dshmarket 1.66.40 → 1.66.41

package/client/client.js

@@ -10017,6 +10017,11 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				setRestarting(true);
 				setInstallError(null);
 				setRecovery(null);
+				const shellRestart = typeof window === "undefined" ? void 0 : window.__dshHostShell?.restart;
+				if (typeof shellRestart === "function") try {
+					shellRestart();
+					return;
+				} catch {}
 				const awaitNewBoot = () => {
 					const deadline = Date.now() + 6e4;
 					const poll = () => {

package/lib/dsh-cli.js

@@ -7,7 +7,7 @@
  * the agent's sandboxed executor and denies writes to the profile directory.
  */
 import { spawn, spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { logEvent } from './log.js';
@@ -550,6 +550,37 @@ export function killChild(child) {
 /** The child of the operation currently running, for /dsh-market/cancel. */
 let activeChild = null;
 let cancelRequested = false;
+/**
+ * Remove the profile's `package.json.lock` when it is provably ours (#914).
+ *
+ * The dsh CLI writes that lock through the host's atomic-write, whose
+ * `finally` releases it. A timeout kills the whole tree with `taskkill /F`,
+ * so that release never runs and the file outlives the child — and on
+ * Windows the host cannot reliably tell a dead PID from a live one, so every
+ * later change waits the full lock timeout and fails.
+ *
+ * Only a lock naming OUR killed child is removed: that PID is provably dead
+ * because we just killed its whole tree, and it cannot belong to another
+ * operation. A lock naming anything else is left for the classifier to name
+ * (#914), because deleting a live operation's lock would race it.
+ */
+export function clearOwnedProfileLock(profile, pid) {
+    if (pid === undefined)
+        return false;
+    try {
+        const lock = join(profileDir(profile), 'package.json.lock');
+        const recorded = Number(readFileSync(lock, 'utf8').trim());
+        if (!Number.isInteger(recorded) || recorded !== pid)
+            return false;
+        rmSync(lock, { force: true });
+        logEvent('warn', 'install', `the timed-out operation left ${lock} behind (pid ${pid}, already killed with its tree) — removed it so the next change is not blocked (#914)`);
+        return true;
+    }
+    catch {
+        // Absent, unreadable, or removed by the child on its way out: nothing to do.
+        return false;
+    }
+}
 let activeDesktopOperation = null;
 /**
  * Kill a child and its whole tree, gracefully where the platform allows:
@@ -1047,6 +1078,10 @@ export function runDshPlugin(profile, pluginArgs) {
         });
         child.on('close', (code) => {
             clearTimeout(timer);
+            // A timed-out run was killed hard, so the host's lock release in the
+            // child's `finally` never ran. Clear only OUR child's lock (#914).
+            if (timedOut)
+                clearOwnedProfileLock(profile, child.pid);
             progress.active = false;
             progress.cancelling = false;
             if (activeChild === child)

