dshmarket 1.66.38 → 1.66.40

package/README.md

@@ -11,6 +11,8 @@ English | [中文](README.zh.md)
 
 The plugin market inside DeepSeek Harness. Open Settings → **Plugin Market** → browse, search, one-click install. Settings sits in the sidebar up to dsh 0.2.0 and in the account menu from 0.2.1.
 
+> 📡 **The same catalog is also a plugin market index.** On dsh 0.2.1+, open **Plugins → Discover → Index sources** and add `https://cdn.jsdelivr.net/npm/dsh-plugin-catalog/index.json`. That is this list as a format-1 index, served from npm so it loads quickly everywhere — dsh gives a source 15 seconds, and the GitHub Pages copies (`https://awesome-dsh-plugin.com/index.json` and `https://dshmarket.com/index.json`) can exceed that from some networks. The host's Discover tab and the `plugin_market` agent tool then search it.
+
 ![dsh-market](assets/demo-en.png)
 
 One-click themes: install, switch live, no restart.
@@ -42,7 +44,6 @@ its own dsh: it may be older than the one `npm` would give you (#139).
 ## What you get
 
 - **Browse & search** the full community catalog (4200+ plugins, growing daily) — category filters, star counts, top/new sorting, bilingual descriptions that follow your UI language
-- **The same catalog in the official Discover tab** — the list is also published as a plugin market index. On dsh 0.2.1+ add `https://awesome-dsh-plugin.com/index.json` under **Plugins → Discover → Index sources**, and the host's own Discover tab and its `plugin_market` agent tool search the same entries (the feature ships behind dsh's optional plugin-market bundle)
 - **Host-aware discovery** — cards show the DSH requirement declared by `engines.dsh` or lockstep `@deepseek-ai/dsh-*` peers; an opt-in filter hides only confirmed mismatches with the running host. Undeclared, malformed, unavailable, and GitHub-only entries remain visible rather than being guessed incompatible
 - **Screenshots** — AppStore-style screenshots, auto-carousel when there's more than one, click to preview full-size: author-curated shots show right on the card (zero extra requests); plugins without curated shots fall back to automatic README extraction once you open the install dialog. Images load from GitHub hosting only
 - **Comments** — every card opens the plugin's discussion thread in place. It is the same thread its pages on [dshmarket.com](https://dshmarket.com) and the [catalog](https://awesome-dsh-plugin.com) show, so a plugin has one conversation rather than three. Backed by GitHub Discussions through giscus: it loads when you open it, needs a GitHub account only to post, and the note above it says plainly that opening it contacts giscus.app and GitHub. On local dsh web, reading stays embedded while a dedicated GitHub action opens the exact discussion in a new tab for sign-in and posting, so the cross-site return never carries or depends on the host session

package/README.zh.md

@@ -11,6 +11,8 @@
 
 装在 DeepSeek Harness 里的插件市场。打开设置 → **插件市场** → 逛一逛，点一下，装好。设置入口在 dsh 0.2.0 及以前位于侧边栏，0.2.1 起移到了账号菜单里。
 
+> 📡 **同一份目录也是一份插件市场索引。** dsh 0.2.1 起，打开 **插件 → 发现（Discover）→ 索引源（Index sources）**，添加 `https://cdn.jsdelivr.net/npm/dsh-plugin-catalog/index.json`。它就是这份列表的 format 1 索引，放在 npm 上分发，所以在哪里都快——dsh 给索引源的时间只有 15 秒，而 GitHub Pages 上的那两份（`https://awesome-dsh-plugin.com/index.json` 与 `https://dshmarket.com/index.json`）在部分网络下会超过。宿主自己的发现页和 `plugin_market` 智能体工具就能搜索它。
+
 ![dsh-market](assets/demo-zh.png)
 
 主题一键换：装完即生效，点一下切换，不用重启。
@@ -37,7 +39,6 @@ dsh plugin --profile web add dshmarket
 ## 你会得到
 
 - **逛与搜**——完整社区目录（4200+ 插件，每天在涨），分类筛选、star 数、最热/最新排序，中英描述跟随界面语言
-- **同一份目录也能进官方 Discover**——这份列表同时发布为插件市场索引：dsh 0.2.1 起，在 **插件 → 发现 → 索引源** 里添加 `https://awesome-dsh-plugin.com/index.json`，宿主自己的发现页和它的 `plugin_market` 智能体工具就能搜索同一批条目（该能力挂在 dsh 可选的 plugin-market bundle 上）
 - **按宿主发现**——卡片展示插件通过 `engines.dsh` 或同版本线 `@deepseek-ai/dsh-*` peer 声明的 DSH 要求；可选筛选只隐藏与当前宿主明确不匹配的插件。未声明、格式异常、暂时取不到清单及仅 GitHub 发布的条目仍保持可见，不猜成不兼容
 - **截图展示**——App Store 式截图，多图自动轮播，点开还能看大图；作者在 registry 里策展的截图列表卡片就直接显示（零额外请求），没有策展的插件则在打开安装弹窗时自动从 README 抽取；图片仅从 GitHub 图床加载
 - **评论**——每张卡片都能就地打开该插件的讨论。它和插件在 [dshmarket.com](https://dshmarket.com) 与[目录站](https://awesome-dsh-plugin.com)上的页面共用同一条讨论，一个插件只有一处对话，而不是三处。底层是 GitHub Discussions（经由 giscus）：打开即加载，只有发表评论才需要 GitHub 账号；说明里也直说打开会连接 giscus.app 与 GitHub。本地 dsh web 继续内嵌评论供阅读，登录和发表则通过专用 GitHub 入口在新标签页打开当前插件的精确讨论，不让跨站回跳携带或依赖宿主会话

package/assets/logo.svg

@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" role="img" aria-labelledby="t">
+  <title id="t">dsh-market</title>
+  <!-- Shared brand mark with awesome-dsh-plugin: the block grid with one
+       cinnabar block being plugged in. -->
+  <rect width="128" height="128" rx="28" fill="#f6f2ea"/>
+  <g transform="translate(15.7 16.7) scale(0.3) translate(-112 -78)">
+    <g fill="#2b2620">
+      <rect x="112" y="112" width="88" height="88" rx="14"/>
+      <rect x="212" y="112" width="88" height="88" rx="14"/>
+      <rect x="112" y="212" width="88" height="88" rx="14"/>
+      <rect x="212" y="212" width="88" height="88" rx="14"/>
+      <rect x="112" y="312" width="88" height="88" rx="14"/>
+      <rect x="212" y="312" width="88" height="88" rx="14"/>
+      <rect x="312" y="212" width="88" height="88" rx="14"/>
+      <rect x="312" y="312" width="88" height="88" rx="14"/>
+    </g>
+    <rect x="346" y="78" width="88" height="88" rx="14" fill="#c0392b" transform="rotate(9 390 122)"/>
+  </g>
+</svg>

