dshmarket 1.66.25 → 1.66.27

package/client/client.js

@@ -510,6 +510,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			confirmInstall: "确认安装",
 			cmdDetails: "安装命令",
 			cmdCopy: "复制安装命令",
+			cmdDesktopUnavailable: "桌面端的插件由应用自己安装（用上面的「安装」按钮）；`dsh plugin` 不接受桌面端这个 profile。",
 			cmdCopied: "已复制",
 			catsMore: "更多分类",
 			catsLess: "收起",
@@ -523,7 +524,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			hostDetecting: "正在识别宿主版本…",
 			hostUnknown: "宿主版本未知",
 			hostFilterLoading: "正在检查宿主要求 {0}/{1}；未声明或无法确认的插件仍会显示",
-			hostFilterActive: "已按 DSH {0} 筛选；未声明或无法确认兼容性的插件仍会显示",
+			hostFilterActive: "已隐藏 {1} 个与 DSH {0} 不兼容的插件；未声明版本的仍在列表里",
 			hostRequirement: "DSH {0}",
 			hostRequirementLoading: "正在读取宿主要求…",
 			hostRequirementUndeclared: "未声明宿主要求",
@@ -1238,6 +1239,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			confirmInstall: "Confirm install",
 			cmdDetails: "Install command",
 			cmdCopy: "Copy install command",
+			cmdDesktopUnavailable: "The desktop app installs plugins itself — use the Install button above; `dsh plugin` refuses this profile.",
 			cmdCopied: "Copied",
 			catsMore: "More categories",
 			catsLess: "Fewer categories",
@@ -1251,7 +1253,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			hostDetecting: "Detecting host version…",
 			hostUnknown: "Host version unknown",
 			hostFilterLoading: "Checking host requirements {0}/{1}; undeclared or unavailable plugins remain visible",
-			hostFilterActive: "Filtered for DSH {0}; undeclared or unconfirmed plugins remain visible",
+			hostFilterActive: "Hid {1} plugins incompatible with DSH {0}; those declaring no version stay listed",
 			hostRequirement: "DSH {0}",
 			hostRequirementLoading: "Reading host requirement…",
 			hostRequirementUndeclared: "Host requirement undeclared",
@@ -1901,6 +1903,53 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			if (state.supervisor !== null) return "restartHintSupervised";
 			return "restartHint";
 		}
+		/**
+		* The install command shown on a plugin's card, corrected for THIS profile
+		* (#872).
+		*
+		* awesome-dsh-plugin generates the string once, for the catalog — always
+		* `dsh plugin --profile web add <spec>` — which is right on a `web` profile
+		* and wrong on every other one. On a desktop profile it is more than wrong:
+		* the DSH CLI refuses a profile by that name, so the command as printed
+		* cannot install anything there at all. Two outcomes, and the caller renders
+		* them differently because the user's next step differs:
+		*
+		* - `command`: the text to show and copy, with the profile it names corrected;
+		* - `unusable`: show no command at all (the market's own button is the way),
+		*   because handing over a command that cannot work is worse than handing
+		*   over none.
+		*
+		* A command with no `--profile` token is passed through untouched: it is not
+		* this function's business to add one.
+		*/
+		function installCommandFor(command, profile) {
+			if (typeof command !== "string" || command.trim() === "") return {
+				command: null,
+				unusable: false
+			};
+			const named = /--profile(?:=|\s+)(\S+)/u.exec(command);
+			if (named === null) return {
+				command,
+				unusable: false
+			};
+			const wanted = typeof profile === "string" ? profile.trim() : "";
+			if (wanted === "") return {
+				command,
+				unusable: false
+			};
+			if (wanted.toLowerCase() === "desktop") return {
+				command: null,
+				unusable: true
+			};
+			if (named[1] === wanted) return {
+				command,
+				unusable: false
+			};
+			return {
+				command: command.replace(named[0], `--profile ${wanted}`),
+				unusable: false
+			};
+		}
 		function groupSwitchState(members, disabled) {
 			const list = members ?? [];
 			if (list.length === 0) return "empty";
@@ -8258,6 +8307,21 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const names = body.runningAgents.map(String).filter((name) => name !== "");
 			return names.length === 0 ? void 0 : names;
 		}
+		/**
+		* Whether the "compatible with this host" filter starts on, and remembers the
+		* answer once the user disagrees with the default (#872).
+		*
+		* Storage may be unavailable (private mode, a locked-down webview); the
+		* default is what matters, so a failure to read it is not a failure.
+		*/
+		const HOST_FILTER_KEY = "dshm-host-filter";
+		function readHostFilterPreference() {
+			try {
+				return localStorage.getItem(HOST_FILTER_KEY) !== "all";
+			} catch {
+				return true;
+			}
+		}
 		function MarketSection(props) {
 			const t = props.t;
 			const initialWebdav = (0, react.useMemo)(savedWebdav, []);
@@ -8811,7 +8875,16 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			/** Undefined while the first catalog response is pending; null means the host cannot be located. */
 			const [hostVersion, setHostVersion] = (0, react.useState)(void 0);
 			/** v1 is deliberately opt-in: undeclared/unknown entries stay visible even when enabled. */
-			const [compatibleWithHost, setCompatibleWithHost] = (0, react.useState)(false);
+			const [compatibleWithHost, setCompatibleWithHostState] = (0, react.useState)(readHostFilterPreference);
+			const setCompatibleWithHost = (0, react.useCallback)((next) => {
+				setCompatibleWithHostState(next);
+				try {
+					localStorage.setItem(HOST_FILTER_KEY, next ? "compatible" : "all");
+				} catch {}
+			}, []);
+			/** The profile this page is running in, for the manual command's own
