dshmarket 1.66.30 → 1.66.32

package/lib/profile.js

@@ -139,7 +139,13 @@ export function readManifestDeps(profile, explicitDir) {
 export function readDependencyOwners(profile, names, explicitDir) {
     const installed = new Set(names);
     const owners = {};
-    for (const owner of [...names].sort()) {
+    // Who may be an OWNER is not the same question as who gets a card (#892).
+    // pnpm hoists a transitive dependency's directory to `node_modules/<name>`
+    // as well, so `ws` — a dependency of a plugin, never a profile dependency —
+    // is where `bufferutil` and `utf-8-validate` are declared. Scanning only the
+    // profile's own entries could therefore never answer "who asked for these",
+    // and the two native peers stayed on the list as plugins nobody chose.
+    for (const owner of topLevelPackageNames(profile, names, explicitDir)) {
         const manifest = readInstalledManifest(profile, owner, explicitDir);
         if (typeof manifest !== 'object' || manifest === null)
             continue;
@@ -156,6 +162,48 @@ export function readDependencyOwners(profile, names, explicitDir) {
     }
     return owners;
 }
+/**
+ * Every package that could be an owner, sorted: the profile's own entries
+ * plus every package sitting at the profile's top level.
+ *
+ * The manifest's keys are the floor, not the ceiling — a missing or
+ * unreadable `node_modules` leaves the answer exactly as it was before the
+ * top level was scanned, so this can only ever find MORE owners.
+ *
+ * One manifest read per top-level package, measured at ~30 ms for 300
+ * packages on a warm cache, once per `/installed` request — which already
+ * reads a manifest, a patch file and an entry artifact for every card.
+ */
+function topLevelPackageNames(profile, names, explicitDir) {
+    const found = new Set(names);
+    const root = join(profileDir(profile, explicitDir), 'node_modules');
+    let entries = [];
+    try {
+        entries = readdirSync(root, { withFileTypes: true })
+            // A scope directory is named `@scope`, so the leading `@` belongs here;
+            // the package's own namespace is added below.
+            .filter(dirent => dirent.isDirectory() && /^@?[A-Za-z0-9._~-]+$/.test(dirent.name))
+            .map(dirent => dirent.name);
+    }
+    catch {
+        return [...found].sort();
+    }
+    for (const entry of entries) {
+        if (!entry.startsWith('@')) {
+            found.add(entry);
+            continue;
+        }
+        // A scope directory holds the packages themselves.
+        try {
+            for (const inner of readdirSync(join(root, entry), { withFileTypes: true })) {
+                if (inner.isDirectory() && /^[A-Za-z0-9._~-]+$/.test(inner.name))
+                    found.add(`${entry}/${inner.name}`);
+            }
+        }
+        catch { /* unreadable scope — its packages simply cannot own anything */ }
+    }
+    return [...found].sort();
+}
 function objectRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value)
         ? value

package/lib/regions.js

@@ -107,6 +107,34 @@ const ROUTES = {
         ],
     },
 };
+/**
+ * Every catalog source worth trying for a region: its own list, plus the
+ * catalog's published package on that region's own registry when the list
+ * does not already name it.
+ *
+ * The catalog hangs off a SECOND, independently blockable host (#891), and
+ * the probe that picks a region measures only the npm registry. A network
+ * where npm answers fast and GitHub Pages is blocked therefore measures
+ * `global` — whose one source is that very host — and since the region is
+ * decided once and persisted, nothing ever reconsiders: "catalog fetch
+ * failed" forever, on a machine whose registry is serving the catalog as a
+ * package all along.
+ *
+ * Appending the package closes that blind spot without asking the probe to
+ * learn about the second host, without revisiting the decision, and without
+ * sending anyone to another region's mirror: it rides the registry the probe
+ * already proved reachable. Last, not first — for everyone the official
+ * domain serves, this stays a source that is never contacted.
+ */
+export function catalogSourcesFor(region) {
+    const routes = routesFor(region);
+    const sources = [...routes.catalog];
+    const served = sources.some(source => source.kind === 'npm'
+        && source.registry === routes.npmRegistry && source.pkg === CATALOG_PACKAGE);
+    if (!served)
+        sources.push({ kind: 'npm', registry: routes.npmRegistry, pkg: CATALOG_PACKAGE });
+    return sources;
+}
 /** Read an environment override, treating blank as unset. */
 function override(env, name) {
     const raw = env[name];

