dshmarket 1.66.22 → 1.66.24

package/client/client.js

@@ -395,6 +395,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			notesNpm: "版本发布时间",
 			notesNone: "该插件未提供更新说明。",
 			notesSource: "市场还没收录这个插件的更新说明。",
+			notesSourceUnreadable: "这个插件不是从 GitHub 装的，市场读不到它的改动记录。",
 			notesSourceLink: "去仓库看改了什么",
 			notesSourceNoLink: "可以问问插件作者改了什么。",
 			notesLoadFail: "暂时读不到更新说明，稍后再试。",
@@ -557,6 +558,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			marketUpdate: "更新插件市场",
 			updateAll: "全部更新",
 			heldReleaseNotice: "已安装，但不是最新版：这个 profile 的 minimumReleaseAge 挡住了 {0}，安装的是 {1}。",
+			installedDependencyNote: "另有 {0} 个包是插件带进来的依赖，不是插件，未列在上方。",
 			heldReleaseAction: "仍安装 {0}",
 			ignoreUpdateNotice: "重启前不再提醒",
 			ignoreAllUpdateNotices: "重启前都不再提醒",
@@ -588,6 +590,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			webdavRestore: "从 WebDAV 恢复",
 			autoBackup: "每天自动备份（打开市场时）",
 			webdavNote: "WebDAV 地址与用户名仅保存在当前浏览器；密码只存于服务端，每次会话需重新输入。",
+			webdavPathHint: "填完整的文件地址（含文件名）：备份写进这个文件，恢复也从它读。开启自动备份后每天最多上传一次。",
 			localOnly: "WebDAV 地址和用户名只保存在此浏览器。",
 			credsWarning: "请注意：备份包含 profile 配置，以及可能含密钥的文件（config.toml、.env 等）。本地导出的文件会原样包含这些内容，上传 WebDAV 前请确认目标可信。",
 			gist: "GitHub Gist",
@@ -1111,6 +1114,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			notesNpm: "Version publish times",
 			notesNone: "This plugin does not publish update notes.",
 			notesSource: "The market doesn't have update notes for this plugin yet.",
+			notesSourceUnreadable: "This plugin was not installed from GitHub, so the market cannot read its change history.",
 			notesSourceLink: "See what changed in the repository",
 			notesSourceNoLink: "You can ask the plugin author what changed.",
 			notesLoadFail: "Update notes are unavailable right now — try again later.",
@@ -1273,6 +1277,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			marketUpdate: "Update the plugin market",
 			updateAll: "Update all",
 			heldReleaseNotice: "Installed, but not the newest: this profile's minimumReleaseAge held {0} back, so {1} was installed.",
+			installedDependencyNote: "{0} more packages came in as dependencies of plugins — they are not plugins, so they are not listed above.",
 			heldReleaseAction: "Install {0} anyway",
 			ignoreUpdateNotice: "Don't remind until restart",
 			ignoreAllUpdateNotices: "Don't remind any until restart",
@@ -1304,6 +1309,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			webdavRestore: "Restore from WebDAV",
 			autoBackup: "Back up daily (when the market opens)",
 			webdavNote: "The WebDAV URL and username stay in this browser only; the password is kept server-side and must be re-entered each session.",
+			webdavPathHint: "Give the whole file path, name included: the backup writes that file and restore reads it back. With automatic backup on it uploads at most once a day.",
 			localOnly: "The WebDAV URL and username stay in this browser only.",
 			credsWarning: "Note: backups include profile configuration and files that may hold secrets (config.toml, .env, …). Local exports are unmodified, so upload only to a WebDAV target you trust.",
 			gist: "GitHub Gist",
@@ -8589,6 +8595,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const [restarting, setRestarting] = (0, react.useState)(false);
 			const [showTop, setShowTop] = (0, react.useState)(false);
 			const [backupBusy, setBackupBusy] = (0, react.useState)(false);
+			const webdavInFlight = (0, react.useRef)(false);
 			const [backupMessage, setBackupMessage] = (0, react.useState)(null);
 			const [backupRestored, setBackupRestored] = (0, react.useState)(false);
 			const [pendingBackup, setPendingBackup] = (0, react.useState)(null);
@@ -10641,7 +10648,19 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const reminderUpdatableNames = updatableNames.filter((name) => !quietUpdateSet.has(name) && !installedBlocked(name));
 			const reminderBatchUpdatableNames = batchUpdatableNames.filter((name) => !quietUpdateSet.has(name) && !installedBlocked(name));
 			const reminderUpdateNames = [...updates[selfName]?.updateAvailable === true && !updatedNames.includes(selfName) ? [selfName] : [], ...updatableNames].filter((name) => !quietUpdateSet.has(name) && !installedBlocked(name));
-			const installedOtherCount = Object.keys(installed).filter((name) => name !== selfName).length;
+			/**
+			* Installed packages that are not plugins at all: a plain library some
+			* other plugin pulled in — zustand, bufferutil, a peer of ws (#634's
+			* `dependencyOf`, #857). They were rendered as plugin cards with a
+			* working uninstall, which is a real remove path for something a plugin
+			* needs. Out of the list; the count stays visible in one quiet line, so the
+			* list is not silently shorter than package.json.
+			*/
+			const dependencyOnlyNames = (0, react.useMemo)(() => new Set(Object.keys(installed).filter((name) => {
+				const act = activations[name];
+				return act?.state === "inert" && act.dependencyOf !== void 0;
+			})), [installed, activations]);
+			const installedOtherCount = Object.keys(installed).filter((name) => name !== selfName && !dependencyOnlyNames.has(name)).length;
 			const ignoreUpdateNotices = (0, react.useCallback)((names) => {
 				if (bootId === null || names.length === 0) return;
 				setIgnoredUpdateNames((current) => {
@@ -10729,7 +10748,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				}).catch((error) => setBackupMessage(String(error))).finally(() => setBackupBusy(false));
 			}, [finishRestore, pendingBackup]);
 			const runWebdav = (0, react.useCallback)((action) => {
-				if (webdavUrl.trim() === "") return;
+				if (webdavUrl.trim() === "" || webdavInFlight.current) return;
+				webdavInFlight.current = true;