+			* `--profile` token (#872). The catalog's is always `web`. */
+			const [profileName, setProfileName] = (0, react.useState)(null);
 			const [hostCompatibility, setHostCompatibility] = (0, react.useState)({});
 			const [hostCompatibilityPending, setHostCompatibilityPending] = (0, react.useState)(0);
 			/** Names already resolved or in flight; failed/unavailable names are released for an explicit retry. */
@@ -8880,6 +8953,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					}
 					if (body.notes !== null && typeof body.notes === "object" && !Array.isArray(body.notes)) setNotes(body.notes);
 					if (Array.isArray(body.patchDisabled)) setPatchDisabledNames(body.patchDisabled);
+					if (typeof body.profile === "string") setProfileName(body.profile);
 					if (Array.isArray(body.unbundled)) setUnbundledNames(body.unbundled);
 					setConfigNamespaceIssues(Array.isArray(body.configNamespaces) ? body.configNamespaces.filter((item) => typeof item === "object" && item !== null && typeof item.name === "string" && Array.isArray(item.namespaces)) : []);
 					if (body.groups && typeof body.groups === "object") setGroups(body.groups);
@@ -9250,16 +9324,37 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				qInstalled,
 				installedView
 			]);
-			const pluginsAll = (0, react.useMemo)(() => data === null ? [] : visiblePlugins(data.plugins, {
-				category: cat,
-				query: q,
-				lang,
-				categories: data.categories,
-				sort: `${sortField}-${sortDir}`,
-				sinceDays: timeRange === "all" ? void 0 : TIME_RANGE_DAYS[timeRange],
-				hostCompatibility,
-				compatibleWithHost
-			}), [
+			const { plugins: pluginsAll, hostHiddenCount } = (0, react.useMemo)(() => {
+				if (data === null) return {
+					plugins: [],
+					hostHiddenCount: 0
+				};
+				const query = {
+					category: cat,
+					query: q,
+					lang,
+					categories: data.categories,
+					sort: `${sortField}-${sortDir}`,
+					sinceDays: timeRange === "all" ? void 0 : TIME_RANGE_DAYS[timeRange],
+					hostCompatibility
+				};
+				const unfiltered = visiblePlugins(data.plugins, {
+					...query,
+					compatibleWithHost: false
+				});
+				if (!compatibleWithHost) return {
+					plugins: unfiltered,
+					hostHiddenCount: 0
+				};
+				const filtered = visiblePlugins(data.plugins, {
+					...query,
+					compatibleWithHost: true
+				});
+				return {
+					plugins: filtered,
+					hostHiddenCount: unfiltered.length - filtered.length
+				};
+			}, [
 				data,
 				q,
 				cat,
@@ -12871,7 +12966,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 										})]
 									}), compatibleWithHost && typeof hostVersion === "string" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 										className: Market_module_css_default.hostFilterNote,
-										children: hostCompatibilityPending > 0 || loadedHostPackages < allHostPackages.length ? t("hostFilterLoading").replace("{0}", String(loadedHostPackages)).replace("{1}", String(allHostPackages.length)) : t("hostFilterActive").replace("{0}", hostVersion)
+										children: hostCompatibilityPending > 0 || loadedHostPackages < allHostPackages.length ? t("hostFilterLoading").replace("{0}", String(loadedHostPackages)).replace("{1}", String(allHostPackages.length)) : t("hostFilterActive").replace("{0}", hostVersion).replace("{1}", String(hostHiddenCount))
 									})]
 								})]
 							}),
@@ -14124,17 +14219,28 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 										title: t("cmdDetails"),
 										open: cmdOpen,
 										onToggle: () => setCmdOpen((o) => !o),
-										children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-											className: Market_module_css_default.confirmCmd,
-											children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-												className: Market_module_css_default.cmd,
-												children: confirming.install
-											}), typeof confirming.install === "string" && confirming.install !== "" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ConfirmCopyButton, {
-												text: confirming.install,
-												label: t("cmdCopy"),
-												copiedLabel: t("cmdCopied")
-											})]
-										})
+										children: (() => {
+											const shown = installCommandFor(confirming.install, profileName);
+											if (shown.unusable) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+												className: Market_module_css_default.confirmCmd,
+												children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+													className: Market_module_css_default.cmd,
+													children: t("cmdDesktopUnavailable")
+												})
+											});
+											if (shown.command === null) return null;
+											return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+												className: Market_module_css_default.confirmCmd,
+												children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+													className: Market_module_css_default.cmd,
+													children: shown.command
+												}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ConfirmCopyButton, {
+													text: shown.command,
+													label: t("cmdCopy"),
+													copiedLabel: t("cmdCopied")
+												})]
+											});
+										})()
 									})]
 								}),
 								(looksTerminal(confirming, lang) || confirming.deprecated === true) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {

package/lib/check.js

@@ -313,6 +313,33 @@ function parseSemver(value) {
         pre: m[4] === undefined ? [] : m[4].split('.'),
     };
 }
+/**
+ * Parse a comparator's target the way node-semver does: a PARTIAL version in
+ * a range is zero-filled, so `<0.3` is `<0.3.0` and `>=2` is `>=2.0.0`.
+ *
+ * Without this, every prerelease floor written as a partial — the
+ * `@deepseek-ai/dsh-*` peers of a whole family of connector plugins say
+ * `>=0.1.5 <0.3`, `>=0.1.7-rc <2`, `>=0.2.0-rc.0 <0.3` — parsed as unknown,
+ * `satisfiesRange` answered null, and the gate stood aside: measured against
+ * the host's own evaluator over 699 live catalog manifests, those were the
+ * last 7 of 2796 (package, runtime) pairs where the host refuses a plugin
+ * and the market still promised a restart would apply it.
+ *
+ * A BARE partial (`1.2`) is a different thing in semver — an x-range that
+ * means `>=1.2.0 <1.3.0` — so it deliberately stays unknown here rather than
+ * being mistaken for the exact version `1.2.0`.
+ */
+function parseComparatorTarget(target, op) {
+    const direct = parseSemver(target);
+    if (direct !== null)
+        return direct;
+    if (op === '')
+        return null;
+    const parts = target.trim().split('.');
+    if (parts.length > 3 || parts.some(part => !/^\d+$/u.test(part)))
+        return null;
+    return parseSemver([...parts, ...Array(3 - parts.length).fill('0')].join('.'));
+}
 function comparePre(a, b) {
     const len = Math.max(a.length, b.length);
     for (let i = 0; i < len; i += 1) {
@@ -441,7 +468,7 @@ export function satisfiesRange(version, range, options = {}) {
         const m = /^(\^|~|>=|<=|>|<)?(.*)$/.exec(p);
         const op = m?.[1] ?? '';
         const target = (m?.[2] ?? '').trim();
-        const tv = parseSemver(target);
+        const tv = parseComparatorTarget(target, op);
         if (tv === null)
             return null;
         const major = tv.major;
@@ -488,7 +515,7 @@ export function satisfiesRange(version, range, options = {}) {
         // prerelease admission gate. Otherwise an unknown protocol such as
         // `workspace:^` or `catalog:default` is misreported as a definite false
         // whenever the resolved version happens to carry a prerelease tag.
-        if (parseSemver(target) === null)
+        if (parseComparatorTarget(target, m[1] ?? '') === null)
             return null;
         return { op: m[1] ?? '', target };
     };

