dshmarket 1.66.23 → 1.66.24

package/client/client.js

@@ -395,6 +395,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			notesNpm: "版本发布时间",
 			notesNone: "该插件未提供更新说明。",
 			notesSource: "市场还没收录这个插件的更新说明。",
+			notesSourceUnreadable: "这个插件不是从 GitHub 装的，市场读不到它的改动记录。",
 			notesSourceLink: "去仓库看改了什么",
 			notesSourceNoLink: "可以问问插件作者改了什么。",
 			notesLoadFail: "暂时读不到更新说明，稍后再试。",
@@ -589,6 +590,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			webdavRestore: "从 WebDAV 恢复",
 			autoBackup: "每天自动备份（打开市场时）",
 			webdavNote: "WebDAV 地址与用户名仅保存在当前浏览器；密码只存于服务端，每次会话需重新输入。",
+			webdavPathHint: "填完整的文件地址（含文件名）：备份写进这个文件，恢复也从它读。开启自动备份后每天最多上传一次。",
 			localOnly: "WebDAV 地址和用户名只保存在此浏览器。",
 			credsWarning: "请注意：备份包含 profile 配置，以及可能含密钥的文件（config.toml、.env 等）。本地导出的文件会原样包含这些内容，上传 WebDAV 前请确认目标可信。",
 			gist: "GitHub Gist",
@@ -1112,6 +1114,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			notesNpm: "Version publish times",
 			notesNone: "This plugin does not publish update notes.",
 			notesSource: "The market doesn't have update notes for this plugin yet.",
+			notesSourceUnreadable: "This plugin was not installed from GitHub, so the market cannot read its change history.",
 			notesSourceLink: "See what changed in the repository",
 			notesSourceNoLink: "You can ask the plugin author what changed.",
 			notesLoadFail: "Update notes are unavailable right now — try again later.",
@@ -1306,6 +1309,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			webdavRestore: "Restore from WebDAV",
 			autoBackup: "Back up daily (when the market opens)",
 			webdavNote: "The WebDAV URL and username stay in this browser only; the password is kept server-side and must be re-entered each session.",
+			webdavPathHint: "Give the whole file path, name included: the backup writes that file and restore reads it back. With automatic backup on it uploads at most once a day.",
 			localOnly: "The WebDAV URL and username stay in this browser only.",
 			credsWarning: "Note: backups include profile configuration and files that may hold secrets (config.toml, .env, …). Local exports are unmodified, so upload only to a WebDAV target you trust.",
 			gist: "GitHub Gist",
@@ -8591,6 +8595,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const [restarting, setRestarting] = (0, react.useState)(false);
 			const [showTop, setShowTop] = (0, react.useState)(false);
 			const [backupBusy, setBackupBusy] = (0, react.useState)(false);
+			const webdavInFlight = (0, react.useRef)(false);
 			const [backupMessage, setBackupMessage] = (0, react.useState)(null);
 			const [backupRestored, setBackupRestored] = (0, react.useState)(false);
 			const [pendingBackup, setPendingBackup] = (0, react.useState)(null);
@@ -10743,7 +10748,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				}).catch((error) => setBackupMessage(String(error))).finally(() => setBackupBusy(false));
 			}, [finishRestore, pendingBackup]);
 			const runWebdav = (0, react.useCallback)((action) => {
-				if (webdavUrl.trim() === "") return;
+				if (webdavUrl.trim() === "" || webdavInFlight.current) return;
+				webdavInFlight.current = true;
 				setBackupBusy(true);
 				setBackupMessage(null);
 				setRestoreErrors([]);
@@ -10766,7 +10772,10 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 						} catch {}
 						setBackupMessage(t("backupDone"));
 					}
-				}).catch((error) => setBackupMessage(String(error))).finally(() => setBackupBusy(false));
+				}).catch((error) => setBackupMessage(String(error))).finally(() => {
+					webdavInFlight.current = false;
+					setBackupBusy(false);
+				});
 			}, [
 				previewBackup,
 				t,
@@ -10890,6 +10899,10 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				setExportIncludeConfig(false);
 				setExportOpen(true);
 			}, [installed, installedBundles]);
+			const runWebdavRef = (0, react.useRef)(runWebdav);
+			(0, react.useEffect)(() => {
+				runWebdavRef.current = runWebdav;
+			}, [runWebdav]);
 			(0, react.useEffect)(() => {
 				try {
 					localStorage.setItem(WEBDAV_STORAGE_KEY, JSON.stringify({
@@ -10898,18 +10911,19 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 						auto: autoBackup
 					}));
 				} catch {}
-				if (!autoBackup || webdavUrl.trim() === "") return;
-				let last = 0;
-				try {
-					last = Number(localStorage.getItem("dshm-webdav-last")) || 0;
-				} catch {}
-				if (Date.now() - last >= 864e5) runWebdav("backup");
 			}, [
 				autoBackup,
-				runWebdav,
 				webdavUrl,
 				webdavUser
 			]);
+			(0, react.useEffect)(() => {
+				if (!autoBackup) return;
+				let last = 0;
+				try {
+					last = Number(localStorage.getItem("dshm-webdav-last")) || 0;
+				} catch {}
+				if (Date.now() - last >= 864e5) runWebdavRef.current("backup");
+			}, [autoBackup]);
 			const sessionPendingRestart = doneUrls.length + restartNames.length + removedCount + toggleRestart + (backupRestored ? 1 : 0);
 			/**
 			* Plugins the HOST reports as restart-pending, independent of what this
@@ -12460,6 +12474,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 											placeholder: t("webdavUrl"),
 											onChange: (e) => setWebdavUrl(e.target.value)
 										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("webdavPathHint") }),
 										/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Input, {
 											className: Market_module_css_default.backupInput,
 											autoComplete: "username",
@@ -14283,7 +14298,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 								})]
 							}) : updateNotes.kind === "source" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: Market_module_css_default.spec,
-								children: [t(updateNotes.reason === "unavailable" ? "notesLoadFail" : "notesSource"), typeof updateNotes.sourceUrl === "string" && /^https?:\/\//i.test(updateNotes.sourceUrl) ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [lang === "zh" ? "" : " ", /* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
+								children: [t(updateNotes.reason === "unavailable" ? "notesLoadFail" : updateNotes.reason === "unreadable" ? "notesSourceUnreadable" : "notesSource"), typeof updateNotes.sourceUrl === "string" && /^https?:\/\//i.test(updateNotes.sourceUrl) ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [lang === "zh" ? "" : " ", /* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
 									className: Market_module_css_default.notesSourceLink,
 									href: updateNotes.sourceUrl,
 									target: "_blank",