package/client/client.js

@@ -211,7 +211,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			setSidebarHint: "在侧栏「插件」下方显示市场。设置里的入口不变。",
 			setSidebarOnlyDoorHint: "这个宿主没有市场设置页，这一行就是进入市场的入口。",
 			setIndexSource: "官方 Discover 索引",
-			setIndexSourceHint: "dsh 0.2.1 起，官方的「插件 → 发现 → 索引源」可以添加 https://awesome-dsh-plugin.com/index.json —— 官方发现页和 plugin_market 智能体工具会搜索同一份目录。",
+			setIndexSourceHint: "dsh 0.2.1 起，官方的「插件 → 发现 → 索引源」可以添加 https://cdn.jsdelivr.net/npm/dsh-plugin-catalog/index.json —— 官方发现页和 plugin_market 智能体工具会搜索同一份目录。",
 			setSidebarOn: "显示",
 			setSidebarOff: "不显示",
 			sidebarTip: "想更快打开？可在侧栏显示。",
@@ -951,7 +951,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			setSidebarHint: "Shows the market below Plugins in the sidebar. The Settings entry stays.",
 			setSidebarOnlyDoorHint: "This host keeps the market out of Settings, so this row is the way in.",
 			setIndexSource: "Discover index",
-			setIndexSourceHint: "On dsh 0.2.1 and newer, add https://awesome-dsh-plugin.com/index.json under Plugins → Discover → Index sources — the official Discover tab and the plugin_market agent tool then search the same catalog.",
+			setIndexSourceHint: "On dsh 0.2.1 and newer, add https://cdn.jsdelivr.net/npm/dsh-plugin-catalog/index.json under Plugins → Discover → Index sources — the official Discover tab and the plugin_market agent tool then search the same catalog.",
 			setSidebarOn: "Show",
 			setSidebarOff: "Hide",
 			sidebarTip: "Want a quicker open? Show it in the sidebar.",