 				setBackupBusy(true);
 				setBackupMessage(null);
 				setRestoreErrors([]);
@@ -10752,7 +10772,10 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 						} catch {}
 						setBackupMessage(t("backupDone"));
 					}
-				}).catch((error) => setBackupMessage(String(error))).finally(() => setBackupBusy(false));
+				}).catch((error) => setBackupMessage(String(error))).finally(() => {
+					webdavInFlight.current = false;
+					setBackupBusy(false);
+				});
 			}, [
 				previewBackup,
 				t,
@@ -10876,6 +10899,10 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				setExportIncludeConfig(false);
 				setExportOpen(true);
 			}, [installed, installedBundles]);
+			const runWebdavRef = (0, react.useRef)(runWebdav);
+			(0, react.useEffect)(() => {
+				runWebdavRef.current = runWebdav;
+			}, [runWebdav]);
 			(0, react.useEffect)(() => {
 				try {
 					localStorage.setItem(WEBDAV_STORAGE_KEY, JSON.stringify({
@@ -10884,18 +10911,19 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 						auto: autoBackup
 					}));
 				} catch {}
-				if (!autoBackup || webdavUrl.trim() === "") return;
-				let last = 0;
-				try {
-					last = Number(localStorage.getItem("dshm-webdav-last")) || 0;
-				} catch {}
-				if (Date.now() - last >= 864e5) runWebdav("backup");
 			}, [
 				autoBackup,
-				runWebdav,
 				webdavUrl,
 				webdavUser
 			]);
+			(0, react.useEffect)(() => {
+				if (!autoBackup) return;
+				let last = 0;
+				try {
+					last = Number(localStorage.getItem("dshm-webdav-last")) || 0;
+				} catch {}
+				if (Date.now() - last >= 864e5) runWebdavRef.current("backup");
+			}, [autoBackup]);
 			const sessionPendingRestart = doneUrls.length + restartNames.length + removedCount + toggleRestart + (backupRestored ? 1 : 0);
 			/**
 			* Plugins the HOST reports as restart-pending, independent of what this
@@ -10936,7 +10964,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const isInstalledListActive = tab === "installed" && installedView === "list";
 			const updatesLoaded = Object.keys(updates).length > 0;
 			const orderedInstalledEntries = (0, react.useMemo)(() => {
-				return Object.entries(displayedInstalled).filter(([name]) => name !== selfName).sort(([nameA, specA], [nameB, specB]) => {
+				return Object.entries(displayedInstalled).filter(([name]) => name !== selfName).filter(([name]) => !dependencyOnlyNames.has(name)).sort(([nameA, specA], [nameB, specB]) => {
 					const aOn = effectiveDisabledSet.has(nameA) ? 0 : 1;
 					const bOn = effectiveDisabledSet.has(nameB) ? 0 : 1;
 					if (aOn !== bOn) return bOn - aOn;
@@ -10948,7 +10976,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				displayedInstalled,
 				selfName,
 				updatesLoaded,
-				effectiveDisabledSet
+				effectiveDisabledSet,
+				dependencyOnlyNames
 			]);
 			const missingRestoreCount = Object.keys(pendingDependencies).filter((name) => !installedFiles.includes(name)).length;
 			const hasUpdates = reminderUpdatableNames.length > 0;
@@ -11770,7 +11799,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			*/
 			const pendingRefreshNames = (0, react.useMemo)(() => [.../* @__PURE__ */ new Set([...hotNames, ...refreshNames])], [hotNames, refreshNames]);
 			/** Installed plugins the market itself cannot group (#60). */
-			const groupableNames = Object.keys(installed).filter((name) => name !== "dsh-market" && name !== "dshmarket");
+			const groupableNames = Object.keys(installed).filter((name) => name !== "dsh-market" && name !== "dshmarket" && !dependencyOnlyNames.has(name));
 			/** Names already inside some group; everything else shows under "ungrouped". */
 			const groupedNames = (0, react.useMemo)(() => new Set(Object.values(groups).flat()), [groups]);
 			const ungroupedNames = groupableNames.filter((name) => !groupedNames.has(name));
@@ -12445,6 +12474,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 											placeholder: t("webdavUrl"),
 											onChange: (e) => setWebdavUrl(e.target.value)
 										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("webdavPathHint") }),
 										/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Input, {
 											className: Market_module_css_default.backupInput,
 											autoComplete: "username",
@@ -13641,6 +13671,10 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 										})]
 									}, name);
 								}
+							}),
+							dependencyOnlyNames.size > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: Market_module_css_default.groupOrgHint,
+								children: t("installedDependencyNote").replace("{0}", String(dependencyOnlyNames.size))
 							})
 						] })
 					}),
@@ -14264,7 +14298,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 								})]
 							}) : updateNotes.kind === "source" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: Market_module_css_default.spec,
-								children: [t(updateNotes.reason === "unavailable" ? "notesLoadFail" : "notesSource"), typeof updateNotes.sourceUrl === "string" && /^https?:\/\//i.test(updateNotes.sourceUrl) ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [lang === "zh" ? "" : " ", /* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
+								children: [t(updateNotes.reason === "unavailable" ? "notesLoadFail" : updateNotes.reason === "unreadable" ? "notesSourceUnreadable" : "notesSource"), typeof updateNotes.sourceUrl === "string" && /^https?:\/\//i.test(updateNotes.sourceUrl) ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [lang === "zh" ? "" : " ", /* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
 									className: Market_module_css_default.notesSourceLink,
 									href: updateNotes.sourceUrl,
 									target: "_blank",

