text.slice(-limit);
+    // Cut at a sentence end instead of mid-word, and say that something was
+    // dropped (#852). The market appends its own explanation to pnpm's output,
+    // and this tail is catalogued into user-facing sentences — including inside
+    // a parenthesis. A blunt cut landed inside the previous sentence and welded
+    // the fragment to the next one: the reporter's log read
+    // `（is, export the log and report it这台宿主…`, which is not a sentence in
+    // either language and says nothing about what to do.
+    const sentenceEnd = /[.!?。！？]["')\]）]?[\s\n]+/gu;
+    const match = sentenceEnd.exec(tail);
+    if (match !== null) {
+        const rest = tail.slice(match.index + match[0].length).trim();
+        // A boundary so near the end would leave a word or two; the raw tail is
+        // more use than the stub.
+        if (rest.length >= 40)
+            return `… ${rest}`;
+    }
+    return `…${tail.trim()}`;
 }
 /**
  * Some registry entries point at collection repos whose actual plugin lives

package/lib/net.js

@@ -30,6 +30,36 @@
  * networking stays as the host configured it.
  */
 import { Agent, EnvHttpProxyAgent, fetch as undiciFetch } from 'undici';
+/**
+ * Hand the host's own undici the dispatcher our import took (#861).
+ *
+ * undici's `lib/global.js` runs at import time, and when its symbol is unset
+ * it installs an Agent on BOTH global dispatcher symbols: `.1`, which Node's
+ * built-in fetch reads, and `.2`, which undici 8's `getGlobalDispatcher()`
+ * reads. `setGlobalDispatcher` defines them non-configurable, so the value
+ * cannot be taken back — but it is writable, and undici 8 only ever READS
+ * `.2`, so hiding ours there is enough for it to install its own dispatcher
+ * and wrap it onto `.1` for the legacy consumers.
+ *
+ * Measured on Node 24.20 and 25.6 (undici 7.29 as the market's copy, 8.12 as
+ * the host's): with this, a host importing undici 8 after the market gets
+ * `getGlobalDispatcher() instanceof its own Agent` — without it, it is handed
+ * the market's undici 7 Agent (`instanceof` its own Agent: false) and never
+ * installs one, which is the state #861 reports as the host's own LLM and
+ * model-list requests failing once the market is loaded.
+ *
+ * `.1` is deliberately left alone: Node's built-in fetch reads it and asserts
+ * it is set, so clearing it breaks global fetch outright (measured: the same
+ * probe that makes `.2` undefined fails `assert(dispatcher)` when `.1` is
+ * cleared too). Our own requests are unaffected either way — every one of
+ * them carries a dispatcher this module created.
+ */
+export function releaseHostUndiciDispatcher(global = globalThis, ownAgent = Agent) {
+    const symbol = Symbol.for('undici.globalDispatcher.2');
+    if (global[symbol] instanceof ownAgent)
+        global[symbol] = undefined;
+}
+releaseHostUndiciDispatcher();
 /**
  * The proxy this process would use for the catalog, if any.
  *

package/lib/official-desktop.js

@@ -1,6 +1,7 @@
 /** The official Electron profile is owned by DSH's in-process plugin manager. */
 import { randomUUID } from 'node:crypto';
 import { progress, TARGET_RE } from './dsh-cli.js';
+import { activeRegion, DEFAULT_NPM_REGISTRY, routesFor } from './regions.js';
 /**
  * What a user can actually do when the market cannot perform an operation on
  * the official Desktop profile: the app's own Plugins page runs the same
@@ -86,9 +87,12 @@ _profileDirectory) {
         progress.cancelling = false;
         let operation;
         try {
+            // Read at each operation so region switches apply without a restart.
+            // The default route leaves the host's own npm configuration in charge.
+            const registry = routesFor(activeRegion()).npmRegistry;
             operation = command === 'remove'
                 ? manager.removeBundle(target)
-                : manager.installBundle(spec, { requestId });
+                : manager.installBundle(spec, { requestId, ...(registry === DEFAULT_NPM_REGISTRY ? {} : { registry }) });
         }
         catch (error) {
             progress.active = false;

