dshmarket 1.66.39 → 1.66.41

package/README.md

@@ -11,7 +11,7 @@ English | [中文](README.zh.md)
 
 The plugin market inside DeepSeek Harness. Open Settings → **Plugin Market** → browse, search, one-click install. Settings sits in the sidebar up to dsh 0.2.0 and in the account menu from 0.2.1.
 
-> 📡 **The same catalog is also a plugin market index.** On dsh 0.2.1+, open **Plugins → Discover → Index sources** and add `https://awesome-dsh-plugin.com/index.json` — or `https://dshmarket.com/index.json`, the same document. The host's Discover tab and the `plugin_market` agent tool then search it.
+> 📡 **The same catalog is also a plugin market index.** On dsh 0.2.1+, open **Plugins → Discover → Index sources** and add `https://cdn.jsdelivr.net/npm/dsh-plugin-catalog/index.json`. That is this list as a format-1 index, served from npm so it loads quickly everywhere — dsh gives a source 15 seconds, and the GitHub Pages copies (`https://awesome-dsh-plugin.com/index.json` and `https://dshmarket.com/index.json`) can exceed that from some networks. The host's Discover tab and the `plugin_market` agent tool then search it.
 
 ![dsh-market](assets/demo-en.png)
 

package/README.zh.md

@@ -11,7 +11,7 @@
 
 装在 DeepSeek Harness 里的插件市场。打开设置 → **插件市场** → 逛一逛，点一下，装好。设置入口在 dsh 0.2.0 及以前位于侧边栏，0.2.1 起移到了账号菜单里。
 
-> 📡 **同一份目录也是一份插件市场索引。** dsh 0.2.1 起，打开 **插件 → 发现（Discover）→ 索引源（Index sources）**，添加 `https://awesome-dsh-plugin.com/index.json`——或 `https://dshmarket.com/index.json`，同一份文档。宿主自己的发现页和 `plugin_market` 智能体工具就能搜索它。
+> 📡 **同一份目录也是一份插件市场索引。** dsh 0.2.1 起，打开 **插件 → 发现（Discover）→ 索引源（Index sources）**，添加 `https://cdn.jsdelivr.net/npm/dsh-plugin-catalog/index.json`。它就是这份列表的 format 1 索引，放在 npm 上分发，所以在哪里都快——dsh 给索引源的时间只有 15 秒，而 GitHub Pages 上的那两份（`https://awesome-dsh-plugin.com/index.json` 与 `https://dshmarket.com/index.json`）在部分网络下会超过。宿主自己的发现页和 `plugin_market` 智能体工具就能搜索它。
 
 ![dsh-market](assets/demo-zh.png)
 

package/assets/logo.svg

@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" role="img" aria-labelledby="t">
+  <title id="t">dsh-market</title>
+  <!-- Shared brand mark with awesome-dsh-plugin: the block grid with one
+       cinnabar block being plugged in. -->
+  <rect width="128" height="128" rx="28" fill="#f6f2ea"/>
+  <g transform="translate(15.7 16.7) scale(0.3) translate(-112 -78)">
+    <g fill="#2b2620">
+      <rect x="112" y="112" width="88" height="88" rx="14"/>
+      <rect x="212" y="112" width="88" height="88" rx="14"/>
+      <rect x="112" y="212" width="88" height="88" rx="14"/>
+      <rect x="212" y="212" width="88" height="88" rx="14"/>
+      <rect x="112" y="312" width="88" height="88" rx="14"/>
+      <rect x="212" y="312" width="88" height="88" rx="14"/>
+      <rect x="312" y="212" width="88" height="88" rx="14"/>
+      <rect x="312" y="312" width="88" height="88" rx="14"/>
+    </g>
+    <rect x="346" y="78" width="88" height="88" rx="14" fill="#c0392b" transform="rotate(9 390 122)"/>
+  </g>
+</svg>

package/client/client.js

@@ -211,7 +211,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			setSidebarHint: "在侧栏「插件」下方显示市场。设置里的入口不变。",
 			setSidebarOnlyDoorHint: "这个宿主没有市场设置页，这一行就是进入市场的入口。",
 			setIndexSource: "官方 Discover 索引",
-			setIndexSourceHint: "dsh 0.2.1 起，官方的「插件 → 发现 → 索引源」可以添加 https://awesome-dsh-plugin.com/index.json —— 官方发现页和 plugin_market 智能体工具会搜索同一份目录。",
+			setIndexSourceHint: "dsh 0.2.1 起，官方的「插件 → 发现 → 索引源」可以添加 https://cdn.jsdelivr.net/npm/dsh-plugin-catalog/index.json —— 官方发现页和 plugin_market 智能体工具会搜索同一份目录。",
 			setSidebarOn: "显示",
 			setSidebarOff: "不显示",
 			sidebarTip: "想更快打开？可在侧栏显示。",
@@ -951,7 +951,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			setSidebarHint: "Shows the market below Plugins in the sidebar. The Settings entry stays.",
 			setSidebarOnlyDoorHint: "This host keeps the market out of Settings, so this row is the way in.",
 			setIndexSource: "Discover index",
-			setIndexSourceHint: "On dsh 0.2.1 and newer, add https://awesome-dsh-plugin.com/index.json under Plugins → Discover → Index sources — the official Discover tab and the plugin_market agent tool then search the same catalog.",
+			setIndexSourceHint: "On dsh 0.2.1 and newer, add https://cdn.jsdelivr.net/npm/dsh-plugin-catalog/index.json under Plugins → Discover → Index sources — the official Discover tab and the plugin_market agent tool then search the same catalog.",
 			setSidebarOn: "Show",
 			setSidebarOff: "Hide",
 			sidebarTip: "Want a quicker open? Show it in the sidebar.",
@@ -10017,6 +10017,11 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				setRestarting(true);
 				setInstallError(null);
 				setRecovery(null);
+				const shellRestart = typeof window === "undefined" ? void 0 : window.__dshHostShell?.restart;
+				if (typeof shellRestart === "function") try {
+					shellRestart();
+					return;
+				} catch {}
 				const awaitNewBoot = () => {
 					const deadline = Date.now() + 6e4;
 					const poll = () => {

package/lib/dsh-cli.js

@@ -7,7 +7,7 @@
  * the agent's sandboxed executor and denies writes to the profile directory.
  */
 import { spawn, spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { logEvent } from './log.js';
@@ -550,6 +550,37 @@ export function killChild(child) {
 /** The child of the operation currently running, for /dsh-market/cancel. */
 let activeChild = null;
 let cancelRequested = false;
+/**
+ * Remove the profile's `package.json.lock` when it is provably ours (#914).
+ *
+ * The dsh CLI writes that lock through the host's atomic-write, whose
+ * `finally` releases it. A timeout kills the whole tree with `taskkill /F`,
+ * so that release never runs and the file outlives the child — and on
+ * Windows the host cannot reliably tell a dead PID from a live one, so every
+ * later change waits the full lock timeout and fails.
+ *
+ * Only a lock naming OUR killed child is removed: that PID is provably dead
+ * because we just killed its whole tree, and it cannot belong to another
+ * operation. A lock naming anything else is left for the classifier to name
+ * (#914), because deleting a live operation's lock would race it.
+ */
+export function clearOwnedProfileLock(profile, pid) {
+    if (pid === undefined)
+        return false;
+    try {
+        const lock = join(profileDir(profile), 'package.json.lock');
+        const recorded = Number(readFileSync(lock, 'utf8').trim());
+        if (!Number.isInteger(recorded) || recorded !== pid)
+            return false;
+        rmSync(lock, { force: true });
+        logEvent('warn', 'install', `the timed-out operation left ${lock} behind (pid ${pid}, already killed with its tree) — removed it so the next change is not blocked (#914)`);
+        return true;
+    }
+    catch {
+        // Absent, unreadable, or removed by the child on its way out: nothing to do.
+        return false;
+    }
+}
 let activeDesktopOperation = null;
 /**
  * Kill a child and its whole tree, gracefully where the platform allows:
@@ -1047,6 +1078,10 @@ export function runDshPlugin(profile, pluginArgs) {
         });
         child.on('close', (code) => {
             clearTimeout(timer);
+            // A timed-out run was killed hard, so the host's lock release in the
+            // child's `finally` never ran. Clear only OUR child's lock (#914).
+            if (timedOut)
+                clearOwnedProfileLock(profile, child.pid);
             progress.active = false;
             progress.cancelling = false;
             if (activeChild === child)