package/lib/install.js

@@ -4,7 +4,7 @@
  * update staleness detection. Every function takes the plugin runner as a
  * parameter so tests can substitute a recording fake.
  */
-import { closeSync, existsSync, lstatSync, openSync, readlinkSync, readSync, rmSync, statSync } from 'node:fs';
+import { closeSync, existsSync, lstatSync, openSync, readFileSync, readlinkSync, readSync, rmSync, statSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { findDshInstallDir } from './dsh-install.js';
 import { classifyPnpmFailure, HOST_NAMESPACE_RE } from './pnpm-compat.js';
@@ -331,12 +331,32 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
         //
         // The wait on a fresh release is the one of these where "no retry" leaves
         // the user with nothing to do at all: the plugin IS published, pnpm just
-        // will not take it yet, and the door the market would open on a plain
-        // `dsh web` host is shut here — so say when the same button starts
-        // working, and what to use meanwhile (#852).
-        const note = unavailableOption === RELEASE_AGE_OVERRIDE
-            ? `这个插件的新版本比本 profile 的 minimumReleaseAge（新版本等待期）还新，pnpm 因此拒绝了本次改动（改别的插件也一样）。官方桌面端由应用自己执行安装，不接受市场的临时放行参数（${unavailableOption}），所以这里没有自动重试。**等这个版本过了等待期再更新一次即可**；想现在就更新，可以在普通的 dsh web 里装。 / The plugin's new version is younger than this profile's minimumReleaseAge, so pnpm refused this change (a change to another plugin too). The official desktop app runs the install itself and takes no one-shot bypass from the market (${unavailableOption}), so no automatic retry happens here. **Update again once the version is past the wait**; to update right now, install from plain dsh web.`
-            : `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`;
+        // will not take it yet. #852 pointed at plain `dsh web`, but the desktop
+        // profile is host-managed — that door is shut (#909). Say the wait, and
+        // when pnpm named the publish time, how long is left (#919).
+        //
+        // Drop the classifier's "market already retried" sentence first: it was
+        // appended above and is false on this host, and the client prefers
+        // body.error / that classified half over a note tacked on afterwards.
+        let note;
+        if (unavailableOption === RELEASE_AGE_OVERRIDE) {
+            const classified = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode);
+            if (classified?.code === 'release-age-violation') {
+                const cut = result.stderr.lastIndexOf(classified.message);
+                if (cut !== -1) {
+                    result = { ...result, stderr: result.stderr.slice(0, cut).trimEnd() };
+                }
+            }
+            const windowMs = readMinimumReleaseAgeMs(profile, profileDirectory);
+            const remaining = windowMs === null
+                ? null
+                : remainingReleaseAgeWait(`${result.stderr}\n${result.stdout}`, Date.now(), windowMs);
+            const wait = remaining === null ? { zh: '', en: '' } : formatRemainingReleaseAgeWait(remaining);
+            note = `这个插件的新版本比本机的新版本等待期还新，所以现在装不了（改别的插件也会被拦住）。官方桌面端不接受临时放行，所以这里没有自动重试。**等这个版本过了等待期再更新一次即可**${wait.zh}。过了等待期后再在市场点一次更新。 / The plugin's new version is younger than this machine's fresh-release wait, so the install was refused (a change to another plugin too). The official desktop app takes no one-shot bypass, so no automatic retry happens here. **Update again once the version is past the wait**${wait.en}. Try the market update again after the wait.`;
+        }
+        else {
+            note = `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`;
+        }
         result = { ...result, stderr: `${result.stderr}\n\n${note}` };
     }
     // pnpm can append a second rule even on success (#883, #878), including
@@ -419,6 +439,104 @@ const DIAGNOSTICS_TAIL_BYTES = 8192;
 export function pnpmNeverStarted(result) {
     return classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)?.code === 'pnpm-unusable';
 }
+/**
+ * Whether pnpm refused a too-young release without writing to the profile.
+ *
+ * Same nature as wroteNothing / pnpmNeverStarted for the update route's
+ * rollback (#919): pnpm DID start, read the lockfile, then exited 1 on
+ * ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION (or the sibling mature-match /
+ * resolution-policy shapes). Nothing was installed or removed, so restoring
+ * "the previous build" is alarm about an untouched profile — and on the
+ * official desktop bridge it pairs every wait with a false
+ * "restoration could not be verified" line that covers the real reason.
+ * @param result - the failed run.
+ * @returns true when the failure is pnpm's fresh-release gate.
+ */
+export function pnpmRefusedYoungRelease(result) {
+    return classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)?.code === 'release-age-violation';
+}
+/** pnpm's default minimumReleaseAge window (1440 minutes). */
+const DEFAULT_RELEASE_AGE_WINDOW_MS = 24 * 60 * 60 * 1000;
+/**
+ * The profile's fresh-release wait window in ms (#919).
+ *
+ * Reads `minimumReleaseAge` (minutes) from pnpm-workspace.yaml, then
+ * `minimum-release-age` from `.npmrc`. A key that is present but not a
+ * number returns null — callers must not invent a remaining wait. When
+ * neither file names the key, pnpm's default 1440 minutes applies.
+ */
+export function readMinimumReleaseAgeMs(profile, explicitDir) {
+    const dir = profileDir(profile, explicitDir);
+    const fromWorkspace = readReleaseAgeMinutesFromWorkspace(dir);
+    if (fromWorkspace === 'invalid')
+        return null;
+    if (typeof fromWorkspace === 'number')
+        return fromWorkspace * 60 * 1000;
+    const fromNpmrc = readReleaseAgeMinutesFromNpmrc(dir);
+    if (fromNpmrc === 'invalid')
+        return null;
+    if (typeof fromNpmrc === 'number')
+        return fromNpmrc * 60 * 1000;
+    return DEFAULT_RELEASE_AGE_WINDOW_MS;
+}
+/** @returns minutes, `'invalid'` when the key is present but unreadable, or null when absent. */
+function readReleaseAgeMinutesFromWorkspace(dir) {
+    let yaml;
+    try {
+        yaml = readFileSync(join(dir, 'pnpm-workspace.yaml'), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    if (!/^minimumReleaseAge\s*:/m.test(yaml))
+        return null;
+    const match = /^minimumReleaseAge:\s*(\d+)\s*(?:#.*)?$/m.exec(yaml);
+    if (match === null)
+        return 'invalid';
+    const minutes = Number(match[1]);
+    return Number.isFinite(minutes) ? minutes : 'invalid';
+}
+/** @returns minutes, `'invalid'` when the key is present but unreadable, or null when absent. */
+function readReleaseAgeMinutesFromNpmrc(dir) {
+    let npmrc;
+    try {
+        npmrc = readFileSync(join(dir, '.npmrc'), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    if (!/^minimum-release-age\s*=/m.test(npmrc))
+        return null;
+    const match = /^minimum-release-age\s*=\s*(\d+)\s*(?:#.*)?$/m.exec(npmrc);
+    if (match === null)
+        return 'invalid';
+    const minutes = Number(match[1]);
+    return Number.isFinite(minutes) ? minutes : 'invalid';
+}
+/**
+ * How long is left in the fresh-release wait, when pnpm named the publish
+ * time in its refusal (#919). Null when the output has no usable timestamp.
+ */
+export function remainingReleaseAgeWait(output, now = Date.now(), windowMs = DEFAULT_RELEASE_AGE_WINDOW_MS) {
+    const match = /published at (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/i.exec(output);
+    if (match === null)
+        return null;
+    const published = Date.parse(match[1]);
+    if (!Number.isFinite(published))
+        return null;
+    return Math.max(0, published + windowMs - now);
+}
+/** Human remaining-wait fragment for the desktop release-age note. */
+function formatRemainingReleaseAgeWait(remainingMs) {
+    if (remainingMs <= 0) {
+        return { zh: '（现在再试一次即可）', en: ' (try again now)' };
+    }
+    const hours = Math.max(1, Math.ceil(remainingMs / (60 * 60 * 1000)));
+    return {
+        zh: `（大约还剩 ${hours} 小时）`,
+        en: ` (about ${hours} hour${hours === 1 ? '' : 's'} left)`,
+    };
+}
 /**
  * Whether pnpm failed because the running host holds the package's files
  * open, so nothing pnpm runs from inside that host can replace them.

package/lib/official-desktop.js

@@ -82,7 +82,14 @@ function selfUpdateMessage(spec) {
     const at = spec.indexOf('@', 1);
     const version = at === -1 ? '' : spec.slice(at + 1);
     const target = version === '' ? spec : `${registryNameOf(spec) ?? spec}@${version}`;
-    return `市场不能在自己的请求里先卸载自己：桌面端的移除会先把市场从正在运行的组合里摘掉，补装那一步就再也执行不到了（#900）。请在桌面端的「设置 → 插件」里更新市场${version === '' ? '' : ` 到 ${version}`}，或完全退出 DSH 后在终端执行 \`dsh plugin --profile desktop add ${target}\`。 / The market cannot remove itself to update: the desktop app unloads it from the running composition first, so the reinstall never runs (#900). Update it from the desktop app's Settings → Plugins${version === '' ? '' : ` (to ${version})`}, or quit DSH completely and run \`dsh plugin --profile desktop add ${target}\` in a terminal.`;
+    // Two paths that used to be named here do not exist on dsh 0.2.1, and a
+    // reporter proved both (#909): `dsh plugin --profile desktop` is refused
+    // outright, and the app's Settings → Plugins has no update entry — its
+    // manager refuses re-adding a package that is already declared. The only
+    // route left is pnpm run against the profile with the app fully quit, which
+    // is what the reporter verified. `--config.minimum-release-age=0` is the
+    // market's own one-shot flag, spelled so it works in every shell.
+    return `市场不能在自己的请求里更新自己：桌面端的移除会先把市场从正在运行的组合里摘掉，补装那一步就执行不到了（#900），而应用内的「设置 → 插件」没有更新入口（#909）。要更新${version === '' ? '' : ` 到 ${version}`}：完全退出 DSH Desktop，在 profile 目录执行 \`pnpm add ${target} --config.minimum-release-age=0\`（没有 pnpm 时用 \`npx pnpm add …\`），然后重新启动。Windows 的 profile 一般在 %USERPROFILE%\\.dsh\\profiles\\desktop。 / The market cannot update itself: the desktop app unloads it from the running composition first, so the reinstall never runs (#900), and the app's Settings → Plugins has no update entry (#909). To update${version === '' ? '' : ` to ${version}`}: quit DSH Desktop completely, run \`pnpm add ${target} --config.minimum-release-age=0\` in the profile directory (use \`npx pnpm add …\` if pnpm is not installed), then start DSH again. On Windows the profile is usually %USERPROFILE%\\.dsh\\profiles\\desktop.`;
 }
 /** The manager's own refusal code, whether it was returned or thrown. */
 function managementCode(error) {
@@ -244,11 +251,18 @@ _profileDirectory) {
                 // No package result means the manager stopped before it ran pnpm: the
                 // profile is untouched, and the route must not try to "restore" it.
                 wroteNothing: !ok && result.packageResult === undefined,
+                // The manager's own code, kept machine-readable (#909): a client can
+                // tell a self-update refusal from an ordinary failure.
+                ...(ok ? {} : { refusalCode: managementCode(result.error) }),
             };
         }, (error) => {
             const message = detail(error);
             progress.error = message;
-            return { ...failure(message, 127), wroteNothing: managementCode(error) !== undefined };
+            return {
+                ...failure(message, 127),
+                wroteNothing: managementCode(error) !== undefined,
+                ...(managementCode(error) === undefined ? {} : { refusalCode: managementCode(error) }),
+            };
         }).finally(() => {
             progress.active = false;
             progress.cancelling = false;

