dshmarket 1.66.29 → 1.66.31

package/lib/install.js

@@ -339,6 +339,21 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             : `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`;
         result = { ...result, stderr: `${result.stderr}\n\n${note}` };
     }
+    // pnpm can append a second rule even on success (#883, #878), including
+    // after a recovery retry or an official Desktop manager install. Repair
+    // the final file now, before another plugin operation reads it; a successful
+    // command must never be retried just because its exclusions needed merging.
+    if (ok(result) && (verb === 'add' || verb === 'remove' || verb === 'install' || verb === 'update')) {
+        try {
+            const merged = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory);
+            if (merged.length > 0) {
+                logEvent('warn', 'install', `merged duplicate minimumReleaseAgeExclude rules for ${merged.join(', ')} after success (#883, #878)`);
+            }
+        }
+        catch (error) {
+            logEvent('warn', 'install', `could not merge minimumReleaseAgeExclude after success (#883, #878): ${String(error)}`);
+        }
+    }
     return result;
 }
 /**

package/lib/pnpm-compat.js

@@ -362,8 +362,27 @@ export function classifyPnpmFailure(output, exitCode) {
     // (MINIMUM_RELEASE_AGE_VIOLATION), and a later add can fail re-resolving
     // the young dep (NO_MATURE_MATCHING_VERSION). Recovery is a one-shot
     // --config.minimum-release-age=0 retry, automated in withHoistRecovery.
+    //
+    // That gate has a THIRD face, and it is the one that fails AFTER the
+    // lockfile check has said yes. pnpm skips that check when the verification
+    // cache holds a run whose recorded window is at least as wide as the
+    // current one (`canTrustPastCheck`: past >= current, pnpm's own
+    // lockfile-verified cache), and the resolver then applies the same policy
+    // from scratch. A re-resolved dependency still inside the window comes back
+    // as a `policyViolation`, which the CLI only knows how to consume through a
+    // handler it never wires on this call path — so it throws
+    // RESOLUTION_POLICY_VIOLATIONS_UNHANDLED instead of reporting anything the
+    // user can act on. Measured on the bundled pnpm 11.7.0 (DSH Desktop), with
+    // a cached pass in place: verification prints "passes supply-chain
+    // policies", and the next phase dies with "2 resolution-policy violations
+    // were produced but no handleResolutionPolicyViolations callback was wired".
+    // Same cause, same cure as the two shapes above — pnpm's hint names
+    // `setupPolicyHandlers`, which an integration calling the CLI cannot wire,
+    // so the only answer is the one-shot override. Classifying it here is what
+    // connects it to that retry; without it the raw internal hint was surfaced.
     if (output.includes('ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION')
-        || output.includes('ERR_PNPM_NO_MATURE_MATCHING_VERSION')) {
+        || output.includes('ERR_PNPM_NO_MATURE_MATCHING_VERSION')
+        || output.includes('ERR_PNPM_RESOLUTION_POLICY_VIOLATIONS_UNHANDLED')) {
         return {
             code: 'release-age-violation',
             recoverable: false,

package/lib/profile.js

@@ -139,7 +139,13 @@ export function readManifestDeps(profile, explicitDir) {
 export function readDependencyOwners(profile, names, explicitDir) {
     const installed = new Set(names);
     const owners = {};
-    for (const owner of [...names].sort()) {
+    // Who may be an OWNER is not the same question as who gets a card (#892).
+    // pnpm hoists a transitive dependency's directory to `node_modules/<name>`
+    // as well, so `ws` — a dependency of a plugin, never a profile dependency —
+    // is where `bufferutil` and `utf-8-validate` are declared. Scanning only the
+    // profile's own entries could therefore never answer "who asked for these",
+    // and the two native peers stayed on the list as plugins nobody chose.
+    for (const owner of topLevelPackageNames(profile, names, explicitDir)) {
         const manifest = readInstalledManifest(profile, owner, explicitDir);
         if (typeof manifest !== 'object' || manifest === null)
             continue;
@@ -156,6 +162,48 @@ export function readDependencyOwners(profile, names, explicitDir) {
     }
     return owners;
 }
+/**
+ * Every package that could be an owner, sorted: the profile's own entries
+ * plus every package sitting at the profile's top level.
+ *
+ * The manifest's keys are the floor, not the ceiling — a missing or
+ * unreadable `node_modules` leaves the answer exactly as it was before the
+ * top level was scanned, so this can only ever find MORE owners.
+ *
+ * One manifest read per top-level package, measured at ~30 ms for 300
+ * packages on a warm cache, once per `/installed` request — which already
+ * reads a manifest, a patch file and an entry artifact for every card.
+ */
+function topLevelPackageNames(profile, names, explicitDir) {
+    const found = new Set(names);
+    const root = join(profileDir(profile, explicitDir), 'node_modules');
+    let entries = [];
+    try {
+        entries = readdirSync(root, { withFileTypes: true })
+            // A scope directory is named `@scope`, so the leading `@` belongs here;
+            // the package's own namespace is added below.
+            .filter(dirent => dirent.isDirectory() && /^@?[A-Za-z0-9._~-]+$/.test(dirent.name))
+            .map(dirent => dirent.name);
+    }
+    catch {
+        return [...found].sort();
+    }
+    for (const entry of entries) {
+        if (!entry.startsWith('@')) {
+            found.add(entry);
+            continue;
+        }
+        // A scope directory holds the packages themselves.
+        try {
+            for (const inner of readdirSync(join(root, entry), { withFileTypes: true })) {
+                if (inner.isDirectory() && /^[A-Za-z0-9._~-]+$/.test(inner.name))
+                    found.add(`${entry}/${inner.name}`);
+            }
+        }
+        catch { /* unreadable scope — its packages simply cannot own anything */ }
+    }
+    return [...found].sort();
+}
 function objectRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value)
         ? value