package/lib/changelog.js

@@ -341,9 +341,17 @@ export async function updateNotesFor(profile, explicitDir, name) {
     const specKey = repoKeyOf(spec) ?? lookupRepoFromUrl(spec);
     // The market holds no notes for this install, but its history is still
     // readable where it came from: say which, and point there.
+    //
+    // Notes come from the catalog's own release feed, which is built from
+    // GitHub, so a gitee or self-hosted git install has no feed to find:
+    // "the market has not collected this one yet" would promise something that
+    // cannot happen, and the reader waits for it (#819). Those say the source
+    // cannot be read instead. The url is the same either way — the repository
+    // is where the answer actually is.
+    const unreadableSource = githubIdentityOf(spec) === null && isGitHostedSpec(spec);
     const fromSource = (reason) => ({
         kind: 'source',
-        reason,
+        reason: unreadableSource ? 'unreadable' : reason,
         sourceUrl: sourceWebUrl(spec) ?? specKey,
     });
     try {

package/lib/install.js

@@ -328,10 +328,16 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
         // no options from us — but the classified message above says the market
         // retried. Say that it did not, or the user reads a retry that never
         // happened and looks for the wrong cause.
-        result = {
-            ...result,
-            stderr: `${result.stderr}\n\n这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`,
-        };
+        //
+        // The wait on a fresh release is the one of these where "no retry" leaves
+        // the user with nothing to do at all: the plugin IS published, pnpm just
+        // will not take it yet, and the door the market would open on a plain
+        // `dsh web` host is shut here — so say when the same button starts
+        // working, and what to use meanwhile (#852).
+        const note = unavailableOption === RELEASE_AGE_OVERRIDE
+            ? `这个插件的新版本比本 profile 的 minimumReleaseAge（新版本等待期）还新，pnpm 因此拒绝了本次改动（改别的插件也一样）。官方桌面端由应用自己执行安装，不接受市场的临时放行参数（${unavailableOption}），所以这里没有自动重试。**等这个版本过了等待期再更新一次即可**；想现在就更新，可以在普通的 dsh web 里装。 / The plugin's new version is younger than this profile's minimumReleaseAge, so pnpm refused this change (a change to another plugin too). The official desktop app runs the install itself and takes no one-shot bypass from the market (${unavailableOption}), so no automatic retry happens here. **Update again once the version is past the wait**; to update right now, install from plain dsh web.`
+            : `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`;
+        result = { ...result, stderr: `${result.stderr}\n\n${note}` };
     }
     return result;
 }
@@ -426,7 +432,27 @@ export function failureDetail(result, limit = 300) {
         const code = result.pnpmErrorCode === undefined ? '' : `${result.pnpmErrorCode}: `;
         return `${code}${result.pnpmError}`.slice(0, limit);
     }
-    return (result.stderr || result.stdout).slice(-limit);
+    const text = (result.stderr || result.stdout).trim();
+    if (text.length <= limit)
+        return text;
+    const tail = text.slice(-limit);
+    // Cut at a sentence end instead of mid-word, and say that something was
+    // dropped (#852). The market appends its own explanation to pnpm's output,
+    // and this tail is catalogued into user-facing sentences — including inside
+    // a parenthesis. A blunt cut landed inside the previous sentence and welded
+    // the fragment to the next one: the reporter's log read
+    // `（is, export the log and report it这台宿主…`, which is not a sentence in
+    // either language and says nothing about what to do.
+    const sentenceEnd = /[.!?。！？]["')\]）]?[\s\n]+/gu;
+    const match = sentenceEnd.exec(tail);
+    if (match !== null) {
+        const rest = tail.slice(match.index + match[0].length).trim();
+        // A boundary so near the end would leave a word or two; the raw tail is
+        // more use than the stub.
+        if (rest.length >= 40)
+            return `… ${rest}`;
+    }
+    return `…${tail.trim()}`;
 }
 /**
  * Some registry entries point at collection repos whose actual plugin lives

package/lib/types/changelog.d.ts

@@ -106,9 +106,10 @@ export interface UpdateNotes {
     /**
      * Present for `source`: `missing` when the notes loaded without this
      * plugin, `unavailable` when they could not be loaded at all — a passing
-     * failure, not a fact about the plugin.
+     * failure, not a fact about the plugin — and `unreadable` when the source is
+     * one the market can never read, so waiting will not help (#819).
      */
-    reason?: 'missing' | 'unavailable';
+    reason?: 'missing' | 'unavailable' | 'unreadable';
 }
 /**
  * Resolve the notes for one installed plugin, or `{ kind: 'none' }`.