package/lib/install.js

@@ -4,7 +4,7 @@
  * update staleness detection. Every function takes the plugin runner as a
  * parameter so tests can substitute a recording fake.
  */
-import { closeSync, existsSync, lstatSync, openSync, readlinkSync, readSync, rmSync, statSync } from 'node:fs';
+import { closeSync, existsSync, lstatSync, openSync, readFileSync, readlinkSync, readSync, rmSync, statSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { findDshInstallDir } from './dsh-install.js';
 import { classifyPnpmFailure, HOST_NAMESPACE_RE } from './pnpm-compat.js';
@@ -331,12 +331,32 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
         //
         // The wait on a fresh release is the one of these where "no retry" leaves
         // the user with nothing to do at all: the plugin IS published, pnpm just
-        // will not take it yet, and the door the market would open on a plain
-        // `dsh web` host is shut here — so say when the same button starts
-        // working, and what to use meanwhile (#852).
-        const note = unavailableOption === RELEASE_AGE_OVERRIDE
-            ? `这个插件的新版本比本 profile 的 minimumReleaseAge（新版本等待期）还新，pnpm 因此拒绝了本次改动（改别的插件也一样）。官方桌面端由应用自己执行安装，不接受市场的临时放行参数（${unavailableOption}），所以这里没有自动重试。**等这个版本过了等待期再更新一次即可**；想现在就更新，可以在普通的 dsh web 里装。 / The plugin's new version is younger than this profile's minimumReleaseAge, so pnpm refused this change (a change to another plugin too). The official desktop app runs the install itself and takes no one-shot bypass from the market (${unavailableOption}), so no automatic retry happens here. **Update again once the version is past the wait**; to update right now, install from plain dsh web.`
-            : `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`;
+        // will not take it yet. #852 pointed at plain `dsh web`, but the desktop
+        // profile is host-managed — that door is shut (#909). Say the wait, and
+        // when pnpm named the publish time, how long is left (#919).
+        //
+        // Drop the classifier's "market already retried" sentence first: it was
+        // appended above and is false on this host, and the client prefers
+        // body.error / that classified half over a note tacked on afterwards.
+        let note;
+        if (unavailableOption === RELEASE_AGE_OVERRIDE) {
+            const classified = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode);
+            if (classified?.code === 'release-age-violation') {
+                const cut = result.stderr.lastIndexOf(classified.message);
+                if (cut !== -1) {
+                    result = { ...result, stderr: result.stderr.slice(0, cut).trimEnd() };
+                }
+            }
+            const windowMs = readMinimumReleaseAgeMs(profile, profileDirectory);
+            const remaining = windowMs === null
+                ? null
+                : remainingReleaseAgeWait(`${result.stderr}\n${result.stdout}`, Date.now(), windowMs);
+            const wait = remaining === null ? { zh: '', en: '' } : formatRemainingReleaseAgeWait(remaining);
+            note = `这个插件的新版本比本机的新版本等待期还新，所以现在装不了（改别的插件也会被拦住）。官方桌面端不接受临时放行，所以这里没有自动重试。**等这个版本过了等待期再更新一次即可**${wait.zh}。过了等待期后再在市场点一次更新。 / The plugin's new version is younger than this machine's fresh-release wait, so the install was refused (a change to another plugin too). The official desktop app takes no one-shot bypass, so no automatic retry happens here. **Update again once the version is past the wait**${wait.en}. Try the market update again after the wait.`;
+        }
+        else {
+            note = `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`;
+        }
         result = { ...result, stderr: `${result.stderr}\n\n${note}` };
     }
     // pnpm can append a second rule even on success (#883, #878), including
@@ -419,6 +439,104 @@ const DIAGNOSTICS_TAIL_BYTES = 8192;
 export function pnpmNeverStarted(result) {
     return classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)?.code === 'pnpm-unusable';
 }
+/**
+ * Whether pnpm refused a too-young release without writing to the profile.
+ *
+ * Same nature as wroteNothing / pnpmNeverStarted for the update route's
+ * rollback (#919): pnpm DID start, read the lockfile, then exited 1 on
+ * ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION (or the sibling mature-match /
+ * resolution-policy shapes). Nothing was installed or removed, so restoring
+ * "the previous build" is alarm about an untouched profile — and on the
+ * official desktop bridge it pairs every wait with a false
+ * "restoration could not be verified" line that covers the real reason.
+ * @param result - the failed run.
+ * @returns true when the failure is pnpm's fresh-release gate.
+ */
+export function pnpmRefusedYoungRelease(result) {
+    return classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)?.code === 'release-age-violation';
+}
+/** pnpm's default minimumReleaseAge window (1440 minutes). */
+const DEFAULT_RELEASE_AGE_WINDOW_MS = 24 * 60 * 60 * 1000;
+/**
+ * The profile's fresh-release wait window in ms (#919).
+ *
+ * Reads `minimumReleaseAge` (minutes) from pnpm-workspace.yaml, then
+ * `minimum-release-age` from `.npmrc`. A key that is present but not a
+ * number returns null — callers must not invent a remaining wait. When
+ * neither file names the key, pnpm's default 1440 minutes applies.
+ */
+export function readMinimumReleaseAgeMs(profile, explicitDir) {
+    const dir = profileDir(profile, explicitDir);
+    const fromWorkspace = readReleaseAgeMinutesFromWorkspace(dir);
+    if (fromWorkspace === 'invalid')
+        return null;
+    if (typeof fromWorkspace === 'number')
+        return fromWorkspace * 60 * 1000;
+    const fromNpmrc = readReleaseAgeMinutesFromNpmrc(dir);
+    if (fromNpmrc === 'invalid')
+        return null;
+    if (typeof fromNpmrc === 'number')
+        return fromNpmrc * 60 * 1000;
+    return DEFAULT_RELEASE_AGE_WINDOW_MS;
+}
+/** @returns minutes, `'invalid'` when the key is present but unreadable, or null when absent. */
+function readReleaseAgeMinutesFromWorkspace(dir) {
+    let yaml;
+    try {
+        yaml = readFileSync(join(dir, 'pnpm-workspace.yaml'), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    if (!/^minimumReleaseAge\s*:/m.test(yaml))
+        return null;
+    const match = /^minimumReleaseAge:\s*(\d+)\s*(?:#.*)?$/m.exec(yaml);
+    if (match === null)
+        return 'invalid';
+    const minutes = Number(match[1]);
+    return Number.isFinite(minutes) ? minutes : 'invalid';
+}
+/** @returns minutes, `'invalid'` when the key is present but unreadable, or null when absent. */
+function readReleaseAgeMinutesFromNpmrc(dir) {
+    let npmrc;
+    try {
+        npmrc = readFileSync(join(dir, '.npmrc'), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    if (!/^minimum-release-age\s*=/m.test(npmrc))
+        return null;
+    const match = /^minimum-release-age\s*=\s*(\d+)\s*(?:#.*)?$/m.exec(npmrc);
+    if (match === null)
+        return 'invalid';
+    const minutes = Number(match[1]);
+    return Number.isFinite(minutes) ? minutes : 'invalid';
+}
+/**
+ * How long is left in the fresh-release wait, when pnpm named the publish
+ * time in its refusal (#919). Null when the output has no usable timestamp.
+ */
+export function remainingReleaseAgeWait(output, now = Date.now(), windowMs = DEFAULT_RELEASE_AGE_WINDOW_MS) {
+    const match = /published at (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/i.exec(output);
+    if (match === null)
+        return null;
+    const published = Date.parse(match[1]);
+    if (!Number.isFinite(published))
+        return null;
+    return Math.max(0, published + windowMs - now);
+}
+/** Human remaining-wait fragment for the desktop release-age note. */
+function formatRemainingReleaseAgeWait(remainingMs) {
+    if (remainingMs <= 0) {
+        return { zh: '（现在再试一次即可）', en: ' (try again now)' };
+    }
+    const hours = Math.max(1, Math.ceil(remainingMs / (60 * 60 * 1000)));
+    return {
+        zh: `（大约还剩 ${hours} 小时）`,
+        en: ` (about ${hours} hour${hours === 1 ? '' : 's'} left)`,
+    };
+}
 /**
  * Whether pnpm failed because the running host holds the package's files
  * open, so nothing pnpm runs from inside that host can replace them.