package/lib/changelog.js

@@ -341,9 +341,17 @@ export async function updateNotesFor(profile, explicitDir, name) {
     const specKey = repoKeyOf(spec) ?? lookupRepoFromUrl(spec);
     // The market holds no notes for this install, but its history is still
     // readable where it came from: say which, and point there.
+    //
+    // Notes come from the catalog's own release feed, which is built from
+    // GitHub, so a gitee or self-hosted git install has no feed to find:
+    // "the market has not collected this one yet" would promise something that
+    // cannot happen, and the reader waits for it (#819). Those say the source
+    // cannot be read instead. The url is the same either way — the repository
+    // is where the answer actually is.
+    const unreadableSource = githubIdentityOf(spec) === null && isGitHostedSpec(spec);
     const fromSource = (reason) => ({
         kind: 'source',
-        reason,
+        reason: unreadableSource ? 'unreadable' : reason,
         sourceUrl: sourceWebUrl(spec) ?? specKey,
     });
     try {

package/lib/types/changelog.d.ts

@@ -106,9 +106,10 @@ export interface UpdateNotes {
     /**
      * Present for `source`: `missing` when the notes loaded without this
      * plugin, `unavailable` when they could not be loaded at all — a passing
-     * failure, not a fact about the plugin.
+     * failure, not a fact about the plugin — and `unreadable` when the source is
+     * one the market can never read, so waiting will not help (#819).
      */
-    reason?: 'missing' | 'unavailable';
+    reason?: 'missing' | 'unavailable' | 'unreadable';
 }
 /**
  * Resolve the notes for one installed plugin, or `{ kind: 'none' }`.