package/lib/registry.js

@@ -3,9 +3,10 @@
  * fresh on every request. See `loadRegistry` for why there is nothing
  * behind it any more.
  */
+import { logEvent } from './log.js';
 import { configuredProxy, marketFetch } from './net.js';
 import { catalogFromPackage } from './catalog-npm.js';
-import { activeRegion, routesFor } from './regions.js';
+import { activeRegion, catalogSourcesFor, routesFor } from './regions.js';
 /**
  * Category ids for one catalog entry, de-duplicated in declaration order.
  *
@@ -166,8 +167,23 @@ export async function loadRegistry(region = activeRegion()) {
     // the FIRST request the market makes, so a mirror that has gone down must
     // mean a slow market rather than an empty one — the list ends at the
     // address that has always worked.
-    for (const source of routesFor(region).catalog) {
+    //
+    // The list runs one entry past the region's own sources on purpose (#891):
+    // the region probe measures the npm registry, so it cannot see a network
+    // where npm is fast and the catalog's host is blocked — and the region is
+    // decided once and persisted. The catalog's published package, on the
+    // registry the probe just proved reachable, is the repair that needs
+    // neither the probe nor the decision to change.
+    const ownSources = routesFor(region).catalog.length;
+    const catalogSources = catalogSourcesFor(region);
+    for (const [sourceIndex, source] of catalogSources.entries()) {
         const key = sourceKey(source);
+        const servedBy = (data) => {
+            if (sourceIndex >= ownSources) {
+                logEvent('warn', 'registry', `catalog: the ${region} sources did not answer; read the catalog package from ${key} instead (#891)`);
+            }
+            return data;
+        };
         // Two attempts each. A catalog fetch crossing a long, lossy path fails
         // transiently often enough that one retry is worth more than the second
         // or two it costs — and with nothing behind this call any more, a
@@ -183,12 +199,12 @@ export async function loadRegistry(region = activeRegion()) {
                     const { version, data } = await catalogFromPackage(source.registry, source.pkg, reusable?.version ?? undefined);
                     // `data === null` means the published version is the one in hand.
                     if (data === null && reusable !== null)
-                        return reusable.data;
+                        return servedBy(reusable.data);
                     if (data === null)
                         throw new Error('the catalog package reported no change with nothing to reuse');
                     const parsed = asRegistry(data);
                     served = { key, etag: null, modified: null, version, data: parsed };
-                    return parsed;
+                    return servedBy(parsed);
                 }
                 // ETag first: it is exact, while a date has one-second resolution and
                 // a catalog republished twice within the same second would validate
@@ -221,7 +237,7 @@ export async function loadRegistry(region = activeRegion()) {
                     // otherwise surface as a confusing parse error on an empty body.
                     if (reusable === null)
                         throw new Error('the catalog answered "not modified" with nothing to revalidate');
-                    return reusable.data;
+                    return servedBy(reusable.data);
                 }
                 if (!res.ok)
                     throw new Error(`HTTP ${String(res.status)}`);
@@ -229,7 +245,7 @@ export async function loadRegistry(region = activeRegion()) {
                 served = {
                     key, etag: res.headers.get('etag'), modified: res.headers.get('last-modified'), version: null, data,
                 };
-                return data;
+                return servedBy(data);
             }
             catch (error) {
                 last = error;