package/lib/verify.js

@@ -33,7 +33,7 @@ import { join } from 'node:path';
 import { listHotMounts, parseSimplePatch } from './hot.js';
 import { userPatchPackageReferences } from './patch.js';
 import { nameMatchesPackage } from './entry-identity.js';
-import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, profileDir, readInstalled } from './profile.js';
+import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled } from './profile.js';
 import { compareSemver, composeLayers, parsePatchFile, satisfiesRange } from './check.js';
 import { dshHostInfo } from './dsh-install.js';
 /**
@@ -422,19 +422,33 @@ export function verifyActivation(profile, name, live = new Set(listHotMounts()),
                 hot: false,
             };
         }
-        return inBundles
-            ? {
+        if (inBundles) {
+            return {
                 state: 'restart',
                 reasons: ['由你自己的 cordis.patch.yml 按名加载,重启后生效 / loaded by name from your own cordis.patch.yml — live after a restart'],
                 bundle: true,
                 hot: false,
-            }
-            : {
-                state: 'inert',
-                reasons: ['普通依赖(未声明 dsh 元数据),不是 profile 层插件;若它由某个 bundle patch 按名加载,启动后会显示为已加载 / a plain dependency with no dsh metadata — not a profile-layer plugin; if some bundle patch loads it by name it will read as live once running'],
-                bundle: false,
-                hot: false,
             };
+        }
+        // A collection repository's ROOT package says nothing about itself and
+        // holds the plugins one level down (#892). Installed whole — which the
+        // market used to do before it learned to retarget one, and which a user
+        // can still do by hand — it lands on this list as "installed, not in
+        // effect" with no way out of that sentence. Name the plugins it does
+        // carry and the way to install one: the dead end is the bug.
+        const carried = pluginSubdirs(dir);
+        const shown = carried.slice(0, 3).join('、');
+        const more = carried.length > 3 ? `等 ${carried.length} 个` : '';
+        const shownEn = carried.slice(0, 3).join(', ');
+        const moreEn = carried.length > 3 ? ` and ${carried.length - 3} more` : '';
+        return {
+            state: 'inert',
+            reasons: [carried.length > 0
+                    ? `这是集合仓库的根包,本身不是插件。可安装的子包：${shown}${more}。请装子包而不是它(仓库地址后加 #path:/子包目录) / this is a collection repository's root package, not a plugin itself; install one of its plugins instead — ${shownEn}${moreEn} — by adding #path:/<subdirectory> to the repository URL`
+                    : '普通依赖(未声明 dsh 元数据),不是 profile 层插件;若它由某个 bundle patch 按名加载,启动后会显示为已加载 / a plain dependency with no dsh metadata — not a profile-layer plugin; if some bundle patch loads it by name it will read as live once running'],
+            bundle: false,
+            hot: false,
+        };
     }
     // Carrier bundles (#103) ship no entry of their own — what they mount is
     // the point — so judge by "is anything loadable", not by this package's

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.29",
+  "version": "1.66.31",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/install.ts