package/lib/profile.js

@@ -846,7 +846,8 @@ export function parsePatchRows(text) {
         // `insert:` indentation closes the block — those target OTHER plugins.
         let insertIndent = null;
         // Indent of a `config:` key whose value is payload, not more rows.
-        // Everything deeper than it is data, and its `id:` keys live in another
+        // Everything deeper than it — and a `- ` at its own column, a sequence
+        // YAML lets sit unindented under its key — is data, and its `id:` keys live in another
         // namespace (#841): a preset row writes `config.plugins[].id` for the
         // entries it will instantiate, so two bundles that instantiate the same
         // official plugins read as two bundles inserting the same entry ids —
@@ -905,19 +906,23 @@ export function parsePatchRows(text) {
             }
             return false;
         };
-        /** Whether the key at `keyIndent` holds a block sequence. */
+        /**
+         * Whether the key at `keyIndent` holds a block sequence. YAML lets that
+         * sequence sit at the key's own column (`config:` then `- id:` without
+         * further indent), so a `- ` there is the value, not a sibling.
+         */
         const valueIsList = (from, keyIndent) => {
-            for (let j = from + 1; j < rows.length; j++) {
-                if (rows[j].indent <= keyIndent)
-                    return false;
-                return rows[j].trimmed === '-' || rows[j].trimmed.startsWith('- ');
-            }
-            return false;
+            const next = from + 1;
+            if (next >= rows.length || rows[next].indent < keyIndent)
+                return false;
+            return isDash(next);
         };
         for (let i = 0; i < rows.length; i++) {
             const { line, trimmed, indent } = rows[i];
-            if (payloadIndent !== null && indent <= payloadIndent)
+            // A `- ` at the payload key's own column is still that key's value.
+            if (payloadIndent !== null && indent <= payloadIndent && !(indent === payloadIndent && isDash(i))) {
                 payloadIndent = null;
+            }
             if (insertIndent !== null && indent <= insertIndent && !/^\s*-?\s*(id|name|config):/u.test(line)) {
                 insertIndent = null;
             }

package/lib/trial.js

@@ -25,7 +25,7 @@
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { buildBundleLayers, composeLayers, findDshInstallDir, parsePatchFile, } from './check.js';
+import { buildBundleLayers, composeLayers, duplicateEntryIdsAreFatal, findDshInstallDir, parsePatchFile, } from './check.js';
 import { resolveDshHome } from './home-paths.js';
 import { mergeOrder, readBundleStack } from './order.js';
 /**
@@ -89,8 +89,17 @@ export function trialValidate(profileDir, newCommunityOrder, options = {}) {
         if (bundle.parseError !== null)
             errors.push({ layer: bundle.name, message: bundle.parseError });
     }
+    // Same version gate as the check report (#853): on a loader that folds one
+    // id into one entry (1.0.4+) this is an override, not a refusal. Making it
+    // fatal here is what rolled back every update for a profile that already
+    // had a package row and a user-patch row on one id.
+    const duplicateFatal = duplicateEntryIdsAreFatal(profileDir);
     for (const dup of composed.duplicates) {
-        errors.push({ layer: dup.layers.join(' / '), message: `duplicate loader entry id ${JSON.stringify(dup.id)} (${dup.count} rows) / 重复的 loader 条目 id ${JSON.stringify(dup.id)}` });
+        const message = `duplicate loader entry id ${JSON.stringify(dup.id)} (${dup.count} rows) / 重复的 loader 条目 id ${JSON.stringify(dup.id)}`;
+        if (duplicateFatal)
+            errors.push({ layer: dup.layers.join(' / '), message });
+        else
+            warnings.push({ layer: dup.layers.join(' / '), message: `${message} — 当前宿主会让后一层覆盖前一层，启动不受影响 / this host lets the later layer win, so the boot is unaffected` });
     }
     for (const orphan of composed.orphans) {
         warnings.push({ layer: orphan.layer, message: `${orphan.id}: ${orphan.reason}` });

