dshmarket 1.66.35 → 1.66.37

package/README.md

@@ -46,7 +46,7 @@ its own dsh: it may be older than the one `npm` would give you (#139).
 - **Screenshots** — AppStore-style screenshots, auto-carousel when there's more than one, click to preview full-size: author-curated shots show right on the card (zero extra requests); plugins without curated shots fall back to automatic README extraction once you open the install dialog. Images load from GitHub hosting only
 - **Comments** — every card opens the plugin's discussion thread in place. It is the same thread its pages on [dshmarket.com](https://dshmarket.com) and the [catalog](https://awesome-dsh-plugin.com) show, so a plugin has one conversation rather than three. Backed by GitHub Discussions through giscus: it loads when you open it, needs a GitHub account only to post, and the note above it says plainly that opening it contacts giscus.app and GitHub. On local dsh web, reading stays embedded while a dedicated GitHub action opens the exact discussion in a new tab for sign-in and posting, so the cross-site return never carries or depends on the host session
 - **Favorites** — bookmark plugins and themes from Discover or the Themes tab; a dedicated Favorites tab lists them with search, sort, and install actions. Bookmarks persist in the profile's market state (`state.json`); entries that leave the catalog can be cleared in one click
-- **Groups** — organise installed plugins into named groups (rename, delete, and per-group search); a plugin lives in one group and ungrouped is the default. Purely organisational: the panel says so, and nothing about enable state changes. The grouping itself is local state in the profile's `state.json`
+- **Groups** — organise installed plugins into named groups (rename, delete, and per-group search); a plugin lives in one group and ungrouped is the default. A group carries its own switch: all-on, all-off, or the mixed state its members are really in, so a working set can be switched as a unit without touching the rest. A group holds at most one theme. The grouping itself is local state in the profile's `state.json`
 - **Notes** — write your own one-line description for any installed plugin and it replaces the author's on that row, so a shelf of forty plugins answers "why did I install this" in your words. Stored locally beside groups and favorites, never sent anywhere
 - **Themes** — a dedicated tab for community themes and skins: install → active immediately, switch with one click (themes are mutually exclusive, your choice survives restarts), uninstall to revert
 - **One-click install** — confirm the source, watch live progress; most plugins go live after a page refresh, no restart

package/README.zh.md

@@ -41,7 +41,7 @@ dsh plugin --profile web add dshmarket
 - **截图展示**——App Store 式截图，多图自动轮播，点开还能看大图；作者在 registry 里策展的截图列表卡片就直接显示（零额外请求），没有策展的插件则在打开安装弹窗时自动从 README 抽取；图片仅从 GitHub 图床加载
 - **评论**——每张卡片都能就地打开该插件的讨论。它和插件在 [dshmarket.com](https://dshmarket.com) 与[目录站](https://awesome-dsh-plugin.com)上的页面共用同一条讨论，一个插件只有一处对话，而不是三处。底层是 GitHub Discussions（经由 giscus）：打开即加载，只有发表评论才需要 GitHub 账号；说明里也直说打开会连接 giscus.app 与 GitHub。本地 dsh web 继续内嵌评论供阅读，登录和发表则通过专用 GitHub 入口在新标签页打开当前插件的精确讨论，不让跨站回跳携带或依赖宿主会话
 - **收藏**——在「发现」或「主题」页点书签即可收藏插件/主题；「收藏」Tab 集中展示，支持搜索、排序与安装。书签写入 profile 的市场状态（`state.json`）；已下架条目可一键清除
-- **分组**——把已安装插件整理进具名分组（可重命名、删除，分组内单独搜索）；一个插件属于一个分组，默认是「未分组」。它只用于整理，面板上写明了这一点，不改变任何启用状态。分组本身是 profile `state.json` 里的本地状态
+- **分组**——把已安装插件整理进具名分组（可重命名、删除，分组内单独搜索）；一个插件属于一个分组，默认是「未分组」。每个分组自带开关：全开、全关，或成员当前真实处于的「混合」状态——一组一起开合，不动其余插件。一个分组最多容纳一个主题。分组本身是 profile `state.json` 里的本地状态
 - **备注**——给任何已安装插件写一行你自己的说明，它会在这行**代替作者简介**显示——四十个插件的列表因此能用你自己的话回答「我当初为什么装它」。和分组、收藏一样只存在本地，不上传
 - **主题**——独立主题页：装完立即生效，点一下切换（主题互斥、选择跨重启保留），卸载即恢复
 - **一键安装**——确认来源，实时进度；多数插件刷新页面即可用，无需重启