package/lib/verify.js

@@ -26,14 +26,15 @@
  *             or a declared entry artifact that is missing
  *   missing – not present in node_modules
  */
-import { readFileSync } from 'node:fs';
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import { createRequire, isBuiltin } from 'node:module';
 import { Script } from 'node:vm';
 import { join } from 'node:path';
 import { listHotMounts, parseSimplePatch } from './hot.js';
 import { userPatchPackageReferences } from './patch.js';
 import { nameMatchesPackage } from './entry-identity.js';
 import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, profileDir, readInstalled } from './profile.js';
-import { compareSemver, parsePatchFile, satisfiesRange } from './check.js';
+import { compareSemver, composeLayers, parsePatchFile, satisfiesRange } from './check.js';
 import { dshHostInfo } from './dsh-install.js';
 /**
  * Whether every bundle patch the package declares parses to an empty list.
@@ -183,11 +184,15 @@ const isDshPeer = (peer) => peer === '@deepseek-ai/dsh' || peer.startsWith('@dee
  * peers fail at once.
  */
 export function hostPeerGate(activeProfileDir, name, facts) {
+    return peerGateAt(join(activeProfileDir, 'node_modules', name), name, facts);
+}
+/** Same prediction for a patch plugin resolved outside the profile's flat node_modules. */
+function peerGateAt(packageDir, name, facts) {
     if (facts.runtimeVersion === null)
         return null;
     let manifest;
     try {
-        manifest = JSON.parse(readFileSync(join(activeProfileDir, 'node_modules', name, 'package.json'), 'utf8'));
+        manifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8'));
     }
     catch {
         return null;
@@ -215,6 +220,74 @@ export function hostPeerGate(activeProfileDir, name, facts) {
     }
     return null;
 }
+/**
+ * #867: only the bundle's own effective loader rows are evidence, never its
+ * ordinary dependency closure or arbitrary names in plugin configuration.
+ * Compose every declared file together so later disables take effect. An
+ * unreadable file or an expression-gated row gives no rejection evidence.
+ */
+function bundleRowPeerGate(packageDir, activeProfileDir, facts) {
+    if (facts.runtimeVersion === null)
+        return null;
+    try {
+        const patches = declaredBundlePatchFiles(packageDir).map(parsePatchFile);
+        if (patches.some(rows => rows === null))
+            return null;
+        const { resolvableRows } = composeLayers([{
+                label: 'bundle', kind: 'bundle', patches: patches.flatMap(rows => rows ?? []), parseError: null,
+            }]);
+        const checked = new Set();
+        for (const row of resolvableRows) {
+            if (row.activation !== 'required' || typeof row.name !== 'string')
+                continue;
+            // Bare npm names and subpath entries only. Relative files, builtins,
+            // aliases and expressions need runtime resolution; do not guess.
+            if (/^[.#/\\]|[:\\]/u.test(row.name) || isBuiltin(row.name))
+                continue;
+            const parts = row.name.split('/');
+            const name = parts.slice(0, row.name.startsWith('@') ? 2 : 1).join('/');
+            if (!/^(?:@[\w.-]+\/)?[\w-][\w.-]*$/u.test(name) || checked.has(name))
+                continue;
+            checked.add(name);
+            const directory = resolveBundleRowPackage(packageDir, activeProfileDir, name);
+            if (directory === null)
+                continue;
+            const gate = peerGateAt(directory, name, facts);
+            if (gate !== null)
+                return { name, gate };
+        }
+    }
+    catch { /* malformed or cyclic patch data — no reliable prediction */ }
+    return null;
+}
+/**
+ * Probe Node's search paths, without resolving an entry or requiring a
+ * package.json export. The real bundle path reaches pnpm's adjacent and