package/lib/types/regions.d.ts

@@ -71,6 +71,26 @@ export interface RegionRoutes {
      */
     catalog: CatalogSource[];
 }
+/**
+ * Every catalog source worth trying for a region: its own list, plus the
+ * catalog's published package on that region's own registry when the list
+ * does not already name it.
+ *
+ * The catalog hangs off a SECOND, independently blockable host (#891), and
+ * the probe that picks a region measures only the npm registry. A network
+ * where npm answers fast and GitHub Pages is blocked therefore measures
+ * `global` — whose one source is that very host — and since the region is
+ * decided once and persisted, nothing ever reconsiders: "catalog fetch
+ * failed" forever, on a machine whose registry is serving the catalog as a
+ * package all along.
+ *
+ * Appending the package closes that blind spot without asking the probe to
+ * learn about the second host, without revisiting the decision, and without
+ * sending anyone to another region's mirror: it rides the registry the probe
+ * already proved reachable. Last, not first — for everyone the official
+ * domain serves, this stays a source that is never contacted.
+ */
+export declare function catalogSourcesFor(region: Region): CatalogSource[];
 /**
  * Normalize a user-maintained prefix, or reject it.
  *

package/lib/verify.js

@@ -33,7 +33,7 @@ import { join } from 'node:path';
 import { listHotMounts, parseSimplePatch } from './hot.js';
 import { userPatchPackageReferences } from './patch.js';
 import { nameMatchesPackage } from './entry-identity.js';
-import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, profileDir, readInstalled } from './profile.js';
+import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled } from './profile.js';
 import { compareSemver, composeLayers, parsePatchFile, satisfiesRange } from './check.js';
 import { dshHostInfo } from './dsh-install.js';
 /**
@@ -422,19 +422,33 @@ export function verifyActivation(profile, name, live = new Set(listHotMounts()),
                 hot: false,
             };
         }
-        return inBundles
-            ? {
+        if (inBundles) {
+            return {
                 state: 'restart',
                 reasons: ['由你自己的 cordis.patch.yml 按名加载,重启后生效 / loaded by name from your own cordis.patch.yml — live after a restart'],
                 bundle: true,
                 hot: false,
-            }
-            : {
-                state: 'inert',
-                reasons: ['普通依赖(未声明 dsh 元数据),不是 profile 层插件;若它由某个 bundle patch 按名加载,启动后会显示为已加载 / a plain dependency with no dsh metadata — not a profile-layer plugin; if some bundle patch loads it by name it will read as live once running'],
-                bundle: false,
-                hot: false,
             };
+        }
+        // A collection repository's ROOT package says nothing about itself and
+        // holds the plugins one level down (#892). Installed whole — which the
+        // market used to do before it learned to retarget one, and which a user
+        // can still do by hand — it lands on this list as "installed, not in
+        // effect" with no way out of that sentence. Name the plugins it does
+        // carry and the way to install one: the dead end is the bug.
+        const carried = pluginSubdirs(dir);
+        const shown = carried.slice(0, 3).join('、');
+        const more = carried.length > 3 ? `等 ${carried.length} 个` : '';
+        const shownEn = carried.slice(0, 3).join(', ');
+        const moreEn = carried.length > 3 ? ` and ${carried.length - 3} more` : '';
+        return {
+            state: 'inert',
+            reasons: [carried.length > 0
+                    ? `这是集合仓库的根包,本身不是插件。可安装的子包：${shown}${more}。请装子包而不是它(仓库地址后加 #path:/子包目录) / this is a collection repository's root package, not a plugin itself; install one of its plugins instead — ${shownEn}${moreEn} — by adding #path:/<subdirectory> to the repository URL`
+                    : '普通依赖(未声明 dsh 元数据),不是 profile 层插件;若它由某个 bundle patch 按名加载,启动后会显示为已加载 / a plain dependency with no dsh metadata — not a profile-layer plugin; if some bundle patch loads it by name it will read as live once running'],
+            bundle: false,
+            hot: false,
+        };
     }
     // Carrier bundles (#103) ship no entry of their own — what they mount is
     // the point — so judge by "is anything loadable", not by this package's