package/client/client.js

@@ -243,6 +243,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			setChannelSwitchHint: "该版本低于当前已安装版本。",
 			setSelfRemove: "卸载插件市场",
 			setSelfRemoveHint: "从这个 profile 卸载市场。已装的其它插件不受影响。",
+			setSelfRemoveRemote: "这个页面不是从本机打开的，市场没法从这里卸载自己。请到运行 DSH 的那台机器上移除：桌面端用「设置 → 插件」，其它环境用命令行。",
 			setSelfConfirm: "确定要卸载插件市场吗？卸载后需使用命令行重新安装。",
 			setSelfPurge: "同时清除市场自己的数据",
 			setSelfPurgeOn: "将删除：市场的停用清单与自定义分组，以及它写进配置文件的停用记录——被停用的插件将恢复运行。不涉及密码或密钥，市场从不把它们存在磁盘上。",
@@ -980,6 +981,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			setChannelSwitchHint: "This version is lower than the one installed.",
 			setSelfRemove: "Uninstall the plugin market",
 			setSelfRemoveHint: "Uninstall the market from this profile. Your other plugins are untouched.",
+			setSelfRemoveRemote: "This page was not opened on the machine running DSH, so the market cannot remove itself from here. Remove it there: Settings → Plugins on the desktop app, or the command line elsewhere.",
 			setSelfConfirm: "Uninstall the plugin market? Reinstalling it requires the command line.",
 			setSelfPurge: "Also clear the market's own data",
 			setSelfPurgeOn: "Will delete: the market's disable list and custom groups, plus the disable entries it wrote into your config file — plugins it switched off will run again. No passwords or tokens are involved; the market never stores those on disk.",
@@ -9418,7 +9420,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 							const statusInstalled = installedMap(status.installed);
 							if (!sameInstalledMap(installed, statusInstalled)) refreshInstalled();
 							if (readSession("dshm-pending") !== null && busyUrl !== null && status.busy !== true) {
-								if (data !== null && data.plugins.some((p) => p.url === busyUrl && isInstalled(p, statusInstalled, repoIdentities, data.plugins, repoHints))) {
+								const url = busyUrl;
+								if (data !== null && data.plugins.some((p) => p.url === url && isInstalled(p, statusInstalled, repoIdentities, data.plugins, repoHints))) {
 									idleStrikes.current = 0;
 									sessionStorage.removeItem("dshm-pending");
 									const recovered = recoveredInstall.current;
@@ -9426,7 +9429,12 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 										setRecords((list) => drop(list, recovered.id));
 										recoveredInstall.current = null;
 									}
-									setDoneUrls((urls) => urls.includes(busyUrl) ? urls : urls.concat(busyUrl));
+									setRecords((list) => list.map((record) => record.kind === "install" && record.url === url && record.state === "running" ? {
+										...record,
+										state: "done",
+										needsRefresh: true
+									} : record));
+									setDoneUrls((urls) => urls.includes(url) ? urls : urls.concat(url));
 									setBusyUrl(null);
 								} else if (++idleStrikes.current >= 2) {
 									idleStrikes.current = 0;
@@ -9436,6 +9444,11 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 										setRecords((list) => drop(list, recovered.id));
 										recoveredInstall.current = null;
 									}
+									setRecords((list) => list.map((record) => record.kind === "install" && record.url === url && record.state === "running" ? {
+										...record,
+										state: "failed",
+										reason: t("installFail")
+									} : record));
 									setBusyUrl(null);
 									setInstallError(t("installFail") + " — " + t("exportLog"));
 								}
@@ -15116,6 +15129,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				githubProxyCustom: typeof body.githubProxyCustom === "string" ? body.githubProxyCustom : null,
 				githubProxyManaged: body.githubProxyManaged === true,
 				selfManaged: body.selfManaged !== false,
+				selfUninstallReachable: body.selfUninstallReachable !== false,
 				buildEnv: body.buildEnv ?? {}
 			};
 		}
@@ -15222,6 +15236,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 							githubProxyCustom: null,
 							githubProxyManaged: false,
 							selfManaged: true,
+							selfUninstallReachable: true,
 							buildEnv: {}
 						});
 					}
@@ -15548,7 +15563,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				onClick: () => {
 					onSaveEnv();
 				}
-			}, t("setBuildEnvSave")))), status?.selfManaged === true ? row(t("setSelfRemove"), t("setSelfRemoveHint"), phase === "confirming" || busy ? null : (0, react.createElement)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+			}, t("setBuildEnvSave")))), status?.selfManaged === true ? row(t("setSelfRemove"), status.selfUninstallReachable ? t("setSelfRemoveHint") : t("setSelfRemoveRemote"), status.selfUninstallReachable && phase !== "confirming" && !busy ? (0, react.createElement)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 				variant: "outline",
 				size: "sm",
 				className: Market_module_css_default.setDanger,
@@ -15556,7 +15571,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				onClick: () => {
 					setPhase("confirming");
 				}
-			}, t("setSelfRemove"))) : null, status?.selfManaged === true && (phase === "confirming" || busy) ? (0, react.createElement)("div", { className: Market_module_css_default.setConfirm }, (0, react.createElement)("div", { className: Market_module_css_default.setHint }, t("setSelfConfirm")), (0, react.createElement)("label", { className: Market_module_css_default.setCheck }, (0, react.createElement)("input", {
+			}, t("setSelfRemove")) : null) : null, status?.selfManaged === true && status.selfUninstallReachable && (phase === "confirming" || busy) ? (0, react.createElement)("div", { className: Market_module_css_default.setConfirm }, (0, react.createElement)("div", { className: Market_module_css_default.setHint }, t("setSelfConfirm")), (0, react.createElement)("label", { className: Market_module_css_default.setCheck }, (0, react.createElement)("input", {
 				type: "checkbox",
 				checked: purge,
 				onChange: () => {

