dshmarket 1.66.41 → 1.66.42

package/lib/changelog.js

@@ -23,9 +23,9 @@
 import { fileFromTarball } from './catalog-npm.js';
 import { marketFetch } from './net.js';
 import { activeRegion, routesFor } from './regions.js';
-import { profileDir, readGitResolutionCommit, readInstalled, readInstalledRepoEvidence, readLockCommits } from './profile.js';
+import { profileDir, readGitResolutionCommit, readInstalled, readInstalledRepoEvidence, readInstalledVersion, readLockCommits } from './profile.js';
 import { githubRepoOfRemote, hostedRepoKey, isGitHostedSpec, lookupRepoFromUrl, parseHostShorthand, parseSourceUrl, repoOf, repoOfTarget } from './sources.js';
-import { checkUpdates } from './updates.js';
+import { checkUpdates, compareVersions } from './updates.js';
 import { loadRegistry } from './registry.js';
 const UPDATES_PACKAGE = 'dsh-plugin-updates';
 const UPDATES_FILE = 'package/updates.json';
@@ -118,6 +118,20 @@ export function sliceCommitsAt(items, installed) {
     }
     return { items: out, found: false };
 }
+/**
+ * The version a release tag names, when it names one.
+ *
+ * Tags come as `v1.2.3`, `1.2.3`, `@scope/pkg@1.2.3` or `pkg-v1.2.3`; the
+ * FIRST semver-shaped run is the version in all of them. A tag that names no
+ * version (`nightly`) returns null, and callers must treat "unknown" as "do
+ * not judge" rather than "older".
+ */
+export function releaseVersionOf(tag) {
+    if (tag === null)
+        return null;
+    const match = /(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/.exec(tag);
+    return match?.[1] ?? null;
+}
 /** The repo url key an entry's update notes live under, or null. */
 export function repoKeyOf(spec) {
     const repo = githubIdentityOf(spec)?.split('#')[0] ?? null;
@@ -407,7 +421,23 @@ export async function updateNotesFor(profile, explicitDir, name) {
             current = statuses?.[name]?.current ?? null;
         }
         if (entry?.release !== undefined && entry.release !== null && (entry.release.body !== '' || entry.release.tag !== null)) {
-            return { kind: 'release', release: entry.release };
+            // The release feed is a DAILY snapshot while the update target is read
+            // live from npm, so the snapshot's newest release is often the version
+            // already installed (or older). Showing it next to "1.66.39 → 1.66.40"
+            // describes a change the user already has (#925). When the release
+            // names a version no newer than the installed one AND a better tier
+            // exists, take the better tier: the commit tail is sliced at this
+            // install's sha, and npm publish times are newer than the install by
+            // construction. With nothing better, the stale release still beats an
+            // empty dialog.
+            const installed = readInstalledVersion(profile, name, activeProfileDir);
+            const released = releaseVersionOf(entry.release.tag);
+            const behind = installed !== null && released !== null
+                && (compareVersions(released, installed) ?? 0) <= 0;
+            const hasCommits = (entry.commits?.length ?? 0) > 0;
+            if (!(behind && (hasCommits || (specKey === null && npmName !== null)))) {
+                return { kind: 'release', release: entry.release };
+            }
         }
         if (entry?.commits !== undefined && entry.commits.length > 0) {
             return { kind: 'commits', commits: sliceCommitsAt(entry.commits, current) };

package/lib/install.js

@@ -662,7 +662,10 @@ export async function validateAddedPlugins(run, profile, before, explicitDir, ho
         const packageDir = join(dir, 'node_modules', n);
         // hasLoadableEntry, not entryArtifactExists: carrier bundles legitimately
         // ship no entry of their own (#103) and must not be uninstalled here.
-        if (!hasDshManifest(packageDir) || !hasLoadableEntry(dir, n)) {
+        // The host install tree is passed too (#906): a carrier mounting only
+        // in-box packages resolves nowhere under the profile, and judging it by
+        // that alone deleted a package the host had just installed correctly.
+        if (!hasDshManifest(packageDir) || !hasLoadableEntry(dir, n, hostDirectory ?? findDshInstallDir())) {
             removedBroken.push(n);
             await removeAndReconcile(run, profile, dir, n, hostDirectory);
             continue;