package/lib/official-desktop.js

@@ -11,6 +11,30 @@ export const OFFICIAL_PAGE_HINT = '官方桌面客户端的这个插件操作需
 function failure(message, exitCode = 1) {
     return { exitCode, timedOut: false, stdout: '', stderr: message, cancelled: false };
 }
+/**
+ * The host's own pre-install diagnostic, when it wrote one.
+ *
+ * On dsh 0.2.1 the manager runs checks of its own before pnpm starts and
+ * reports them as `dsh: …` in an `operation-error`'s `diagnostic` (#912).
+ */
+function hostDiagnostic(error) {
+    const diagnostic = error?.diagnostic;
+    return typeof diagnostic === 'string' && diagnostic.startsWith('dsh: ') ? diagnostic : undefined;
+}
+/**
+ * Whether the host stopped before pnpm ran, on a check of its own (#912).
+ *
+ * `checkGithubConnection` refuses an install after five seconds without
+ * touching the profile; so does the compatibility gate (`installation
+ * rejected:`). Neither is a write, and treating them as one sent the update
+ * route into a rollback of an untouched profile — a false "restoration
+ * could not be verified" alarm that buried the real reason.
+ */
+function prePnpmHostFailure(result) {
+    const diagnostic = hostDiagnostic(result.error);
+    return diagnostic !== undefined
+        && /^dsh: (?:connection to \S+ timed out|installation rejected:)/.test(diagnostic);
+}
 function detail(error) {
     if (typeof error === 'string')
         return error;
@@ -26,6 +50,15 @@ function detail(error) {
     const message = error.message;
     if (typeof message === 'string' && message !== '')
         return message;
+    const diagnostic = hostDiagnostic(error);
+    if (diagnostic !== undefined) {
+        if (/^dsh: connection to \S+ timed out/.test(diagnostic)) {
+            // The 5 s is the host's own pre-install reachability check, not the
+            // install failing: say which knob moves it (#912).
+            return `${diagnostic}\n\n宿主在开始安装前自己检查了 GitHub 的连通性，5 秒内没连上就放弃了这次安装，pnpm 还没有开始，profile 没有任何改动。如果手动 \`git ls-remote\` 能连上（例如已给 git 配好代理或换过 TLS 后端），把宿主 plugin-manager 的 \`githubConnectionTimeoutMs\` 调大再试（cordis.yml 里该插件的 config）。 / the host checks GitHub reachability before installing and gave up after five seconds; pnpm never started and the profile is unchanged. If git itself can reach GitHub (a proxy, or a different TLS backend), raise the host plugin-manager's \`githubConnectionTimeoutMs\` (its config in cordis.yml) and try again.`;
+        }
+        return diagnostic;
+    }
     return JSON.stringify(error);
 }
 /**
@@ -250,7 +283,9 @@ _profileDirectory) {
                 cancelled: current.cancelled || result.application === 'cancelled',
                 // No package result means the manager stopped before it ran pnpm: the
                 // profile is untouched, and the route must not try to "restore" it.
-                wroteNothing: !ok && result.packageResult === undefined,
+                // A pre-install host check (#912) is the same shape even when the
+                // manager attached a package result to its refusal.
+                wroteNothing: !ok && (result.packageResult === undefined || prePnpmHostFailure(result)),
                 // The manager's own code, kept machine-readable (#909): a client can
                 // tell a self-update refusal from an ordinary failure.
                 ...(ok ? {} : { refusalCode: managementCode(result.error) }),

package/lib/pnpm-compat.js

@@ -191,6 +191,21 @@ export function classifyPnpmFailure(output, exitCode) {
                 : `pnpm ${minutes} 分钟没有任何输出，被终止了，什么都没装上。通常是网络卡住了。检查网络后重试。 / pnpm printed nothing for ${minutes} minutes and was stopped, so nothing was installed. This usually means the network stalled. Check the connection and try again.`,
         };
     }
+    // #914: the host's atomic-write could not take the profile's write lock.
+    // Either a concurrent operation is legitimately holding it, or an earlier
+    // update was killed hard and left the file behind — on Windows the host
+    // cannot always tell a dead PID from a live one, so it never takes over.
+    // The market does not delete the file: it belongs to the host, and a wrong
+    // deletion races a live operation. Say where it is and what is safe.
+    const writerLock = /timed out waiting for the writer lock at "?([^"\n]+)"?/.exec(output);
+    if (writerLock !== null) {
+        const path = writerLock[1].trim();
+        return {
+            code: 'profile-write-lock',
+            recoverable: true,
+            message: `profile 的写锁等了太久没等到：${path}。要么另一个插件操作还在跑（等它结束再试），要么某次被中断的更新把锁留在了那里。确认没有安装或更新正在进行后，删掉这个文件再重试即可；市场不会替你去动它。 / the profile's writer lock was never released: ${path}. Either another plugin operation is still running (wait for it), or an interrupted update left the lock behind. Once nothing is installing or updating, delete that file and try again; the market does not remove it for you.`,
+        };
+    }
     if (output.includes('ERR_PNPM_PUBLIC_HOIST_PATTERN_DIFF')
         || output.includes('ERR_PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH_DIFF')) {
         return {