package/lib/official-desktop.js

@@ -23,6 +23,9 @@ function detail(error) {
     // The code stays on the line: it is what the log and the issue report carry.
     if (copy !== undefined)
         return `${copy.zh} / ${copy.en} (${code})`;
+    const message = error.message;
+    if (typeof message === 'string' && message !== '')
+        return message;
     return JSON.stringify(error);
 }
 /**
@@ -60,6 +63,27 @@ const REFUSAL_COPY = {
         en: 'this version is not compatible with the running DSH, so the host refused it',
     },
 };
+/**
+ * The market's own package names. A desktop profile installs it from npm as
+ * `dshmarket`; a fork or a local checkout can declare the repository's name.
+ */
+const SELF_NAMES = new Set(['dshmarket', 'dsh-market']);
+/**
+ * Why the market will not remove itself to update, and what to do instead.
+ *
+ * The manager's `removeBundle` drops the bundle from the running composition
+ * before pnpm runs. For every other package that is a normal unload; for the
+ * market it unloads the very code that was going to install the new version,
+ * so the reinstall never happens and the profile is left with the bundle row
+ * gone and the dependency still declared (#900). The app's own Plugins page
+ * performs the same two steps from outside the market and survives.
+ */
+function selfUpdateMessage(spec) {
+    const at = spec.indexOf('@', 1);
+    const version = at === -1 ? '' : spec.slice(at + 1);
+    const target = version === '' ? spec : `${registryNameOf(spec) ?? spec}@${version}`;
+    return `市场不能在自己的请求里先卸载自己：桌面端的移除会先把市场从正在运行的组合里摘掉，补装那一步就再也执行不到了（#900）。请在桌面端的「设置 → 插件」里更新市场${version === '' ? '' : ` 到 ${version}`}，或完全退出 DSH 后在终端执行 \`dsh plugin --profile desktop add ${target}\`。 / The market cannot remove itself to update: the desktop app unloads it from the running composition first, so the reinstall never runs (#900). Update it from the desktop app's Settings → Plugins${version === '' ? '' : ` (to ${version})`}, or quit DSH completely and run \`dsh plugin --profile desktop add ${target}\` in a terminal.`;
+}
 /** The manager's own refusal code, whether it was returned or thrown. */
 function managementCode(error) {
     const code = error?.code;
@@ -100,6 +124,11 @@ async function installOrReinstall(manager, spec, options) {
     // A refusal we cannot turn into a name is the manager's answer to give.
     if (name === undefined)
         return first;
+    // Removing the market would unload this very code before the reinstall runs
+    // (#900). Say how to update it instead.
+    if (SELF_NAMES.has(name)) {
+        return { application: 'failed', error: { code: 'market-self-update', message: selfUpdateMessage(spec) } };
+    }
     progress.lastLine = 'Removing the installed copy so the desktop app can install the new version';
     const removed = await manager.removeBundle(name);
     if (removed.application === 'failed' || removed.application === 'cancelled')