package/lib/types/check.d.ts

@@ -285,6 +285,27 @@ interface Composed {
  * composition with a candidate bundle order BEFORE anything is written.
  */
 export declare function composeLayers(layers: LayerInput[]): Composed;
+/**
+ * Whether two rows sharing one loader id still stop the boot (#853).
+ *
+ * It depends on the loader, and the loader changed: up to
+ * `cordis-plugin-loader@1.0.3` `EntryGroup.update` threw
+ * `duplicate loader entry id` for a config array holding one id twice
+ * (measured against the published packages — 1.0.3 has the throw, 1.0.4 and
+ * 1.0.5 do not). From 1.0.4 the same array is folded into a Map keyed by id,
+ * so the LATER row wins and the earlier one is silently dropped.
+ *
+ * The market's rule was written against the old loader (#122: two bundles on
+ * one id really did refuse to start), and it is right on one. On a new one it
+ * is not a boot failure but a silent override — which is worth SAYING and not
+ * worth refusing every operation over. The reported shape is a package's own
+ * patch row plus a user-patch row on the same id: fatal forever meant every
+ * update of every plugin rolled back.
+ *
+ * Unknown version stays fatal: the conservative direction, and the case where
+ * the evidence to be less strict is missing.
+ */
+export declare function duplicateEntryIdsAreFatal(profileDirectory: string): boolean;
 /**
  * Build the bundle layer stack for a profile under a GIVEN bundle order —
  * the manifest order for analyzeProfile, or a candidate order for trial

package/lib/types/net.d.ts

@@ -29,6 +29,31 @@
  * plain `Agent` otherwise. Only requests made here take it. The host's own
  * networking stays as the host configured it.
  */
+/**
+ * Hand the host's own undici the dispatcher our import took (#861).
+ *
+ * undici's `lib/global.js` runs at import time, and when its symbol is unset
+ * it installs an Agent on BOTH global dispatcher symbols: `.1`, which Node's
+ * built-in fetch reads, and `.2`, which undici 8's `getGlobalDispatcher()`
+ * reads. `setGlobalDispatcher` defines them non-configurable, so the value
+ * cannot be taken back — but it is writable, and undici 8 only ever READS
+ * `.2`, so hiding ours there is enough for it to install its own dispatcher
+ * and wrap it onto `.1` for the legacy consumers.
+ *
+ * Measured on Node 24.20 and 25.6 (undici 7.29 as the market's copy, 8.12 as
+ * the host's): with this, a host importing undici 8 after the market gets
+ * `getGlobalDispatcher() instanceof its own Agent` — without it, it is handed
+ * the market's undici 7 Agent (`instanceof` its own Agent: false) and never
+ * installs one, which is the state #861 reports as the host's own LLM and
+ * model-list requests failing once the market is loaded.
+ *
+ * `.1` is deliberately left alone: Node's built-in fetch reads it and asserts
+ * it is set, so clearing it breaks global fetch outright (measured: the same
+ * probe that makes `.2` undefined fails `assert(dispatcher)` when `.1` is
+ * cleared too). Our own requests are unaffected either way — every one of
+ * them carries a dispatcher this module created.
+ */
+export declare function releaseHostUndiciDispatcher(global?: Record<symbol, unknown>, ownAgent?: abstract new (...args: never[]) => unknown): void;
 /**
  * The proxy this process would use for the catalog, if any.
  *

package/lib/types/official-desktop.d.ts

@@ -11,6 +11,7 @@ interface ManagedResult {
 export interface OfficialPluginManagerLike {
     installBundle(spec: string, options?: {
         requestId?: string;
+        registry?: string;
     }): Promise<ManagedResult>;
     removeBundle(name: string): Promise<ManagedResult>;
     cancelInstall(requestId: string): Promise<unknown>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.21",
+  "version": "1.66.23",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/check.ts

@@ -937,6 +937,33 @@ export function composeLayers(layers: LayerInput[]): Composed {
   return { rows, resolvableRows, duplicates, overrides, orphans }
 }
 