package/lib/official-desktop.js

@@ -11,6 +11,30 @@ export const OFFICIAL_PAGE_HINT = '官方桌面客户端的这个插件操作需
 function failure(message, exitCode = 1) {
     return { exitCode, timedOut: false, stdout: '', stderr: message, cancelled: false };
 }
+/**
+ * The host's own pre-install diagnostic, when it wrote one.
+ *
+ * On dsh 0.2.1 the manager runs checks of its own before pnpm starts and
+ * reports them as `dsh: …` in an `operation-error`'s `diagnostic` (#912).
+ */
+function hostDiagnostic(error) {
+    const diagnostic = error?.diagnostic;
+    return typeof diagnostic === 'string' && diagnostic.startsWith('dsh: ') ? diagnostic : undefined;
+}
+/**
+ * Whether the host stopped before pnpm ran, on a check of its own (#912).
+ *
+ * `checkGithubConnection` refuses an install after five seconds without
+ * touching the profile; so does the compatibility gate (`installation
+ * rejected:`). Neither is a write, and treating them as one sent the update
+ * route into a rollback of an untouched profile — a false "restoration
+ * could not be verified" alarm that buried the real reason.
+ */
+function prePnpmHostFailure(result) {
+    const diagnostic = hostDiagnostic(result.error);
+    return diagnostic !== undefined
+        && /^dsh: (?:connection to \S+ timed out|installation rejected:)/.test(diagnostic);
+}
 function detail(error) {
     if (typeof error === 'string')
         return error;
@@ -26,6 +50,15 @@ function detail(error) {
     const message = error.message;
     if (typeof message === 'string' && message !== '')
         return message;
+    const diagnostic = hostDiagnostic(error);
+    if (diagnostic !== undefined) {
+        if (/^dsh: connection to \S+ timed out/.test(diagnostic)) {
+            // The 5 s is the host's own pre-install reachability check, not the
+            // install failing: say which knob moves it (#912).
+            return `${diagnostic}\n\n宿主在开始安装前自己检查了 GitHub 的连通性，5 秒内没连上就放弃了这次安装，pnpm 还没有开始，profile 没有任何改动。如果手动 \`git ls-remote\` 能连上（例如已给 git 配好代理或换过 TLS 后端），把宿主 plugin-manager 的 \`githubConnectionTimeoutMs\` 调大再试（cordis.yml 里该插件的 config）。 / the host checks GitHub reachability before installing and gave up after five seconds; pnpm never started and the profile is unchanged. If git itself can reach GitHub (a proxy, or a different TLS backend), raise the host plugin-manager's \`githubConnectionTimeoutMs\` (its config in cordis.yml) and try again.`;
+        }
+        return diagnostic;
+    }
     return JSON.stringify(error);
 }
 /**
@@ -82,7 +115,14 @@ function selfUpdateMessage(spec) {
     const at = spec.indexOf('@', 1);
     const version = at === -1 ? '' : spec.slice(at + 1);
     const target = version === '' ? spec : `${registryNameOf(spec) ?? spec}@${version}`;
-    return `市场不能在自己的请求里先卸载自己：桌面端的移除会先把市场从正在运行的组合里摘掉，补装那一步就再也执行不到了（#900）。请在桌面端的「设置 → 插件」里更新市场${version === '' ? '' : ` 到 ${version}`}，或完全退出 DSH 后在终端执行 \`dsh plugin --profile desktop add ${target}\`。 / The market cannot remove itself to update: the desktop app unloads it from the running composition first, so the reinstall never runs (#900). Update it from the desktop app's Settings → Plugins${version === '' ? '' : ` (to ${version})`}, or quit DSH completely and run \`dsh plugin --profile desktop add ${target}\` in a terminal.`;
+    // Two paths that used to be named here do not exist on dsh 0.2.1, and a
+    // reporter proved both (#909): `dsh plugin --profile desktop` is refused
+    // outright, and the app's Settings → Plugins has no update entry — its
+    // manager refuses re-adding a package that is already declared. The only
+    // route left is pnpm run against the profile with the app fully quit, which
+    // is what the reporter verified. `--config.minimum-release-age=0` is the
+    // market's own one-shot flag, spelled so it works in every shell.
+    return `市场不能在自己的请求里更新自己：桌面端的移除会先把市场从正在运行的组合里摘掉，补装那一步就执行不到了（#900），而应用内的「设置 → 插件」没有更新入口（#909）。要更新${version === '' ? '' : ` 到 ${version}`}：完全退出 DSH Desktop，在 profile 目录执行 \`pnpm add ${target} --config.minimum-release-age=0\`（没有 pnpm 时用 \`npx pnpm add …\`），然后重新启动。Windows 的 profile 一般在 %USERPROFILE%\\.dsh\\profiles\\desktop。 / The market cannot update itself: the desktop app unloads it from the running composition first, so the reinstall never runs (#900), and the app's Settings → Plugins has no update entry (#909). To update${version === '' ? '' : ` to ${version}`}: quit DSH Desktop completely, run \`pnpm add ${target} --config.minimum-release-age=0\` in the profile directory (use \`npx pnpm add …\` if pnpm is not installed), then start DSH again. On Windows the profile is usually %USERPROFILE%\\.dsh\\profiles\\desktop.`;
 }
 /** The manager's own refusal code, whether it was returned or thrown. */
 function managementCode(error) {
@@ -243,12 +283,21 @@ _profileDirectory) {
                 cancelled: current.cancelled || result.application === 'cancelled',
                 // No package result means the manager stopped before it ran pnpm: the
                 // profile is untouched, and the route must not try to "restore" it.
-                wroteNothing: !ok && result.packageResult === undefined,
+                // A pre-install host check (#912) is the same shape even when the
+                // manager attached a package result to its refusal.
+                wroteNothing: !ok && (result.packageResult === undefined || prePnpmHostFailure(result)),
+                // The manager's own code, kept machine-readable (#909): a client can
+                // tell a self-update refusal from an ordinary failure.
+                ...(ok ? {} : { refusalCode: managementCode(result.error) }),
             };
         }, (error) => {
             const message = detail(error);
             progress.error = message;
-            return { ...failure(message, 127), wroteNothing: managementCode(error) !== undefined };
+            return {
+                ...failure(message, 127),
+                wroteNothing: managementCode(error) !== undefined,
+                ...(managementCode(error) === undefined ? {} : { refusalCode: managementCode(error) }),
+            };
         }).finally(() => {
             progress.active = false;
             progress.cancelling = false;

package/lib/pnpm-compat.js

@@ -191,6 +191,21 @@ export function classifyPnpmFailure(output, exitCode) {
                 : `pnpm ${minutes} 分钟没有任何输出，被终止了，什么都没装上。通常是网络卡住了。检查网络后重试。 / pnpm printed nothing for ${minutes} minutes and was stopped, so nothing was installed. This usually means the network stalled. Check the connection and try again.`,
         };
     }
+    // #914: the host's atomic-write could not take the profile's write lock.
+    // Either a concurrent operation is legitimately holding it, or an earlier
+    // update was killed hard and left the file behind — on Windows the host
+    // cannot always tell a dead PID from a live one, so it never takes over.
+    // The market does not delete the file: it belongs to the host, and a wrong
+    // deletion races a live operation. Say where it is and what is safe.
+    const writerLock = /timed out waiting for the writer lock at "?([^"\n]+)"?/.exec(output);
+    if (writerLock !== null) {
+        const path = writerLock[1].trim();
+        return {
+            code: 'profile-write-lock',
+            recoverable: true,
+            message: `profile 的写锁等了太久没等到：${path}。要么另一个插件操作还在跑（等它结束再试），要么某次被中断的更新把锁留在了那里。确认没有安装或更新正在进行后，删掉这个文件再重试即可；市场不会替你去动它。 / the profile's writer lock was never released: ${path}. Either another plugin operation is still running (wait for it), or an interrupted update left the lock behind. Once nothing is installing or updating, delete that file and try again; the market does not remove it for you.`,
+        };
+    }
     if (output.includes('ERR_PNPM_PUBLIC_HOIST_PATTERN_DIFF')
         || output.includes('ERR_PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH_DIFF')) {
         return {