package/lib/routes.js

@@ -32,7 +32,7 @@ import { createProfileSnapshot, DEFAULT_MAX_SNAPSHOTS, deleteSnapshot, listSnaps
 import { readHostRecoveryView, restoreHostRecoveryBackup } from './host-recovery.js';
 import { trialValidate } from './trial.js';
 import { catalogRepoKey, findCatalogEntryForLocal, findInstalledAlias, gitCommitOfTarget, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitRefOfTarget, gitTargetAtCommit, gitUpdateTarget, hostedRepoKey, lookupRepoFromUrl, pinnedAllowBuildsKeys, installTargetFor, isGenerationLink, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, sourceFallbackFor, workspaceProtocolDeps } from './sources.js';
-import { failureDetail, groupConflictsByOwner, isStaleUpdate, parseIgnoredBuildEntries, parseIgnoredBuilds, parsePrepareKey, parsePrepareNotAllowed, pnpmBlockedByOpenFiles, pnpmNeverStarted, RELEASE_AGE_OVERRIDE, removeDanglingHostBridge, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.js';
+import { failureDetail, groupConflictsByOwner, isStaleUpdate, parseIgnoredBuildEntries, parseIgnoredBuilds, parsePrepareKey, parsePrepareNotAllowed, pnpmBlockedByOpenFiles, pnpmNeverStarted, pnpmRefusedYoungRelease, RELEASE_AGE_OVERRIDE, removeDanglingHostBridge, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.js';
 import { classifyPnpmFailure } from './pnpm-compat.js';
 import { asChannel, CHANNELS, DIST_TAG, resolveChannel } from './channels.js';
 import { asRegion, githubProxyManaged, normalizeGithubProxy, REGIONS, routesFor, setActiveRegion, setCustomGithubProxy, } from './regions.js';
@@ -333,6 +333,14 @@ function pnpmFailureMessage(result) {
         return undefined;
     if (failure.code === 'ignored-builds' || failure.code === 'git-prepare-not-allowed')
         return undefined;
+    // Desktop release-age note is already the actionable sentence (#919). Do
+    // not cover it with the classifier's "market already retried" claim —
+    // install/uninstall fall through to stderr via failureText when error is
+    // undefined.
+    if (failure.code === 'release-age-violation'
+        && /没有自动重试|no automatic retry happens here/.test(`${result.stderr}\n${result.stdout}`)) {
+        return undefined;
+    }
     return failure.message;
 }
 /**
@@ -4606,7 +4614,12 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             // verify restoration, inspect this profile" warning this block
                             // raises on a failed rollback would be alarm about an untouched
                             // profile.
-                            && result.wroteNothing !== true) {
+                            && result.wroteNothing !== true
+                            // pnpm ran, then refused a too-young release without writing
+                            // (#919). Same untouched profile; skipping the rollback keeps
+                            // the release-age reason visible instead of covering it with a
+                            // false "restoration could not be verified" alarm.
+                            && !pnpmRefusedYoungRelease(result)) {
                             if (pnpmBlockedByOpenFiles(result)) {
                                 const kept = keepLockedBuild();
                                 rollbackOk = kept.ok;
@@ -4943,7 +4956,10 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             // ever sees this when something really is unbootable.
                             ...(() => { const orphans = orphanBundles(); return orphans.length > 0 ? { orphanBundles: orphans } : {}; })(),
                             staleReason: staleReason ?? undefined,
-                            failureCode: versionFailureCode ?? undefined,
+                            // The host's own refusal code when it stopped before pnpm
+                            // (#909): `market-self-update` tells a client that the button
+                            // cannot work on this host, not that the update was broken.
+                            failureCode: versionFailureCode ?? result.refusalCode ?? undefined,
                             renamedTo: renamedTo ?? undefined,
                             removedDeclaration: removedDeclaration ?? undefined,
                             ...(droppedBundles.length > 0 ? { droppedBundles } : {}),
@@ -4954,8 +4970,14 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             // before running pnpm there is no classifier for its words and
                             // no rollback behind it, so without this the answer carried no
                             // reason at all.
+                            // Release-age on Desktop (#919): withHoistRecovery already wrote
+                            // the wait note into stderr (and stripped the false "already
+                            // retried" classifier). Prefer that over pnpmFailureMessage,
+                            // which would re-surface the classifier alone — the client
+                            // shows body.error first.
                             error: versionFailureError ?? renamedError ?? trialError ?? brokenEntryError ?? hardFailureRollbackError ?? staleError
                                 ?? (result.wroteNothing === true && result.stderr.trim() !== '' ? result.stderr.trim() : undefined)
+                                ?? (pnpmRefusedYoungRelease(result) && result.stderr.trim() !== '' ? result.stderr.trim() : undefined)
                                 ?? pnpmFailureMessage(result) ?? undefined,
                             exitCode: result.exitCode,
                             timedOut: result.timedOut,