package/lib/verify.js

@@ -26,14 +26,15 @@
  *             or a declared entry artifact that is missing
  *   missing – not present in node_modules
  */
-import { readFileSync } from 'node:fs';
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import { createRequire, isBuiltin } from 'node:module';
 import { Script } from 'node:vm';
 import { join } from 'node:path';
 import { listHotMounts, parseSimplePatch } from './hot.js';
 import { userPatchPackageReferences } from './patch.js';
 import { nameMatchesPackage } from './entry-identity.js';
 import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, profileDir, readInstalled } from './profile.js';
-import { compareSemver, parsePatchFile, satisfiesRange } from './check.js';
+import { compareSemver, composeLayers, parsePatchFile, satisfiesRange } from './check.js';
 import { dshHostInfo } from './dsh-install.js';
 /**
  * Whether every bundle patch the package declares parses to an empty list.
@@ -183,11 +184,15 @@ const isDshPeer = (peer) => peer === '@deepseek-ai/dsh' || peer.startsWith('@dee
  * peers fail at once.
  */
 export function hostPeerGate(activeProfileDir, name, facts) {
+    return peerGateAt(join(activeProfileDir, 'node_modules', name), name, facts);
+}
+/** Same prediction for a patch plugin resolved outside the profile's flat node_modules. */
+function peerGateAt(packageDir, name, facts) {
     if (facts.runtimeVersion === null)
         return null;
     let manifest;
     try {
-        manifest = JSON.parse(readFileSync(join(activeProfileDir, 'node_modules', name, 'package.json'), 'utf8'));
+        manifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8'));
     }
     catch {
         return null;
@@ -215,6 +220,74 @@ export function hostPeerGate(activeProfileDir, name, facts) {
     }
     return null;
 }
+/**
+ * #867: only the bundle's own effective loader rows are evidence, never its
+ * ordinary dependency closure or arbitrary names in plugin configuration.
+ * Compose every declared file together so later disables take effect. An
+ * unreadable file or an expression-gated row gives no rejection evidence.
+ */
+function bundleRowPeerGate(packageDir, activeProfileDir, facts) {
+    if (facts.runtimeVersion === null)
+        return null;
+    try {
+        const patches = declaredBundlePatchFiles(packageDir).map(parsePatchFile);
+        if (patches.some(rows => rows === null))
+            return null;
+        const { resolvableRows } = composeLayers([{
+                label: 'bundle', kind: 'bundle', patches: patches.flatMap(rows => rows ?? []), parseError: null,
+            }]);
+        const checked = new Set();
+        for (const row of resolvableRows) {
+            if (row.activation !== 'required' || typeof row.name !== 'string')
+                continue;
+            // Bare npm names and subpath entries only. Relative files, builtins,
+            // aliases and expressions need runtime resolution; do not guess.
+            if (/^[.#/\\]|[:\\]/u.test(row.name) || isBuiltin(row.name))
+                continue;
+            const parts = row.name.split('/');
+            const name = parts.slice(0, row.name.startsWith('@') ? 2 : 1).join('/');
+            if (!/^(?:@[\w.-]+\/)?[\w-][\w.-]*$/u.test(name) || checked.has(name))
+                continue;
+            checked.add(name);
+            const directory = resolveBundleRowPackage(packageDir, activeProfileDir, name);
+            if (directory === null)
+                continue;
+            const gate = peerGateAt(directory, name, facts);
+            if (gate !== null)
+                return { name, gate };
+        }
+    }
+    catch { /* malformed or cyclic patch data — no reliable prediction */ }
+    return null;
+}
+/**
+ * Probe Node's search paths, without resolving an entry or requiring a
+ * package.json export. The real bundle path reaches pnpm's adjacent and
+ * nested dependencies; the profile anchor also covers workspace hoisting.
+ * Stop at a present directory even if its manifest is missing: a broken
+ * nearer copy must not borrow an incompatible manifest from a fallback.
+ */
+function resolveBundleRowPackage(packageDir, activeProfileDir, name) {
+    const bundleAnchor = join(realpathSync(packageDir), 'package.json');
+    const manifest = JSON.parse(readFileSync(bundleAnchor, 'utf8'));
+    // The host publishes dependencies carried by selected bundles into its
+    // profile resolution. A stray nested copy not declared by this bundle is
+    // no evidence of what a profile row will import.
+    const carried = manifest.name === name || Object.hasOwn(manifest.dependencies ?? {}, name)
+        || Object.hasOwn(manifest.peerDependencies ?? {}, name);
+    const profileAnchor = join(activeProfileDir, 'package.json');
+    for (const anchor of carried ? [bundleAnchor, profileAnchor] : [profileAnchor]) {
+        for (const searchPath of createRequire(anchor).resolve.paths(name) ?? []) {
+            const candidate = join(searchPath, name);
+            try {
+                if (statSync(candidate).isDirectory())
+                    return candidate;
+            }
+            catch { /* try the next Node search path */ }
+        }
+    }
+    return null;
+}
 /** The way out of a peer gate, in the direction the versions allow (#758). */
 export function peerGateRemedy(gate) {
     if (gate.hostTooOld) {
@@ -391,7 +464,8 @@ export function verifyActivation(profile, name, live = new Set(listHotMounts()),
         // range excludes the running runtime — predict that verdict here so
         // the plugin reads as incompatible instead of promising a restart
         // that cannot fix it.
-        const gate = hostPeerGate(activeProfileDir, name, hostFacts ?? defaultHostRuntimeFacts(activeProfileDir));
+        const facts = hostFacts ?? defaultHostRuntimeFacts(activeProfileDir);
+        const gate = hostPeerGate(activeProfileDir, name, facts);
         if (gate !== null) {
             const remedy = peerGateRemedy(gate);
             return {
@@ -403,6 +477,21 @@ export function verifyActivation(profile, name, live = new Set(listHotMounts()),
                 hot: false,
             };
         }
+        const child = bundleRowPeerGate(dir, activeProfileDir, facts);
+        if (child !== null) {
+            const { gate, name: plugin } = child;
+            const remedy = gate.hostTooOld
+                ? { zh: '升级 dsh，或更新此插件包以匹配当前 dsh', en: 'upgrade dsh, or update this bundle to match the current dsh' }
+                : { zh: '更新此插件包，或安装与当前 dsh 兼容的版本；升级 dsh 解决不了', en: 'update this bundle or install a version compatible with the current dsh — upgrading dsh will not help' };
+            return {
+                state: 'incompatible',
+                reasons: [
+                    `它加载的插件 ${plugin} 要求 ${gate.peer} ${gate.range}，当前 dsh 为 ${gate.runtimeVersion}，重启也不会生效；${remedy.zh} / its plugin ${plugin} requires ${gate.peer} ${gate.range}, but dsh runs ${gate.runtimeVersion} — a restart will not activate it; ${remedy.en}`,
+                ],
+                bundle: true,
+                hot: false,
+            };
+        }
         const patch = patchTextOf(profile, name, activeProfileDir);
         const complex = patch !== null && parseSimplePatch(patch) === null;
         return {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.22",
+  "version": "1.66.24",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -41,7 +41,7 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-settings": "^0.1.0-rc.7 || ^0.1.1-rc.2 || ^0.1.2-alpha.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.0-rc.7 || ^0.1.1-rc.2 || ^0.1.2-alpha.2 || ^0.2.0-rc.1 || ^0.2.1-alpha.3",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "dsh": {

package/src/changelog.ts

@@ -351,9 +351,10 @@ export interface UpdateNotes {
   /**
    * Present for `source`: `missing` when the notes loaded without this
    * plugin, `unavailable` when they could not be loaded at all — a passing
-   * failure, not a fact about the plugin.
+   * failure, not a fact about the plugin — and `unreadable` when the source is
+   * one the market can never read, so waiting will not help (#819).
    */
-  reason?: 'missing' | 'unavailable'
+  reason?: 'missing' | 'unavailable' | 'unreadable'
 }
 