package/lib/routes.js

@@ -32,7 +32,7 @@ import { createProfileSnapshot, DEFAULT_MAX_SNAPSHOTS, deleteSnapshot, listSnaps
 import { readHostRecoveryView, restoreHostRecoveryBackup } from './host-recovery.js';
 import { trialValidate } from './trial.js';
 import { catalogRepoKey, findCatalogEntryForLocal, findInstalledAlias, gitCommitOfTarget, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitRefOfTarget, gitTargetAtCommit, gitUpdateTarget, hostedRepoKey, lookupRepoFromUrl, pinnedAllowBuildsKeys, installTargetFor, isGenerationLink, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, sourceFallbackFor, workspaceProtocolDeps } from './sources.js';
-import { failureDetail, groupConflictsByOwner, isStaleUpdate, parseIgnoredBuildEntries, parseIgnoredBuilds, parsePrepareKey, parsePrepareNotAllowed, pnpmBlockedByOpenFiles, pnpmNeverStarted, RELEASE_AGE_OVERRIDE, removeDanglingHostBridge, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.js';
+import { failureDetail, groupConflictsByOwner, isStaleUpdate, parseIgnoredBuildEntries, parseIgnoredBuilds, parsePrepareKey, parsePrepareNotAllowed, pnpmBlockedByOpenFiles, pnpmNeverStarted, pnpmRefusedYoungRelease, RELEASE_AGE_OVERRIDE, removeDanglingHostBridge, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.js';
 import { classifyPnpmFailure } from './pnpm-compat.js';
 import { asChannel, CHANNELS, DIST_TAG, resolveChannel } from './channels.js';
 import { asRegion, githubProxyManaged, normalizeGithubProxy, REGIONS, routesFor, setActiveRegion, setCustomGithubProxy, } from './regions.js';
@@ -333,6 +333,14 @@ function pnpmFailureMessage(result) {
         return undefined;
     if (failure.code === 'ignored-builds' || failure.code === 'git-prepare-not-allowed')
         return undefined;
+    // Desktop release-age note is already the actionable sentence (#919). Do
+    // not cover it with the classifier's "market already retried" claim —
+    // install/uninstall fall through to stderr via failureText when error is
+    // undefined.
+    if (failure.code === 'release-age-violation'
+        && /没有自动重试|no automatic retry happens here/.test(`${result.stderr}\n${result.stdout}`)) {
+        return undefined;
+    }
     return failure.message;
 }
 /**
@@ -4606,7 +4614,12 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             // verify restoration, inspect this profile" warning this block
                             // raises on a failed rollback would be alarm about an untouched
                             // profile.
-                            && result.wroteNothing !== true) {
+                            && result.wroteNothing !== true
+                            // pnpm ran, then refused a too-young release without writing
+                            // (#919). Same untouched profile; skipping the rollback keeps
+                            // the release-age reason visible instead of covering it with a
+                            // false "restoration could not be verified" alarm.
+                            && !pnpmRefusedYoungRelease(result)) {
                             if (pnpmBlockedByOpenFiles(result)) {
                                 const kept = keepLockedBuild();
                                 rollbackOk = kept.ok;
@@ -4943,7 +4956,10 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             // ever sees this when something really is unbootable.
                             ...(() => { const orphans = orphanBundles(); return orphans.length > 0 ? { orphanBundles: orphans } : {}; })(),
                             staleReason: staleReason ?? undefined,
-                            failureCode: versionFailureCode ?? undefined,
+                            // The host's own refusal code when it stopped before pnpm
+                            // (#909): `market-self-update` tells a client that the button
+                            // cannot work on this host, not that the update was broken.
+                            failureCode: versionFailureCode ?? result.refusalCode ?? undefined,
                             renamedTo: renamedTo ?? undefined,
                             removedDeclaration: removedDeclaration ?? undefined,
                             ...(droppedBundles.length > 0 ? { droppedBundles } : {}),
@@ -4954,8 +4970,14 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             // before running pnpm there is no classifier for its words and
                             // no rollback behind it, so without this the answer carried no
                             // reason at all.
+                            // Release-age on Desktop (#919): withHoistRecovery already wrote
+                            // the wait note into stderr (and stripped the false "already
+                            // retried" classifier). Prefer that over pnpmFailureMessage,
+                            // which would re-surface the classifier alone — the client
+                            // shows body.error first.
                             error: versionFailureError ?? renamedError ?? trialError ?? brokenEntryError ?? hardFailureRollbackError ?? staleError
                                 ?? (result.wroteNothing === true && result.stderr.trim() !== '' ? result.stderr.trim() : undefined)
+                                ?? (pnpmRefusedYoungRelease(result) && result.stderr.trim() !== '' ? result.stderr.trim() : undefined)
                                 ?? pnpmFailureMessage(result) ?? undefined,
                             exitCode: result.exitCode,
                             timedOut: result.timedOut,

package/lib/types/dsh-cli.d.ts

@@ -172,6 +172,16 @@ export interface InstallResult {
      * (#897) — and their only true account is "nothing happened".
      */
     wroteNothing?: boolean;
+    /**
+     * The host's own refusal code, when it stopped before running pnpm.
+     *
+     * The desktop manager answers with structured codes — `already-installed`,
+     * `bundle-in-use`, `market-self-update` — but they used to survive only as
+     * text inside `stderr`. The update route forwards this to `failureCode`,
+     * so a client can tell "the market cannot update itself here" (#909) from
+     * an ordinary failure without parsing a sentence.
+     */
+    refusalCode?: string;
     /** Package names pnpm reported as having ignored build scripts (ndjson). */
     ignoredBuilds?: string[];
     /**
@@ -289,6 +299,21 @@ export interface DesktopPluginRuntime extends PluginCommandRuntime {
  * (Contributed in #7 by @mraing.)
  */
 export declare function killChild(child: ChildProcess): void;
+/**
+ * Remove the profile's `package.json.lock` when it is provably ours (#914).
+ *
+ * The dsh CLI writes that lock through the host's atomic-write, whose
+ * `finally` releases it. A timeout kills the whole tree with `taskkill /F`,
+ * so that release never runs and the file outlives the child — and on
+ * Windows the host cannot reliably tell a dead PID from a live one, so every
+ * later change waits the full lock timeout and fails.
+ *
+ * Only a lock naming OUR killed child is removed: that PID is provably dead
+ * because we just killed its whole tree, and it cannot belong to another
+ * operation. A lock naming anything else is left for the classifier to name
+ * (#914), because deleting a live operation's lock would race it.
+ */
+export declare function clearOwnedProfileLock(profile: string, pid: number | undefined): boolean;
 /**
  * Cancel the plugin command currently running.
  * @returns true when there was one to cancel.

package/lib/types/install.d.ts

@@ -147,6 +147,34 @@ export declare function diagnosticsTail(result: {
  * @returns true when the failure happened before pnpm could run.
  */
 export declare function pnpmNeverStarted(result: InstallResult): boolean;
+/**
+ * Whether pnpm refused a too-young release without writing to the profile.
+ *
+ * Same nature as wroteNothing / pnpmNeverStarted for the update route's
+ * rollback (#919): pnpm DID start, read the lockfile, then exited 1 on
+ * ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION (or the sibling mature-match /
+ * resolution-policy shapes). Nothing was installed or removed, so restoring
+ * "the previous build" is alarm about an untouched profile — and on the
+ * official desktop bridge it pairs every wait with a false
+ * "restoration could not be verified" line that covers the real reason.
+ * @param result - the failed run.
+ * @returns true when the failure is pnpm's fresh-release gate.
+ */
+export declare function pnpmRefusedYoungRelease(result: InstallResult): boolean;
+/**
+ * The profile's fresh-release wait window in ms (#919).
+ *
+ * Reads `minimumReleaseAge` (minutes) from pnpm-workspace.yaml, then
+ * `minimum-release-age` from `.npmrc`. A key that is present but not a
+ * number returns null — callers must not invent a remaining wait. When
+ * neither file names the key, pnpm's default 1440 minutes applies.
+ */
+export declare function readMinimumReleaseAgeMs(profile: string, explicitDir?: string): number | null;
+/**
+ * How long is left in the fresh-release wait, when pnpm named the publish
+ * time in its refusal (#919). Null when the output has no usable timestamp.
+ */
+export declare function remainingReleaseAgeWait(output: string, now?: number, windowMs?: number): number | null;
 /**
  * Whether pnpm failed because the running host holds the package's files
  * open, so nothing pnpm runs from inside that host can replace them.