package/lib/restart.js

@@ -213,6 +213,47 @@ function directLoopbackRequest(request) {
 export function restartReachableFrom(request) {
     return directLoopbackRequest(request);
 }
+/**
+ * Whether the request has the exact shape dsh Desktop's own document proxy
+ * forwards: a loopback peer, no forwarding headers, and **neither** `Host`
+ * nor `Origin`.
+ *
+ * The desktop app strips `origin`/`host` (and cookies) before forwarding to
+ * the internal host (#648), so that absence is the trusted desktop shape
+ * rather than a missing signal. It is also not something a browser can
+ * produce — every browser request carries `Host` — so a rebinding page or a
+ * cross-site POST still lands on the strict path below, carrying the
+ * attacker's own names (#678). A local non-browser client could omit both,
+ * but such a client can equally set them correctly, so this widens nothing
+ * against the threats the fence exists for.
+ */
+function desktopForwardedRequest(request) {
+    const address = request.socket.remoteAddress;
+    if (address !== '127.0.0.1' && address !== '::1' && address !== '::ffff:127.0.0.1')
+        return false;
+    if (request.headers.forwarded !== undefined
+        || request.headers['x-forwarded-for'] !== undefined
+        || request.headers['x-real-ip'] !== undefined)
+        return false;
+    return request.headers.host === undefined && request.headers.origin === undefined;
+}
+/**
+ * Whether a self-uninstall request may proceed.
+ *
+ * Same door as the restart route, plus the desktop proxy's headerless shape
+ * (#903): on Desktop the market's own card is the place users go to remove it,
+ * and the fence was refusing every such click because the proxy had stripped
+ * the very headers it required. Restart keeps the stricter predicate — it
+ * spawns a replacement host, which is not something a desktop-managed profile
+ * should get from here.
+ */
+export function trustedSelfUninstallRequest(request) {
+    return trustedRestartRequest(request) || desktopForwardedRequest(request);
+}
+/** Whether the request that asked for status could uninstall the market (#903). */
+export function selfUninstallReachableFrom(request) {
+    return trustedSelfUninstallRequest(request);
+}
 /** Whether a process-control request came from this Web host on loopback. */
 export function trustedRestartRequest(request) {
     if (!directLoopbackRequest(request))

package/lib/routes.js

@@ -43,7 +43,7 @@ import { checkUpdates, isUpdatablePlugin, compareVersions, fetchNpmLatest, inval
 import { createThemeManager } from './themes.js';
 import { readJsonBody, refuseUnadmitted, sameOrigin, sendJson } from './http.js';
 import { resolveDshHome } from './home-paths.js';
-import { detectedDebugger, detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest, restartReachableFrom } from './restart.js';
+import { detectedDebugger, detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest, trustedSelfUninstallRequest, selfUninstallReachableFrom, restartReachableFrom } from './restart.js';
 import { activationAfterReplace, brokenClientBundles, bundlePatchIsEmpty, checkClientBundle, defaultHostRuntimeFacts, findUnservedConfigNamespaces, hasHostHalf, hostPeerGate, newlyBrokenBundles, peerGateRemedy, verifyActivation } from './verify.js';
 import { carrierDisableIds, disableRow, enableRow, findUserPatchPath, foreignRowIds, isProtectedModule, packagePatchFlags, readUserPatchState, removeRowBlocks, rowIdsForPackage, userPatchPackageReferences, } from './patch.js';
 import { createProfileBackup, downloadWebdav, MAX_BACKUP_BYTES, mergeRestoreManifest, restoreProfileBackup, unportableDeps, uploadWebdav, } from './backup.js';
@@ -3552,6 +3552,9 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                     // Deliberately NOT folded into `restart`, which is also what the
                     // settings page reads and writes back as the user's own choice.
                     restartReachable: restartReachableFrom(request),
+                    // Same door, one notch wider for the desktop proxy (#903): the
+                    // card hides a remove button that could only ever answer 403.
+                    selfUninstallReachable: selfUninstallReachableFrom(request),
                     selfManaged: installed.dshmarket !== undefined || installed['dsh-market'] !== undefined,
                     // Whether the host took the market's settings namespace (#677).
                     // `unsupported-by-host` is 0.1.7 and newer, where settings come from
@@ -5255,8 +5258,13 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                 // read as an extra guard while testing nothing: origin-matches-host
                 // is already part of what this checks, so no request can fail one
                 // and pass the other.
-                if (!trustedRestartRequest(request)) {
-                    sendJson(response, 403, { error: 'self-uninstall is limited to same-origin loopback requests' });
+                if (!trustedSelfUninstallRequest(request)) {
+                    // Says what to do, not only which policy refused it: this is the one
+                    // button whose failure leaves the user with no other way out of the
+                    // page they are looking at (#903).
+                    sendJson(response, 403, {
+                        error: `不能从这个地址卸载插件市场（只接受本机同源请求）。请在运行 DSH 的机器上执行 \`dsh plugin --profile ${config.profile} remove dshmarket\`；桌面端也可以在它自己的「设置 → 插件」里移除。 / The market can only be removed from the same machine it runs on. Run \`dsh plugin --profile ${config.profile} remove dshmarket\` there, or remove it from the desktop app's Settings → Plugins.`,
+                    });
                     return;
                 }
                 try {