 /**
@@ -380,9 +381,17 @@ export async function updateNotesFor(
   const specKey = repoKeyOf(spec) ?? lookupRepoFromUrl(spec)
   // The market holds no notes for this install, but its history is still
   // readable where it came from: say which, and point there.
+  //
+  // Notes come from the catalog's own release feed, which is built from
+  // GitHub, so a gitee or self-hosted git install has no feed to find:
+  // "the market has not collected this one yet" would promise something that
+  // cannot happen, and the reader waits for it (#819). Those say the source
+  // cannot be read instead. The url is the same either way — the repository
+  // is where the answer actually is.
+  const unreadableSource = githubIdentityOf(spec) === null && isGitHostedSpec(spec)
   const fromSource = (reason: 'missing' | 'unavailable'): UpdateNotes => ({
     kind: 'source',
-    reason,
+    reason: unreadableSource ? 'unreadable' : reason,
     sourceUrl: sourceWebUrl(spec) ?? specKey,
   })
   try {

package/src/client/MarketSection.tsx

@@ -1996,13 +1996,13 @@ export function MarketSection(props: MarketSectionProps) {
     commits?: { items: NoteCommit[]; found: boolean }
     npmTimes?: Array<{ version: string; date: string }>
     sourceUrl?: string | null
-    reason?: 'missing' | 'unavailable'
+    reason?: 'missing' | 'unavailable' | 'unreadable'
   }
   type ResolvedNotes =
     | { kind: 'release'; release: NoteRelease }
     | { kind: 'commits'; commits: { items: NoteCommit[]; found: boolean } }
     | { kind: 'npm'; npmTimes: Array<{ version: string; date: string }> }
-    | { kind: 'source'; sourceUrl?: string | null; reason?: 'missing' | 'unavailable' }
+    | { kind: 'source'; sourceUrl?: string | null; reason?: 'missing' | 'unavailable' | 'unreadable' }
     | { kind: 'none' }
   interface CompatibilityNotice {
     code: 'soft-incompatible'
@@ -2279,6 +2279,7 @@ export function MarketSection(props: MarketSectionProps) {
   const [restarting, setRestarting] = useState(false)
   const [showTop, setShowTop] = useState(false)
   const [backupBusy, setBackupBusy] = useState(false)
+  const webdavInFlight = useRef(false)
   const [backupMessage, setBackupMessage] = useState<string | null>(null)
   const [backupRestored, setBackupRestored] = useState(false)
   const [pendingBackup, setPendingBackup] = useState<unknown>(null)
@@ -4462,7 +4463,23 @@ export function MarketSection(props: MarketSectionProps) {
   // The market manages itself from its own settings card (Settings → Plugins
   // → Plugin configuration), not as a row here — listing it in both places
   // read as two different controls for the same thing.
-  const installedOtherCount = Object.keys(installed).filter(name => name !== selfName).length
+  /**
+   * Installed packages that are not plugins at all: a plain library some
+   * other plugin pulled in — zustand, bufferutil, a peer of ws (#634's
+   * `dependencyOf`, #857). They were rendered as plugin cards with a
+   * working uninstall, which is a real remove path for something a plugin
+   * needs. Out of the list; the count stays visible in one quiet line, so the
+   * list is not silently shorter than package.json.
+   */
+  const dependencyOnlyNames = useMemo(
+    () => new Set(Object.keys(installed).filter(name => {
+      const act = activations[name]
+      return act?.state === 'inert' && act.dependencyOf !== undefined
+    })),
+    [installed, activations],
+  )
+  const installedOtherCount = Object.keys(installed)
+    .filter(name => name !== selfName && !dependencyOnlyNames.has(name)).length
 
   const ignoreUpdateNotices = useCallback((names: string[]) => {
     if (bootId === null || names.length === 0) return
@@ -4560,7 +4577,8 @@ export function MarketSection(props: MarketSectionProps) {
   }, [finishRestore, pendingBackup])
 
   const runWebdav = useCallback((action: 'backup' | 'restore') => {
-    if (webdavUrl.trim() === '') return
+    if (webdavUrl.trim() === '' || webdavInFlight.current) return
+    webdavInFlight.current = true
     setBackupBusy(true)
     setBackupMessage(null)
     setRestoreErrors([])
@@ -4577,7 +4595,10 @@ export function MarketSection(props: MarketSectionProps) {
         try { localStorage.setItem('dshm-webdav-last', String(Date.now())) } catch { /* storage unavailable */ }
         setBackupMessage(t('backupDone'))
       }
-    }).catch(error => setBackupMessage(String(error))).finally(() => setBackupBusy(false))
+    }).catch(error => setBackupMessage(String(error))).finally(() => {
+      webdavInFlight.current = false
+      setBackupBusy(false)
+    })
   }, [previewBackup, t, webdavPassword, webdavUrl, webdavUser])
 
   /** Map the server's token-source string to a localized label. */
@@ -4702,6 +4723,9 @@ export function MarketSection(props: MarketSectionProps) {
     setExportOpen(true)
   }, [installed, installedBundles])
 
+  const runWebdavRef = useRef(runWebdav)
+  useEffect(() => { runWebdavRef.current = runWebdav }, [runWebdav])
+
   useEffect(() => {
     // Persist only the non-secret WebDAV settings; the password stays
     // server-side/in-memory (see savedWebdav). Storage itself may be
@@ -4709,13 +4733,18 @@ export function MarketSection(props: MarketSectionProps) {
     try {
       localStorage.setItem(WEBDAV_STORAGE_KEY, JSON.stringify({ url: webdavUrl, username: webdavUser, auto: autoBackup }))
     } catch { /* storage unavailable — config just won't survive reload */ }
-    if (!autoBackup || webdavUrl.trim() === '') return
+  }, [autoBackup, webdavUrl, webdavUser])
+
+  // Check when the market opens or daily backup is enabled. Editing the
+  // settings (or changing the locale) must not start another upload.
+  useEffect(() => {
+    if (!autoBackup) return
     let last = 0
     try {
       last = Number(localStorage.getItem('dshm-webdav-last')) || 0
     } catch { /* ignore */ }
-    if (Date.now() - last >= 24 * 60 * 60 * 1000) runWebdav('backup')
-  }, [autoBackup, runWebdav, webdavUrl, webdavUser])
+    if (Date.now() - last >= 24 * 60 * 60 * 1000) runWebdavRef.current('backup')
+  }, [autoBackup])
 