+ * nested dependencies; the profile anchor also covers workspace hoisting.
+ * Stop at a present directory even if its manifest is missing: a broken
+ * nearer copy must not borrow an incompatible manifest from a fallback.
+ */
+function resolveBundleRowPackage(packageDir, activeProfileDir, name) {
+    const bundleAnchor = join(realpathSync(packageDir), 'package.json');
+    const manifest = JSON.parse(readFileSync(bundleAnchor, 'utf8'));
+    // The host publishes dependencies carried by selected bundles into its
+    // profile resolution. A stray nested copy not declared by this bundle is
+    // no evidence of what a profile row will import.
+    const carried = manifest.name === name || Object.hasOwn(manifest.dependencies ?? {}, name)
+        || Object.hasOwn(manifest.peerDependencies ?? {}, name);
+    const profileAnchor = join(activeProfileDir, 'package.json');
+    for (const anchor of carried ? [bundleAnchor, profileAnchor] : [profileAnchor]) {
+        for (const searchPath of createRequire(anchor).resolve.paths(name) ?? []) {
+            const candidate = join(searchPath, name);
+            try {
+                if (statSync(candidate).isDirectory())
+                    return candidate;
+            }
+            catch { /* try the next Node search path */ }
+        }
+    }
+    return null;
+}
 /** The way out of a peer gate, in the direction the versions allow (#758). */
 export function peerGateRemedy(gate) {
     if (gate.hostTooOld) {
@@ -391,7 +464,8 @@ export function verifyActivation(profile, name, live = new Set(listHotMounts()),
         // range excludes the running runtime — predict that verdict here so
         // the plugin reads as incompatible instead of promising a restart
         // that cannot fix it.
-        const gate = hostPeerGate(activeProfileDir, name, hostFacts ?? defaultHostRuntimeFacts(activeProfileDir));
+        const facts = hostFacts ?? defaultHostRuntimeFacts(activeProfileDir);
+        const gate = hostPeerGate(activeProfileDir, name, facts);
         if (gate !== null) {
             const remedy = peerGateRemedy(gate);
             return {
@@ -403,6 +477,21 @@ export function verifyActivation(profile, name, live = new Set(listHotMounts()),
                 hot: false,
             };
         }
+        const child = bundleRowPeerGate(dir, activeProfileDir, facts);
+        if (child !== null) {
+            const { gate, name: plugin } = child;
+            const remedy = gate.hostTooOld
+                ? { zh: '升级 dsh，或更新此插件包以匹配当前 dsh', en: 'upgrade dsh, or update this bundle to match the current dsh' }
+                : { zh: '更新此插件包，或安装与当前 dsh 兼容的版本；升级 dsh 解决不了', en: 'update this bundle or install a version compatible with the current dsh — upgrading dsh will not help' };
+            return {
+                state: 'incompatible',
+                reasons: [
+                    `它加载的插件 ${plugin} 要求 ${gate.peer} ${gate.range}，当前 dsh 为 ${gate.runtimeVersion}，重启也不会生效；${remedy.zh} / its plugin ${plugin} requires ${gate.peer} ${gate.range}, but dsh runs ${gate.runtimeVersion} — a restart will not activate it; ${remedy.en}`,
+                ],
+                bundle: true,
+                hot: false,
+            };
+        }
         const patch = patchTextOf(profile, name, activeProfileDir);
         const complex = patch !== null && parseSimplePatch(patch) === null;
         return {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.23",
+  "version": "1.66.24",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -41,7 +41,7 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-settings": "^0.1.0-rc.7 || ^0.1.1-rc.2 || ^0.1.2-alpha.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.0-rc.7 || ^0.1.1-rc.2 || ^0.1.2-alpha.2 || ^0.2.0-rc.1 || ^0.2.1-alpha.3",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "dsh": {