package/lib/profile.js

@@ -4,9 +4,11 @@
  * functions of the directory contents; no processes, no network.
  */
 import { existsSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { JSON_SCHEMA, load } from 'js-yaml';
+import { findDshInstallDir } from './dsh-install.js';
 import { resolveDshHome } from './home-paths.js';
 import { githubRemoteIdentities, githubRepoIdentities, hostedRepoKey, isGenerationLink, isGitHostedSpec, repoOfTarget } from './sources.js';
 /**
@@ -1296,7 +1298,7 @@ export function conflictingEntryIds(profileDirectory, candidate, installedBundle
  * @param profileDirectory - resolved profile directory (host-authoritative under Desktop).
  * @param name - installed package name.
  */
-export function hasLoadableEntry(profileDirectory, name) {
+export function hasLoadableEntry(profileDirectory, name, hostDirectory) {
     const dir = join(profileDirectory, 'node_modules', name);
     if (entryArtifactExists(dir))
         return true;
@@ -1310,11 +1312,41 @@ export function hasLoadableEntry(profileDirectory, name) {
     // exiting 0 was immediately followed by the market removing what it had
     // just, correctly, installed.
     const workspaceRoot = dirname(profileDirectory);
-    return bundlePatchTargets(dir)
-        .filter(target => target !== name)
-        .some(target => entryArtifactExists(join(profileDirectory, 'node_modules', target))
+    const targets = bundlePatchTargets(dir).filter(target => target !== name);
+    if (targets.some(target => entryArtifactExists(join(profileDirectory, 'node_modules', target))
         || entryArtifactExists(join(dir, 'node_modules', target))
-        || entryArtifactExists(join(workspaceRoot, 'node_modules', target)));
+        || entryArtifactExists(join(workspaceRoot, 'node_modules', target))))
+        return true;
+    // #906: the host's OWN packages live in its install tree, not in any
+    // profile node_modules — `<install>/dsh/node_modules/...`, often inside
+    // app.asar. A carrier whose patch mounts nothing but in-box packages
+    // (@deepseek-ai/dsh-mcp-client and the like) therefore failed every root
+    // above, was reported "broken", and — through validateAddedPlugins — was
+    // uninstalled right after a successful install. `undefined` resolves the
+    // install dir lazily (only carriers pay for it); `null` means "do not look".
+    //
+    // Inside app.asar the probe is blind for EVERY @deepseek-ai/ name (the
+    // same measurement behind #676), so there identity decides instead of the
+    // filesystem — the host publishes that scope, and our own composer loads
+    // those packages from the archive at boot.
+    const host = hostDirectory === undefined ? findDshInstallDir() : hostDirectory;
+    if (host === null || targets.length === 0)
+        return false;
+    const packaged = /[/\\]app\.asar[/\\]/iu.test(host);
+    return targets.some(target => packaged && target.startsWith('@deepseek-ai/')
+        || packageResolvableFrom(join(host, 'package.json'), target));
+}
+/** Whether `target` resolves from the host's own dependency tree. */
+function packageResolvableFrom(anchorPackageJson, target) {
+    try {
+        const paths = createRequire(anchorPackageJson).resolve.paths(target) ?? [];
+        return paths.some(searchPath => existsSync(join(searchPath, target, 'package.json')));
+    }
+    catch {
+        // An unreadable anchor says nothing about the target: treat as absent
+        // rather than loadable, so the caller keeps its conservative answer.
+        return false;
+    }
 }
 /** Plugin subdirectories (depth 2) of a collection checkout, as relative paths. */
 export function pluginSubdirs(root) {

package/lib/types/changelog.d.ts

@@ -63,6 +63,15 @@ export declare function sliceCommitsAt(items: CommitNote[], installed: string |
     items: CommitNote[];
     found: boolean;
 };
+/**
+ * The version a release tag names, when it names one.
+ *
+ * Tags come as `v1.2.3`, `1.2.3`, `@scope/pkg@1.2.3` or `pkg-v1.2.3`; the
+ * FIRST semver-shaped run is the version in all of them. A tag that names no
+ * version (`nightly`) returns null, and callers must treat "unknown" as "do
+ * not judge" rather than "older".
+ */
+export declare function releaseVersionOf(tag: string | null): string | null;
 /** The repo url key an entry's update notes live under, or null. */
 export declare function repoKeyOf(spec: string): string | null;
 /**