package/lib/types/restart.d.ts

@@ -126,6 +126,19 @@ export declare function servingPort(request: Pick<IncomingMessage, 'headers'>):
  * grant: the route still runs the full fence, including `Origin`, on the POST.
  */
 export declare function restartReachableFrom(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean;
+/**
+ * Whether a self-uninstall request may proceed.
+ *
+ * Same door as the restart route, plus the desktop proxy's headerless shape
+ * (#903): on Desktop the market's own card is the place users go to remove it,
+ * and the fence was refusing every such click because the proxy had stripped
+ * the very headers it required. Restart keeps the stricter predicate — it
+ * spawns a replacement host, which is not something a desktop-managed profile
+ * should get from here.
+ */
+export declare function trustedSelfUninstallRequest(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean;
+/** Whether the request that asked for status could uninstall the market (#903). */
+export declare function selfUninstallReachableFrom(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean;
 /** Whether a process-control request came from this Web host on loopback. */
 export declare function trustedRestartRequest(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean;
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.35",
+  "version": "1.66.37",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/client/MarketSection.tsx

@@ -2950,8 +2950,9 @@ export function MarketSection(props: MarketSectionProps) {
             // declare the install done nor count an idle strike yet — a
             // premature banner here invited a restart click into a 409.
             if (pending !== null && busyUrl !== null && status.busy !== true) {
+              const url = busyUrl
               const nowInstalled = data !== null && data.plugins.some(p =>
-                p.url === busyUrl && isInstalled(p, statusInstalled, repoIdentities, data.plugins, repoHints))
+                p.url === url && isInstalled(p, statusInstalled, repoIdentities, data.plugins, repoHints))
               if (nowInstalled) {
                 idleStrikes.current = 0
                 sessionStorage.removeItem('dshm-pending')
@@ -2960,7 +2961,18 @@ export function MarketSection(props: MarketSectionProps) {
                   setRecords(list => drop(list, recovered.id))
                   recoveredInstall.current = null
                 }
-                setDoneUrls(urls => urls.includes(busyUrl) ? urls : urls.concat(busyUrl))
+                // This poll is the only witness when the install response was
+                // lost (#100): the record `doInstall` created is still
+                // `running`, and releasing only the card's busy state leaves
+                // the Tasks entry claiming "Installing 1/1" for the rest of
+                // the mount — until settings travel remounts the section and
+                // drops `records` with it. The install landed, so the record
+                // has to land with it (#904).
+                setRecords(list => list.map(record =>
+                  record.kind === 'install' && record.url === url && record.state === 'running'
+                    ? { ...record, state: 'done' as const, needsRefresh: true }
+                    : record))
+                setDoneUrls(urls => urls.includes(url) ? urls : urls.concat(url))
                 setBusyUrl(null)
               } else if (++idleStrikes.current >= 2) {
                 // Host is idle and the plugin never landed: the install died
@@ -2973,6 +2985,13 @@ export function MarketSection(props: MarketSectionProps) {
                   setRecords(list => drop(list, recovered.id))
                   recoveredInstall.current = null
                 }
+                // Same release for the record this mount created: an install
+                // that died without a response must not leave the Tasks entry
+                // "Installing 1/1" either (#904).
+                setRecords(list => list.map(record =>
+                  record.kind === 'install' && record.url === url && record.state === 'running'
+                    ? { ...record, state: 'failed' as const, reason: t('installFail') }
+                    : record))
                 setBusyUrl(null)
                 setInstallError(t('installFail') + ' — ' + t('exportLog'))
               }

