dshmarket 1.66.25 → 1.66.26

package/lib/check.js

@@ -313,6 +313,33 @@ function parseSemver(value) {
         pre: m[4] === undefined ? [] : m[4].split('.'),
     };
 }
+/**
+ * Parse a comparator's target the way node-semver does: a PARTIAL version in
+ * a range is zero-filled, so `<0.3` is `<0.3.0` and `>=2` is `>=2.0.0`.
+ *
+ * Without this, every prerelease floor written as a partial — the
+ * `@deepseek-ai/dsh-*` peers of a whole family of connector plugins say
+ * `>=0.1.5 <0.3`, `>=0.1.7-rc <2`, `>=0.2.0-rc.0 <0.3` — parsed as unknown,
+ * `satisfiesRange` answered null, and the gate stood aside: measured against
+ * the host's own evaluator over 699 live catalog manifests, those were the
+ * last 7 of 2796 (package, runtime) pairs where the host refuses a plugin
+ * and the market still promised a restart would apply it.
+ *
+ * A BARE partial (`1.2`) is a different thing in semver — an x-range that
+ * means `>=1.2.0 <1.3.0` — so it deliberately stays unknown here rather than
+ * being mistaken for the exact version `1.2.0`.
+ */
+function parseComparatorTarget(target, op) {
+    const direct = parseSemver(target);
+    if (direct !== null)
+        return direct;
+    if (op === '')
+        return null;
+    const parts = target.trim().split('.');
+    if (parts.length > 3 || parts.some(part => !/^\d+$/u.test(part)))
+        return null;
+    return parseSemver([...parts, ...Array(3 - parts.length).fill('0')].join('.'));
+}
 function comparePre(a, b) {
     const len = Math.max(a.length, b.length);
     for (let i = 0; i < len; i += 1) {
@@ -441,7 +468,7 @@ export function satisfiesRange(version, range, options = {}) {
         const m = /^(\^|~|>=|<=|>|<)?(.*)$/.exec(p);
         const op = m?.[1] ?? '';
         const target = (m?.[2] ?? '').trim();
-        const tv = parseSemver(target);
+        const tv = parseComparatorTarget(target, op);
         if (tv === null)
             return null;
         const major = tv.major;
@@ -488,7 +515,7 @@ export function satisfiesRange(version, range, options = {}) {
         // prerelease admission gate. Otherwise an unknown protocol such as
         // `workspace:^` or `catalog:default` is misreported as a definite false
         // whenever the resolved version happens to carry a prerelease tag.
-        if (parseSemver(target) === null)
+        if (parseComparatorTarget(target, m[1] ?? '') === null)
             return null;
         return { op: m[1] ?? '', target };
     };