   // #558: count restart-pending session changes (restartNames), not every
   // completed `updatedNames` entry (which would double-count a batch update
@@ -4759,6 +4788,7 @@ export function MarketSection(props: MarketSectionProps) {
   const orderedInstalledEntries = useMemo(() => {
     return Object.entries(displayedInstalled)
       .filter(([name]) => name !== selfName)
+      .filter(([name]) => !dependencyOnlyNames.has(name))
       .sort(([nameA, specA], [nameB, specB]) => {
         // The list reads as "what is running", so a plugin that is off sinks
         // below every one that is on (#745) — even a disabled row with a
@@ -4771,7 +4801,7 @@ export function MarketSection(props: MarketSectionProps) {
         return bUp - aUp
       })
     // eslint-disable-next-line react-hooks/exhaustive-deps -- `updatesLoaded` stands in for `updates`/`updatedNames`: reorder when the check lands, then hold (#631). `effectiveDisabledSet` only re-runs this when a disable state actually changed; the toggled row is the only one that moves.
-  }, [isInstalledListActive, displayedInstalled, selfName, updatesLoaded, effectiveDisabledSet])
+  }, [isInstalledListActive, displayedInstalled, selfName, updatesLoaded, effectiveDisabledSet, dependencyOnlyNames])
   const missingRestoreCount = Object.keys(pendingDependencies).filter(name => !installedFiles.includes(name)).length
   // Self-update lives in the header button and the settings card, not this
   // tab's row list (the market itself is filtered out below) — so a pending
@@ -5520,7 +5550,8 @@ export function MarketSection(props: MarketSectionProps) {
   )
 
   /** Installed plugins the market itself cannot group (#60). */
-  const groupableNames = Object.keys(installed).filter(name => name !== 'dsh-market' && name !== 'dshmarket')
+  const groupableNames = Object.keys(installed)
+    .filter(name => name !== 'dsh-market' && name !== 'dshmarket' && !dependencyOnlyNames.has(name))
   /** Names already inside some group; everything else shows under "ungrouped". */
   const groupedNames = useMemo(() => new Set(Object.values(groups).flat()), [groups])
   const ungroupedNames = groupableNames.filter(name => !groupedNames.has(name))
@@ -6049,6 +6080,12 @@ export function MarketSection(props: MarketSectionProps) {
                     ]}
                   />
                   <Input className={css.backupInput} icon={<IconLinkOutline14 size={14} />} type="url" value={webdavUrl} placeholder={t('webdavUrl')} onChange={e => setWebdavUrl(e.target.value)} />
+                  {/* The field had a placeholder and nothing else, so "is this a
+                      folder or a file?" was answered only by trying it — and a
+                      reporter who read it as a folder expected the market to
+                      name the file (#868). Name the shape, and say why the
+                      name has to stay put: restore looks for that same one. */}
+                  <p>{t('webdavPathHint')}</p>
                   <Input className={css.backupInput} autoComplete="username" value={webdavUser} placeholder={t('webdavUser')} onChange={e => setWebdavUser(e.target.value)} />
                   <Input className={css.backupInput} type="password" autoComplete="current-password" value={webdavPassword} placeholder={t('webdavPassword')} onChange={e => setWebdavPassword(e.target.value)} />
                   <div className={css.backupActions}>
@@ -7045,6 +7082,13 @@ export function MarketSection(props: MarketSectionProps) {
                           }}
                           />
                         )}
+                {dependencyOnlyNames.size > 0 && (
+                  // The list is complete as a list of PLUGINS; the count keeps it
+                  // from looking like packages went missing (#857).
+                  <p className={css.groupOrgHint}>
+                    {t('installedDependencyNote').replace('{0}', String(dependencyOnlyNames.size))}
+                  </p>
+                )}
                 </>
               )}
       </div>
@@ -7606,7 +7650,9 @@ export function MarketSection(props: MarketSectionProps) {
             )
             : updateNotes.kind === 'source' ? (
               <div className={css.spec}>
-                {t(updateNotes.reason === 'unavailable' ? 'notesLoadFail' : 'notesSource')}
+                {t(updateNotes.reason === 'unavailable'
+                  ? 'notesLoadFail'
+                  : updateNotes.reason === 'unreadable' ? 'notesSourceUnreadable' : 'notesSource')}
                 {typeof updateNotes.sourceUrl === 'string' && /^https?:\/\//i.test(updateNotes.sourceUrl)
                   ? <>{lang === 'zh' ? '' : ' '}<a className={css.notesSourceLink} href={updateNotes.sourceUrl} target="_blank" rel="noreferrer">{t('notesSourceLink')}</a></>
                   : updateNotes.reason !== 'unavailable' && <>{lang === 'zh' ? '' : ' '}{t('notesSourceNoLink')}</>}