package/lib/types/dsh-cli.d.ts

@@ -172,6 +172,16 @@ export interface InstallResult {
      * (#897) — and their only true account is "nothing happened".
      */
     wroteNothing?: boolean;
+    /**
+     * The host's own refusal code, when it stopped before running pnpm.
+     *
+     * The desktop manager answers with structured codes — `already-installed`,
+     * `bundle-in-use`, `market-self-update` — but they used to survive only as
+     * text inside `stderr`. The update route forwards this to `failureCode`,
+     * so a client can tell "the market cannot update itself here" (#909) from
+     * an ordinary failure without parsing a sentence.
+     */
+    refusalCode?: string;
     /** Package names pnpm reported as having ignored build scripts (ndjson). */
     ignoredBuilds?: string[];
     /**

package/lib/types/install.d.ts

@@ -147,6 +147,34 @@ export declare function diagnosticsTail(result: {
  * @returns true when the failure happened before pnpm could run.
  */
 export declare function pnpmNeverStarted(result: InstallResult): boolean;
+/**
+ * Whether pnpm refused a too-young release without writing to the profile.
+ *
+ * Same nature as wroteNothing / pnpmNeverStarted for the update route's
+ * rollback (#919): pnpm DID start, read the lockfile, then exited 1 on
+ * ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION (or the sibling mature-match /
+ * resolution-policy shapes). Nothing was installed or removed, so restoring
+ * "the previous build" is alarm about an untouched profile — and on the
+ * official desktop bridge it pairs every wait with a false
+ * "restoration could not be verified" line that covers the real reason.
+ * @param result - the failed run.
+ * @returns true when the failure is pnpm's fresh-release gate.
+ */
+export declare function pnpmRefusedYoungRelease(result: InstallResult): boolean;
+/**
+ * The profile's fresh-release wait window in ms (#919).
+ *
+ * Reads `minimumReleaseAge` (minutes) from pnpm-workspace.yaml, then
+ * `minimum-release-age` from `.npmrc`. A key that is present but not a
+ * number returns null — callers must not invent a remaining wait. When
+ * neither file names the key, pnpm's default 1440 minutes applies.
+ */
+export declare function readMinimumReleaseAgeMs(profile: string, explicitDir?: string): number | null;
+/**
+ * How long is left in the fresh-release wait, when pnpm named the publish
+ * time in its refusal (#919). Null when the output has no usable timestamp.
+ */
+export declare function remainingReleaseAgeWait(output: string, now?: number, windowMs?: number): number | null;
 /**
  * Whether pnpm failed because the running host holds the package's files
  * open, so nothing pnpm runs from inside that host can replace them.

package/lib/update-api-v1.js

@@ -18,9 +18,29 @@ function text(value) {
 function bool(value) {
     return value === true;
 }
+/**
+ * Host refusal codes that may travel through `failureCode` unchanged.
+ *
+ * The route forwards the desktop manager's own codes (#909); the v1 API only
+ * re-publishes the ones a caller can act on, so an internal code cannot leak
+ * by accident. `market-self-update` is the one this exists for: the market
+ * cannot update itself on a host whose manager refuses re-adds, and a caller
+ * should be able to say so instead of retrying.
+ */
+const FORWARDED_FAILURE_CODES = new Set([
+    'DOWNGRADE_DETECTED',
+    'RESOLVED_VERSION_MISMATCH',
+    'market-self-update',
+    'already-installed',
+    'bundle-in-use',
+    'not-removable',
+    'stop-profile',
+    'management-required',
+    'incompatible-version',
+]);
 function failureCode(status, body) {
     const explicit = text(body.failureCode);
-    if (explicit === 'DOWNGRADE_DETECTED' || explicit === 'RESOLVED_VERSION_MISMATCH')
+    if (explicit !== null && FORWARDED_FAILURE_CODES.has(explicit))
         return explicit;
     if (body.agentsBusy === true)
         return 'AGENTS_RUNNING';

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.38",
+  "version": "1.66.40",
+  "icon": "assets/logo.svg",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -72,6 +73,7 @@
     "./locale/*.json": "./locale/*.json"
   },
   "files": [
+    "assets/logo.svg",
     "locale",
     "lib",
     "src",

package/src/client/locales.ts

@@ -14,7 +14,7 @@ export const zh = {
   setSidebarHint: '在侧栏「插件」下方显示市场。设置里的入口不变。',
   setSidebarOnlyDoorHint: '这个宿主没有市场设置页，这一行就是进入市场的入口。',
   setIndexSource: '官方 Discover 索引',
-  setIndexSourceHint: 'dsh 0.2.1 起，官方的「插件 → 发现 → 索引源」可以添加 https://awesome-dsh-plugin.com/index.json —— 官方发现页和 plugin_market 智能体工具会搜索同一份目录。',
+  setIndexSourceHint: 'dsh 0.2.1 起，官方的「插件 → 发现 → 索引源」可以添加 https://cdn.jsdelivr.net/npm/dsh-plugin-catalog/index.json —— 官方发现页和 plugin_market 智能体工具会搜索同一份目录。',
   setSidebarOn: '显示',
   setSidebarOff: '不显示',
   sidebarTip: '想更快打开？可在侧栏显示。',
@@ -778,7 +778,7 @@ export const en: Record<MarketKey, string> = {
   setSidebarHint: 'Shows the market below Plugins in the sidebar. The Settings entry stays.',
   setSidebarOnlyDoorHint: 'This host keeps the market out of Settings, so this row is the way in.',
   setIndexSource: 'Discover index',
-  setIndexSourceHint: 'On dsh 0.2.1 and newer, add https://awesome-dsh-plugin.com/index.json under Plugins → Discover → Index sources — the official Discover tab and the plugin_market agent tool then search the same catalog.',
+  setIndexSourceHint: 'On dsh 0.2.1 and newer, add https://cdn.jsdelivr.net/npm/dsh-plugin-catalog/index.json under Plugins → Discover → Index sources — the official Discover tab and the plugin_market agent tool then search the same catalog.',
   setSidebarOn: 'Show',
   setSidebarOff: 'Hide',
   sidebarTip: 'Want a quicker open? Show it in the sidebar.',

