dshmarket 1.66.30 → 1.66.31

package/lib/profile.js

@@ -139,7 +139,13 @@ export function readManifestDeps(profile, explicitDir) {
 export function readDependencyOwners(profile, names, explicitDir) {
     const installed = new Set(names);
     const owners = {};
-    for (const owner of [...names].sort()) {
+    // Who may be an OWNER is not the same question as who gets a card (#892).
+    // pnpm hoists a transitive dependency's directory to `node_modules/<name>`
+    // as well, so `ws` — a dependency of a plugin, never a profile dependency —
+    // is where `bufferutil` and `utf-8-validate` are declared. Scanning only the
+    // profile's own entries could therefore never answer "who asked for these",
+    // and the two native peers stayed on the list as plugins nobody chose.
+    for (const owner of topLevelPackageNames(profile, names, explicitDir)) {
         const manifest = readInstalledManifest(profile, owner, explicitDir);
         if (typeof manifest !== 'object' || manifest === null)
             continue;
@@ -156,6 +162,48 @@ export function readDependencyOwners(profile, names, explicitDir) {
     }
     return owners;
 }
+/**
+ * Every package that could be an owner, sorted: the profile's own entries
+ * plus every package sitting at the profile's top level.
+ *
+ * The manifest's keys are the floor, not the ceiling — a missing or
+ * unreadable `node_modules` leaves the answer exactly as it was before the
+ * top level was scanned, so this can only ever find MORE owners.
+ *
+ * One manifest read per top-level package, measured at ~30 ms for 300
+ * packages on a warm cache, once per `/installed` request — which already
+ * reads a manifest, a patch file and an entry artifact for every card.
+ */
+function topLevelPackageNames(profile, names, explicitDir) {
+    const found = new Set(names);
+    const root = join(profileDir(profile, explicitDir), 'node_modules');
+    let entries = [];
+    try {
+        entries = readdirSync(root, { withFileTypes: true })
+            // A scope directory is named `@scope`, so the leading `@` belongs here;
+            // the package's own namespace is added below.
+            .filter(dirent => dirent.isDirectory() && /^@?[A-Za-z0-9._~-]+$/.test(dirent.name))
+            .map(dirent => dirent.name);
+    }
+    catch {
+        return [...found].sort();
+    }
+    for (const entry of entries) {
+        if (!entry.startsWith('@')) {
+            found.add(entry);
+            continue;
+        }
+        // A scope directory holds the packages themselves.
+        try {
+            for (const inner of readdirSync(join(root, entry), { withFileTypes: true })) {
+                if (inner.isDirectory() && /^[A-Za-z0-9._~-]+$/.test(inner.name))
+                    found.add(`${entry}/${inner.name}`);
+            }
+        }
+        catch { /* unreadable scope — its packages simply cannot own anything */ }
+    }
+    return [...found].sort();
+}
 function objectRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value)
         ? value