package/src/changelog.ts

@@ -351,9 +351,10 @@ export interface UpdateNotes {
   /**
    * Present for `source`: `missing` when the notes loaded without this
    * plugin, `unavailable` when they could not be loaded at all — a passing
-   * failure, not a fact about the plugin.
+   * failure, not a fact about the plugin — and `unreadable` when the source is
+   * one the market can never read, so waiting will not help (#819).
    */
-  reason?: 'missing' | 'unavailable'
+  reason?: 'missing' | 'unavailable' | 'unreadable'
 }
 
 /**
@@ -380,9 +381,17 @@ export async function updateNotesFor(
   const specKey = repoKeyOf(spec) ?? lookupRepoFromUrl(spec)
   // The market holds no notes for this install, but its history is still
   // readable where it came from: say which, and point there.
+  //
+  // Notes come from the catalog's own release feed, which is built from
+  // GitHub, so a gitee or self-hosted git install has no feed to find:
+  // "the market has not collected this one yet" would promise something that
+  // cannot happen, and the reader waits for it (#819). Those say the source
+  // cannot be read instead. The url is the same either way — the repository
+  // is where the answer actually is.
+  const unreadableSource = githubIdentityOf(spec) === null && isGitHostedSpec(spec)
   const fromSource = (reason: 'missing' | 'unavailable'): UpdateNotes => ({
     kind: 'source',
-    reason,
+    reason: unreadableSource ? 'unreadable' : reason,
     sourceUrl: sourceWebUrl(spec) ?? specKey,
   })
   try {

package/src/client/MarketSection.tsx

@@ -1996,13 +1996,13 @@ export function MarketSection(props: MarketSectionProps) {
     commits?: { items: NoteCommit[]; found: boolean }
     npmTimes?: Array<{ version: string; date: string }>
     sourceUrl?: string | null
-    reason?: 'missing' | 'unavailable'
+    reason?: 'missing' | 'unavailable' | 'unreadable'
   }
   type ResolvedNotes =
     | { kind: 'release'; release: NoteRelease }
     | { kind: 'commits'; commits: { items: NoteCommit[]; found: boolean } }
     | { kind: 'npm'; npmTimes: Array<{ version: string; date: string }> }
-    | { kind: 'source'; sourceUrl?: string | null; reason?: 'missing' | 'unavailable' }
+    | { kind: 'source'; sourceUrl?: string | null; reason?: 'missing' | 'unavailable' | 'unreadable' }
     | { kind: 'none' }
   interface CompatibilityNotice {
     code: 'soft-incompatible'
@@ -2279,6 +2279,7 @@ export function MarketSection(props: MarketSectionProps) {
   const [restarting, setRestarting] = useState(false)
   const [showTop, setShowTop] = useState(false)
   const [backupBusy, setBackupBusy] = useState(false)
+  const webdavInFlight = useRef(false)
   const [backupMessage, setBackupMessage] = useState<string | null>(null)
   const [backupRestored, setBackupRestored] = useState(false)
   const [pendingBackup, setPendingBackup] = useState<unknown>(null)
@@ -4576,7 +4577,8 @@ export function MarketSection(props: MarketSectionProps) {
   }, [finishRestore, pendingBackup])
 
   const runWebdav = useCallback((action: 'backup' | 'restore') => {
-    if (webdavUrl.trim() === '') return
+    if (webdavUrl.trim() === '' || webdavInFlight.current) return
+    webdavInFlight.current = true
     setBackupBusy(true)
     setBackupMessage(null)
     setRestoreErrors([])
@@ -4593,7 +4595,10 @@ export function MarketSection(props: MarketSectionProps) {
         try { localStorage.setItem('dshm-webdav-last', String(Date.now())) } catch { /* storage unavailable */ }
         setBackupMessage(t('backupDone'))
       }
-    }).catch(error => setBackupMessage(String(error))).finally(() => setBackupBusy(false))
+    }).catch(error => setBackupMessage(String(error))).finally(() => {
+      webdavInFlight.current = false
+      setBackupBusy(false)
+    })
   }, [previewBackup, t, webdavPassword, webdavUrl, webdavUser])
 
   /** Map the server's token-source string to a localized label. */
@@ -4718,6 +4723,9 @@ export function MarketSection(props: MarketSectionProps) {
     setExportOpen(true)
   }, [installed, installedBundles])
 
+  const runWebdavRef = useRef(runWebdav)
+  useEffect(() => { runWebdavRef.current = runWebdav }, [runWebdav])
+
   useEffect(() => {
     // Persist only the non-secret WebDAV settings; the password stays
     // server-side/in-memory (see savedWebdav). Storage itself may be
@@ -4725,13 +4733,18 @@ export function MarketSection(props: MarketSectionProps) {
     try {
       localStorage.setItem(WEBDAV_STORAGE_KEY, JSON.stringify({ url: webdavUrl, username: webdavUser, auto: autoBackup }))
     } catch { /* storage unavailable — config just won't survive reload */ }
-    if (!autoBackup || webdavUrl.trim() === '') return
+  }, [autoBackup, webdavUrl, webdavUser])
+
+  // Check when the market opens or daily backup is enabled. Editing the
+  // settings (or changing the locale) must not start another upload.
+  useEffect(() => {
+    if (!autoBackup) return
     let last = 0
     try {
       last = Number(localStorage.getItem('dshm-webdav-last')) || 0
     } catch { /* ignore */ }
-    if (Date.now() - last >= 24 * 60 * 60 * 1000) runWebdav('backup')
-  }, [autoBackup, runWebdav, webdavUrl, webdavUser])
+    if (Date.now() - last >= 24 * 60 * 60 * 1000) runWebdavRef.current('backup')
+  }, [autoBackup])
 