package/lib/types/pnpm-compat.d.ts

@@ -33,7 +33,7 @@ export declare function pluginArgsFor(profileDir: string, pluginArgs: string[]):
  */
 export declare const HOST_NAMESPACE_RE: RegExp;
 export interface PnpmFailure {
-    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch' | 'fetch-404' | 'no-matching-version' | 'transient-network' | 'fetch-timeout' | 'unexpected-store' | 'patch-failed' | 'unused-patch' | 'missing-tarball-integrity' | 'windows-file-locked' | 'profile-file-locked' | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key' | 'native-oom' | 'ssh-auth-failed' | 'host-incompatible-install' | 'lockfile-broken' | 'lockfile-outdated' | 'pnpm-stalled';
+    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch' | 'fetch-404' | 'no-matching-version' | 'transient-network' | 'fetch-timeout' | 'unexpected-store' | 'patch-failed' | 'unused-patch' | 'missing-tarball-integrity' | 'windows-file-locked' | 'profile-file-locked' | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key' | 'native-oom' | 'ssh-auth-failed' | 'host-incompatible-install' | 'lockfile-broken' | 'lockfile-outdated' | 'pnpm-stalled' | 'profile-write-lock';
     /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
     message: string;
     /** True when re-running `pnpm install` in the profile is the documented recovery. */

package/lib/update-api-v1.js

@@ -18,9 +18,29 @@ function text(value) {
 function bool(value) {
     return value === true;
 }
+/**
+ * Host refusal codes that may travel through `failureCode` unchanged.
+ *
+ * The route forwards the desktop manager's own codes (#909); the v1 API only
+ * re-publishes the ones a caller can act on, so an internal code cannot leak
+ * by accident. `market-self-update` is the one this exists for: the market
+ * cannot update itself on a host whose manager refuses re-adds, and a caller
+ * should be able to say so instead of retrying.
+ */
+const FORWARDED_FAILURE_CODES = new Set([
+    'DOWNGRADE_DETECTED',
+    'RESOLVED_VERSION_MISMATCH',
+    'market-self-update',
+    'already-installed',
+    'bundle-in-use',
+    'not-removable',
+    'stop-profile',
+    'management-required',
+    'incompatible-version',
+]);
 function failureCode(status, body) {
     const explicit = text(body.failureCode);
-    if (explicit === 'DOWNGRADE_DETECTED' || explicit === 'RESOLVED_VERSION_MISMATCH')
+    if (explicit !== null && FORWARDED_FAILURE_CODES.has(explicit))
         return explicit;
     if (body.agentsBusy === true)
         return 'AGENTS_RUNNING';

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.39",
+  "version": "1.66.41",
+  "icon": "assets/logo.svg",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -72,6 +73,7 @@
     "./locale/*.json": "./locale/*.json"
   },
   "files": [
+    "assets/logo.svg",
     "locale",
     "lib",
     "src",

package/src/client/MarketSection.tsx

@@ -3560,6 +3560,20 @@ export function MarketSection(props: MarketSectionProps) {
     setRestarting(true)
     setInstallError(null)
     setRecovery(null)
+    // A shell that runs this host as its own child process owns the lifecycle:
+    // it stops the process it started and relaunches its window. The helper
+    // below would be a second lifecycle competing with it — two processes, one
+    // port — so where the shell is there, ask it instead of spawning anything.
+    const shellRestart = typeof window === 'undefined' ? undefined : window.__dshHostShell?.restart
+    if (typeof shellRestart === 'function') {
+      try {
+        shellRestart()
+        return
+      } catch {
+        // A shell that published the bridge and then threw is not a restart:
+        // fall through to the host's own route, which is the pre-existing path.
+      }
+    }
     const awaitNewBoot = () => {
       const deadline = Date.now() + 60000
       const poll = () => {

package/src/client/globals.d.ts

@@ -10,4 +10,22 @@ interface Window {
   __DSH_BOOT__?: {
     entries?: Array<{ id: string }>
   }
+  /**
+   * The host shell's own lifecycle, published by a shell that runs the host as
+   * a child process (a Tauri or Electron app that spawned `dsh web`). Optional:
+   * absent on every host that is not wrapped in one.
+   *
+   * A shell restart is not the same operation as the market's own: the shell
+   * stops the process it started and relaunches its own window, so a detached
+   * helper spawned by the host would be a second, competing lifecycle. When
+   * the shell is there, the restart is asked for through it instead.
+   */
+  __dshHostShell?: {
+    /**
+     * Restart the host the way the shell's own menu item does. Returns
+     * nothing on purpose: the window it answers on is about to go away, so
+     * there is no state a caller could usefully read back.
+     */
+    restart?: () => void
+  }
 }

package/src/client/locales.ts

@@ -14,7 +14,7 @@ export const zh = {
   setSidebarHint: '在侧栏「插件」下方显示市场。设置里的入口不变。',
   setSidebarOnlyDoorHint: '这个宿主没有市场设置页，这一行就是进入市场的入口。',
   setIndexSource: '官方 Discover 索引',
-  setIndexSourceHint: 'dsh 0.2.1 起，官方的「插件 → 发现 → 索引源」可以添加 https://awesome-dsh-plugin.com/index.json —— 官方发现页和 plugin_market 智能体工具会搜索同一份目录。',
+  setIndexSourceHint: 'dsh 0.2.1 起，官方的「插件 → 发现 → 索引源」可以添加 https://cdn.jsdelivr.net/npm/dsh-plugin-catalog/index.json —— 官方发现页和 plugin_market 智能体工具会搜索同一份目录。',
   setSidebarOn: '显示',
   setSidebarOff: '不显示',
   sidebarTip: '想更快打开？可在侧栏显示。',
@@ -778,7 +778,7 @@ export const en: Record<MarketKey, string> = {
   setSidebarHint: 'Shows the market below Plugins in the sidebar. The Settings entry stays.',
   setSidebarOnlyDoorHint: 'This host keeps the market out of Settings, so this row is the way in.',
   setIndexSource: 'Discover index',
-  setIndexSourceHint: 'On dsh 0.2.1 and newer, add https://awesome-dsh-plugin.com/index.json under Plugins → Discover → Index sources — the official Discover tab and the plugin_market agent tool then search the same catalog.',
+  setIndexSourceHint: 'On dsh 0.2.1 and newer, add https://cdn.jsdelivr.net/npm/dsh-plugin-catalog/index.json under Plugins → Discover → Index sources — the official Discover tab and the plugin_market agent tool then search the same catalog.',
   setSidebarOn: 'Show',
   setSidebarOff: 'Hide',
   sidebarTip: 'Want a quicker open? Show it in the sidebar.',

package/src/dsh-cli.ts

@@ -9,7 +9,7 @@
 
 import { spawn, spawnSync } from 'node:child_process'
 import type { ChildProcess, SpawnOptions } from 'node:child_process'
-import { existsSync } from 'node:fs'
+import { existsSync, readFileSync, rmSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, isAbsolute, join, resolve } from 'node:path'
 import { logEvent } from './log.ts'
@@ -511,6 +511,16 @@ export interface InstallResult {
    * (#897) — and their only true account is "nothing happened".
    */
   wroteNothing?: boolean
+  /**
+   * The host's own refusal code, when it stopped before running pnpm.
+   *
+   * The desktop manager answers with structured codes — `already-installed`,
+   * `bundle-in-use`, `market-self-update` — but they used to survive only as
+   * text inside `stderr`. The update route forwards this to `failureCode`,
+   * so a client can tell "the market cannot update itself here" (#909) from
+   * an ordinary failure without parsing a sentence.
+   */
+  refusalCode?: string
   /** Package names pnpm reported as having ignored build scripts (ndjson). */
   ignoredBuilds?: string[]
   /**
@@ -713,6 +723,35 @@ export function killChild(child: ChildProcess): void {
 let activeChild: ChildProcess | null = null
 let cancelRequested = false
 