package/lib/verify.js

@@ -186,6 +186,19 @@ const isDshPeer = (peer) => peer === '@deepseek-ai/dsh' || peer.startsWith('@dee
 export function hostPeerGate(activeProfileDir, name, facts) {
     return peerGateAt(join(activeProfileDir, 'node_modules', name), name, facts);
 }
+/**
+ * The unmet requirement, if any, and the remedy side it points at.
+ *
+ * Which side of the range the runtime sits on decides the remedy: below the
+ * floor, upgrading the host genuinely helps; above the cap (#757's own
+ * shape) no upgrade can satisfy it, and suggesting one points the wrong way
+ * (#758).
+ */
+function unmetOf(peer, range, runtimeVersion) {
+    const floor = /[0-9]+\.[0-9]+\.[0-9]+[-+0-9A-Za-z.]*/.exec(range);
+    const hostTooOld = floor !== null && compareSemver(runtimeVersion, floor[0]) < 0;
+    return { peer, range, runtimeVersion, hostTooOld };
+}
 /** Same prediction for a patch plugin resolved outside the profile's flat node_modules. */
 function peerGateAt(packageDir, name, facts) {
     if (facts.runtimeVersion === null)
@@ -201,22 +214,33 @@ function peerGateAt(packageDir, name, facts) {
     if (version !== '' && (facts.exemptions[`${name}@${version}`] ?? []).includes(facts.runtimeVersion)) {
         return null;
     }
+    // An own `engines.dsh` range decides ALONE and peerDependencies are then
+    // ignored — the host's rule, read from unmetRequirements in
+    // @deepseek-ai/dsh-app-boot, and the reason a gate that only read peers
+    // was too lenient on 62 of 2796 (package, runtime) pairs measured over the
+    // live catalog: `dsh-file-explorer-kit` (engines.dsh ^0.1.1) and
+    // `dsh-workspace-kit` (^0.1.2-rc.1) declare NO dsh peer at all, so the
+    // family that refuses them was invisible here and the card promised a
+    // restart the host would not honour. A non-string range throws inside the
+    // host's own evaluator; that is not a verdict this can predict, so the
+    // old answer stands (#757).
+    const engines = manifest.engines?.dsh;
+    if (engines !== undefined) {
+        if (typeof engines !== 'string')
+            return null;
+        const range = engines.trim();
+        // `workspace:` is substituted only for PEERS: the host counts it as an
+        // unmet range for engines, so an empty or invalid range stays unmet too.
+        const satisfied = range === '' ? false : satisfiesRange(facts.runtimeVersion, range, { includePrerelease: true });
+        return satisfied ? null : unmetOf('engines.dsh', range, facts.runtimeVersion);
+    }
     for (const [peer, requirement] of Object.entries(manifest.peerDependencies ?? {})) {
         if (!isDshPeer(peer) || typeof requirement !== 'string')
             continue;
         const range = requirement.trim();
         const satisfied = range === '' ? false : satisfiesRange(facts.runtimeVersion, range, { includePrerelease: true });
-        if (satisfied === false) {
-            // Which side of the range the runtime sits on decides the remedy:
-            // below the floor, upgrading the host genuinely helps; above the cap
-            // (#757's own shape) no upgrade can satisfy it, and suggesting one
-            // points the wrong way (#758).
-            const floor = /[0-9]+\.[0-9]+\.[0-9]+[-+0-9A-Za-z.]*/.exec(range);
-            let hostTooOld = false;
-            if (floor !== null)
-                hostTooOld = compareSemver(facts.runtimeVersion, floor[0]) < 0;
-            return { peer, range, runtimeVersion: facts.runtimeVersion, hostTooOld };
-        }
+        if (satisfied === false)
+            return unmetOf(peer, range, facts.runtimeVersion);
     }
     return null;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.25",
+  "version": "1.66.27",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/check.ts

@@ -520,6 +520,31 @@ function parseSemver(value: string): Semver | null {
   }
 }
 