   // #558: count restart-pending session changes (restartNames), not every
   // completed `updatedNames` entry (which would double-count a batch update
@@ -6067,6 +6080,12 @@ export function MarketSection(props: MarketSectionProps) {
                     ]}
                   />
                   <Input className={css.backupInput} icon={<IconLinkOutline14 size={14} />} type="url" value={webdavUrl} placeholder={t('webdavUrl')} onChange={e => setWebdavUrl(e.target.value)} />
+                  {/* The field had a placeholder and nothing else, so "is this a
+                      folder or a file?" was answered only by trying it — and a
+                      reporter who read it as a folder expected the market to
+                      name the file (#868). Name the shape, and say why the
+                      name has to stay put: restore looks for that same one. */}
+                  <p>{t('webdavPathHint')}</p>
                   <Input className={css.backupInput} autoComplete="username" value={webdavUser} placeholder={t('webdavUser')} onChange={e => setWebdavUser(e.target.value)} />
                   <Input className={css.backupInput} type="password" autoComplete="current-password" value={webdavPassword} placeholder={t('webdavPassword')} onChange={e => setWebdavPassword(e.target.value)} />
                   <div className={css.backupActions}>
@@ -7631,7 +7650,9 @@ export function MarketSection(props: MarketSectionProps) {
             )
             : updateNotes.kind === 'source' ? (
               <div className={css.spec}>
-                {t(updateNotes.reason === 'unavailable' ? 'notesLoadFail' : 'notesSource')}
+                {t(updateNotes.reason === 'unavailable'
+                  ? 'notesLoadFail'
+                  : updateNotes.reason === 'unreadable' ? 'notesSourceUnreadable' : 'notesSource')}
                 {typeof updateNotes.sourceUrl === 'string' && /^https?:\/\//i.test(updateNotes.sourceUrl)
                   ? <>{lang === 'zh' ? '' : ' '}<a className={css.notesSourceLink} href={updateNotes.sourceUrl} target="_blank" rel="noreferrer">{t('notesSourceLink')}</a></>
                   : updateNotes.reason !== 'unavailable' && <>{lang === 'zh' ? '' : ' '}{t('notesSourceNoLink')}</>}

package/src/client/locales.ts

@@ -198,6 +198,7 @@ export const zh = {
   notesNpm: '版本发布时间',
   notesNone: '该插件未提供更新说明。',
   notesSource: '市场还没收录这个插件的更新说明。',
+  notesSourceUnreadable: '这个插件不是从 GitHub 装的，市场读不到它的改动记录。',
   notesSourceLink: '去仓库看改了什么',
   notesSourceNoLink: '可以问问插件作者改了什么。',
   notesLoadFail: '暂时读不到更新说明，稍后再试。',
@@ -398,6 +399,7 @@ export const zh = {
   webdavRestore: '从 WebDAV 恢复',
   autoBackup: '每天自动备份（打开市场时）',
   webdavNote: 'WebDAV 地址与用户名仅保存在当前浏览器；密码只存于服务端，每次会话需重新输入。',
+  webdavPathHint: '填完整的文件地址（含文件名）：备份写进这个文件，恢复也从它读。开启自动备份后每天最多上传一次。',
   localOnly: 'WebDAV 地址和用户名只保存在此浏览器。',
   credsWarning: '请注意：备份包含 profile 配置，以及可能含密钥的文件（config.toml、.env 等）。本地导出的文件会原样包含这些内容，上传 WebDAV 前请确认目标可信。',
   gist: 'GitHub Gist',
@@ -935,6 +937,7 @@ export const en: Record<MarketKey, string> = {
   notesNpm: 'Version publish times',
   notesNone: 'This plugin does not publish update notes.',
   notesSource: "The market doesn't have update notes for this plugin yet.",
+  notesSourceUnreadable: 'This plugin was not installed from GitHub, so the market cannot read its change history.',
   notesSourceLink: 'See what changed in the repository',
   notesSourceNoLink: 'You can ask the plugin author what changed.',
   notesLoadFail: 'Update notes are unavailable right now — try again later.',
@@ -1129,6 +1132,7 @@ export const en: Record<MarketKey, string> = {
   webdavRestore: 'Restore from WebDAV',
   autoBackup: 'Back up daily (when the market opens)',
   webdavNote: 'The WebDAV URL and username stay in this browser only; the password is kept server-side and must be re-entered each session.',
+  webdavPathHint: 'Give the whole file path, name included: the backup writes that file and restore reads it back. With automatic backup on it uploads at most once a day.',
   localOnly: 'The WebDAV URL and username stay in this browser only.',
   credsWarning: 'Note: backups include profile configuration and files that may hold secrets (config.toml, .env, …). Local exports are unmodified, so upload only to a WebDAV target you trust.',
   gist: 'GitHub Gist',