package/src/client/SettingsCard.tsx

@@ -83,6 +83,12 @@ interface SelfStatus {
   githubProxyManaged: boolean
   /** Whether the profile package manager owns this market installation. */
   selfManaged: boolean
+  /**
+   * Whether a remove request from this page could pass the market's own
+   * fence (#903). False behind a reverse proxy or a remote host, where the
+   * card must not offer a button that can only answer 403.
+   */
+  selfUninstallReachable: boolean
   /** The effective build environment (composition + card-saved override). */
   buildEnv: Record<string, string>
 }
@@ -91,6 +97,7 @@ interface SelfStatus {
 interface StatusBody {
   version?: string
   restart?: boolean
+  selfUninstallReachable?: boolean
   channel?: string
   channels?: string[]
   region?: string
@@ -168,6 +175,7 @@ function readStatus(body: StatusBody): SelfStatus {
     githubProxyCustom: typeof body.githubProxyCustom === 'string' ? body.githubProxyCustom : null,
     githubProxyManaged: body.githubProxyManaged === true,
     selfManaged: body.selfManaged !== false,
+    selfUninstallReachable: body.selfUninstallReachable !== false,
     buildEnv: body.buildEnv ?? {},
   }
 }
@@ -279,7 +287,7 @@ export function SettingsCard({ t, onRemoved, sidebar }: SettingsCardProps): Reac
           setStatus({
             version: null, restart: false, channel: 'stable', channels: ['stable', 'beta'],
             region: 'global', regions: REGIONS, regionAuto: false,
-            githubProxyCustom: null, githubProxyManaged: false, selfManaged: true, buildEnv: {},
+            githubProxyCustom: null, githubProxyManaged: false, selfManaged: true, selfUninstallReachable: true, buildEnv: {},
           })
         }
       }
@@ -669,17 +677,18 @@ export function SettingsCard({ t, onRemoved, sidebar }: SettingsCardProps): Reac
               onClick: () => { void onSaveEnv() },
             }, t('setBuildEnvSave'))),
         ),
-        status?.selfManaged === true ? row(t('setSelfRemove'), t('setSelfRemoveHint'),
-          phase === 'confirming' || busy
-            ? null
-            : h(Button, {
+        status?.selfManaged === true ? row(t('setSelfRemove'),
+          status.selfUninstallReachable ? t('setSelfRemoveHint') : t('setSelfRemoveRemote'),
+          status.selfUninstallReachable && phase !== 'confirming' && !busy
+            ? h(Button, {
                 variant: 'outline',
                 size: 'sm',
                 className: css.setDanger,
                 disabled: busy,
                 onClick: () => { setPhase('confirming') },
-              }, t('setSelfRemove'))) : null,
-        status?.selfManaged === true && (phase === 'confirming' || busy)
+              }, t('setSelfRemove'))
+            : null) : null,
+        status?.selfManaged === true && status.selfUninstallReachable && (phase === 'confirming' || busy)
           ? h('div', { className: css.setConfirm },
               h('div', { className: css.setHint }, t('setSelfConfirm')),
               h('label', { className: css.setCheck },

package/src/client/locales.ts

@@ -46,6 +46,7 @@ export const zh = {
   setChannelSwitchHint: '该版本低于当前已安装版本。',
   setSelfRemove: '卸载插件市场',
   setSelfRemoveHint: '从这个 profile 卸载市场。已装的其它插件不受影响。',
+  setSelfRemoveRemote: '这个页面不是从本机打开的，市场没法从这里卸载自己。请到运行 DSH 的那台机器上移除：桌面端用「设置 → 插件」，其它环境用命令行。',
   setSelfConfirm: '确定要卸载插件市场吗？卸载后需使用命令行重新安装。',
   setSelfPurge: '同时清除市场自己的数据',
   setSelfPurgeOn: '将删除：市场的停用清单与自定义分组，以及它写进配置文件的停用记录——被停用的插件将恢复运行。不涉及密码或密钥，市场从不把它们存在磁盘上。',
@@ -807,6 +808,7 @@ export const en: Record<MarketKey, string> = {
   setChannelSwitchHint: 'This version is lower than the one installed.',
   setSelfRemove: 'Uninstall the plugin market',
   setSelfRemoveHint: 'Uninstall the market from this profile. Your other plugins are untouched.',
+  setSelfRemoveRemote: 'This page was not opened on the machine running DSH, so the market cannot remove itself from here. Remove it there: Settings → Plugins on the desktop app, or the command line elsewhere.',
   setSelfConfirm: 'Uninstall the plugin market? Reinstalling it requires the command line.',
   setSelfPurge: 'Also clear the market\'s own data',
   setSelfPurgeOn: 'Will delete: the market\'s disable list and custom groups, plus the disable entries it wrote into your config file — plugins it switched off will run again. No passwords or tokens are involved; the market never stores those on disk.',