package/lib/types/dsh-cli.d.ts

@@ -299,6 +299,21 @@ export interface DesktopPluginRuntime extends PluginCommandRuntime {
  * (Contributed in #7 by @mraing.)
  */
 export declare function killChild(child: ChildProcess): void;
+/**
+ * Remove the profile's `package.json.lock` when it is provably ours (#914).
+ *
+ * The dsh CLI writes that lock through the host's atomic-write, whose
+ * `finally` releases it. A timeout kills the whole tree with `taskkill /F`,
+ * so that release never runs and the file outlives the child — and on
+ * Windows the host cannot reliably tell a dead PID from a live one, so every
+ * later change waits the full lock timeout and fails.
+ *
+ * Only a lock naming OUR killed child is removed: that PID is provably dead
+ * because we just killed its whole tree, and it cannot belong to another
+ * operation. A lock naming anything else is left for the classifier to name
+ * (#914), because deleting a live operation's lock would race it.
+ */
+export declare function clearOwnedProfileLock(profile: string, pid: number | undefined): boolean;
 /**
  * Cancel the plugin command currently running.
  * @returns true when there was one to cancel.

package/lib/types/pnpm-compat.d.ts

@@ -33,7 +33,7 @@ export declare function pluginArgsFor(profileDir: string, pluginArgs: string[]):
  */
 export declare const HOST_NAMESPACE_RE: RegExp;
 export interface PnpmFailure {
-    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch' | 'fetch-404' | 'no-matching-version' | 'transient-network' | 'fetch-timeout' | 'unexpected-store' | 'patch-failed' | 'unused-patch' | 'missing-tarball-integrity' | 'windows-file-locked' | 'profile-file-locked' | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key' | 'native-oom' | 'ssh-auth-failed' | 'host-incompatible-install' | 'lockfile-broken' | 'lockfile-outdated' | 'pnpm-stalled';
+    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch' | 'fetch-404' | 'no-matching-version' | 'transient-network' | 'fetch-timeout' | 'unexpected-store' | 'patch-failed' | 'unused-patch' | 'missing-tarball-integrity' | 'windows-file-locked' | 'profile-file-locked' | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key' | 'native-oom' | 'ssh-auth-failed' | 'host-incompatible-install' | 'lockfile-broken' | 'lockfile-outdated' | 'pnpm-stalled' | 'profile-write-lock';
     /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
     message: string;
     /** True when re-running `pnpm install` in the profile is the documented recovery. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.40",
+  "version": "1.66.41",
   "icon": "assets/logo.svg",
   "type": "module",
   "main": "lib/index.js",

package/src/client/MarketSection.tsx

@@ -3560,6 +3560,20 @@ export function MarketSection(props: MarketSectionProps) {
     setRestarting(true)
     setInstallError(null)
     setRecovery(null)
+    // A shell that runs this host as its own child process owns the lifecycle:
+    // it stops the process it started and relaunches its window. The helper
+    // below would be a second lifecycle competing with it — two processes, one
+    // port — so where the shell is there, ask it instead of spawning anything.
+    const shellRestart = typeof window === 'undefined' ? undefined : window.__dshHostShell?.restart
+    if (typeof shellRestart === 'function') {
+      try {
+        shellRestart()
+        return
+      } catch {
+        // A shell that published the bridge and then threw is not a restart:
+        // fall through to the host's own route, which is the pre-existing path.
+      }
+    }
     const awaitNewBoot = () => {
       const deadline = Date.now() + 60000
       const poll = () => {

package/src/client/globals.d.ts

@@ -10,4 +10,22 @@ interface Window {
   __DSH_BOOT__?: {
     entries?: Array<{ id: string }>
   }
+  /**
+   * The host shell's own lifecycle, published by a shell that runs the host as
+   * a child process (a Tauri or Electron app that spawned `dsh web`). Optional:
+   * absent on every host that is not wrapped in one.
+   *
+   * A shell restart is not the same operation as the market's own: the shell
+   * stops the process it started and relaunches its own window, so a detached
+   * helper spawned by the host would be a second, competing lifecycle. When
+   * the shell is there, the restart is asked for through it instead.
+   */
+  __dshHostShell?: {
+    /**
+     * Restart the host the way the shell's own menu item does. Returns
+     * nothing on purpose: the window it answers on is about to go away, so
+     * there is no state a caller could usefully read back.
+     */
+    restart?: () => void
+  }
 }

package/src/dsh-cli.ts

@@ -9,7 +9,7 @@
 
 import { spawn, spawnSync } from 'node:child_process'
 import type { ChildProcess, SpawnOptions } from 'node:child_process'
-import { existsSync } from 'node:fs'
+import { existsSync, readFileSync, rmSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, isAbsolute, join, resolve } from 'node:path'
 import { logEvent } from './log.ts'
@@ -723,6 +723,35 @@ export function killChild(child: ChildProcess): void {
 let activeChild: ChildProcess | null = null
 let cancelRequested = false
 