package/lib/types/profile.d.ts

@@ -412,7 +412,7 @@ export declare function conflictingEntryIds(profileDirectory: string, candidate:
  * @param profileDirectory - resolved profile directory (host-authoritative under Desktop).
  * @param name - installed package name.
  */
-export declare function hasLoadableEntry(profileDirectory: string, name: string): boolean;
+export declare function hasLoadableEntry(profileDirectory: string, name: string, hostDirectory?: string | null): boolean;
 /** Plugin subdirectories (depth 2) of a collection checkout, as relative paths. */
 export declare function pluginSubdirs(root: string): string[];
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.41",
+  "version": "1.66.42",
   "icon": "assets/logo.svg",
   "type": "module",
   "main": "lib/index.js",

package/src/changelog.ts

@@ -24,9 +24,9 @@
 import { fileFromTarball } from './catalog-npm.ts'
 import { marketFetch } from './net.ts'
 import { activeRegion, routesFor } from './regions.ts'
-import { profileDir, readGitResolutionCommit, readInstalled, readInstalledRepoEvidence, readLockCommits } from './profile.ts'
+import { profileDir, readGitResolutionCommit, readInstalled, readInstalledRepoEvidence, readInstalledVersion, readLockCommits } from './profile.ts'
 import { githubRepoOfRemote, hostedRepoKey, isGitHostedSpec, lookupRepoFromUrl, parseHostShorthand, parseSourceUrl, repoOf, repoOfTarget } from './sources.ts'
-import { checkUpdates } from './updates.ts'
+import { checkUpdates, compareVersions } from './updates.ts'
 import { loadRegistry, type RegistryPlugin } from './registry.ts'
 
 const UPDATES_PACKAGE = 'dsh-plugin-updates'
@@ -141,6 +141,20 @@ export function sliceCommitsAt(items: CommitNote[], installed: string | null): {
   return { items: out, found: false }
 }
 
+/**
+ * The version a release tag names, when it names one.
+ *
+ * Tags come as `v1.2.3`, `1.2.3`, `@scope/pkg@1.2.3` or `pkg-v1.2.3`; the
+ * FIRST semver-shaped run is the version in all of them. A tag that names no
+ * version (`nightly`) returns null, and callers must treat "unknown" as "do
+ * not judge" rather than "older".
+ */
+export function releaseVersionOf(tag: string | null): string | null {
+  if (tag === null) return null
+  const match = /(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/.exec(tag)
+  return match?.[1] ?? null
+}
+
 /** The repo url key an entry's update notes live under, or null. */
 export function repoKeyOf(spec: string): string | null {
   const repo = githubIdentityOf(spec)?.split('#')[0] ?? null
@@ -450,7 +464,23 @@ export async function updateNotesFor(
     }
 
     if (entry?.release !== undefined && entry.release !== null && (entry.release.body !== '' || entry.release.tag !== null)) {
-      return { kind: 'release', release: entry.release }
+      // The release feed is a DAILY snapshot while the update target is read
+      // live from npm, so the snapshot's newest release is often the version
+      // already installed (or older). Showing it next to "1.66.39 → 1.66.40"
+      // describes a change the user already has (#925). When the release
+      // names a version no newer than the installed one AND a better tier
+      // exists, take the better tier: the commit tail is sliced at this
+      // install's sha, and npm publish times are newer than the install by
+      // construction. With nothing better, the stale release still beats an
+      // empty dialog.
+      const installed = readInstalledVersion(profile, name, activeProfileDir)
+      const released = releaseVersionOf(entry.release.tag)
+      const behind = installed !== null && released !== null
+        && (compareVersions(released, installed) ?? 0) <= 0
+      const hasCommits = (entry.commits?.length ?? 0) > 0
+      if (!(behind && (hasCommits || (specKey === null && npmName !== null)))) {
+        return { kind: 'release', release: entry.release }
+      }
     }
     if (entry?.commits !== undefined && entry.commits.length > 0) {
       return { kind: 'commits', commits: sliceCommitsAt(entry.commits, current) }