@@ -345,6 +345,20 @@ export async function withHoistRecovery(
       : `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`
     result = { ...result, stderr: `${result.stderr}\n\n${note}` }
   }
+  // pnpm can append a second rule even on success (#883, #878), including
+  // after a recovery retry or an official Desktop manager install. Repair
+  // the final file now, before another plugin operation reads it; a successful
+  // command must never be retried just because its exclusions needed merging.
+  if (ok(result) && (verb === 'add' || verb === 'remove' || verb === 'install' || verb === 'update')) {
+    try {
+      const merged = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory)
+      if (merged.length > 0) {
+        logEvent('warn', 'install', `merged duplicate minimumReleaseAgeExclude rules for ${merged.join(', ')} after success (#883, #878)`)
+      }
+    } catch (error) {
+      logEvent('warn', 'install', `could not merge minimumReleaseAgeExclude after success (#883, #878): ${String(error)}`)
+    }
+  }
   return result
 }
 

package/src/pnpm-compat.ts

@@ -399,8 +399,27 @@ export function classifyPnpmFailure(output: string, exitCode?: number | null): P
   // (MINIMUM_RELEASE_AGE_VIOLATION), and a later add can fail re-resolving
   // the young dep (NO_MATURE_MATCHING_VERSION). Recovery is a one-shot
   // --config.minimum-release-age=0 retry, automated in withHoistRecovery.
+  //
+  // That gate has a THIRD face, and it is the one that fails AFTER the
+  // lockfile check has said yes. pnpm skips that check when the verification
+  // cache holds a run whose recorded window is at least as wide as the
+  // current one (`canTrustPastCheck`: past >= current, pnpm's own
+  // lockfile-verified cache), and the resolver then applies the same policy
+  // from scratch. A re-resolved dependency still inside the window comes back
+  // as a `policyViolation`, which the CLI only knows how to consume through a
+  // handler it never wires on this call path — so it throws
+  // RESOLUTION_POLICY_VIOLATIONS_UNHANDLED instead of reporting anything the
+  // user can act on. Measured on the bundled pnpm 11.7.0 (DSH Desktop), with
+  // a cached pass in place: verification prints "passes supply-chain
+  // policies", and the next phase dies with "2 resolution-policy violations
+  // were produced but no handleResolutionPolicyViolations callback was wired".
+  // Same cause, same cure as the two shapes above — pnpm's hint names
+  // `setupPolicyHandlers`, which an integration calling the CLI cannot wire,
+  // so the only answer is the one-shot override. Classifying it here is what
+  // connects it to that retry; without it the raw internal hint was surfaced.
   if (output.includes('ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION')
-    || output.includes('ERR_PNPM_NO_MATURE_MATCHING_VERSION')) {
+    || output.includes('ERR_PNPM_NO_MATURE_MATCHING_VERSION')
+    || output.includes('ERR_PNPM_RESOLUTION_POLICY_VIOLATIONS_UNHANDLED')) {
     return {
       code: 'release-age-violation',
       recoverable: false,

package/src/profile.ts

@@ -151,7 +151,13 @@ export function readDependencyOwners(
 ): Record<string, string> {
   const installed = new Set(names)
   const owners: Record<string, string> = {}
-  for (const owner of [...names].sort()) {
+  // Who may be an OWNER is not the same question as who gets a card (#892).
+  // pnpm hoists a transitive dependency's directory to `node_modules/<name>`
+  // as well, so `ws` — a dependency of a plugin, never a profile dependency —
+  // is where `bufferutil` and `utf-8-validate` are declared. Scanning only the
+  // profile's own entries could therefore never answer "who asked for these",
+  // and the two native peers stayed on the list as plugins nobody chose.
+  for (const owner of topLevelPackageNames(profile, names, explicitDir)) {
     const manifest = readInstalledManifest(profile, owner, explicitDir)
     if (typeof manifest !== 'object' || manifest === null) continue
     const declared = manifest as { dependencies?: unknown; peerDependencies?: unknown }
@@ -166,6 +172,50 @@ export function readDependencyOwners(
   return owners
 }
 