+/**
+ * Remove the profile's `package.json.lock` when it is provably ours (#914).
+ *
+ * The dsh CLI writes that lock through the host's atomic-write, whose
+ * `finally` releases it. A timeout kills the whole tree with `taskkill /F`,
+ * so that release never runs and the file outlives the child — and on
+ * Windows the host cannot reliably tell a dead PID from a live one, so every
+ * later change waits the full lock timeout and fails.
+ *
+ * Only a lock naming OUR killed child is removed: that PID is provably dead
+ * because we just killed its whole tree, and it cannot belong to another
+ * operation. A lock naming anything else is left for the classifier to name
+ * (#914), because deleting a live operation's lock would race it.
+ */
+export function clearOwnedProfileLock(profile: string, pid: number | undefined): boolean {
+  if (pid === undefined) return false
+  try {
+    const lock = join(profileDir(profile), 'package.json.lock')
+    const recorded = Number(readFileSync(lock, 'utf8').trim())
+    if (!Number.isInteger(recorded) || recorded !== pid) return false
+    rmSync(lock, { force: true })
+    logEvent('warn', 'install', `the timed-out operation left ${lock} behind (pid ${pid}, already killed with its tree) — removed it so the next change is not blocked (#914)`)
+    return true
+  } catch {
+    // Absent, unreadable, or removed by the child on its way out: nothing to do.
+    return false
+  }
+}
+
 interface ActiveDesktopOperation {
   readonly owner: symbol
   readonly cancel: () => void
@@ -1277,6 +1306,9 @@ export function runDshPlugin(profile: string, pluginArgs: string[]): Promise<Ins
     })
     child.on('close', (code) => {
       clearTimeout(timer)
+      // A timed-out run was killed hard, so the host's lock release in the
+      // child's `finally` never ran. Clear only OUR child's lock (#914).
+      if (timedOut) clearOwnedProfileLock(profile, child.pid)
       progress.active = false
       progress.cancelling = false
       if (activeChild === child) activeChild = null

package/src/official-desktop.ts

@@ -27,6 +27,32 @@ function failure(message: string, exitCode = 1): InstallResult {
   return { exitCode, timedOut: false, stdout: '', stderr: message, cancelled: false }
 }
 
+/**
+ * The host's own pre-install diagnostic, when it wrote one.
+ *
+ * On dsh 0.2.1 the manager runs checks of its own before pnpm starts and
+ * reports them as `dsh: …` in an `operation-error`'s `diagnostic` (#912).
+ */
+function hostDiagnostic(error: unknown): string | undefined {
+  const diagnostic = (error as { diagnostic?: unknown } | null | undefined)?.diagnostic
+  return typeof diagnostic === 'string' && diagnostic.startsWith('dsh: ') ? diagnostic : undefined
+}
+
+/**
+ * Whether the host stopped before pnpm ran, on a check of its own (#912).
+ *
+ * `checkGithubConnection` refuses an install after five seconds without
+ * touching the profile; so does the compatibility gate (`installation
+ * rejected:`). Neither is a write, and treating them as one sent the update
+ * route into a rollback of an untouched profile — a false "restoration
+ * could not be verified" alarm that buried the real reason.
+ */
+function prePnpmHostFailure(result: ManagedResult): boolean {
+  const diagnostic = hostDiagnostic(result.error)
+  return diagnostic !== undefined
+    && /^dsh: (?:connection to \S+ timed out|installation rejected:)/.test(diagnostic)
+}
+
 function detail(error: unknown): string {
   if (typeof error === 'string') return error
   if (error instanceof Error) return error.message
@@ -37,6 +63,15 @@ function detail(error: unknown): string {
   if (copy !== undefined) return `${copy.zh} / ${copy.en} (${code})`
   const message = (error as { message?: unknown }).message
   if (typeof message === 'string' && message !== '') return message
+  const diagnostic = hostDiagnostic(error)
+  if (diagnostic !== undefined) {
+    if (/^dsh: connection to \S+ timed out/.test(diagnostic)) {
+      // The 5 s is the host's own pre-install reachability check, not the
+      // install failing: say which knob moves it (#912).
+      return `${diagnostic}\n\n宿主在开始安装前自己检查了 GitHub 的连通性，5 秒内没连上就放弃了这次安装，pnpm 还没有开始，profile 没有任何改动。如果手动 \`git ls-remote\` 能连上（例如已给 git 配好代理或换过 TLS 后端），把宿主 plugin-manager 的 \`githubConnectionTimeoutMs\` 调大再试（cordis.yml 里该插件的 config）。 / the host checks GitHub reachability before installing and gave up after five seconds; pnpm never started and the profile is unchanged. If git itself can reach GitHub (a proxy, or a different TLS backend), raise the host plugin-manager's \`githubConnectionTimeoutMs\` (its config in cordis.yml) and try again.`
+    }
+    return diagnostic
+  }
   return JSON.stringify(error)
 }
 