+/**
+ * Parse a comparator's target the way node-semver does: a PARTIAL version in
+ * a range is zero-filled, so `<0.3` is `<0.3.0` and `>=2` is `>=2.0.0`.
+ *
+ * Without this, every prerelease floor written as a partial — the
+ * `@deepseek-ai/dsh-*` peers of a whole family of connector plugins say
+ * `>=0.1.5 <0.3`, `>=0.1.7-rc <2`, `>=0.2.0-rc.0 <0.3` — parsed as unknown,
+ * `satisfiesRange` answered null, and the gate stood aside: measured against
+ * the host's own evaluator over 699 live catalog manifests, those were the
+ * last 7 of 2796 (package, runtime) pairs where the host refuses a plugin
+ * and the market still promised a restart would apply it.
+ *
+ * A BARE partial (`1.2`) is a different thing in semver — an x-range that
+ * means `>=1.2.0 <1.3.0` — so it deliberately stays unknown here rather than
+ * being mistaken for the exact version `1.2.0`.
+ */
+function parseComparatorTarget(target: string, op: string): Semver | null {
+  const direct = parseSemver(target)
+  if (direct !== null) return direct
+  if (op === '') return null
+  const parts = target.trim().split('.')
+  if (parts.length > 3 || parts.some(part => !/^\d+$/u.test(part))) return null
+  return parseSemver([...parts, ...Array<string>(3 - parts.length).fill('0')].join('.'))
+}
+
 function comparePre(a: string[], b: string[]): number {
   const len = Math.max(a.length, b.length)
   for (let i = 0; i < len; i += 1) {
@@ -643,7 +668,7 @@ export function satisfiesRange(
     const m = /^(\^|~|>=|<=|>|<)?(.*)$/.exec(p)
     const op = m?.[1] ?? ''
     const target = (m?.[2] ?? '').trim()
-    const tv = parseSemver(target)
+    const tv = parseComparatorTarget(target, op)
     if (tv === null) return null
     const major = tv.major
     const minor = tv.minor
@@ -688,7 +713,7 @@ export function satisfiesRange(
     // prerelease admission gate. Otherwise an unknown protocol such as
     // `workspace:^` or `catalog:default` is misreported as a definite false
     // whenever the resolved version happens to carry a prerelease tag.
-    if (parseSemver(target) === null) return null
+    if (parseComparatorTarget(target, m[1] ?? '') === null) return null
     return { op: m[1] ?? '', target }
   }
 

package/src/client/MarketSection.tsx

@@ -51,6 +51,7 @@ import type { OperationRecord } from './operations.ts'
 import { Diagnostics } from './Diagnostics.tsx'
 import { exportMarketLog } from './self-check.ts'
 import {
+  installCommandFor,
   api, applyGithubRouting, avatarColor, catalogEntryForInstalled, entryForDep, failureText, githubRouteCandidates, groupSwitchState, installedForCatalog, isGenerationSpec, isInstalled, localizeBilingual, localizeBilingualList, looksTerminal, matchInstalledName, orderedCategories, pluginCategories,
   formatCount, pageItems, pluginName, blockAliases, pluginScreenshotCandidates, pluginScreenshots, pluginsForFavorites, queuedRowApplies, rankThemeScreenshots, readSession, releaseNotesHttpsImage, rememberGithubRoute, resetScreenshotsCache, resolveCatalogRestore, safeScreenshots, sanitizeReleaseNotesBody, staleFavoriteUrls, themePlugins as themePluginsOf, themeSwatch, TIME_RANGE_DAYS, visiblePlugins, restartHintKey,
 } from './market-data.ts'
@@ -1723,6 +1724,18 @@ function blockedSessions(body: { runningAgents?: unknown }): string[] | undefine
   return names.length === 0 ? undefined : names
 }
 
+/**
+ * Whether the "compatible with this host" filter starts on, and remembers the
+ * answer once the user disagrees with the default (#872).
+ *
+ * Storage may be unavailable (private mode, a locked-down webview); the
+ * default is what matters, so a failure to read it is not a failure.
+ */
+const HOST_FILTER_KEY = 'dshm-host-filter'
+function readHostFilterPreference(): boolean {
+  try { return localStorage.getItem(HOST_FILTER_KEY) !== 'all' } catch { return true }
+}
+
 export function MarketSection(props: MarketSectionProps) {
   const t = props.t
   const initialWebdav = useMemo(savedWebdav, [])
@@ -2320,7 +2333,20 @@ export function MarketSection(props: MarketSectionProps) {
   /** Undefined while the first catalog response is pending; null means the host cannot be located. */
   const [hostVersion, setHostVersion] = useState<string | null | undefined>(undefined)
   /** v1 is deliberately opt-in: undeclared/unknown entries stay visible even when enabled. */
-  const [compatibleWithHost, setCompatibleWithHost] = useState(false)
+  // #872: ON by default. The report measured it on a live 0.2.0-rc.2 host —
+  // 175 discovered plugins, 45 of them declaring that host — so the default
+  // list was ~74% installable-in-name-only, with nothing at list level saying
+  // so. That is the wrong default per this project's own rule: the default has
+  // to be the one that is right without reading anything. Turning it off is
+  // one click in the filter menu, and the choice sticks.
+  const [compatibleWithHost, setCompatibleWithHostState] = useState(readHostFilterPreference)
+  const setCompatibleWithHost = useCallback((next: boolean) => {
+    setCompatibleWithHostState(next)
+    try { localStorage.setItem(HOST_FILTER_KEY, next ? 'compatible' : 'all') } catch { /* storage unavailable — the choice just won't survive a reload */ }
+  }, [])
+  /** The profile this page is running in, for the manual command's own
+   * `--profile` token (#872). The catalog's is always `web`. */
+  const [profileName, setProfileName] = useState<string | null>(null)
   const [hostCompatibility, setHostCompatibility] = useState<HostCompatibilityMap>({})
   const [hostCompatibilityPending, setHostCompatibilityPending] = useState(0)
   /** Names already resolved or in flight; failed/unavailable names are released for an explicit retry. */
@@ -2405,6 +2431,7 @@ export function MarketSection(props: MarketSectionProps) {
           setNotes(body.notes as Record<string, string>)
         }
         if (Array.isArray(body.patchDisabled)) setPatchDisabledNames(body.patchDisabled)
+        if (typeof body.profile === 'string') setProfileName(body.profile)
         if (Array.isArray(body.unbundled)) setUnbundledNames(body.unbundled)
         setConfigNamespaceIssues(Array.isArray(body.configNamespaces)
           ? body.configNamespaces.filter((item: unknown): item is { name: string; namespaces: string[]; ownEntryIds: string[] } =>
@@ -2830,14 +2857,23 @@ export function MarketSection(props: MarketSectionProps) {
     setShowTop(false)
   }, [tab, q, cat, sortField, sortDir, timeRange, compatibleWithHost, qThemes, themeSortField, themeSortDir, themeTimeRange, qFavorites, favSortField, favSortDir, favTimeRange, qInstalled, installedView])
 