package/src/dsh-cli.ts

@@ -511,6 +511,16 @@ export interface InstallResult {
    * (#897) — and their only true account is "nothing happened".
    */
   wroteNothing?: boolean
+  /**
+   * The host's own refusal code, when it stopped before running pnpm.
+   *
+   * The desktop manager answers with structured codes — `already-installed`,
+   * `bundle-in-use`, `market-self-update` — but they used to survive only as
+   * text inside `stderr`. The update route forwards this to `failureCode`,
+   * so a client can tell "the market cannot update itself here" (#909) from
+   * an ordinary failure without parsing a sentence.
+   */
+  refusalCode?: string
   /** Package names pnpm reported as having ignored build scripts (ndjson). */
   ignoredBuilds?: string[]
   /**

package/src/install.ts

@@ -5,7 +5,7 @@
  * parameter so tests can substitute a recording fake.
  */
 
-import { closeSync, existsSync, lstatSync, openSync, readlinkSync, readSync, rmSync, statSync } from 'node:fs'
+import { closeSync, existsSync, lstatSync, openSync, readFileSync, readlinkSync, readSync, rmSync, statSync } from 'node:fs'
 import { dirname, isAbsolute, join, resolve } from 'node:path'
 import type { InstallResult, PluginRunner } from './dsh-cli.ts'
 import { findDshInstallDir } from './dsh-install.ts'
@@ -337,12 +337,31 @@ export async function withHoistRecovery(
     //
     // The wait on a fresh release is the one of these where "no retry" leaves
     // the user with nothing to do at all: the plugin IS published, pnpm just
-    // will not take it yet, and the door the market would open on a plain
-    // `dsh web` host is shut here — so say when the same button starts
-    // working, and what to use meanwhile (#852).
-    const note = unavailableOption === RELEASE_AGE_OVERRIDE
-      ? `这个插件的新版本比本 profile 的 minimumReleaseAge（新版本等待期）还新，pnpm 因此拒绝了本次改动（改别的插件也一样）。官方桌面端由应用自己执行安装，不接受市场的临时放行参数（${unavailableOption}），所以这里没有自动重试。**等这个版本过了等待期再更新一次即可**；想现在就更新，可以在普通的 dsh web 里装。 / The plugin's new version is younger than this profile's minimumReleaseAge, so pnpm refused this change (a change to another plugin too). The official desktop app runs the install itself and takes no one-shot bypass from the market (${unavailableOption}), so no automatic retry happens here. **Update again once the version is past the wait**; to update right now, install from plain dsh web.`
-      : `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`
+    // will not take it yet. #852 pointed at plain `dsh web`, but the desktop
+    // profile is host-managed — that door is shut (#909). Say the wait, and
+    // when pnpm named the publish time, how long is left (#919).
+    //
+    // Drop the classifier's "market already retried" sentence first: it was
+    // appended above and is false on this host, and the client prefers
+    // body.error / that classified half over a note tacked on afterwards.
+    let note: string
+    if (unavailableOption === RELEASE_AGE_OVERRIDE) {
+      const classified = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)
+      if (classified?.code === 'release-age-violation') {
+        const cut = result.stderr.lastIndexOf(classified.message)
+        if (cut !== -1) {
+          result = { ...result, stderr: result.stderr.slice(0, cut).trimEnd() }
+        }
+      }
+      const windowMs = readMinimumReleaseAgeMs(profile, profileDirectory)
+      const remaining = windowMs === null
+        ? null
+        : remainingReleaseAgeWait(`${result.stderr}\n${result.stdout}`, Date.now(), windowMs)
+      const wait = remaining === null ? { zh: '', en: '' } : formatRemainingReleaseAgeWait(remaining)
+      note = `这个插件的新版本比本机的新版本等待期还新，所以现在装不了（改别的插件也会被拦住）。官方桌面端不接受临时放行，所以这里没有自动重试。**等这个版本过了等待期再更新一次即可**${wait.zh}。过了等待期后再在市场点一次更新。 / The plugin's new version is younger than this machine's fresh-release wait, so the install was refused (a change to another plugin too). The official desktop app takes no one-shot bypass, so no automatic retry happens here. **Update again once the version is past the wait**${wait.en}. Try the market update again after the wait.`
+    } else {
+      note = `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`
+    }
     result = { ...result, stderr: `${result.stderr}\n\n${note}` }
   }
   // pnpm can append a second rule even on success (#883, #878), including
@@ -423,6 +442,95 @@ export function pnpmNeverStarted(result: InstallResult): boolean {
   return classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)?.code === 'pnpm-unusable'
 }
 