+/**
+ * Every package that could be an owner, sorted: the profile's own entries
+ * plus every package sitting at the profile's top level.
+ *
+ * The manifest's keys are the floor, not the ceiling — a missing or
+ * unreadable `node_modules` leaves the answer exactly as it was before the
+ * top level was scanned, so this can only ever find MORE owners.
+ *
+ * One manifest read per top-level package, measured at ~30 ms for 300
+ * packages on a warm cache, once per `/installed` request — which already
+ * reads a manifest, a patch file and an entry artifact for every card.
+ */
+function topLevelPackageNames(
+  profile: string,
+  names: readonly string[],
+  explicitDir?: string,
+): string[] {
+  const found = new Set(names)
+  const root = join(profileDir(profile, explicitDir), 'node_modules')
+  let entries: string[] = []
+  try {
+    entries = readdirSync(root, { withFileTypes: true })
+      // A scope directory is named `@scope`, so the leading `@` belongs here;
+      // the package's own namespace is added below.
+      .filter(dirent => dirent.isDirectory() && /^@?[A-Za-z0-9._~-]+$/.test(dirent.name))
+      .map(dirent => dirent.name)
+  } catch {
+    return [...found].sort()
+  }
+  for (const entry of entries) {
+    if (!entry.startsWith('@')) {
+      found.add(entry)
+      continue
+    }
+    // A scope directory holds the packages themselves.
+    try {
+      for (const inner of readdirSync(join(root, entry), { withFileTypes: true })) {
+        if (inner.isDirectory() && /^[A-Za-z0-9._~-]+$/.test(inner.name)) found.add(`${entry}/${inner.name}`)
+      }
+    } catch { /* unreadable scope — its packages simply cannot own anything */ }
+  }
+  return [...found].sort()
+}
+
 /** Exact rollback state owned by one profile package operation. */
 export interface ProfileManifestSnapshot {
   dependencies: Record<string, string>

package/src/verify.ts

@@ -34,7 +34,7 @@ import { join } from 'node:path'
 import { listHotMounts, parseSimplePatch } from './hot.ts'
 import { userPatchPackageReferences } from './patch.ts'
 import { nameMatchesPackage } from './entry-identity.ts'
-import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, profileDir, readInstalled } from './profile.ts'
+import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled } from './profile.ts'
 import { compareSemver, composeLayers, parsePatchFile, satisfiesRange } from './check.ts'
 import { dshHostInfo } from './dsh-install.ts'
 
@@ -498,19 +498,33 @@ export function verifyActivation(
         hot: false,
       }
     }
-    return inBundles
-      ? {
-          state: 'restart',
-          reasons: ['由你自己的 cordis.patch.yml 按名加载,重启后生效 / loaded by name from your own cordis.patch.yml — live after a restart'],
-          bundle: true,
-          hot: false,
-        }
-      : {
-          state: 'inert',
-          reasons: ['普通依赖(未声明 dsh 元数据),不是 profile 层插件;若它由某个 bundle patch 按名加载,启动后会显示为已加载 / a plain dependency with no dsh metadata — not a profile-layer plugin; if some bundle patch loads it by name it will read as live once running'],
-          bundle: false,
-          hot: false,
-        }
+    if (inBundles) {
+      return {
+        state: 'restart',
+        reasons: ['由你自己的 cordis.patch.yml 按名加载,重启后生效 / loaded by name from your own cordis.patch.yml — live after a restart'],
+        bundle: true,
+        hot: false,
+      }
+    }
+    // A collection repository's ROOT package says nothing about itself and
+    // holds the plugins one level down (#892). Installed whole — which the
+    // market used to do before it learned to retarget one, and which a user
+    // can still do by hand — it lands on this list as "installed, not in
+    // effect" with no way out of that sentence. Name the plugins it does
+    // carry and the way to install one: the dead end is the bug.
+    const carried = pluginSubdirs(dir)
+    const shown = carried.slice(0, 3).join('、')
+    const more = carried.length > 3 ? `等 ${carried.length} 个` : ''
+    const shownEn = carried.slice(0, 3).join(', ')
+    const moreEn = carried.length > 3 ? ` and ${carried.length - 3} more` : ''
+    return {
+      state: 'inert',
+      reasons: [carried.length > 0
+        ? `这是集合仓库的根包,本身不是插件。可安装的子包：${shown}${more}。请装子包而不是它(仓库地址后加 #path:/子包目录) / this is a collection repository's root package, not a plugin itself; install one of its plugins instead — ${shownEn}${moreEn} — by adding #path:/<subdirectory> to the repository URL`
+        : '普通依赖(未声明 dsh 元数据),不是 profile 层插件;若它由某个 bundle patch 按名加载,启动后会显示为已加载 / a plain dependency with no dsh metadata — not a profile-layer plugin; if some bundle patch loads it by name it will read as live once running'],
+      bundle: false,
+      hot: false,
+    }
   }
   // Carrier bundles (#103) ship no entry of their own — what they mount is
   // the point — so judge by "is anything loadable", not by this package's