package/src/client/locales.ts

@@ -198,6 +198,7 @@ export const zh = {
   notesNpm: '版本发布时间',
   notesNone: '该插件未提供更新说明。',
   notesSource: '市场还没收录这个插件的更新说明。',
+  notesSourceUnreadable: '这个插件不是从 GitHub 装的，市场读不到它的改动记录。',
   notesSourceLink: '去仓库看改了什么',
   notesSourceNoLink: '可以问问插件作者改了什么。',
   notesLoadFail: '暂时读不到更新说明，稍后再试。',
@@ -366,6 +367,7 @@ export const zh = {
   marketUpdate: '更新插件市场',
   updateAll: '全部更新',
   heldReleaseNotice: '已安装，但不是最新版：这个 profile 的 minimumReleaseAge 挡住了 {0}，安装的是 {1}。',
+  installedDependencyNote: '另有 {0} 个包是插件带进来的依赖，不是插件，未列在上方。',
   heldReleaseAction: '仍安装 {0}',
   ignoreUpdateNotice: '重启前不再提醒',
   ignoreAllUpdateNotices: '重启前都不再提醒',
@@ -397,6 +399,7 @@ export const zh = {
   webdavRestore: '从 WebDAV 恢复',
   autoBackup: '每天自动备份（打开市场时）',
   webdavNote: 'WebDAV 地址与用户名仅保存在当前浏览器；密码只存于服务端，每次会话需重新输入。',
+  webdavPathHint: '填完整的文件地址（含文件名）：备份写进这个文件，恢复也从它读。开启自动备份后每天最多上传一次。',
   localOnly: 'WebDAV 地址和用户名只保存在此浏览器。',
   credsWarning: '请注意：备份包含 profile 配置，以及可能含密钥的文件（config.toml、.env 等）。本地导出的文件会原样包含这些内容，上传 WebDAV 前请确认目标可信。',
   gist: 'GitHub Gist',
@@ -934,6 +937,7 @@ export const en: Record<MarketKey, string> = {
   notesNpm: 'Version publish times',
   notesNone: 'This plugin does not publish update notes.',
   notesSource: "The market doesn't have update notes for this plugin yet.",
+  notesSourceUnreadable: 'This plugin was not installed from GitHub, so the market cannot read its change history.',
   notesSourceLink: 'See what changed in the repository',
   notesSourceNoLink: 'You can ask the plugin author what changed.',
   notesLoadFail: 'Update notes are unavailable right now — try again later.',
@@ -1096,6 +1100,7 @@ export const en: Record<MarketKey, string> = {
   marketUpdate: 'Update the plugin market',
   updateAll: 'Update all',
   heldReleaseNotice: 'Installed, but not the newest: this profile\'s minimumReleaseAge held {0} back, so {1} was installed.',
+  installedDependencyNote: '{0} more packages came in as dependencies of plugins — they are not plugins, so they are not listed above.',
   heldReleaseAction: 'Install {0} anyway',
   ignoreUpdateNotice: "Don't remind until restart",
   ignoreAllUpdateNotices: "Don't remind any until restart",
@@ -1127,6 +1132,7 @@ export const en: Record<MarketKey, string> = {
   webdavRestore: 'Restore from WebDAV',
   autoBackup: 'Back up daily (when the market opens)',
   webdavNote: 'The WebDAV URL and username stay in this browser only; the password is kept server-side and must be re-entered each session.',
+  webdavPathHint: 'Give the whole file path, name included: the backup writes that file and restore reads it back. With automatic backup on it uploads at most once a day.',
   localOnly: 'The WebDAV URL and username stay in this browser only.',
   credsWarning: 'Note: backups include profile configuration and files that may hold secrets (config.toml, .env, …). Local exports are unmodified, so upload only to a WebDAV target you trust.',
   gist: 'GitHub Gist',

package/src/install.ts

@@ -334,10 +334,16 @@ export async function withHoistRecovery(
     // no options from us — but the classified message above says the market
     // retried. Say that it did not, or the user reads a retry that never
     // happened and looks for the wrong cause.
-    result = {
-      ...result,
-      stderr: `${result.stderr}\n\n这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`,
-    }
+    //
+    // The wait on a fresh release is the one of these where "no retry" leaves
+    // the user with nothing to do at all: the plugin IS published, pnpm just
+    // will not take it yet, and the door the market would open on a plain
+    // `dsh web` host is shut here — so say when the same button starts
+    // working, and what to use meanwhile (#852).
+    const note = unavailableOption === RELEASE_AGE_OVERRIDE
+      ? `这个插件的新版本比本 profile 的 minimumReleaseAge（新版本等待期）还新，pnpm 因此拒绝了本次改动（改别的插件也一样）。官方桌面端由应用自己执行安装，不接受市场的临时放行参数（${unavailableOption}），所以这里没有自动重试。**等这个版本过了等待期再更新一次即可**；想现在就更新，可以在普通的 dsh web 里装。 / The plugin's new version is younger than this profile's minimumReleaseAge, so pnpm refused this change (a change to another plugin too). The official desktop app runs the install itself and takes no one-shot bypass from the market (${unavailableOption}), so no automatic retry happens here. **Update again once the version is past the wait**; to update right now, install from plain dsh web.`
+      : `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`
+    result = { ...result, stderr: `${result.stderr}\n\n${note}` }
   }
   return result
 }
@@ -432,7 +438,25 @@ export function failureDetail(result: InstallResult, limit = 300): string {
     const code = result.pnpmErrorCode === undefined ? '' : `${result.pnpmErrorCode}: `
     return `${code}${result.pnpmError}`.slice(0, limit)
   }
-  return (result.stderr || result.stdout).slice(-limit)
+  const text = (result.stderr || result.stdout).trim()
+  if (text.length <= limit) return text
+  const tail = text.slice(-limit)
+  // Cut at a sentence end instead of mid-word, and say that something was
+  // dropped (#852). The market appends its own explanation to pnpm's output,
+  // and this tail is catalogued into user-facing sentences — including inside
+  // a parenthesis. A blunt cut landed inside the previous sentence and welded
+  // the fragment to the next one: the reporter's log read
+  // `（is, export the log and report it这台宿主…`, which is not a sentence in
+  // either language and says nothing about what to do.
+  const sentenceEnd = /[.!?。！？]["')\]）]?[\s\n]+/gu
+  const match = sentenceEnd.exec(tail)
+  if (match !== null) {
+    const rest = tail.slice(match.index + match[0].length).trim()
+    // A boundary so near the end would leave a word or two; the raw tail is
+    // more use than the stub.
+    if (rest.length >= 40) return `… ${rest}`
+  }
+  return `…${tail.trim()}`
 }
 
 /**

package/src/verify.ts

@@ -27,14 +27,15 @@
  *   missing – not present in node_modules
  */
 
-import { readFileSync } from 'node:fs'
+import { readFileSync, realpathSync, statSync } from 'node:fs'
+import { createRequire, isBuiltin } from 'node:module'
 import { Script } from 'node:vm'
 import { join } from 'node:path'
 import { listHotMounts, parseSimplePatch } from './hot.ts'
 import { userPatchPackageReferences } from './patch.ts'
 import { nameMatchesPackage } from './entry-identity.ts'
 import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, profileDir, readInstalled } from './profile.ts'
-import { compareSemver, parsePatchFile, satisfiesRange } from './check.ts'
+import { compareSemver, composeLayers, parsePatchFile, satisfiesRange } from './check.ts'
 import { dshHostInfo } from './dsh-install.ts'
 
 export type ActivationState = 'live' | 'restart' | 'incompatible' | 'inert' | 'broken' | 'missing' | 'disabled'
@@ -247,11 +248,16 @@ const isDshPeer = (peer: string): boolean => peer === '@deepseek-ai/dsh' || peer
  * peers fail at once.
  */
 export function hostPeerGate(activeProfileDir: string, name: string, facts: HostRuntimeFacts): PeerGate | null {
+  return peerGateAt(join(activeProfileDir, 'node_modules', name), name, facts)
+}
+
+/** Same prediction for a patch plugin resolved outside the profile's flat node_modules. */
+function peerGateAt(packageDir: string, name: string, facts: HostRuntimeFacts): PeerGate | null {
   if (facts.runtimeVersion === null) return null
   let manifest: { version?: unknown; peerDependencies?: Record<string, unknown> }
   try {
     manifest = JSON.parse(
-      readFileSync(join(activeProfileDir, 'node_modules', name, 'package.json'), 'utf8'),
+      readFileSync(join(packageDir, 'package.json'), 'utf8'),
     )
   } catch {
     return null
@@ -278,6 +284,72 @@ export function hostPeerGate(activeProfileDir: string, name: string, facts: Host
   return null
 }
 