+/**
+ * Remove the profile's `package.json.lock` when it is provably ours (#914).
+ *
+ * The dsh CLI writes that lock through the host's atomic-write, whose
+ * `finally` releases it. A timeout kills the whole tree with `taskkill /F`,
+ * so that release never runs and the file outlives the child — and on
+ * Windows the host cannot reliably tell a dead PID from a live one, so every
+ * later change waits the full lock timeout and fails.
+ *
+ * Only a lock naming OUR killed child is removed: that PID is provably dead
+ * because we just killed its whole tree, and it cannot belong to another
+ * operation. A lock naming anything else is left for the classifier to name
+ * (#914), because deleting a live operation's lock would race it.
+ */
+export function clearOwnedProfileLock(profile: string, pid: number | undefined): boolean {
+  if (pid === undefined) return false
+  try {
+    const lock = join(profileDir(profile), 'package.json.lock')
+    const recorded = Number(readFileSync(lock, 'utf8').trim())
+    if (!Number.isInteger(recorded) || recorded !== pid) return false
+    rmSync(lock, { force: true })
+    logEvent('warn', 'install', `the timed-out operation left ${lock} behind (pid ${pid}, already killed with its tree) — removed it so the next change is not blocked (#914)`)
+    return true
+  } catch {
+    // Absent, unreadable, or removed by the child on its way out: nothing to do.
+    return false
+  }
+}
+
 interface ActiveDesktopOperation {
   readonly owner: symbol
   readonly cancel: () => void
@@ -1267,6 +1306,9 @@ export function runDshPlugin(profile: string, pluginArgs: string[]): Promise<Ins
     })
     child.on('close', (code) => {
       clearTimeout(timer)
+      // A timed-out run was killed hard, so the host's lock release in the
+      // child's `finally` never ran. Clear only OUR child's lock (#914).
+      if (timedOut) clearOwnedProfileLock(profile, child.pid)
       progress.active = false
       progress.cancelling = false
       if (activeChild === child) activeChild = null

package/src/install.ts

@@ -5,7 +5,7 @@
  * parameter so tests can substitute a recording fake.
  */
 
-import { closeSync, existsSync, lstatSync, openSync, readlinkSync, readSync, rmSync, statSync } from 'node:fs'
+import { closeSync, existsSync, lstatSync, openSync, readFileSync, readlinkSync, readSync, rmSync, statSync } from 'node:fs'
 import { dirname, isAbsolute, join, resolve } from 'node:path'
 import type { InstallResult, PluginRunner } from './dsh-cli.ts'
 import { findDshInstallDir } from './dsh-install.ts'
@@ -337,12 +337,31 @@ export async function withHoistRecovery(
     //
     // The wait on a fresh release is the one of these where "no retry" leaves
     // the user with nothing to do at all: the plugin IS published, pnpm just
-    // will not take it yet, and the door the market would open on a plain
-    // `dsh web` host is shut here — so say when the same button starts
-    // working, and what to use meanwhile (#852).
-    const note = unavailableOption === RELEASE_AGE_OVERRIDE
-      ? `这个插件的新版本比本 profile 的 minimumReleaseAge（新版本等待期）还新，pnpm 因此拒绝了本次改动（改别的插件也一样）。官方桌面端由应用自己执行安装，不接受市场的临时放行参数（${unavailableOption}），所以这里没有自动重试。**等这个版本过了等待期再更新一次即可**；想现在就更新，可以在普通的 dsh web 里装。 / The plugin's new version is younger than this profile's minimumReleaseAge, so pnpm refused this change (a change to another plugin too). The official desktop app runs the install itself and takes no one-shot bypass from the market (${unavailableOption}), so no automatic retry happens here. **Update again once the version is past the wait**; to update right now, install from plain dsh web.`
-      : `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`
+    // will not take it yet. #852 pointed at plain `dsh web`, but the desktop
+    // profile is host-managed — that door is shut (#909). Say the wait, and
+    // when pnpm named the publish time, how long is left (#919).
+    //
+    // Drop the classifier's "market already retried" sentence first: it was
+    // appended above and is false on this host, and the client prefers
+    // body.error / that classified half over a note tacked on afterwards.
+    let note: string
+    if (unavailableOption === RELEASE_AGE_OVERRIDE) {
+      const classified = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)
+      if (classified?.code === 'release-age-violation') {
+        const cut = result.stderr.lastIndexOf(classified.message)
+        if (cut !== -1) {
+          result = { ...result, stderr: result.stderr.slice(0, cut).trimEnd() }
+        }
+      }
+      const windowMs = readMinimumReleaseAgeMs(profile, profileDirectory)
+      const remaining = windowMs === null
+        ? null
+        : remainingReleaseAgeWait(`${result.stderr}\n${result.stdout}`, Date.now(), windowMs)
+      const wait = remaining === null ? { zh: '', en: '' } : formatRemainingReleaseAgeWait(remaining)
+      note = `这个插件的新版本比本机的新版本等待期还新，所以现在装不了（改别的插件也会被拦住）。官方桌面端不接受临时放行，所以这里没有自动重试。**等这个版本过了等待期再更新一次即可**${wait.zh}。过了等待期后再在市场点一次更新。 / The plugin's new version is younger than this machine's fresh-release wait, so the install was refused (a change to another plugin too). The official desktop app takes no one-shot bypass, so no automatic retry happens here. **Update again once the version is past the wait**${wait.en}. Try the market update again after the wait.`
+    } else {
+      note = `这台宿主（官方桌面端）自己执行安装，不接受市场附加的 pnpm 参数（${unavailableOption}），所以这一步没有自动重试。 / This host (the official desktop app) runs the install itself and takes no pnpm options from the market (${unavailableOption}), so that automatic retry could not be attempted.`
+    }
     result = { ...result, stderr: `${result.stderr}\n\n${note}` }
   }
   // pnpm can append a second rule even on success (#883, #878), including
@@ -423,6 +442,95 @@ export function pnpmNeverStarted(result: InstallResult): boolean {
   return classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)?.code === 'pnpm-unusable'
 }
 
+/**
+ * Whether pnpm refused a too-young release without writing to the profile.
+ *
+ * Same nature as wroteNothing / pnpmNeverStarted for the update route's
+ * rollback (#919): pnpm DID start, read the lockfile, then exited 1 on
+ * ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION (or the sibling mature-match /
+ * resolution-policy shapes). Nothing was installed or removed, so restoring
+ * "the previous build" is alarm about an untouched profile — and on the
+ * official desktop bridge it pairs every wait with a false
+ * "restoration could not be verified" line that covers the real reason.
+ * @param result - the failed run.
+ * @returns true when the failure is pnpm's fresh-release gate.
+ */
+export function pnpmRefusedYoungRelease(result: InstallResult): boolean {
+  return classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)?.code === 'release-age-violation'
+}
+
+/** pnpm's default minimumReleaseAge window (1440 minutes). */
+const DEFAULT_RELEASE_AGE_WINDOW_MS = 24 * 60 * 60 * 1000
+
+/**
+ * The profile's fresh-release wait window in ms (#919).
+ *
+ * Reads `minimumReleaseAge` (minutes) from pnpm-workspace.yaml, then
+ * `minimum-release-age` from `.npmrc`. A key that is present but not a
+ * number returns null — callers must not invent a remaining wait. When
+ * neither file names the key, pnpm's default 1440 minutes applies.
+ */
+export function readMinimumReleaseAgeMs(profile: string, explicitDir?: string): number | null {
+  const dir = profileDir(profile, explicitDir)
+  const fromWorkspace = readReleaseAgeMinutesFromWorkspace(dir)
+  if (fromWorkspace === 'invalid') return null
+  if (typeof fromWorkspace === 'number') return fromWorkspace * 60 * 1000
+  const fromNpmrc = readReleaseAgeMinutesFromNpmrc(dir)
+  if (fromNpmrc === 'invalid') return null
+  if (typeof fromNpmrc === 'number') return fromNpmrc * 60 * 1000
+  return DEFAULT_RELEASE_AGE_WINDOW_MS
+}
+
+/** @returns minutes, `'invalid'` when the key is present but unreadable, or null when absent. */
+function readReleaseAgeMinutesFromWorkspace(dir: string): number | 'invalid' | null {
+  let yaml: string
+  try { yaml = readFileSync(join(dir, 'pnpm-workspace.yaml'), 'utf8') } catch { return null }
+  if (!/^minimumReleaseAge\s*:/m.test(yaml)) return null
+  const match = /^minimumReleaseAge:\s*(\d+)\s*(?:#.*)?$/m.exec(yaml)
+  if (match === null) return 'invalid'
+  const minutes = Number(match[1])
+  return Number.isFinite(minutes) ? minutes : 'invalid'
+}
+
+/** @returns minutes, `'invalid'` when the key is present but unreadable, or null when absent. */
+function readReleaseAgeMinutesFromNpmrc(dir: string): number | 'invalid' | null {
+  let npmrc: string
+  try { npmrc = readFileSync(join(dir, '.npmrc'), 'utf8') } catch { return null }
+  if (!/^minimum-release-age\s*=/m.test(npmrc)) return null
+  const match = /^minimum-release-age\s*=\s*(\d+)\s*(?:#.*)?$/m.exec(npmrc)
+  if (match === null) return 'invalid'
+  const minutes = Number(match[1])
+  return Number.isFinite(minutes) ? minutes : 'invalid'
+}
+
+/**
+ * How long is left in the fresh-release wait, when pnpm named the publish
+ * time in its refusal (#919). Null when the output has no usable timestamp.
+ */
+export function remainingReleaseAgeWait(
+  output: string,
+  now = Date.now(),
+  windowMs = DEFAULT_RELEASE_AGE_WINDOW_MS,
+): number | null {
+  const match = /published at (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/i.exec(output)
+  if (match === null) return null
+  const published = Date.parse(match[1]!)
+  if (!Number.isFinite(published)) return null
+  return Math.max(0, published + windowMs - now)
+}
+
+/** Human remaining-wait fragment for the desktop release-age note. */
+function formatRemainingReleaseAgeWait(remainingMs: number): { zh: string, en: string } {
+  if (remainingMs <= 0) {
+    return { zh: '（现在再试一次即可）', en: ' (try again now)' }
+  }
+  const hours = Math.max(1, Math.ceil(remainingMs / (60 * 60 * 1000)))
+  return {
+    zh: `（大约还剩 ${hours} 小时）`,
+    en: ` (about ${hours} hour${hours === 1 ? '' : 's'} left)`,
+  }
+}
+
 /**
  * Whether pnpm failed because the running host holds the package's files
  * open, so nothing pnpm runs from inside that host can replace them.