package/lib/verify.js

@@ -33,7 +33,7 @@ import { join } from 'node:path';
 import { listHotMounts, parseSimplePatch } from './hot.js';
 import { userPatchPackageReferences } from './patch.js';
 import { nameMatchesPackage } from './entry-identity.js';
-import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, profileDir, readInstalled } from './profile.js';
+import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled } from './profile.js';
 import { compareSemver, composeLayers, parsePatchFile, satisfiesRange } from './check.js';
 import { dshHostInfo } from './dsh-install.js';
 /**
@@ -422,19 +422,33 @@ export function verifyActivation(profile, name, live = new Set(listHotMounts()),
                 hot: false,
             };
         }
-        return inBundles
-            ? {
+        if (inBundles) {
+            return {
                 state: 'restart',
                 reasons: ['由你自己的 cordis.patch.yml 按名加载,重启后生效 / loaded by name from your own cordis.patch.yml — live after a restart'],
                 bundle: true,
                 hot: false,
-            }
-            : {
-                state: 'inert',
-                reasons: ['普通依赖(未声明 dsh 元数据),不是 profile 层插件;若它由某个 bundle patch 按名加载,启动后会显示为已加载 / a plain dependency with no dsh metadata — not a profile-layer plugin; if some bundle patch loads it by name it will read as live once running'],
-                bundle: false,
-                hot: false,
             };
+        }
+        // A collection repository's ROOT package says nothing about itself and
+        // holds the plugins one level down (#892). Installed whole — which the
+        // market used to do before it learned to retarget one, and which a user
+        // can still do by hand — it lands on this list as "installed, not in
+        // effect" with no way out of that sentence. Name the plugins it does
+        // carry and the way to install one: the dead end is the bug.
+        const carried = pluginSubdirs(dir);
+        const shown = carried.slice(0, 3).join('、');
+        const more = carried.length > 3 ? `等 ${carried.length} 个` : '';
+        const shownEn = carried.slice(0, 3).join(', ');
+        const moreEn = carried.length > 3 ? ` and ${carried.length - 3} more` : '';
+        return {
+            state: 'inert',
+            reasons: [carried.length > 0
+                    ? `这是集合仓库的根包,本身不是插件。可安装的子包：${shown}${more}。请装子包而不是它(仓库地址后加 #path:/子包目录) / this is a collection repository's root package, not a plugin itself; install one of its plugins instead — ${shownEn}${moreEn} — by adding #path:/<subdirectory> to the repository URL`
+                    : '普通依赖(未声明 dsh 元数据),不是 profile 层插件;若它由某个 bundle patch 按名加载,启动后会显示为已加载 / a plain dependency with no dsh metadata — not a profile-layer plugin; if some bundle patch loads it by name it will read as live once running'],
+            bundle: false,
+            hot: false,
+        };
     }
     // Carrier bundles (#103) ship no entry of their own — what they mount is
     // the point — so judge by "is anything loadable", not by this package's

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.30",
+  "version": "1.66.31",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/profile.ts

@@ -151,7 +151,13 @@ export function readDependencyOwners(
 ): Record<string, string> {
   const installed = new Set(names)
   const owners: Record<string, string> = {}
-  for (const owner of [...names].sort()) {
+  // Who may be an OWNER is not the same question as who gets a card (#892).
+  // pnpm hoists a transitive dependency's directory to `node_modules/<name>`
+  // as well, so `ws` — a dependency of a plugin, never a profile dependency —
+  // is where `bufferutil` and `utf-8-validate` are declared. Scanning only the
+  // profile's own entries could therefore never answer "who asked for these",
+  // and the two native peers stayed on the list as plugins nobody chose.
+  for (const owner of topLevelPackageNames(profile, names, explicitDir)) {
     const manifest = readInstalledManifest(profile, owner, explicitDir)
     if (typeof manifest !== 'object' || manifest === null) continue
     const declared = manifest as { dependencies?: unknown; peerDependencies?: unknown }
@@ -166,6 +172,50 @@ export function readDependencyOwners(
   return owners
 }
 
+/**
+ * Every package that could be an owner, sorted: the profile's own entries
+ * plus every package sitting at the profile's top level.
+ *
+ * The manifest's keys are the floor, not the ceiling — a missing or
+ * unreadable `node_modules` leaves the answer exactly as it was before the
+ * top level was scanned, so this can only ever find MORE owners.
+ *
+ * One manifest read per top-level package, measured at ~30 ms for 300
+ * packages on a warm cache, once per `/installed` request — which already
+ * reads a manifest, a patch file and an entry artifact for every card.
+ */
+function topLevelPackageNames(
+  profile: string,
+  names: readonly string[],
+  explicitDir?: string,
+): string[] {
+  const found = new Set(names)
+  const root = join(profileDir(profile, explicitDir), 'node_modules')
+  let entries: string[] = []
+  try {
+    entries = readdirSync(root, { withFileTypes: true })
+      // A scope directory is named `@scope`, so the leading `@` belongs here;
+      // the package's own namespace is added below.
+      .filter(dirent => dirent.isDirectory() && /^@?[A-Za-z0-9._~-]+$/.test(dirent.name))
+      .map(dirent => dirent.name)
+  } catch {
+    return [...found].sort()
+  }
+  for (const entry of entries) {
+    if (!entry.startsWith('@')) {
+      found.add(entry)
+      continue
+    }
+    // A scope directory holds the packages themselves.
+    try {
+      for (const inner of readdirSync(join(root, entry), { withFileTypes: true })) {
+        if (inner.isDirectory() && /^[A-Za-z0-9._~-]+$/.test(inner.name)) found.add(`${entry}/${inner.name}`)
+      }
+    } catch { /* unreadable scope — its packages simply cannot own anything */ }
+  }
+  return [...found].sort()
+}
+
 /** Exact rollback state owned by one profile package operation. */
 export interface ProfileManifestSnapshot {
   dependencies: Record<string, string>