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.30",
+  "version": "1.66.32",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/profile.ts

@@ -151,7 +151,13 @@ export function readDependencyOwners(
 ): Record<string, string> {
   const installed = new Set(names)
   const owners: Record<string, string> = {}
-  for (const owner of [...names].sort()) {
+  // Who may be an OWNER is not the same question as who gets a card (#892).
+  // pnpm hoists a transitive dependency's directory to `node_modules/<name>`
+  // as well, so `ws` — a dependency of a plugin, never a profile dependency —
+  // is where `bufferutil` and `utf-8-validate` are declared. Scanning only the
+  // profile's own entries could therefore never answer "who asked for these",
+  // and the two native peers stayed on the list as plugins nobody chose.
+  for (const owner of topLevelPackageNames(profile, names, explicitDir)) {
     const manifest = readInstalledManifest(profile, owner, explicitDir)
     if (typeof manifest !== 'object' || manifest === null) continue
     const declared = manifest as { dependencies?: unknown; peerDependencies?: unknown }
@@ -166,6 +172,50 @@ export function readDependencyOwners(
   return owners
 }
 
+/**
+ * Every package that could be an owner, sorted: the profile's own entries
+ * plus every package sitting at the profile's top level.
+ *
+ * The manifest's keys are the floor, not the ceiling — a missing or
+ * unreadable `node_modules` leaves the answer exactly as it was before the
+ * top level was scanned, so this can only ever find MORE owners.
+ *
+ * One manifest read per top-level package, measured at ~30 ms for 300
+ * packages on a warm cache, once per `/installed` request — which already
+ * reads a manifest, a patch file and an entry artifact for every card.
+ */
+function topLevelPackageNames(
+  profile: string,
+  names: readonly string[],
+  explicitDir?: string,
+): string[] {
+  const found = new Set(names)
+  const root = join(profileDir(profile, explicitDir), 'node_modules')
+  let entries: string[] = []
+  try {
+    entries = readdirSync(root, { withFileTypes: true })
+      // A scope directory is named `@scope`, so the leading `@` belongs here;
+      // the package's own namespace is added below.
+      .filter(dirent => dirent.isDirectory() && /^@?[A-Za-z0-9._~-]+$/.test(dirent.name))
+      .map(dirent => dirent.name)
+  } catch {
+    return [...found].sort()
+  }
+  for (const entry of entries) {
+    if (!entry.startsWith('@')) {
+      found.add(entry)
+      continue
+    }
+    // A scope directory holds the packages themselves.
+    try {
+      for (const inner of readdirSync(join(root, entry), { withFileTypes: true })) {
+        if (inner.isDirectory() && /^[A-Za-z0-9._~-]+$/.test(inner.name)) found.add(`${entry}/${inner.name}`)
+      }
+    } catch { /* unreadable scope — its packages simply cannot own anything */ }
+  }
+  return [...found].sort()
+}
+
 /** Exact rollback state owned by one profile package operation. */
 export interface ProfileManifestSnapshot {
   dependencies: Record<string, string>