-  const pluginsAll = useMemo(
-    () => (data === null ? [] : visiblePlugins(data.plugins, {
+  // The list, plus how many entries the host filter took out of it (#872).
+  // Both come from one pass over the same query, so the count is exactly
+  // "what this filter is hiding from what you were looking at" and the chip
+  // can say it without a second trip through the catalog.
+  const { plugins: pluginsAll, hostHiddenCount } = useMemo(() => {
+    if (data === null) return { plugins: [] as RegistryPlugin[], hostHiddenCount: 0 }
+    const query = {
       category: cat, query: q, lang, categories: data.categories,
-      sort: `${sortField}-${sortDir}`,
+      sort: `${sortField}-${sortDir}` as `${typeof sortField}-${typeof sortDir}`,
       sinceDays: timeRange === 'all' ? undefined : TIME_RANGE_DAYS[timeRange],
       hostCompatibility,
-      compatibleWithHost,
-    })),
+    }
+    const unfiltered = visiblePlugins(data.plugins, { ...query, compatibleWithHost: false })
+    if (!compatibleWithHost) return { plugins: unfiltered, hostHiddenCount: 0 }
+    const filtered = visiblePlugins(data.plugins, { ...query, compatibleWithHost: true })
+    return { plugins: filtered, hostHiddenCount: unfiltered.length - filtered.length }
+  },
     [data, q, cat, lang, sortField, sortDir, timeRange, hostCompatibility, compatibleWithHost])
   // One plugin can be stored under the installed name or the catalog name.
   // Both have to hide the card and skip Update all (#657).
@@ -6234,7 +6270,9 @@ export function MarketSection(props: MarketSectionProps) {
                             ? t('hostFilterLoading')
                               .replace('{0}', String(loadedHostPackages))
                               .replace('{1}', String(allHostPackages.length))
-                            : t('hostFilterActive').replace('{0}', hostVersion)}
+                            : t('hostFilterActive')
+                                .replace('{0}', hostVersion)
+                                .replace('{1}', String(hostHiddenCount))}
                         </div>
                       )}
                     </div>
@@ -7328,12 +7366,20 @@ export function MarketSection(props: MarketSectionProps) {
             open={cmdOpen}
             onToggle={() => setCmdOpen(o => !o)}
           >
-            <div className={css.confirmCmd}>
-              <div className={css.cmd}>{confirming.install}</div>
-              {typeof confirming.install === 'string' && confirming.install !== '' && (
-                <ConfirmCopyButton text={confirming.install} label={t('cmdCopy')} copiedLabel={t('cmdCopied')} />
-              )}
-            </div>
+            {(() => {
+              // #872: the catalog's command names the `web` profile, which is
+              // a different profile from the one this page is running in —
+              // and on a desktop profile the CLI refuses that name outright.
+              const shown = installCommandFor(confirming.install, profileName)
+              if (shown.unusable) return <div className={css.confirmCmd}><div className={css.cmd}>{t('cmdDesktopUnavailable')}</div></div>
+              if (shown.command === null) return null
+              return (
+                <div className={css.confirmCmd}>
+                  <div className={css.cmd}>{shown.command}</div>
+                  <ConfirmCopyButton text={shown.command} label={t('cmdCopy')} copiedLabel={t('cmdCopied')} />
+                </div>
+              )
+            })()}
           </ConfirmFold>
           </div>
           {(looksTerminal(confirming, lang) || confirming.deprecated === true) && (