package/src/verify.ts

@@ -27,14 +27,15 @@
  *   missing – not present in node_modules
  */
 
-import { readFileSync } from 'node:fs'
+import { readFileSync, realpathSync, statSync } from 'node:fs'
+import { createRequire, isBuiltin } from 'node:module'
 import { Script } from 'node:vm'
 import { join } from 'node:path'
 import { listHotMounts, parseSimplePatch } from './hot.ts'
 import { userPatchPackageReferences } from './patch.ts'
 import { nameMatchesPackage } from './entry-identity.ts'
 import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, profileDir, readInstalled } from './profile.ts'
-import { compareSemver, parsePatchFile, satisfiesRange } from './check.ts'
+import { compareSemver, composeLayers, parsePatchFile, satisfiesRange } from './check.ts'
 import { dshHostInfo } from './dsh-install.ts'
 
 export type ActivationState = 'live' | 'restart' | 'incompatible' | 'inert' | 'broken' | 'missing' | 'disabled'
@@ -247,11 +248,16 @@ const isDshPeer = (peer: string): boolean => peer === '@deepseek-ai/dsh' || peer
  * peers fail at once.
  */
 export function hostPeerGate(activeProfileDir: string, name: string, facts: HostRuntimeFacts): PeerGate | null {
+  return peerGateAt(join(activeProfileDir, 'node_modules', name), name, facts)
+}
+
+/** Same prediction for a patch plugin resolved outside the profile's flat node_modules. */
+function peerGateAt(packageDir: string, name: string, facts: HostRuntimeFacts): PeerGate | null {
   if (facts.runtimeVersion === null) return null
   let manifest: { version?: unknown; peerDependencies?: Record<string, unknown> }
   try {
     manifest = JSON.parse(
-      readFileSync(join(activeProfileDir, 'node_modules', name, 'package.json'), 'utf8'),
+      readFileSync(join(packageDir, 'package.json'), 'utf8'),
     )
   } catch {
     return null
@@ -278,6 +284,72 @@ export function hostPeerGate(activeProfileDir: string, name: string, facts: Host
   return null
 }
 