package/src/verify.ts

@@ -34,7 +34,7 @@ import { join } from 'node:path'
 import { listHotMounts, parseSimplePatch } from './hot.ts'
 import { userPatchPackageReferences } from './patch.ts'
 import { nameMatchesPackage } from './entry-identity.ts'
-import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, profileDir, readInstalled } from './profile.ts'
+import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled } from './profile.ts'
 import { compareSemver, composeLayers, parsePatchFile, satisfiesRange } from './check.ts'
 import { dshHostInfo } from './dsh-install.ts'
 
@@ -498,19 +498,33 @@ export function verifyActivation(
         hot: false,
       }
     }
-    return inBundles
-      ? {
-          state: 'restart',
-          reasons: ['由你自己的 cordis.patch.yml 按名加载,重启后生效 / loaded by name from your own cordis.patch.yml — live after a restart'],
-          bundle: true,
-          hot: false,
-        }
-      : {
-          state: 'inert',
-          reasons: ['普通依赖(未声明 dsh 元数据),不是 profile 层插件;若它由某个 bundle patch 按名加载,启动后会显示为已加载 / a plain dependency with no dsh metadata — not a profile-layer plugin; if some bundle patch loads it by name it will read as live once running'],
-          bundle: false,
-          hot: false,
-        }
+    if (inBundles) {
+      return {
+        state: 'restart',
+        reasons: ['由你自己的 cordis.patch.yml 按名加载,重启后生效 / loaded by name from your own cordis.patch.yml — live after a restart'],
+        bundle: true,
+        hot: false,
+      }
+    }
+    // A collection repository's ROOT package says nothing about itself and
+    // holds the plugins one level down (#892). Installed whole — which the
+    // market used to do before it learned to retarget one, and which a user
+    // can still do by hand — it lands on this list as "installed, not in
+    // effect" with no way out of that sentence. Name the plugins it does
+    // carry and the way to install one: the dead end is the bug.
+    const carried = pluginSubdirs(dir)
+    const shown = carried.slice(0, 3).join('、')
+    const more = carried.length > 3 ? `等 ${carried.length} 个` : ''
+    const shownEn = carried.slice(0, 3).join(', ')
+    const moreEn = carried.length > 3 ? ` and ${carried.length - 3} more` : ''
+    return {
+      state: 'inert',
+      reasons: [carried.length > 0
+        ? `这是集合仓库的根包,本身不是插件。可安装的子包：${shown}${more}。请装子包而不是它(仓库地址后加 #path:/子包目录) / this is a collection repository's root package, not a plugin itself; install one of its plugins instead — ${shownEn}${moreEn} — by adding #path:/<subdirectory> to the repository URL`
+        : '普通依赖(未声明 dsh 元数据),不是 profile 层插件;若它由某个 bundle patch 按名加载,启动后会显示为已加载 / a plain dependency with no dsh metadata — not a profile-layer plugin; if some bundle patch loads it by name it will read as live once running'],
+      bundle: false,
+      hot: false,
+    }
   }
   // Carrier bundles (#103) ship no entry of their own — what they mount is
   // the point — so judge by "is anything loadable", not by this package's