package/src/official-desktop.ts

@@ -35,6 +35,8 @@ function detail(error: unknown): string {
   const copy = code === undefined ? undefined : REFUSAL_COPY[code]
   // The code stays on the line: it is what the log and the issue report carry.
   if (copy !== undefined) return `${copy.zh} / ${copy.en} (${code})`
+  const message = (error as { message?: unknown }).message
+  if (typeof message === 'string' && message !== '') return message
   return JSON.stringify(error)
 }
 
@@ -74,6 +76,29 @@ const REFUSAL_COPY: Record<string, { zh: string; en: string }> = {
   },
 }
 
+/**
+ * The market's own package names. A desktop profile installs it from npm as
+ * `dshmarket`; a fork or a local checkout can declare the repository's name.
+ */
+const SELF_NAMES = new Set(['dshmarket', 'dsh-market'])
+
+/**
+ * Why the market will not remove itself to update, and what to do instead.
+ *
+ * The manager's `removeBundle` drops the bundle from the running composition
+ * before pnpm runs. For every other package that is a normal unload; for the
+ * market it unloads the very code that was going to install the new version,
+ * so the reinstall never happens and the profile is left with the bundle row
+ * gone and the dependency still declared (#900). The app's own Plugins page
+ * performs the same two steps from outside the market and survives.
+ */
+function selfUpdateMessage(spec: string): string {
+  const at = spec.indexOf('@', 1)
+  const version = at === -1 ? '' : spec.slice(at + 1)
+  const target = version === '' ? spec : `${registryNameOf(spec) ?? spec}@${version}`
+  return `市场不能在自己的请求里先卸载自己：桌面端的移除会先把市场从正在运行的组合里摘掉，补装那一步就再也执行不到了（#900）。请在桌面端的「设置 → 插件」里更新市场${version === '' ? '' : ` 到 ${version}`}，或完全退出 DSH 后在终端执行 \`dsh plugin --profile desktop add ${target}\`。 / The market cannot remove itself to update: the desktop app unloads it from the running composition first, so the reinstall never runs (#900). Update it from the desktop app's Settings → Plugins${version === '' ? '' : ` (to ${version})`}, or quit DSH completely and run \`dsh plugin --profile desktop add ${target}\` in a terminal.`
+}
+
 /** The manager's own refusal code, whether it was returned or thrown. */
 function managementCode(error: unknown): string | undefined {
   const code = (error as { code?: unknown } | null | undefined)?.code
@@ -116,6 +141,11 @@ async function installOrReinstall(
   const name = registryNameOf(spec)
   // A refusal we cannot turn into a name is the manager's answer to give.
   if (name === undefined) return first
+  // Removing the market would unload this very code before the reinstall runs
+  // (#900). Say how to update it instead.
+  if (SELF_NAMES.has(name)) {
+    return { application: 'failed', error: { code: 'market-self-update', message: selfUpdateMessage(spec) } }
+  }
   progress.lastLine = 'Removing the installed copy so the desktop app can install the new version'
   const removed = await manager.removeBundle(name)
   if (removed.application === 'failed' || removed.application === 'cancelled') return removed

package/src/restart.ts

@@ -233,6 +233,48 @@ export function restartReachableFrom(request: Pick<IncomingMessage, 'headers' |
   return directLoopbackRequest(request)
 }
 