@@ -268,7 +303,9 @@ export function createOfficialDesktopRuntime(
         cancelled: current.cancelled || result.application === 'cancelled',
         // No package result means the manager stopped before it ran pnpm: the
         // profile is untouched, and the route must not try to "restore" it.
-        wroteNothing: !ok && result.packageResult === undefined,
+        // A pre-install host check (#912) is the same shape even when the
+        // manager attached a package result to its refusal.
+        wroteNothing: !ok && (result.packageResult === undefined || prePnpmHostFailure(result)),
         // The manager's own code, kept machine-readable (#909): a client can
         // tell a self-update refusal from an ordinary failure.
         ...(ok ? {} : { refusalCode: managementCode(result.error) }),

package/src/pnpm-compat.ts

@@ -51,7 +51,7 @@ export interface PnpmFailure {
     | 'profile-file-locked'
     | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key' | 'native-oom' | 'ssh-auth-failed'
     | 'host-incompatible-install'
-    | 'lockfile-broken' | 'lockfile-outdated' | 'pnpm-stalled'
+    | 'lockfile-broken' | 'lockfile-outdated' | 'pnpm-stalled' | 'profile-write-lock'
   /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
   message: string
   /** True when re-running `pnpm install` in the profile is the documented recovery. */
@@ -229,6 +229,21 @@ export function classifyPnpmFailure(output: string, exitCode?: number | null): P
         : `pnpm ${minutes} 分钟没有任何输出，被终止了，什么都没装上。通常是网络卡住了。检查网络后重试。 / pnpm printed nothing for ${minutes} minutes and was stopped, so nothing was installed. This usually means the network stalled. Check the connection and try again.`,
     }
   }
+  // #914: the host's atomic-write could not take the profile's write lock.
+  // Either a concurrent operation is legitimately holding it, or an earlier
+  // update was killed hard and left the file behind — on Windows the host
+  // cannot always tell a dead PID from a live one, so it never takes over.
+  // The market does not delete the file: it belongs to the host, and a wrong
+  // deletion races a live operation. Say where it is and what is safe.
+  const writerLock = /timed out waiting for the writer lock at "?([^"\n]+)"?/.exec(output)
+  if (writerLock !== null) {
+    const path = writerLock[1]!.trim()
+    return {
+      code: 'profile-write-lock',
+      recoverable: true,
+      message: `profile 的写锁等了太久没等到：${path}。要么另一个插件操作还在跑（等它结束再试），要么某次被中断的更新把锁留在了那里。确认没有安装或更新正在进行后，删掉这个文件再重试即可；市场不会替你去动它。 / the profile's writer lock was never released: ${path}. Either another plugin operation is still running (wait for it), or an interrupted update left the lock behind. Once nothing is installing or updating, delete that file and try again; the market does not remove it for you.`,
+    }
+  }
   if (output.includes('ERR_PNPM_PUBLIC_HOIST_PATTERN_DIFF')
     || output.includes('ERR_PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH_DIFF')) {
     return {