package/src/regions.ts

@@ -157,6 +157,34 @@ const ROUTES: Record<Region, RegionRoutes> = {
   },
 }
 
+/**
+ * Every catalog source worth trying for a region: its own list, plus the
+ * catalog's published package on that region's own registry when the list
+ * does not already name it.
+ *
+ * The catalog hangs off a SECOND, independently blockable host (#891), and
+ * the probe that picks a region measures only the npm registry. A network
+ * where npm answers fast and GitHub Pages is blocked therefore measures
+ * `global` — whose one source is that very host — and since the region is
+ * decided once and persisted, nothing ever reconsiders: "catalog fetch
+ * failed" forever, on a machine whose registry is serving the catalog as a
+ * package all along.
+ *
+ * Appending the package closes that blind spot without asking the probe to
+ * learn about the second host, without revisiting the decision, and without
+ * sending anyone to another region's mirror: it rides the registry the probe
+ * already proved reachable. Last, not first — for everyone the official
+ * domain serves, this stays a source that is never contacted.
+ */
+export function catalogSourcesFor(region: Region): CatalogSource[] {
+  const routes = routesFor(region)
+  const sources = [...routes.catalog]
+  const served = sources.some(source => source.kind === 'npm'
+    && source.registry === routes.npmRegistry && source.pkg === CATALOG_PACKAGE)
+  if (!served) sources.push({ kind: 'npm', registry: routes.npmRegistry, pkg: CATALOG_PACKAGE })
+  return sources
+}
+
 /** Read an environment override, treating blank as unset. */
 function override(env: NodeJS.ProcessEnv, name: string): string | null {
   const raw = env[name]

package/src/registry.ts

@@ -4,9 +4,10 @@
  * behind it any more.
  */
 
+import { logEvent } from './log.ts'
 import { configuredProxy, marketFetch } from './net.ts'
 import { catalogFromPackage } from './catalog-npm.ts'
-import { activeRegion, routesFor, type CatalogSource, type Region } from './regions.ts'
+import { activeRegion, catalogSourcesFor, routesFor, type CatalogSource, type Region } from './regions.ts'
 
 export interface RegistryPlugin {
   name: string
@@ -245,8 +246,23 @@ export async function loadRegistry(region: Region = activeRegion()): Promise<Reg
   // the FIRST request the market makes, so a mirror that has gone down must
   // mean a slow market rather than an empty one — the list ends at the
   // address that has always worked.
-  for (const source of routesFor(region).catalog) {
+  //
+  // The list runs one entry past the region's own sources on purpose (#891):
+  // the region probe measures the npm registry, so it cannot see a network
+  // where npm is fast and the catalog's host is blocked — and the region is
+  // decided once and persisted. The catalog's published package, on the
+  // registry the probe just proved reachable, is the repair that needs
+  // neither the probe nor the decision to change.
+  const ownSources = routesFor(region).catalog.length
+  const catalogSources = catalogSourcesFor(region)
+  for (const [sourceIndex, source] of catalogSources.entries()) {
     const key = sourceKey(source)
+    const servedBy = <T>(data: T): T => {
+      if (sourceIndex >= ownSources) {
+        logEvent('warn', 'registry', `catalog: the ${region} sources did not answer; read the catalog package from ${key} instead (#891)`)
+      }
+      return data
+    }
     // Two attempts each. A catalog fetch crossing a long, lossy path fails
     // transiently often enough that one retry is worth more than the second
     // or two it costs — and with nothing behind this call any more, a
@@ -263,11 +279,11 @@ export async function loadRegistry(region: Region = activeRegion()): Promise<Reg
             source.registry, source.pkg, reusable?.version ?? undefined,
           )
           // `data === null` means the published version is the one in hand.
-          if (data === null && reusable !== null) return reusable.data
+          if (data === null && reusable !== null) return servedBy(reusable.data)
           if (data === null) throw new Error('the catalog package reported no change with nothing to reuse')
           const parsed = asRegistry(data)
           served = { key, etag: null, modified: null, version, data: parsed }
-          return parsed
+          return servedBy(parsed)
         }
         // ETag first: it is exact, while a date has one-second resolution and
         // a catalog republished twice within the same second would validate
@@ -300,7 +316,7 @@ export async function loadRegistry(region: Region = activeRegion()): Promise<Reg
           // Guarded anyway: answering a 304 with nothing to reuse would
           // otherwise surface as a confusing parse error on an empty body.
           if (reusable === null) throw new Error('the catalog answered "not modified" with nothing to revalidate')
-          return reusable.data
+          return servedBy(reusable.data)
         }
         if (!res.ok) throw new Error(`HTTP ${String(res.status)}`)
         const data = asRegistry(JSON.parse(new TextDecoder().decode(
@@ -309,7 +325,7 @@ export async function loadRegistry(region: Region = activeRegion()): Promise<Reg
         served = {
           key, etag: res.headers.get('etag'), modified: res.headers.get('last-modified'), version: null, data,
         }
-        return data
+        return servedBy(data)
       } catch (error) {
         last = error
         failures.push({