package/src/client/locales.ts

@@ -316,6 +316,7 @@ export const zh = {
   confirmInstall: '确认安装',
   cmdDetails: '安装命令',
   cmdCopy: '复制安装命令',
+  cmdDesktopUnavailable: '桌面端的插件由应用自己安装（用上面的「安装」按钮）；`dsh plugin` 不接受桌面端这个 profile。',
   cmdCopied: '已复制',
   catsMore: '更多分类',
   catsLess: '收起',
@@ -329,7 +330,7 @@ export const zh = {
   hostDetecting: '正在识别宿主版本…',
   hostUnknown: '宿主版本未知',
   hostFilterLoading: '正在检查宿主要求 {0}/{1}；未声明或无法确认的插件仍会显示',
-  hostFilterActive: '已按 DSH {0} 筛选；未声明或无法确认兼容性的插件仍会显示',
+  hostFilterActive: '已隐藏 {1} 个与 DSH {0} 不兼容的插件；未声明版本的仍在列表里',
   hostRequirement: 'DSH {0}',
   hostRequirementLoading: '正在读取宿主要求…',
   hostRequirementUndeclared: '未声明宿主要求',
@@ -1065,6 +1066,7 @@ export const en: Record<MarketKey, string> = {
   confirmInstall: 'Confirm install',
   cmdDetails: 'Install command',
   cmdCopy: 'Copy install command',
+  cmdDesktopUnavailable: 'The desktop app installs plugins itself — use the Install button above; `dsh plugin` refuses this profile.',
   cmdCopied: 'Copied',
   catsMore: 'More categories',
   catsLess: 'Fewer categories',
@@ -1078,7 +1080,7 @@ export const en: Record<MarketKey, string> = {
   hostDetecting: 'Detecting host version…',
   hostUnknown: 'Host version unknown',
   hostFilterLoading: 'Checking host requirements {0}/{1}; undeclared or unavailable plugins remain visible',
-  hostFilterActive: 'Filtered for DSH {0}; undeclared or unconfirmed plugins remain visible',
+  hostFilterActive: 'Hid {1} plugins incompatible with DSH {0}; those declaring no version stay listed',
   hostRequirement: 'DSH {0}',
   hostRequirementLoading: 'Reading host requirement…',
   hostRequirementUndeclared: 'Host requirement undeclared',

package/src/client/market-data.ts

@@ -318,6 +318,42 @@ export interface ActivationInfo {
   loadedByProfile?: true
 }
 
+/**
+ * The install command shown on a plugin's card, corrected for THIS profile
+ * (#872).
+ *
+ * awesome-dsh-plugin generates the string once, for the catalog — always
+ * `dsh plugin --profile web add <spec>` — which is right on a `web` profile
+ * and wrong on every other one. On a desktop profile it is more than wrong:
+ * the DSH CLI refuses a profile by that name, so the command as printed
+ * cannot install anything there at all. Two outcomes, and the caller renders
+ * them differently because the user's next step differs:
+ *
+ * - `command`: the text to show and copy, with the profile it names corrected;
+ * - `unusable`: show no command at all (the market's own button is the way),
+ *   because handing over a command that cannot work is worse than handing
+ *   over none.
+ *
+ * A command with no `--profile` token is passed through untouched: it is not
+ * this function's business to add one.
+ */
+export function installCommandFor(
+  command: unknown,
+  profile: string | null | undefined,
+): { command: string | null; unusable: boolean } {
+  if (typeof command !== 'string' || command.trim() === '') return { command: null, unusable: false }
+  const named = /--profile(?:=|\s+)(\S+)/u.exec(command)
+  if (named === null) return { command, unusable: false }
+  const wanted = typeof profile === 'string' ? profile.trim() : ''
+  if (wanted === '') return { command, unusable: false }
+  // The CLI refuses the desktop profile by name — inside the running app it
+  // can never be used, whatever the install layout is (src/index.ts states
+  // the same rule where it chooses the plugin manager).
+  if (wanted.toLowerCase() === 'desktop') return { command: null, unusable: true }
+  if (named[1] === wanted) return { command, unusable: false }
+  return { command: command.replace(named[0], `--profile ${wanted}`), unusable: false }
+}
+
 /** The /dsh-market/installed payload (fields the market UI consumes). */
 export interface InstalledPayload {
   profile?: string

package/src/verify.ts

@@ -251,10 +251,28 @@ export function hostPeerGate(activeProfileDir: string, name: string, facts: Host
   return peerGateAt(join(activeProfileDir, 'node_modules', name), name, facts)
 }
 