+/**
+ * Whether two rows sharing one loader id still stop the boot (#853).
+ *
+ * It depends on the loader, and the loader changed: up to
+ * `cordis-plugin-loader@1.0.3` `EntryGroup.update` threw
+ * `duplicate loader entry id` for a config array holding one id twice
+ * (measured against the published packages — 1.0.3 has the throw, 1.0.4 and
+ * 1.0.5 do not). From 1.0.4 the same array is folded into a Map keyed by id,
+ * so the LATER row wins and the earlier one is silently dropped.
+ *
+ * The market's rule was written against the old loader (#122: two bundles on
+ * one id really did refuse to start), and it is right on one. On a new one it
+ * is not a boot failure but a silent override — which is worth SAYING and not
+ * worth refusing every operation over. The reported shape is a package's own
+ * patch row plus a user-patch row on the same id: fatal forever meant every
+ * update of every plugin rolled back.
+ *
+ * Unknown version stays fatal: the conservative direction, and the case where
+ * the evidence to be less strict is missing.
+ */
+export function duplicateEntryIdsAreFatal(profileDirectory: string): boolean {
+  const versions = lockfileCoreVersions(profileDirectory).get('@deepseek-ai/cordis-plugin-loader') ?? []
+  if (versions.length === 0) return true
+  const newest = versions.reduce((a, b) => (compareSemver(a, b) >= 0 ? a : b))
+  return compareSemver(newest, '1.0.4') < 0
+}
+
 /** Distinct versions of `@deepseek-ai/{dsh,cordis}*` packages in the lockfile. */
 function lockfileCoreVersions(profileDir: string): Map<string, string[]> {
   const found = new Map<string, Set<string>>()
@@ -1509,8 +1536,16 @@ export function analyzeProfile(profileDirectory: string, options: CheckOptions =
     if (row.activation === 'required') errors.push(`${message} — the profile will fail to boot`)
     else warnings.push(`${message} — boot will fail if its disabled expression enables the entry`)
   }
+  // Rows on one id: a boot failure on an old loader, a silent override on a
+  // new one (see duplicateEntryIdsAreFatal). Refusing an operation over the
+  // second shape rolled back every update for the reporter's profile.
+  const duplicateFatal = duplicateEntryIdsAreFatal(profileDirectory)
   for (const dup of composed.duplicates) {
-    errors.push(`duplicate loader entry id ${JSON.stringify(dup.id)} (${dup.count} rows: ${dup.layers.join(', ')})`)
+    if (duplicateFatal) {
+      errors.push(`duplicate loader entry id ${JSON.stringify(dup.id)} (${dup.count} rows: ${dup.layers.join(', ')})`)
+      continue
+    }
+    warnings.push(`${dup.layers.join(' 与 ')}：同一个条目 id ${JSON.stringify(dup.id)} 各有 ${String(dup.count)} 行，当前宿主会让后一层覆盖前一层，启动不受影响，但前面那行会静默失效——删除其中一行即可消除歧义 / the layers ${dup.layers.join(' and ')} each declare entry id ${JSON.stringify(dup.id)} (${String(dup.count)} rows); this host lets the LATER row win, so the boot is fine but the earlier row is silently dropped — remove one of them to make the intent unambiguous`)
   }
   for (const orphan of composed.orphans) {
     warnings.push(`${orphan.layer}: ${orphan.id} — ${orphan.reason}`)