package/src/official-desktop.ts

@@ -27,6 +27,32 @@ function failure(message: string, exitCode = 1): InstallResult {
   return { exitCode, timedOut: false, stdout: '', stderr: message, cancelled: false }
 }
 
+/**
+ * The host's own pre-install diagnostic, when it wrote one.
+ *
+ * On dsh 0.2.1 the manager runs checks of its own before pnpm starts and
+ * reports them as `dsh: …` in an `operation-error`'s `diagnostic` (#912).
+ */
+function hostDiagnostic(error: unknown): string | undefined {
+  const diagnostic = (error as { diagnostic?: unknown } | null | undefined)?.diagnostic
+  return typeof diagnostic === 'string' && diagnostic.startsWith('dsh: ') ? diagnostic : undefined
+}
+
+/**
+ * Whether the host stopped before pnpm ran, on a check of its own (#912).
+ *
+ * `checkGithubConnection` refuses an install after five seconds without
+ * touching the profile; so does the compatibility gate (`installation
+ * rejected:`). Neither is a write, and treating them as one sent the update
+ * route into a rollback of an untouched profile — a false "restoration
+ * could not be verified" alarm that buried the real reason.
+ */
+function prePnpmHostFailure(result: ManagedResult): boolean {
+  const diagnostic = hostDiagnostic(result.error)
+  return diagnostic !== undefined
+    && /^dsh: (?:connection to \S+ timed out|installation rejected:)/.test(diagnostic)
+}
+
 function detail(error: unknown): string {
   if (typeof error === 'string') return error
   if (error instanceof Error) return error.message
@@ -37,6 +63,15 @@ function detail(error: unknown): string {
   if (copy !== undefined) return `${copy.zh} / ${copy.en} (${code})`
   const message = (error as { message?: unknown }).message
   if (typeof message === 'string' && message !== '') return message
+  const diagnostic = hostDiagnostic(error)
+  if (diagnostic !== undefined) {
+    if (/^dsh: connection to \S+ timed out/.test(diagnostic)) {
+      // The 5 s is the host's own pre-install reachability check, not the
+      // install failing: say which knob moves it (#912).
+      return `${diagnostic}\n\n宿主在开始安装前自己检查了 GitHub 的连通性，5 秒内没连上就放弃了这次安装，pnpm 还没有开始，profile 没有任何改动。如果手动 \`git ls-remote\` 能连上（例如已给 git 配好代理或换过 TLS 后端），把宿主 plugin-manager 的 \`githubConnectionTimeoutMs\` 调大再试（cordis.yml 里该插件的 config）。 / the host checks GitHub reachability before installing and gave up after five seconds; pnpm never started and the profile is unchanged. If git itself can reach GitHub (a proxy, or a different TLS backend), raise the host plugin-manager's \`githubConnectionTimeoutMs\` (its config in cordis.yml) and try again.`
+    }
+    return diagnostic
+  }
   return JSON.stringify(error)
 }
 
@@ -96,7 +131,14 @@ function selfUpdateMessage(spec: string): string {
   const at = spec.indexOf('@', 1)
   const version = at === -1 ? '' : spec.slice(at + 1)
   const target = version === '' ? spec : `${registryNameOf(spec) ?? spec}@${version}`
-  return `市场不能在自己的请求里先卸载自己：桌面端的移除会先把市场从正在运行的组合里摘掉，补装那一步就再也执行不到了（#900）。请在桌面端的「设置 → 插件」里更新市场${version === '' ? '' : ` 到 ${version}`}，或完全退出 DSH 后在终端执行 \`dsh plugin --profile desktop add ${target}\`。 / The market cannot remove itself to update: the desktop app unloads it from the running composition first, so the reinstall never runs (#900). Update it from the desktop app's Settings → Plugins${version === '' ? '' : ` (to ${version})`}, or quit DSH completely and run \`dsh plugin --profile desktop add ${target}\` in a terminal.`
+  // Two paths that used to be named here do not exist on dsh 0.2.1, and a
+  // reporter proved both (#909): `dsh plugin --profile desktop` is refused
+  // outright, and the app's Settings → Plugins has no update entry — its
+  // manager refuses re-adding a package that is already declared. The only
+  // route left is pnpm run against the profile with the app fully quit, which
+  // is what the reporter verified. `--config.minimum-release-age=0` is the
+  // market's own one-shot flag, spelled so it works in every shell.
+  return `市场不能在自己的请求里更新自己：桌面端的移除会先把市场从正在运行的组合里摘掉，补装那一步就执行不到了（#900），而应用内的「设置 → 插件」没有更新入口（#909）。要更新${version === '' ? '' : ` 到 ${version}`}：完全退出 DSH Desktop，在 profile 目录执行 \`pnpm add ${target} --config.minimum-release-age=0\`（没有 pnpm 时用 \`npx pnpm add …\`），然后重新启动。Windows 的 profile 一般在 %USERPROFILE%\\.dsh\\profiles\\desktop。 / The market cannot update itself: the desktop app unloads it from the running composition first, so the reinstall never runs (#900), and the app's Settings → Plugins has no update entry (#909). To update${version === '' ? '' : ` to ${version}`}: quit DSH Desktop completely, run \`pnpm add ${target} --config.minimum-release-age=0\` in the profile directory (use \`npx pnpm add …\` if pnpm is not installed), then start DSH again. On Windows the profile is usually %USERPROFILE%\\.dsh\\profiles\\desktop.`
 }
 
 /** The manager's own refusal code, whether it was returned or thrown. */
@@ -261,12 +303,21 @@ export function createOfficialDesktopRuntime(
         cancelled: current.cancelled || result.application === 'cancelled',
         // No package result means the manager stopped before it ran pnpm: the
         // profile is untouched, and the route must not try to "restore" it.
-        wroteNothing: !ok && result.packageResult === undefined,
+        // A pre-install host check (#912) is the same shape even when the
+        // manager attached a package result to its refusal.
+        wroteNothing: !ok && (result.packageResult === undefined || prePnpmHostFailure(result)),
+        // The manager's own code, kept machine-readable (#909): a client can
+        // tell a self-update refusal from an ordinary failure.
+        ...(ok ? {} : { refusalCode: managementCode(result.error) }),
       }
     }, (error): InstallResult => {
       const message = detail(error)
       progress.error = message
-      return { ...failure(message, 127), wroteNothing: managementCode(error) !== undefined }
+      return {
+        ...failure(message, 127),
+        wroteNothing: managementCode(error) !== undefined,
+        ...(managementCode(error) === undefined ? {} : { refusalCode: managementCode(error) }),
+      }
     }).finally(() => {
       progress.active = false
       progress.cancelling = false