+/**
+ * The unmet requirement, if any, and the remedy side it points at.
+ *
+ * Which side of the range the runtime sits on decides the remedy: below the
+ * floor, upgrading the host genuinely helps; above the cap (#757's own
+ * shape) no upgrade can satisfy it, and suggesting one points the wrong way
+ * (#758).
+ */
+function unmetOf(peer: string, range: string, runtimeVersion: string): PeerGate {
+  const floor = /[0-9]+\.[0-9]+\.[0-9]+[-+0-9A-Za-z.]*/.exec(range)
+  const hostTooOld = floor !== null && compareSemver(runtimeVersion, floor[0]) < 0
+  return { peer, range, runtimeVersion, hostTooOld }
+}
+
 /** Same prediction for a patch plugin resolved outside the profile's flat node_modules. */
 function peerGateAt(packageDir: string, name: string, facts: HostRuntimeFacts): PeerGate | null {
   if (facts.runtimeVersion === null) return null
-  let manifest: { version?: unknown; peerDependencies?: Record<string, unknown> }
+  let manifest: {
+    version?: unknown
+    engines?: Record<string, unknown>
+    peerDependencies?: Record<string, unknown>
+  }
   try {
     manifest = JSON.parse(
       readFileSync(join(packageDir, 'package.json'), 'utf8'),
@@ -266,20 +284,30 @@ function peerGateAt(packageDir: string, name: string, facts: HostRuntimeFacts):
   if (version !== '' && (facts.exemptions[`${name}@${version}`] ?? []).includes(facts.runtimeVersion)) {
     return null
   }
+  // An own `engines.dsh` range decides ALONE and peerDependencies are then
+  // ignored — the host's rule, read from unmetRequirements in
+  // @deepseek-ai/dsh-app-boot, and the reason a gate that only read peers
+  // was too lenient on 62 of 2796 (package, runtime) pairs measured over the
+  // live catalog: `dsh-file-explorer-kit` (engines.dsh ^0.1.1) and
+  // `dsh-workspace-kit` (^0.1.2-rc.1) declare NO dsh peer at all, so the
+  // family that refuses them was invisible here and the card promised a
+  // restart the host would not honour. A non-string range throws inside the
+  // host's own evaluator; that is not a verdict this can predict, so the
+  // old answer stands (#757).
+  const engines = manifest.engines?.dsh
+  if (engines !== undefined) {
+    if (typeof engines !== 'string') return null
+    const range = engines.trim()
+    // `workspace:` is substituted only for PEERS: the host counts it as an
+    // unmet range for engines, so an empty or invalid range stays unmet too.
+    const satisfied = range === '' ? false : satisfiesRange(facts.runtimeVersion, range, { includePrerelease: true })
+    return satisfied ? null : unmetOf('engines.dsh', range, facts.runtimeVersion)
+  }
   for (const [peer, requirement] of Object.entries(manifest.peerDependencies ?? {})) {
     if (!isDshPeer(peer) || typeof requirement !== 'string') continue
     const range = requirement.trim()
     const satisfied = range === '' ? false : satisfiesRange(facts.runtimeVersion, range, { includePrerelease: true })
-    if (satisfied === false) {
-      // Which side of the range the runtime sits on decides the remedy:
-      // below the floor, upgrading the host genuinely helps; above the cap
-      // (#757's own shape) no upgrade can satisfy it, and suggesting one
-      // points the wrong way (#758).
-      const floor = /[0-9]+\.[0-9]+\.[0-9]+[-+0-9A-Za-z.]*/.exec(range)
-      let hostTooOld = false
-      if (floor !== null) hostTooOld = compareSemver(facts.runtimeVersion, floor[0]) < 0
-      return { peer, range, runtimeVersion: facts.runtimeVersion, hostTooOld }
-    }
+    if (satisfied === false) return unmetOf(peer, range, facts.runtimeVersion)
   }
   return null
 }