package/src/client/Market.module.css

@@ -11,8 +11,9 @@
 .sub{display:flex;align-items:center;gap:8px;font-size:12px;line-height:18px;color:var(--dsw-alias-label-tertiary,#8b93a1);margin:0}
 .submitLink{font-size:11px;line-height:18px;color:var(--dsw-alias-label-tertiary,#8b93a1);text-decoration:none;white-space:nowrap}
 .submitLink:hover{color:var(--dsw-alias-brand-primary,#4f6ef7);text-decoration:underline}
-/* Wrap instead of clipping controls or the Tasks popover in narrow panels. */
-.tabs{display:flex;flex-wrap:wrap;gap:2px;border-bottom:1px solid var(--dsw-alias-border-l2,#e5e7eb);align-items:flex-end}
+/* Wrap instead of clipping controls or the Tasks popover in narrow panels.
+   position:relative is the popover's anchor — see .opPanel (#866). */
+.tabs{position:relative;display:flex;flex-wrap:wrap;gap:2px;border-bottom:1px solid var(--dsw-alias-border-l2,#e5e7eb);align-items:flex-end}
 .tab{border:none;background:none;font:inherit;font-size:13px;color:var(--dsw-alias-label-secondary,#6b7280);padding:7px 12px;cursor:pointer;border-bottom:2px solid transparent;white-space:nowrap}
 .tab.on{color:var(--dsw-alias-brand-primary,#4f6ef7);border-bottom-color:var(--dsw-alias-brand-primary,#4f6ef7);font-weight:600}
 /* Second-level tabs under "Advanced" — same button styling as .tabs so the
@@ -619,7 +620,15 @@
 /* Lift the entry off the tab row's bottom rule — a pill button flush on the
    divider reads as clipped, especially when export log sits one row above on
    narrow viewports. */
-.opWrap{position:relative;display:inline-flex;flex-shrink:0;margin-bottom:6px}
+/* NOT the popover's containing block (#866): this entry sits at the right end
+   of the tab row, so when the row wraps it lands at the LEFT edge of the
+   second line — and a panel anchored `right:0` to it would then open to the
+   left, past the settings panel's edge. The host's panel is `overflow:hidden`,
+   and LTR inline-start overflow is unreachable by scrolling, so the panel's
+   title, icons and the first half of every plugin name were simply gone. The
+   row is the anchor instead, so the panel hangs from the container's right
+   edge wherever the entry ends up. */
+.opWrap{display:inline-flex;flex-shrink:0;margin-bottom:6px}
 .opEntry{display:inline-flex;align-items:center;gap:6px;font:inherit;font-size:12px;
          padding:4px 10px;border-radius:7px;cursor:pointer;position:relative;white-space:nowrap;
          color:var(--dsw-alias-label-primary,#1f2328);
@@ -630,7 +639,10 @@
 .opEntryAlert{border-color:var(--dsw-alias-state-error-primary,#dc2626);color:var(--dsw-alias-state-error-primary,#dc2626)}
 .opDot{position:absolute;top:-3px;right:-3px;width:8px;height:8px;border-radius:99px;
        background:var(--dsw-alias-state-error-primary,#dc2626)}
-.opPanel{position:absolute;top:calc(100% + 6px);right:0;z-index:40;width:460px;max-width:86vw;
+/* max-width is a percentage of the row, not of the viewport: the panel must
+   never be wider than the row it hangs from, or the part past the container's
+   left edge is clipped unreachably (#866). */
+.opPanel{position:absolute;top:calc(100% + 6px);right:0;z-index:40;width:460px;max-width:100%;
          max-height:70vh;overflow-y:auto;border-radius:12px;
          background:var(--dsw-alias-bg-layer-1,#fff);
          border:1px solid var(--dsw-alias-border-l3,#d9dde3);

package/src/client/MarketSection.tsx

@@ -4462,7 +4462,23 @@ export function MarketSection(props: MarketSectionProps) {
   // The market manages itself from its own settings card (Settings → Plugins
   // → Plugin configuration), not as a row here — listing it in both places
   // read as two different controls for the same thing.
-  const installedOtherCount = Object.keys(installed).filter(name => name !== selfName).length
+  /**
+   * Installed packages that are not plugins at all: a plain library some
+   * other plugin pulled in — zustand, bufferutil, a peer of ws (#634's
+   * `dependencyOf`, #857). They were rendered as plugin cards with a
+   * working uninstall, which is a real remove path for something a plugin
+   * needs. Out of the list; the count stays visible in one quiet line, so the
+   * list is not silently shorter than package.json.
+   */
+  const dependencyOnlyNames = useMemo(
+    () => new Set(Object.keys(installed).filter(name => {
+      const act = activations[name]
+      return act?.state === 'inert' && act.dependencyOf !== undefined
+    })),
+    [installed, activations],
+  )
+  const installedOtherCount = Object.keys(installed)
+    .filter(name => name !== selfName && !dependencyOnlyNames.has(name)).length
 
   const ignoreUpdateNotices = useCallback((names: string[]) => {
     if (bootId === null || names.length === 0) return
@@ -4759,6 +4775,7 @@ export function MarketSection(props: MarketSectionProps) {
   const orderedInstalledEntries = useMemo(() => {
     return Object.entries(displayedInstalled)
       .filter(([name]) => name !== selfName)
+      .filter(([name]) => !dependencyOnlyNames.has(name))
       .sort(([nameA, specA], [nameB, specB]) => {
         // The list reads as "what is running", so a plugin that is off sinks
         // below every one that is on (#745) — even a disabled row with a
@@ -4771,7 +4788,7 @@ export function MarketSection(props: MarketSectionProps) {
         return bUp - aUp
       })
     // eslint-disable-next-line react-hooks/exhaustive-deps -- `updatesLoaded` stands in for `updates`/`updatedNames`: reorder when the check lands, then hold (#631). `effectiveDisabledSet` only re-runs this when a disable state actually changed; the toggled row is the only one that moves.
-  }, [isInstalledListActive, displayedInstalled, selfName, updatesLoaded, effectiveDisabledSet])
+  }, [isInstalledListActive, displayedInstalled, selfName, updatesLoaded, effectiveDisabledSet, dependencyOnlyNames])
   const missingRestoreCount = Object.keys(pendingDependencies).filter(name => !installedFiles.includes(name)).length
   // Self-update lives in the header button and the settings card, not this
   // tab's row list (the market itself is filtered out below) — so a pending
@@ -5520,7 +5537,8 @@ export function MarketSection(props: MarketSectionProps) {
   )
 