package/src/pnpm-compat.ts

@@ -51,7 +51,7 @@ export interface PnpmFailure {
     | 'profile-file-locked'
     | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key' | 'native-oom' | 'ssh-auth-failed'
     | 'host-incompatible-install'
-    | 'lockfile-broken' | 'lockfile-outdated' | 'pnpm-stalled'
+    | 'lockfile-broken' | 'lockfile-outdated' | 'pnpm-stalled' | 'profile-write-lock'
   /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
   message: string
   /** True when re-running `pnpm install` in the profile is the documented recovery. */
@@ -229,6 +229,21 @@ export function classifyPnpmFailure(output: string, exitCode?: number | null): P
         : `pnpm ${minutes} 分钟没有任何输出，被终止了，什么都没装上。通常是网络卡住了。检查网络后重试。 / pnpm printed nothing for ${minutes} minutes and was stopped, so nothing was installed. This usually means the network stalled. Check the connection and try again.`,
     }
   }
+  // #914: the host's atomic-write could not take the profile's write lock.
+  // Either a concurrent operation is legitimately holding it, or an earlier
+  // update was killed hard and left the file behind — on Windows the host
+  // cannot always tell a dead PID from a live one, so it never takes over.
+  // The market does not delete the file: it belongs to the host, and a wrong
+  // deletion races a live operation. Say where it is and what is safe.
+  const writerLock = /timed out waiting for the writer lock at "?([^"\n]+)"?/.exec(output)
+  if (writerLock !== null) {
+    const path = writerLock[1]!.trim()
+    return {
+      code: 'profile-write-lock',
+      recoverable: true,
+      message: `profile 的写锁等了太久没等到：${path}。要么另一个插件操作还在跑（等它结束再试），要么某次被中断的更新把锁留在了那里。确认没有安装或更新正在进行后，删掉这个文件再重试即可；市场不会替你去动它。 / the profile's writer lock was never released: ${path}. Either another plugin operation is still running (wait for it), or an interrupted update left the lock behind. Once nothing is installing or updating, delete that file and try again; the market does not remove it for you.`,
+    }
+  }
   if (output.includes('ERR_PNPM_PUBLIC_HOIST_PATTERN_DIFF')
     || output.includes('ERR_PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH_DIFF')) {
     return {

package/src/routes.ts

@@ -41,7 +41,7 @@ import { createProfileSnapshot, DEFAULT_MAX_SNAPSHOTS, deleteSnapshot, listSnaps
 import { readHostRecoveryView, restoreHostRecoveryBackup } from './host-recovery.ts'
 import { trialValidate } from './trial.ts'
 import { catalogRepoKey, findCatalogEntryForLocal, findInstalledAlias, gitCommitOfTarget, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitRefOfTarget, gitTargetAtCommit, gitUpdateTarget, hostedRepoKey, lookupRepoFromUrl, pinnedAllowBuildsKeys, installTargetFor, isGenerationLink, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, sourceFallbackFor, workspaceProtocolDeps } from './sources.ts'
-import { failureDetail, groupConflictsByOwner, isStaleUpdate, parseIgnoredBuildEntries, parseIgnoredBuilds, parsePrepareKey, parsePrepareNotAllowed, pnpmBlockedByOpenFiles, pnpmNeverStarted, RELEASE_AGE_OVERRIDE, removeDanglingHostBridge, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.ts'
+import { failureDetail, groupConflictsByOwner, isStaleUpdate, parseIgnoredBuildEntries, parseIgnoredBuilds, parsePrepareKey, parsePrepareNotAllowed, pnpmBlockedByOpenFiles, pnpmNeverStarted, pnpmRefusedYoungRelease, RELEASE_AGE_OVERRIDE, removeDanglingHostBridge, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.ts'
 import { classifyPnpmFailure } from './pnpm-compat.ts'
 import { asChannel, CHANNELS, DIST_TAG, resolveChannel, type Channel } from './channels.ts'
 import {
@@ -451,6 +451,14 @@ function pnpmFailureMessage(result: { exitCode: number | null; stdout: string; s
   const failure = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode)
   if (failure === null) return undefined
   if (failure.code === 'ignored-builds' || failure.code === 'git-prepare-not-allowed') return undefined
+  // Desktop release-age note is already the actionable sentence (#919). Do
+  // not cover it with the classifier's "market already retried" claim —
+  // install/uninstall fall through to stderr via failureText when error is
+  // undefined.
+  if (failure.code === 'release-age-violation'
+    && /没有自动重试|no automatic retry happens here/.test(`${result.stderr}\n${result.stdout}`)) {
+    return undefined
+  }
   return failure.message
 }
 
@@ -4817,7 +4825,12 @@ sendJson(response, 200, { updates })
               // verify restoration, inspect this profile" warning this block
               // raises on a failed rollback would be alarm about an untouched
               // profile.
-              && result.wroteNothing !== true) {
+              && result.wroteNothing !== true
+              // pnpm ran, then refused a too-young release without writing
+              // (#919). Same untouched profile; skipping the rollback keeps
+              // the release-age reason visible instead of covering it with a
+              // false "restoration could not be verified" alarm.
+              && !pnpmRefusedYoungRelease(result)) {
               if (pnpmBlockedByOpenFiles(result)) {
                 const kept = keepLockedBuild()
                 rollbackOk = kept.ok
@@ -5172,7 +5185,10 @@ sendJson(response, 200, { updates })
               // ever sees this when something really is unbootable.
               ...(() => { const orphans = orphanBundles(); return orphans.length > 0 ? { orphanBundles: orphans } : {} })(),
               staleReason: staleReason ?? undefined,
-              failureCode: versionFailureCode ?? undefined,
+              // The host's own refusal code when it stopped before pnpm
+              // (#909): `market-self-update` tells a client that the button
+              // cannot work on this host, not that the update was broken.
+              failureCode: versionFailureCode ?? result.refusalCode ?? undefined,
               renamedTo: renamedTo ?? undefined,
               removedDeclaration: removedDeclaration ?? undefined,
               ...(droppedBundles.length > 0 ? { droppedBundles } : {}),
@@ -5183,8 +5199,14 @@ sendJson(response, 200, { updates })
               // before running pnpm there is no classifier for its words and
               // no rollback behind it, so without this the answer carried no
               // reason at all.
+              // Release-age on Desktop (#919): withHoistRecovery already wrote
+              // the wait note into stderr (and stripped the false "already
+              // retried" classifier). Prefer that over pnpmFailureMessage,
+              // which would re-surface the classifier alone — the client
+              // shows body.error first.
               error: versionFailureError ?? renamedError ?? trialError ?? brokenEntryError ?? hardFailureRollbackError ?? staleError
                 ?? (result.wroteNothing === true && result.stderr.trim() !== '' ? result.stderr.trim() : undefined)
+                ?? (pnpmRefusedYoungRelease(result) && result.stderr.trim() !== '' ? result.stderr.trim() : undefined)
                 ?? pnpmFailureMessage(result) ?? undefined,
               exitCode: result.exitCode,
               timedOut: result.timedOut,

package/src/update-api-v1.ts

@@ -76,9 +76,30 @@ function bool(value: unknown): boolean {
   return value === true
 }
 
+/**
+ * Host refusal codes that may travel through `failureCode` unchanged.
+ *
+ * The route forwards the desktop manager's own codes (#909); the v1 API only
+ * re-publishes the ones a caller can act on, so an internal code cannot leak
+ * by accident. `market-self-update` is the one this exists for: the market
+ * cannot update itself on a host whose manager refuses re-adds, and a caller
+ * should be able to say so instead of retrying.
+ */
+const FORWARDED_FAILURE_CODES = new Set([
+  'DOWNGRADE_DETECTED',
+  'RESOLVED_VERSION_MISMATCH',
+  'market-self-update',
+  'already-installed',
+  'bundle-in-use',
+  'not-removable',
+  'stop-profile',
+  'management-required',
+  'incompatible-version',
+])
+
 function failureCode(status: number, body: Record<string, unknown>): string {
   const explicit = text(body.failureCode)
-  if (explicit === 'DOWNGRADE_DETECTED' || explicit === 'RESOLVED_VERSION_MISMATCH') return explicit
+  if (explicit !== null && FORWARDED_FAILURE_CODES.has(explicit)) return explicit
   if (body.agentsBusy === true) return 'AGENTS_RUNNING'
   if (body.busy === true || status === 409) return 'OPERATION_BUSY'
   if (body.stale === true && body.staleReason === 'release-age') return 'RELEASE_TOO_FRESH'