+/**
+ * Whether pnpm refused a too-young release without writing to the profile.
+ *
+ * Same nature as wroteNothing / pnpmNeverStarted for the update route's
+ * rollback (#919): pnpm DID start, read the lockfile, then exited 1 on
+ * ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION (or the sibling mature-match /
+ * resolution-policy shapes). Nothing was installed or removed, so restoring
+ * "the previous build" is alarm about an untouched profile — and on the
+ * official desktop bridge it pairs every wait with a false
+ * "restoration could not be verified" line that covers the real reason.
+ * @param result - the failed run.
+ * @returns true when the failure is pnpm's fresh-release gate.
+ */
+export function pnpmRefusedYoungRelease(result: InstallResult): boolean {
+  return classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)?.code === 'release-age-violation'
+}
+
+/** pnpm's default minimumReleaseAge window (1440 minutes). */
+const DEFAULT_RELEASE_AGE_WINDOW_MS = 24 * 60 * 60 * 1000
+
+/**
+ * The profile's fresh-release wait window in ms (#919).
+ *
+ * Reads `minimumReleaseAge` (minutes) from pnpm-workspace.yaml, then
+ * `minimum-release-age` from `.npmrc`. A key that is present but not a
+ * number returns null — callers must not invent a remaining wait. When
+ * neither file names the key, pnpm's default 1440 minutes applies.
+ */
+export function readMinimumReleaseAgeMs(profile: string, explicitDir?: string): number | null {
+  const dir = profileDir(profile, explicitDir)
+  const fromWorkspace = readReleaseAgeMinutesFromWorkspace(dir)
+  if (fromWorkspace === 'invalid') return null
+  if (typeof fromWorkspace === 'number') return fromWorkspace * 60 * 1000
+  const fromNpmrc = readReleaseAgeMinutesFromNpmrc(dir)
+  if (fromNpmrc === 'invalid') return null
+  if (typeof fromNpmrc === 'number') return fromNpmrc * 60 * 1000
+  return DEFAULT_RELEASE_AGE_WINDOW_MS
+}
+
+/** @returns minutes, `'invalid'` when the key is present but unreadable, or null when absent. */
+function readReleaseAgeMinutesFromWorkspace(dir: string): number | 'invalid' | null {
+  let yaml: string
+  try { yaml = readFileSync(join(dir, 'pnpm-workspace.yaml'), 'utf8') } catch { return null }
+  if (!/^minimumReleaseAge\s*:/m.test(yaml)) return null
+  const match = /^minimumReleaseAge:\s*(\d+)\s*(?:#.*)?$/m.exec(yaml)
+  if (match === null) return 'invalid'
+  const minutes = Number(match[1])
+  return Number.isFinite(minutes) ? minutes : 'invalid'
+}
+
+/** @returns minutes, `'invalid'` when the key is present but unreadable, or null when absent. */
+function readReleaseAgeMinutesFromNpmrc(dir: string): number | 'invalid' | null {
+  let npmrc: string
+  try { npmrc = readFileSync(join(dir, '.npmrc'), 'utf8') } catch { return null }
+  if (!/^minimum-release-age\s*=/m.test(npmrc)) return null
+  const match = /^minimum-release-age\s*=\s*(\d+)\s*(?:#.*)?$/m.exec(npmrc)
+  if (match === null) return 'invalid'
+  const minutes = Number(match[1])
+  return Number.isFinite(minutes) ? minutes : 'invalid'
+}
+
+/**
+ * How long is left in the fresh-release wait, when pnpm named the publish
+ * time in its refusal (#919). Null when the output has no usable timestamp.
+ */
+export function remainingReleaseAgeWait(
+  output: string,
+  now = Date.now(),
+  windowMs = DEFAULT_RELEASE_AGE_WINDOW_MS,
+): number | null {
+  const match = /published at (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/i.exec(output)
+  if (match === null) return null
+  const published = Date.parse(match[1]!)
+  if (!Number.isFinite(published)) return null
+  return Math.max(0, published + windowMs - now)
+}
+
+/** Human remaining-wait fragment for the desktop release-age note. */
+function formatRemainingReleaseAgeWait(remainingMs: number): { zh: string, en: string } {
+  if (remainingMs <= 0) {
+    return { zh: '（现在再试一次即可）', en: ' (try again now)' }
+  }
+  const hours = Math.max(1, Math.ceil(remainingMs / (60 * 60 * 1000)))
+  return {
+    zh: `（大约还剩 ${hours} 小时）`,
+    en: ` (about ${hours} hour${hours === 1 ? '' : 's'} left)`,
+  }
+}
+
 /**
  * Whether pnpm failed because the running host holds the package's files
  * open, so nothing pnpm runs from inside that host can replace them.

package/src/official-desktop.ts

@@ -96,7 +96,14 @@ function selfUpdateMessage(spec: string): string {
   const at = spec.indexOf('@', 1)
   const version = at === -1 ? '' : spec.slice(at + 1)
   const target = version === '' ? spec : `${registryNameOf(spec) ?? spec}@${version}`
-  return `市场不能在自己的请求里先卸载自己：桌面端的移除会先把市场从正在运行的组合里摘掉，补装那一步就再也执行不到了（#900）。请在桌面端的「设置 → 插件」里更新市场${version === '' ? '' : ` 到 ${version}`}，或完全退出 DSH 后在终端执行 \`dsh plugin --profile desktop add ${target}\`。 / The market cannot remove itself to update: the desktop app unloads it from the running composition first, so the reinstall never runs (#900). Update it from the desktop app's Settings → Plugins${version === '' ? '' : ` (to ${version})`}, or quit DSH completely and run \`dsh plugin --profile desktop add ${target}\` in a terminal.`
+  // Two paths that used to be named here do not exist on dsh 0.2.1, and a
+  // reporter proved both (#909): `dsh plugin --profile desktop` is refused
+  // outright, and the app's Settings → Plugins has no update entry — its
+  // manager refuses re-adding a package that is already declared. The only
+  // route left is pnpm run against the profile with the app fully quit, which
+  // is what the reporter verified. `--config.minimum-release-age=0` is the
+  // market's own one-shot flag, spelled so it works in every shell.
+  return `市场不能在自己的请求里更新自己：桌面端的移除会先把市场从正在运行的组合里摘掉，补装那一步就执行不到了（#900），而应用内的「设置 → 插件」没有更新入口（#909）。要更新${version === '' ? '' : ` 到 ${version}`}：完全退出 DSH Desktop，在 profile 目录执行 \`pnpm add ${target} --config.minimum-release-age=0\`（没有 pnpm 时用 \`npx pnpm add …\`），然后重新启动。Windows 的 profile 一般在 %USERPROFILE%\\.dsh\\profiles\\desktop。 / The market cannot update itself: the desktop app unloads it from the running composition first, so the reinstall never runs (#900), and the app's Settings → Plugins has no update entry (#909). To update${version === '' ? '' : ` to ${version}`}: quit DSH Desktop completely, run \`pnpm add ${target} --config.minimum-release-age=0\` in the profile directory (use \`npx pnpm add …\` if pnpm is not installed), then start DSH again. On Windows the profile is usually %USERPROFILE%\\.dsh\\profiles\\desktop.`
 }
 