package/src/install.ts

@@ -659,7 +659,10 @@ export async function validateAddedPlugins(
     const packageDir = join(dir, 'node_modules', n)
     // hasLoadableEntry, not entryArtifactExists: carrier bundles legitimately
     // ship no entry of their own (#103) and must not be uninstalled here.
-    if (!hasDshManifest(packageDir) || !hasLoadableEntry(dir, n)) {
+    // The host install tree is passed too (#906): a carrier mounting only
+    // in-box packages resolves nowhere under the profile, and judging it by
+    // that alone deleted a package the host had just installed correctly.
+    if (!hasDshManifest(packageDir) || !hasLoadableEntry(dir, n, hostDirectory ?? findDshInstallDir())) {
       removedBroken.push(n)
       await removeAndReconcile(run, profile, dir, n, hostDirectory)
       continue

package/src/profile.ts

@@ -5,9 +5,11 @@
  */
 
 import { existsSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
 import { isDeepStrictEqual } from 'node:util'
 import { JSON_SCHEMA, load } from 'js-yaml'
+import { findDshInstallDir } from './dsh-install.ts'
 import { resolveDshHome } from './home-paths.ts'
 import { githubRemoteIdentities, githubRepoIdentities, hostedRepoKey, isGenerationLink, isGitHostedSpec, repoOfTarget } from './sources.ts'
 
@@ -1340,7 +1342,7 @@ export function conflictingEntryIds(
  * @param profileDirectory - resolved profile directory (host-authoritative under Desktop).
  * @param name - installed package name.
  */
-export function hasLoadableEntry(profileDirectory: string, name: string): boolean {
+export function hasLoadableEntry(profileDirectory: string, name: string, hostDirectory?: string | null): boolean {
   const dir = join(profileDirectory, 'node_modules', name)
   if (entryArtifactExists(dir)) return true
   // A carrier is only sound when something it mounts is itself loadable.
@@ -1353,11 +1355,39 @@ export function hasLoadableEntry(profileDirectory: string, name: string): boolea
   // exiting 0 was immediately followed by the market removing what it had
   // just, correctly, installed.
   const workspaceRoot = dirname(profileDirectory)
-  return bundlePatchTargets(dir)
-    .filter(target => target !== name)
-    .some(target => entryArtifactExists(join(profileDirectory, 'node_modules', target))
-      || entryArtifactExists(join(dir, 'node_modules', target))
-      || entryArtifactExists(join(workspaceRoot, 'node_modules', target)))
+  const targets = bundlePatchTargets(dir).filter(target => target !== name)
+  if (targets.some(target => entryArtifactExists(join(profileDirectory, 'node_modules', target))
+    || entryArtifactExists(join(dir, 'node_modules', target))
+    || entryArtifactExists(join(workspaceRoot, 'node_modules', target)))) return true
+  // #906: the host's OWN packages live in its install tree, not in any
+  // profile node_modules — `<install>/dsh/node_modules/...`, often inside
+  // app.asar. A carrier whose patch mounts nothing but in-box packages
+  // (@deepseek-ai/dsh-mcp-client and the like) therefore failed every root
+  // above, was reported "broken", and — through validateAddedPlugins — was
+  // uninstalled right after a successful install. `undefined` resolves the
+  // install dir lazily (only carriers pay for it); `null` means "do not look".
+  //
+  // Inside app.asar the probe is blind for EVERY @deepseek-ai/ name (the
+  // same measurement behind #676), so there identity decides instead of the
+  // filesystem — the host publishes that scope, and our own composer loads
+  // those packages from the archive at boot.
+  const host = hostDirectory === undefined ? findDshInstallDir() : hostDirectory
+  if (host === null || targets.length === 0) return false
+  const packaged = /[/\\]app\.asar[/\\]/iu.test(host)
+  return targets.some(target => packaged && target.startsWith('@deepseek-ai/')
+    || packageResolvableFrom(join(host, 'package.json'), target))
+}
+
+/** Whether `target` resolves from the host's own dependency tree. */
+function packageResolvableFrom(anchorPackageJson: string, target: string): boolean {
+  try {
+    const paths = createRequire(anchorPackageJson).resolve.paths(target) ?? []
+    return paths.some(searchPath => existsSync(join(searchPath, target, 'package.json')))
+  } catch {
+    // An unreadable anchor says nothing about the target: treat as absent
+    // rather than loadable, so the caller keeps its conservative answer.
+    return false
+  }
 }
 
 /** Plugin subdirectories (depth 2) of a collection checkout, as relative paths. */