+/**
+ * #867: only the bundle's own effective loader rows are evidence, never its
+ * ordinary dependency closure or arbitrary names in plugin configuration.
+ * Compose every declared file together so later disables take effect. An
+ * unreadable file or an expression-gated row gives no rejection evidence.
+ */
+function bundleRowPeerGate(
+  packageDir: string,
+  activeProfileDir: string,
+  facts: HostRuntimeFacts,
+): { name: string; gate: PeerGate } | null {
+  if (facts.runtimeVersion === null) return null
+  try {
+    const patches = declaredBundlePatchFiles(packageDir).map(parsePatchFile)
+    if (patches.some(rows => rows === null)) return null
+    const { resolvableRows } = composeLayers([{
+      label: 'bundle', kind: 'bundle', patches: patches.flatMap(rows => rows ?? []), parseError: null,
+    }])
+    const checked = new Set<string>()
+    for (const row of resolvableRows) {
+      if (row.activation !== 'required' || typeof row.name !== 'string') continue
+      // Bare npm names and subpath entries only. Relative files, builtins,
+      // aliases and expressions need runtime resolution; do not guess.
+      if (/^[.#/\\]|[:\\]/u.test(row.name) || isBuiltin(row.name)) continue
+      const parts = row.name.split('/')
+      const name = parts.slice(0, row.name.startsWith('@') ? 2 : 1).join('/')
+      if (!/^(?:@[\w.-]+\/)?[\w-][\w.-]*$/u.test(name) || checked.has(name)) continue
+      checked.add(name)
+      const directory = resolveBundleRowPackage(packageDir, activeProfileDir, name)
+      if (directory === null) continue
+      const gate = peerGateAt(directory, name, facts)
+      if (gate !== null) return { name, gate }
+    }
+  } catch { /* malformed or cyclic patch data — no reliable prediction */ }
+  return null
+}
+
+/**
+ * Probe Node's search paths, without resolving an entry or requiring a
+ * package.json export. The real bundle path reaches pnpm's adjacent and
+ * nested dependencies; the profile anchor also covers workspace hoisting.
+ * Stop at a present directory even if its manifest is missing: a broken
+ * nearer copy must not borrow an incompatible manifest from a fallback.
+ */
+function resolveBundleRowPackage(packageDir: string, activeProfileDir: string, name: string): string | null {
+  const bundleAnchor = join(realpathSync(packageDir), 'package.json')
+  const manifest = JSON.parse(readFileSync(bundleAnchor, 'utf8')) as {
+    name?: string; dependencies?: Record<string, unknown>; peerDependencies?: Record<string, unknown>
+  }
+  // The host publishes dependencies carried by selected bundles into its
+  // profile resolution. A stray nested copy not declared by this bundle is
+  // no evidence of what a profile row will import.
+  const carried = manifest.name === name || Object.hasOwn(manifest.dependencies ?? {}, name)
+    || Object.hasOwn(manifest.peerDependencies ?? {}, name)
+  const profileAnchor = join(activeProfileDir, 'package.json')
+  for (const anchor of carried ? [bundleAnchor, profileAnchor] : [profileAnchor]) {
+    for (const searchPath of createRequire(anchor).resolve.paths(name) ?? []) {
+      const candidate = join(searchPath, name)
+      try {
+        if (statSync(candidate).isDirectory()) return candidate
+      } catch { /* try the next Node search path */ }
+    }
+  }
+  return null
+}
+
 /** The way out of a peer gate, in the direction the versions allow (#758). */
 export function peerGateRemedy(gate: PeerGate): { zh: string; en: string } {
   if (gate.hostTooOld) {
@@ -467,7 +539,8 @@ export function verifyActivation(
     // range excludes the running runtime — predict that verdict here so
     // the plugin reads as incompatible instead of promising a restart
     // that cannot fix it.
-    const gate = hostPeerGate(activeProfileDir, name, hostFacts ?? defaultHostRuntimeFacts(activeProfileDir))
+    const facts = hostFacts ?? defaultHostRuntimeFacts(activeProfileDir)
+    const gate = hostPeerGate(activeProfileDir, name, facts)
     if (gate !== null) {
       const remedy = peerGateRemedy(gate)
       return {
@@ -479,6 +552,21 @@ export function verifyActivation(
         hot: false,
       }
     }
+    const child = bundleRowPeerGate(dir, activeProfileDir, facts)
+    if (child !== null) {
+      const { gate, name: plugin } = child
+      const remedy = gate.hostTooOld
+        ? { zh: '升级 dsh，或更新此插件包以匹配当前 dsh', en: 'upgrade dsh, or update this bundle to match the current dsh' }
+        : { zh: '更新此插件包，或安装与当前 dsh 兼容的版本；升级 dsh 解决不了', en: 'update this bundle or install a version compatible with the current dsh — upgrading dsh will not help' }
+      return {
+        state: 'incompatible',
+        reasons: [
+          `它加载的插件 ${plugin} 要求 ${gate.peer} ${gate.range}，当前 dsh 为 ${gate.runtimeVersion}，重启也不会生效；${remedy.zh} / its plugin ${plugin} requires ${gate.peer} ${gate.range}, but dsh runs ${gate.runtimeVersion} — a restart will not activate it; ${remedy.en}`,
+        ],
+        bundle: true,
+        hot: false,
+      }
+    }
     const patch = patchTextOf(profile, name, activeProfileDir)
     const complex = patch !== null && parseSimplePatch(patch) === null
     return {