package/lib/verify.js

@@ -186,6 +186,19 @@ const isDshPeer = (peer) => peer === '@deepseek-ai/dsh' || peer.startsWith('@dee
 export function hostPeerGate(activeProfileDir, name, facts) {
     return peerGateAt(join(activeProfileDir, 'node_modules', name), name, facts);
 }
+/**
+ * The unmet requirement, if any, and the remedy side it points at.
+ *
+ * Which side of the range the runtime sits on decides the remedy: below the
+ * floor, upgrading the host genuinely helps; above the cap (#757's own
+ * shape) no upgrade can satisfy it, and suggesting one points the wrong way
+ * (#758).
+ */
+function unmetOf(peer, range, runtimeVersion) {
+    const floor = /[0-9]+\.[0-9]+\.[0-9]+[-+0-9A-Za-z.]*/.exec(range);
+    const hostTooOld = floor !== null && compareSemver(runtimeVersion, floor[0]) < 0;
+    return { peer, range, runtimeVersion, hostTooOld };
+}
 /** Same prediction for a patch plugin resolved outside the profile's flat node_modules. */
 function peerGateAt(packageDir, name, facts) {
     if (facts.runtimeVersion === null)
@@ -201,22 +214,33 @@ function peerGateAt(packageDir, name, facts) {
     if (version !== '' && (facts.exemptions[`${name}@${version}`] ?? []).includes(facts.runtimeVersion)) {
         return null;
     }
+    // An own `engines.dsh` range decides ALONE and peerDependencies are then
+    // ignored — the host's rule, read from unmetRequirements in
+    // @deepseek-ai/dsh-app-boot, and the reason a gate that only read peers
+    // was too lenient on 62 of 2796 (package, runtime) pairs measured over the
+    // live catalog: `dsh-file-explorer-kit` (engines.dsh ^0.1.1) and
+    // `dsh-workspace-kit` (^0.1.2-rc.1) declare NO dsh peer at all, so the
+    // family that refuses them was invisible here and the card promised a
+    // restart the host would not honour. A non-string range throws inside the
+    // host's own evaluator; that is not a verdict this can predict, so the
+    // old answer stands (#757).
+    const engines = manifest.engines?.dsh;
+    if (engines !== undefined) {
+        if (typeof engines !== 'string')
+            return null;
+        const range = engines.trim();
+        // `workspace:` is substituted only for PEERS: the host counts it as an
+        // unmet range for engines, so an empty or invalid range stays unmet too.
+        const satisfied = range === '' ? false : satisfiesRange(facts.runtimeVersion, range, { includePrerelease: true });
+        return satisfied ? null : unmetOf('engines.dsh', range, facts.runtimeVersion);
+    }
     for (const [peer, requirement] of Object.entries(manifest.peerDependencies ?? {})) {
         if (!isDshPeer(peer) || typeof requirement !== 'string')
             continue;
         const range = requirement.trim();
         const satisfied = range === '' ? false : satisfiesRange(facts.runtimeVersion, range, { includePrerelease: true });
-        if (satisfied === false) {
-            // Which side of the range the runtime sits on decides the remedy:
-            // below the floor, upgrading the host genuinely helps; above the cap
-            // (#757's own shape) no upgrade can satisfy it, and suggesting one
-            // points the wrong way (#758).
-            const floor = /[0-9]+\.[0-9]+\.[0-9]+[-+0-9A-Za-z.]*/.exec(range);
-            let hostTooOld = false;
-            if (floor !== null)
-                hostTooOld = compareSemver(facts.runtimeVersion, floor[0]) < 0;
-            return { peer, range, runtimeVersion: facts.runtimeVersion, hostTooOld };
-        }
+        if (satisfied === false)
+            return unmetOf(peer, range, facts.runtimeVersion);
     }
     return null;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.25",
+  "version": "1.66.26",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/check.ts

@@ -520,6 +520,31 @@ function parseSemver(value: string): Semver | null {
   }
 }
 
+/**
+ * Parse a comparator's target the way node-semver does: a PARTIAL version in
+ * a range is zero-filled, so `<0.3` is `<0.3.0` and `>=2` is `>=2.0.0`.
+ *
+ * Without this, every prerelease floor written as a partial — the
+ * `@deepseek-ai/dsh-*` peers of a whole family of connector plugins say
+ * `>=0.1.5 <0.3`, `>=0.1.7-rc <2`, `>=0.2.0-rc.0 <0.3` — parsed as unknown,
+ * `satisfiesRange` answered null, and the gate stood aside: measured against
+ * the host's own evaluator over 699 live catalog manifests, those were the
+ * last 7 of 2796 (package, runtime) pairs where the host refuses a plugin
+ * and the market still promised a restart would apply it.
+ *
+ * A BARE partial (`1.2`) is a different thing in semver — an x-range that
+ * means `>=1.2.0 <1.3.0` — so it deliberately stays unknown here rather than
+ * being mistaken for the exact version `1.2.0`.
+ */
+function parseComparatorTarget(target: string, op: string): Semver | null {
+  const direct = parseSemver(target)
+  if (direct !== null) return direct
+  if (op === '') return null
+  const parts = target.trim().split('.')
+  if (parts.length > 3 || parts.some(part => !/^\d+$/u.test(part))) return null
+  return parseSemver([...parts, ...Array<string>(3 - parts.length).fill('0')].join('.'))
+}
+
 function comparePre(a: string[], b: string[]): number {
   const len = Math.max(a.length, b.length)
   for (let i = 0; i < len; i += 1) {
@@ -643,7 +668,7 @@ export function satisfiesRange(
     const m = /^(\^|~|>=|<=|>|<)?(.*)$/.exec(p)
     const op = m?.[1] ?? ''
     const target = (m?.[2] ?? '').trim()
-    const tv = parseSemver(target)
+    const tv = parseComparatorTarget(target, op)
     if (tv === null) return null
     const major = tv.major
     const minor = tv.minor
@@ -688,7 +713,7 @@ export function satisfiesRange(
     // prerelease admission gate. Otherwise an unknown protocol such as
     // `workspace:^` or `catalog:default` is misreported as a definite false
     // whenever the resolved version happens to carry a prerelease tag.
-    if (parseSemver(target) === null) return null
+    if (parseComparatorTarget(target, m[1] ?? '') === null) return null
     return { op: m[1] ?? '', target }
   }
 

package/src/verify.ts

@@ -251,10 +251,28 @@ export function hostPeerGate(activeProfileDir: string, name: string, facts: Host
   return peerGateAt(join(activeProfileDir, 'node_modules', name), name, facts)
 }
 