+/**
+ * #867: only the bundle's own effective loader rows are evidence, never its
+ * ordinary dependency closure or arbitrary names in plugin configuration.
+ * Compose every declared file together so later disables take effect. An
+ * unreadable file or an expression-gated row gives no rejection evidence.
+ */
+function bundleRowPeerGate(
+  packageDir: string,
+  activeProfileDir: string,
+  facts: HostRuntimeFacts,
+): { name: string; gate: PeerGate } | null {
+  if (facts.runtimeVersion === null) return null
+  try {
+    const patches = declaredBundlePatchFiles(packageDir).map(parsePatchFile)
+    if (patches.some(rows => rows === null)) return null
+    const { resolvableRows } = composeLayers([{
+      label: 'bundle', kind: 'bundle', patches: patches.flatMap(rows => rows ?? []), parseError: null,
+    }])
+    const checked = new Set<string>()
+    for (const row of resolvableRows) {
+      if (row.activation !== 'required' || typeof row.name !== 'string') continue
+      // Bare npm names and subpath entries only. Relative files, builtins,
+      // aliases and expressions need runtime resolution; do not guess.
+      if (/^[.#/\\]|[:\\]/u.test(row.name) || isBuiltin(row.name)) continue
+      const parts = row.name.split('/')
+      const name = parts.slice(0, row.name.startsWith('@') ? 2 : 1).join('/')
+      if (!/^(?:@[\w.-]+\/)?[\w-][\w.-]*$/u.test(name) || checked.has(name)) continue
+      checked.add(name)
+      const directory = resolveBundleRowPackage(packageDir, activeProfileDir, name)
+      if (directory === null) continue
+      const gate = peerGateAt(directory, name, facts)
+      if (gate !== null) return { name, gate }
+    }
+  } catch { /* malformed or cyclic patch data — no reliable prediction */ }
+  return null
+}
+
+/**
+ * Probe Node's search paths, without resolving an entry or requiring a
+ * package.json export. The real bundle path reaches pnpm's adjacent and
+ * nested dependencies; the profile anchor also covers workspace hoisting.
+ * Stop at a present directory even if its manifest is missing: a broken
+ * nearer copy must not borrow an incompatible manifest from a fallback.
+ */
+function resolveBundleRowPackage(packageDir: string, activeProfileDir: string, name: string): string | null {
+  const bundleAnchor = join(realpathSync(packageDir), 'package.json')
+  const manifest = JSON.parse(readFileSync(bundleAnchor, 'utf8')) as {
+    name?: string; dependencies?: Record<string, unknown>; peerDependencies?: Record<string, unknown>
+  }
+  // The host publishes dependencies carried by selected bundles into its
+  // profile resolution. A stray nested copy not declared by this bundle is
+  // no evidence of what a profile row will import.
+  const carried = manifest.name === name || Object.hasOwn(manifest.dependencies ?? {}, name)
+    || Object.hasOwn(manifest.peerDependencies ?? {}, name)
+  const profileAnchor = join(activeProfileDir, 'package.json')
+  for (const anchor of carried ? [bundleAnchor, profileAnchor] : [profileAnchor]) {
+    for (const searchPath of createRequire(anchor).resolve.paths(name) ?? []) {
+      const candidate = join(searchPath, name)
+      try {
+        if (statSync(candidate).isDirectory()) return candidate
+      } catch { /* try the next Node search path */ }
+    }
+  }
+  return null
+}
+
 /** The way out of a peer gate, in the direction the versions allow (#758). */
 export function peerGateRemedy(gate: PeerGate): { zh: string; en: string } {
   if (gate.hostTooOld) {
@@ -467,7 +539,8 @@ export function verifyActivation(
     // range excludes the running runtime — predict that verdict here so
     // the plugin reads as incompatible instead of promising a restart
     // that cannot fix it.
-    const gate = hostPeerGate(activeProfileDir, name, hostFacts ?? defaultHostRuntimeFacts(activeProfileDir))
+    const facts = hostFacts ?? defaultHostRuntimeFacts(activeProfileDir)
+    const gate = hostPeerGate(activeProfileDir, name, facts)
     if (gate !== null) {
       const remedy = peerGateRemedy(gate)
       return {
@@ -479,6 +552,21 @@ export function verifyActivation(
         hot: false,
       }
     }
+    const child = bundleRowPeerGate(dir, activeProfileDir, facts)
+    if (child !== null) {
+      const { gate, name: plugin } = child
+      const remedy = gate.hostTooOld
+        ? { zh: '升级 dsh，或更新此插件包以匹配当前 dsh', en: 'upgrade dsh, or update this bundle to match the current dsh' }
+        : { zh: '更新此插件包，或安装与当前 dsh 兼容的版本；升级 dsh 解决不了', en: 'update this bundle or install a version compatible with the current dsh — upgrading dsh will not help' }
+      return {
+        state: 'incompatible',
+        reasons: [
+          `它加载的插件 ${plugin} 要求 ${gate.peer} ${gate.range}，当前 dsh 为 ${gate.runtimeVersion}，重启也不会生效；${remedy.zh} / its plugin ${plugin} requires ${gate.peer} ${gate.range}, but dsh runs ${gate.runtimeVersion} — a restart will not activate it; ${remedy.en}`,
+        ],
+        bundle: true,
+        hot: false,
+      }
+    }
     const patch = patchTextOf(profile, name, activeProfileDir)
     const complex = patch !== null && parseSimplePatch(patch) === null
     return {