package/src/verify.ts

@@ -34,7 +34,7 @@ import { join } from 'node:path'
 import { listHotMounts, parseSimplePatch } from './hot.ts'
 import { userPatchPackageReferences } from './patch.ts'
 import { nameMatchesPackage } from './entry-identity.ts'
-import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, profileDir, readInstalled } from './profile.ts'
+import { bundlePatchInsertedIds, declaredBundlePatchFiles, hasDshManifest, hasLoadableEntry, pluginSubdirs, profileDir, readInstalled } from './profile.ts'
 import { compareSemver, composeLayers, parsePatchFile, satisfiesRange } from './check.ts'
 import { dshHostInfo } from './dsh-install.ts'
 
@@ -498,19 +498,33 @@ export function verifyActivation(
         hot: false,
       }
     }
-    return inBundles
-      ? {
-          state: 'restart',
-          reasons: ['由你自己的 cordis.patch.yml 按名加载,重启后生效 / loaded by name from your own cordis.patch.yml — live after a restart'],
-          bundle: true,
-          hot: false,
-        }
-      : {
-          state: 'inert',
-          reasons: ['普通依赖(未声明 dsh 元数据),不是 profile 层插件;若它由某个 bundle patch 按名加载,启动后会显示为已加载 / a plain dependency with no dsh metadata — not a profile-layer plugin; if some bundle patch loads it by name it will read as live once running'],
-          bundle: false,
-          hot: false,
-        }
+    if (inBundles) {
+      return {
+        state: 'restart',
+        reasons: ['由你自己的 cordis.patch.yml 按名加载,重启后生效 / loaded by name from your own cordis.patch.yml — live after a restart'],
+        bundle: true,
+        hot: false,
+      }
+    }
+    // A collection repository's ROOT package says nothing about itself and
+    // holds the plugins one level down (#892). Installed whole — which the
+    // market used to do before it learned to retarget one, and which a user
+    // can still do by hand — it lands on this list as "installed, not in
+    // effect" with no way out of that sentence. Name the plugins it does
+    // carry and the way to install one: the dead end is the bug.
+    const carried = pluginSubdirs(dir)
+    const shown = carried.slice(0, 3).join('、')
+    const more = carried.length > 3 ? `等 ${carried.length} 个` : ''
+    const shownEn = carried.slice(0, 3).join(', ')
+    const moreEn = carried.length > 3 ? ` and ${carried.length - 3} more` : ''
+    return {
+      state: 'inert',
+      reasons: [carried.length > 0
+        ? `这是集合仓库的根包,本身不是插件。可安装的子包：${shown}${more}。请装子包而不是它(仓库地址后加 #path:/子包目录) / this is a collection repository's root package, not a plugin itself; install one of its plugins instead — ${shownEn}${moreEn} — by adding #path:/<subdirectory> to the repository URL`
+        : '普通依赖(未声明 dsh 元数据),不是 profile 层插件;若它由某个 bundle patch 按名加载,启动后会显示为已加载 / a plain dependency with no dsh metadata — not a profile-layer plugin; if some bundle patch loads it by name it will read as live once running'],
+      bundle: false,
+      hot: false,
+    }
   }
   // Carrier bundles (#103) ship no entry of their own — what they mount is
   // the point — so judge by "is anything loadable", not by this package's