+/**
+ * The unmet requirement, if any, and the remedy side it points at.
+ *
+ * Which side of the range the runtime sits on decides the remedy: below the
+ * floor, upgrading the host genuinely helps; above the cap (#757's own
+ * shape) no upgrade can satisfy it, and suggesting one points the wrong way
+ * (#758).
+ */
+function unmetOf(peer: string, range: string, runtimeVersion: string): PeerGate {
+  const floor = /[0-9]+\.[0-9]+\.[0-9]+[-+0-9A-Za-z.]*/.exec(range)
+  const hostTooOld = floor !== null && compareSemver(runtimeVersion, floor[0]) < 0
+  return { peer, range, runtimeVersion, hostTooOld }
+}
+
 /** Same prediction for a patch plugin resolved outside the profile's flat node_modules. */
 function peerGateAt(packageDir: string, name: string, facts: HostRuntimeFacts): PeerGate | null {
   if (facts.runtimeVersion === null) return null
-  let manifest: { version?: unknown; peerDependencies?: Record<string, unknown> }
+  let manifest: {
+    version?: unknown
+    engines?: Record<string, unknown>
+    peerDependencies?: Record<string, unknown>
+  }
   try {
     manifest = JSON.parse(
       readFileSync(join(packageDir, 'package.json'), 'utf8'),
@@ -266,20 +284,30 @@ function peerGateAt(packageDir: string, name: string, facts: HostRuntimeFacts):
   if (version !== '' && (facts.exemptions[`${name}@${version}`] ?? []).includes(facts.runtimeVersion)) {
     return null
   }
+  // An own `engines.dsh` range decides ALONE and peerDependencies are then
+  // ignored — the host's rule, read from unmetRequirements in
+  // @deepseek-ai/dsh-app-boot, and the reason a gate that only read peers
+  // was too lenient on 62 of 2796 (package, runtime) pairs measured over the
+  // live catalog: `dsh-file-explorer-kit` (engines.dsh ^0.1.1) and
+  // `dsh-workspace-kit` (^0.1.2-rc.1) declare NO dsh peer at all, so the
+  // family that refuses them was invisible here and the card promised a
+  // restart the host would not honour. A non-string range throws inside the
+  // host's own evaluator; that is not a verdict this can predict, so the
+  // old answer stands (#757).
+  const engines = manifest.engines?.dsh
+  if (engines !== undefined) {
+    if (typeof engines !== 'string') return null
+    const range = engines.trim()
+    // `workspace:` is substituted only for PEERS: the host counts it as an
+    // unmet range for engines, so an empty or invalid range stays unmet too.
+    const satisfied = range === '' ? false : satisfiesRange(facts.runtimeVersion, range, { includePrerelease: true })
+    return satisfied ? null : unmetOf('engines.dsh', range, facts.runtimeVersion)
+  }
   for (const [peer, requirement] of Object.entries(manifest.peerDependencies ?? {})) {
     if (!isDshPeer(peer) || typeof requirement !== 'string') continue
     const range = requirement.trim()
     const satisfied = range === '' ? false : satisfiesRange(facts.runtimeVersion, range, { includePrerelease: true })
-    if (satisfied === false) {
-      // Which side of the range the runtime sits on decides the remedy:
-      // below the floor, upgrading the host genuinely helps; above the cap
-      // (#757's own shape) no upgrade can satisfy it, and suggesting one
-      // points the wrong way (#758).
-      const floor = /[0-9]+\.[0-9]+\.[0-9]+[-+0-9A-Za-z.]*/.exec(range)
-      let hostTooOld = false
-      if (floor !== null) hostTooOld = compareSemver(facts.runtimeVersion, floor[0]) < 0
-      return { peer, range, runtimeVersion: facts.runtimeVersion, hostTooOld }
-    }
+    if (satisfied === false) return unmetOf(peer, range, facts.runtimeVersion)
   }
   return null
 }