   /** Installed plugins the market itself cannot group (#60). */
-  const groupableNames = Object.keys(installed).filter(name => name !== 'dsh-market' && name !== 'dshmarket')
+  const groupableNames = Object.keys(installed)
+    .filter(name => name !== 'dsh-market' && name !== 'dshmarket' && !dependencyOnlyNames.has(name))
   /** Names already inside some group; everything else shows under "ungrouped". */
   const groupedNames = useMemo(() => new Set(Object.values(groups).flat()), [groups])
   const ungroupedNames = groupableNames.filter(name => !groupedNames.has(name))
@@ -7045,6 +7063,13 @@ export function MarketSection(props: MarketSectionProps) {
                           }}
                           />
                         )}
+                {dependencyOnlyNames.size > 0 && (
+                  // The list is complete as a list of PLUGINS; the count keeps it
+                  // from looking like packages went missing (#857).
+                  <p className={css.groupOrgHint}>
+                    {t('installedDependencyNote').replace('{0}', String(dependencyOnlyNames.size))}
+                  </p>
+                )}
                 </>
               )}
       </div>

package/src/client/locales.ts

@@ -366,6 +366,7 @@ export const zh = {
   marketUpdate: '更新插件市场',
   updateAll: '全部更新',
   heldReleaseNotice: '已安装，但不是最新版：这个 profile 的 minimumReleaseAge 挡住了 {0}，安装的是 {1}。',
+  installedDependencyNote: '另有 {0} 个包是插件带进来的依赖，不是插件，未列在上方。',
   heldReleaseAction: '仍安装 {0}',
   ignoreUpdateNotice: '重启前不再提醒',
   ignoreAllUpdateNotices: '重启前都不再提醒',
@@ -1096,6 +1097,7 @@ export const en: Record<MarketKey, string> = {
   marketUpdate: 'Update the plugin market',
   updateAll: 'Update all',
   heldReleaseNotice: 'Installed, but not the newest: this profile\'s minimumReleaseAge held {0} back, so {1} was installed.',
+  installedDependencyNote: '{0} more packages came in as dependencies of plugins — they are not plugins, so they are not listed above.',
   heldReleaseAction: 'Install {0} anyway',
   ignoreUpdateNotice: "Don't remind until restart",
   ignoreAllUpdateNotices: "Don't remind any until restart",

package/src/client/market-data.ts

@@ -1076,14 +1076,29 @@ export interface ScreenshotMeasurement {
   height: number
 }
 
+/** One refused candidate and the reason the image gate refused it. */
+export interface ScreenshotRejection {
+  value: unknown
+  reason: string
+}
+
+/** The single acceptance rule: the URL to load, or the sentence explaining the refusal. */
+type ScreenshotGate = { ok: true; src: string } | { ok: false; reason: string }
+
+function gateScreenshot(value: unknown): ScreenshotGate {
+  if (typeof value !== 'string') return { ok: false, reason: 'not a string' }
+  let parsed: URL
+  try { parsed = new URL(value) } catch { return { ok: false, reason: 'not a parseable URL' } }
+  if (parsed.protocol !== 'https:') return { ok: false, reason: 'not https' }
+  if (!SCREENSHOT_HOSTS.has(parsed.hostname)) return { ok: false, reason: `host not allowlisted (${parsed.hostname})` }
+  if (/\.svg$/iu.test(parsed.pathname)) return { ok: false, reason: 'svg is not rendered' }
+  return { ok: true, src: value }
+}
+
 /** Return one safe screenshot URL without applying the public list limit. */
 function safeScreenshot(value: unknown): string | null {
-  if (typeof value !== 'string') return null
-  let parsed: URL
-  try { parsed = new URL(value) } catch { return null }
-  if (parsed.protocol !== 'https:' || !SCREENSHOT_HOSTS.has(parsed.hostname)) return null
-  if (/\.svg$/iu.test(parsed.pathname)) return null
-  return value
+  const gate = gateScreenshot(value)
+  return gate.ok ? gate.src : null
 }
 