 /** The manager's own refusal code, whether it was returned or thrown. */
@@ -262,11 +269,18 @@ export function createOfficialDesktopRuntime(
         // No package result means the manager stopped before it ran pnpm: the
         // profile is untouched, and the route must not try to "restore" it.
         wroteNothing: !ok && result.packageResult === undefined,
+        // The manager's own code, kept machine-readable (#909): a client can
+        // tell a self-update refusal from an ordinary failure.
+        ...(ok ? {} : { refusalCode: managementCode(result.error) }),
       }
     }, (error): InstallResult => {
       const message = detail(error)
       progress.error = message
-      return { ...failure(message, 127), wroteNothing: managementCode(error) !== undefined }
+      return {
+        ...failure(message, 127),
+        wroteNothing: managementCode(error) !== undefined,
+        ...(managementCode(error) === undefined ? {} : { refusalCode: managementCode(error) }),
+      }
     }).finally(() => {
       progress.active = false
       progress.cancelling = false

package/src/routes.ts

@@ -41,7 +41,7 @@ import { createProfileSnapshot, DEFAULT_MAX_SNAPSHOTS, deleteSnapshot, listSnaps
 import { readHostRecoveryView, restoreHostRecoveryBackup } from './host-recovery.ts'
 import { trialValidate } from './trial.ts'
 import { catalogRepoKey, findCatalogEntryForLocal, findInstalledAlias, gitCommitOfTarget, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitRefOfTarget, gitTargetAtCommit, gitUpdateTarget, hostedRepoKey, lookupRepoFromUrl, pinnedAllowBuildsKeys, installTargetFor, isGenerationLink, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, sourceFallbackFor, workspaceProtocolDeps } from './sources.ts'
-import { failureDetail, groupConflictsByOwner, isStaleUpdate, parseIgnoredBuildEntries, parseIgnoredBuilds, parsePrepareKey, parsePrepareNotAllowed, pnpmBlockedByOpenFiles, pnpmNeverStarted, RELEASE_AGE_OVERRIDE, removeDanglingHostBridge, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.ts'
+import { failureDetail, groupConflictsByOwner, isStaleUpdate, parseIgnoredBuildEntries, parseIgnoredBuilds, parsePrepareKey, parsePrepareNotAllowed, pnpmBlockedByOpenFiles, pnpmNeverStarted, pnpmRefusedYoungRelease, RELEASE_AGE_OVERRIDE, removeDanglingHostBridge, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.ts'
 import { classifyPnpmFailure } from './pnpm-compat.ts'
 import { asChannel, CHANNELS, DIST_TAG, resolveChannel, type Channel } from './channels.ts'
 import {
@@ -451,6 +451,14 @@ function pnpmFailureMessage(result: { exitCode: number | null; stdout: string; s
   const failure = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)
   if (failure === null) return undefined
   if (failure.code === 'ignored-builds' || failure.code === 'git-prepare-not-allowed') return undefined
+  // Desktop release-age note is already the actionable sentence (#919). Do
+  // not cover it with the classifier's "market already retried" claim —
+  // install/uninstall fall through to stderr via failureText when error is
+  // undefined.
+  if (failure.code === 'release-age-violation'
+    && /没有自动重试|no automatic retry happens here/.test(`${result.stderr}\n${result.stdout}`)) {
+    return undefined
+  }
   return failure.message
 }
 
@@ -4817,7 +4825,12 @@ sendJson(response, 200, { updates })
               // verify restoration, inspect this profile" warning this block
               // raises on a failed rollback would be alarm about an untouched
               // profile.
-              && result.wroteNothing !== true) {
+              && result.wroteNothing !== true
+              // pnpm ran, then refused a too-young release without writing
+              // (#919). Same untouched profile; skipping the rollback keeps
+              // the release-age reason visible instead of covering it with a
+              // false "restoration could not be verified" alarm.
+              && !pnpmRefusedYoungRelease(result)) {
               if (pnpmBlockedByOpenFiles(result)) {
                 const kept = keepLockedBuild()
                 rollbackOk = kept.ok
@@ -5172,7 +5185,10 @@ sendJson(response, 200, { updates })
               // ever sees this when something really is unbootable.
               ...(() => { const orphans = orphanBundles(); return orphans.length > 0 ? { orphanBundles: orphans } : {} })(),
               staleReason: staleReason ?? undefined,
-              failureCode: versionFailureCode ?? undefined,
+              // The host's own refusal code when it stopped before pnpm
+              // (#909): `market-self-update` tells a client that the button
+              // cannot work on this host, not that the update was broken.
+              failureCode: versionFailureCode ?? result.refusalCode ?? undefined,
               renamedTo: renamedTo ?? undefined,
               removedDeclaration: removedDeclaration ?? undefined,
               ...(droppedBundles.length > 0 ? { droppedBundles } : {}),
@@ -5183,8 +5199,14 @@ sendJson(response, 200, { updates })
               // before running pnpm there is no classifier for its words and
               // no rollback behind it, so without this the answer carried no
               // reason at all.
+              // Release-age on Desktop (#919): withHoistRecovery already wrote
+              // the wait note into stderr (and stripped the false "already
+              // retried" classifier). Prefer that over pnpmFailureMessage,
+              // which would re-surface the classifier alone — the client
+              // shows body.error first.
               error: versionFailureError ?? renamedError ?? trialError ?? brokenEntryError ?? hardFailureRollbackError ?? staleError
                 ?? (result.wroteNothing === true && result.stderr.trim() !== '' ? result.stderr.trim() : undefined)
+                ?? (pnpmRefusedYoungRelease(result) && result.stderr.trim() !== '' ? result.stderr.trim() : undefined)
                 ?? pnpmFailureMessage(result) ?? undefined,
               exitCode: result.exitCode,
               timedOut: result.timedOut,

package/src/update-api-v1.ts

@@ -76,9 +76,30 @@ function bool(value: unknown): boolean {
   return value === true
 }
 
+/**
+ * Host refusal codes that may travel through `failureCode` unchanged.
+ *
+ * The route forwards the desktop manager's own codes (#909); the v1 API only
+ * re-publishes the ones a caller can act on, so an internal code cannot leak
+ * by accident. `market-self-update` is the one this exists for: the market
+ * cannot update itself on a host whose manager refuses re-adds, and a caller
+ * should be able to say so instead of retrying.
+ */
+const FORWARDED_FAILURE_CODES = new Set([
+  'DOWNGRADE_DETECTED',
+  'RESOLVED_VERSION_MISMATCH',
+  'market-self-update',
+  'already-installed',
+  'bundle-in-use',
+  'not-removable',
+  'stop-profile',
+  'management-required',
+  'incompatible-version',
+])
+
 function failureCode(status: number, body: Record<string, unknown>): string {
   const explicit = text(body.failureCode)
-  if (explicit === 'DOWNGRADE_DETECTED' || explicit === 'RESOLVED_VERSION_MISMATCH') return explicit
+  if (explicit !== null && FORWARDED_FAILURE_CODES.has(explicit)) return explicit
   if (body.agentsBusy === true) return 'AGENTS_RUNNING'
   if (body.busy === true || status === 409) return 'OPERATION_BUSY'
   if (body.stale === true && body.staleReason === 'release-age') return 'RELEASE_TOO_FRESH'