+/**
+ * Whether the request has the exact shape dsh Desktop's own document proxy
+ * forwards: a loopback peer, no forwarding headers, and **neither** `Host`
+ * nor `Origin`.
+ *
+ * The desktop app strips `origin`/`host` (and cookies) before forwarding to
+ * the internal host (#648), so that absence is the trusted desktop shape
+ * rather than a missing signal. It is also not something a browser can
+ * produce — every browser request carries `Host` — so a rebinding page or a
+ * cross-site POST still lands on the strict path below, carrying the
+ * attacker's own names (#678). A local non-browser client could omit both,
+ * but such a client can equally set them correctly, so this widens nothing
+ * against the threats the fence exists for.
+ */
+function desktopForwardedRequest(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean {
+  const address = request.socket.remoteAddress
+  if (address !== '127.0.0.1' && address !== '::1' && address !== '::ffff:127.0.0.1') return false
+  if (request.headers.forwarded !== undefined
+    || request.headers['x-forwarded-for'] !== undefined
+    || request.headers['x-real-ip'] !== undefined) return false
+  return request.headers.host === undefined && request.headers.origin === undefined
+}
+
+/**
+ * Whether a self-uninstall request may proceed.
+ *
+ * Same door as the restart route, plus the desktop proxy's headerless shape
+ * (#903): on Desktop the market's own card is the place users go to remove it,
+ * and the fence was refusing every such click because the proxy had stripped
+ * the very headers it required. Restart keeps the stricter predicate — it
+ * spawns a replacement host, which is not something a desktop-managed profile
+ * should get from here.
+ */
+export function trustedSelfUninstallRequest(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean {
+  return trustedRestartRequest(request) || desktopForwardedRequest(request)
+}
+
+/** Whether the request that asked for status could uninstall the market (#903). */
+export function selfUninstallReachableFrom(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean {
+  return trustedSelfUninstallRequest(request)
+}
+
 /** Whether a process-control request came from this Web host on loopback. */
 export function trustedRestartRequest(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean {
   if (!directLoopbackRequest(request)) return false

package/src/routes.ts

@@ -55,7 +55,7 @@ import { checkUpdates, isUpdatablePlugin, compareVersions, fetchNpmLatest, inval
 import { createThemeManager, type LoaderEntry } from './themes.ts'
 import { readJsonBody, refuseUnadmitted, sameOrigin, sendJson } from './http.ts'
 import { resolveDshHome } from './home-paths.ts'
-import { detectedDebugger, detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest, type RecoveryHandoffConfig, restartReachableFrom } from './restart.ts'
+import { detectedDebugger, detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest, trustedSelfUninstallRequest, selfUninstallReachableFrom, type RecoveryHandoffConfig, restartReachableFrom } from './restart.ts'
 import type { RecoveryPlugin } from './recovery.ts'
 import { activationAfterReplace, brokenClientBundles, bundlePatchIsEmpty, checkClientBundle, defaultHostRuntimeFacts, findUnservedConfigNamespaces, hasHostHalf, hostPeerGate, newlyBrokenBundles, peerGateRemedy, verifyActivation } from './verify.ts'
 import {
@@ -3758,6 +3758,9 @@ export function mountMarketRoutes(
           // Deliberately NOT folded into `restart`, which is also what the
           // settings page reads and writes back as the user's own choice.
           restartReachable: restartReachableFrom(request),
+          // Same door, one notch wider for the desktop proxy (#903): the
+          // card hides a remove button that could only ever answer 403.
+          selfUninstallReachable: selfUninstallReachableFrom(request),
           selfManaged: installed.dshmarket !== undefined || installed['dsh-market'] !== undefined,
           // Whether the host took the market's settings namespace (#677).
           // `unsupported-by-host` is 0.1.7 and newer, where settings come from
@@ -5484,8 +5487,13 @@ sendJson(response, 200, { updates })
         // read as an extra guard while testing nothing: origin-matches-host
         // is already part of what this checks, so no request can fail one
         // and pass the other.
-        if (!trustedRestartRequest(request)) {
-          sendJson(response, 403, { error: 'self-uninstall is limited to same-origin loopback requests' })
+        if (!trustedSelfUninstallRequest(request)) {
+          // Says what to do, not only which policy refused it: this is the one
+          // button whose failure leaves the user with no other way out of the
+          // page they are looking at (#903).
+          sendJson(response, 403, {
+            error: `不能从这个地址卸载插件市场（只接受本机同源请求）。请在运行 DSH 的机器上执行 \`dsh plugin --profile ${config.profile} remove dshmarket\`；桌面端也可以在它自己的「设置 → 插件」里移除。 / The market can only be removed from the same machine it runs on. Run \`dsh plugin --profile ${config.profile} remove dshmarket\` there, or remove it from the desktop app's Settings → Plugins.`,
+          })
           return
         }
         try {