 /**
@@ -1114,14 +1129,29 @@ export function releaseNotesHttpsImage(line: string): { alt: string; src: string
   return { alt: match[1] ?? '', src }
 }
 
-/** Keep only https URLs on allowlisted image hosts; SVG dropped (logos/badges). */
-export function safeScreenshots(urls: unknown): string[] {
+/**
+ * Keep only https URLs on allowlisted image hosts; SVG dropped (logos/badges).
+ *
+ * `onReject` is opt-in, because whether a refusal deserves a word depends on
+ * where the list came from: a README contributes mostly badges, logos and
+ * third-party hosts, where refusing IS the intended outcome. A curated
+ * catalog list is different — every URL in it is declared intent — so
+ * `pluginScreenshotCandidates` is the caller that reports (see there).
+ */
+export function safeScreenshots(
+  urls: unknown,
+  options: { onReject?: (rejection: ScreenshotRejection) => void } = {},
+): string[] {
   if (!Array.isArray(urls)) return []
+  const { onReject } = options
   const safe: string[] = []
   for (const value of urls) {
-    const src = safeScreenshot(value)
-    if (src === null) continue
-    if (!safe.includes(src)) safe.push(src)
+    const gate = gateScreenshot(value)
+    if (!gate.ok) {
+      onReject?.({ value, reason: gate.reason })
+      continue
+    }
+    if (!safe.includes(gate.src)) safe.push(gate.src)
     if (safe.length >= MAX_SCREENSHOTS) break
   }
   return safe
@@ -1303,9 +1333,35 @@ export function rankThemeScreenshots(
 
 const readmeShotsCache = new Map<string, Promise<ScreenshotCandidate[]>>()
 
-/** Clear README-derived media at the boundary of an accepted catalog generation. */
+/**
+ * Declared screenshots the market refuses, reported once per catalog entry.
+ *
+ * A curated entry is the publisher's declaration, and the registry gate that
+ * accepts it (`scripts/validate-registry.mjs`, E12) allows any https URL on
+ * the four GitHub hosts, while this client additionally refuses `.svg`. An
+ * entry can therefore pass CI with a screenshot the market then drops, and
+ * until this existed nothing said so: the card rendered fewer previews, or —
+ * when every declared shot was refused — the client quietly fell back to
+ * scraping the README. Keyed by entry plus the refused values, so a re-render,
+ * a dialog and a theme card report one line between them, and cleared with the
+ * README cache at each accepted catalog generation.
+ */
+const refusedCuratedScreenshots = new Set<string>()
+
+function warnRefusedCuratedScreenshots(plugin: RegistryPlugin, rejections: ScreenshotRejection[]): void {
+  const details = [...new Set(rejections.map(({ value, reason }) => `${reason}: ${String(value)}`))]
+  const key = `${plugin.url}\n${details.join('\n')}`
+  if (refusedCuratedScreenshots.has(key)) return
+  refusedCuratedScreenshots.add(key)
+  console.warn(
+    `[dsh-market] catalog entry "${plugin.name}" declares ${details.length} screenshot(s) the market will not load — ${details.join('; ')}`,
+  )
+}
+
+/** Clear README-derived media and refusal reporting at the boundary of an accepted catalog generation. */
 export function resetScreenshotsCache(): void {
   readmeShotsCache.clear()
+  refusedCuratedScreenshots.clear()
 }
 
 /**
@@ -1313,7 +1369,9 @@ export function resetScreenshotsCache(): void {
  * present, otherwise lazily extracted and semantically ranked from README.
  */
 export function pluginScreenshotCandidates(plugin: RegistryPlugin): Promise<ScreenshotCandidate[]> {
-  const curated = safeScreenshots(plugin.screenshots)
+  const refused: ScreenshotRejection[] = []
+  const curated = safeScreenshots(plugin.screenshots, { onReject: rejection => { refused.push(rejection) } })
+  if (refused.length > 0) warnRefusedCuratedScreenshots(plugin, refused)
   if (curated.length > 0) {
     return Promise.resolve(curated.map((src, order) => ({ src, order, semanticScore: 1_000 - order, curated: true })))
   }

package/src/dsh-cli.ts

@@ -136,12 +136,23 @@ export function proxyEnvForPnpm(env: NodeJS.ProcessEnv = process.env, region: Re
   // statement about where packages come from, and a region setting must not
   // overrule it. Same rule the proxy translation above follows, for the same
   // reason — this function's job is to fill silence, not to overwrite speech.
+  //
+  // Written in BOTH vocabularies (#865). pnpm reads `pnpm_config_*` /
+  // `PNPM_CONFIG_*` and does not read `npm_config_registry` at all — measured
+  // on 11.7.0, where the npm spelling is ignored and whatever `.npmrc` names
+  // stands. So the region setting used to move the market's own requests
+  // (checks, catalog, changelog) while every install still fetched from the
+  // user's configured registry, which is how a mirror lagging behind the
+  // catalog reads as "this version was never published" (#862). npm's own
+  // spelling stays because other things in the install path read it, and it
+  // is the name the value has always had.
   const mirror = routesFor(region).npmRegistry
-  if (mirror !== DEFAULT_NPM_REGISTRY && !has('npm_config_registry')) {
+  if (mirror !== DEFAULT_NPM_REGISTRY && !has('npm_config_registry') && !has('PNPM_CONFIG_REGISTRY')) {
     // npm's own config convention terminates the registry with a slash;
     // pnpm accepts either, but writing it the conventional way keeps the
     // value recognizable to anyone reading the spawned process's env.
     out.npm_config_registry = `${mirror}/`
+    out.PNPM_CONFIG_REGISTRY = `${mirror}/`
   }
   return out
 }

package/src/install.ts

@@ -334,10 +334,16 @@ export async function withHoistRecovery(
     // no options from us — but the classified message above says the market
     // retried. Say that it did not, or the user reads a retry that never
     // happened and looks for the wrong cause.
-    result = {
-      ...result,
-      stderr: `${result.stderr}\n\n这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`,
-    }
+    //
+    // The wait on a fresh release is the one of these where "no retry" leaves
+    // the user with nothing to do at all: the plugin IS published, pnpm just
+    // will not take it yet, and the door the market would open on a plain
+    // `dsh web` host is shut here — so say when the same button starts
+    // working, and what to use meanwhile (#852).
+    const note = unavailableOption === RELEASE_AGE_OVERRIDE
+      ? `这个插件的新版本比本 profile 的 minimumReleaseAge（新版本等待期）还新，pnpm 因此拒绝了本次改动（改别的插件也一样）。官方桌面端由应用自己执行安装，不接受市场的临时放行参数（${unavailableOption}），所以这里没有自动重试。**等这个版本过了等待期再更新一次即可**；想现在就更新，可以在普通的 dsh web 里装。 / The plugin's new version is younger than this profile's minimumReleaseAge, so pnpm refused this change (a change to another plugin too). The official desktop app runs the install itself and takes no one-shot bypass from the market (${unavailableOption}), so no automatic retry happens here. **Update again once the version is past the wait**; to update right now, install from plain dsh web.`
+      : `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`
+    result = { ...result, stderr: `${result.stderr}\n\n${note}` }
   }
   return result
 }
@@ -432,7 +438,25 @@ export function failureDetail(result: InstallResult, limit = 300): string {
     const code = result.pnpmErrorCode === undefined ? '' : `${result.pnpmErrorCode}: `
     return `${code}${result.pnpmError}`.slice(0, limit)
   }
-  return (result.stderr || result.stdout).slice(-limit)
+  const text = (result.stderr || result.stdout).trim()
+  if (text.length <= limit) return text
+  const tail = text.slice(-limit)
+  // Cut at a sentence end instead of mid-word, and say that something was
+  // dropped (#852). The market appends its own explanation to pnpm's output,
+  // and this tail is catalogued into user-facing sentences — including inside
+  // a parenthesis. A blunt cut landed inside the previous sentence and welded
+  // the fragment to the next one: the reporter's log read
+  // `（is, export the log and report it这台宿主…`, which is not a sentence in
+  // either language and says nothing about what to do.
+  const sentenceEnd = /[.!?。！？]["')\]）]?[\s\n]+/gu
+  const match = sentenceEnd.exec(tail)
+  if (match !== null) {
+    const rest = tail.slice(match.index + match[0].length).trim()
+    // A boundary so near the end would leave a word or two; the raw tail is
+    // more use than the stub.
+    if (rest.length >= 40) return `… ${rest}`
+  }
+  return `…${tail.trim()}`
 }
 
 /**