dshmarket 1.66.41 → 1.66.43

package/lib/changelog.js

@@ -23,9 +23,9 @@
 import { fileFromTarball } from './catalog-npm.js';
 import { marketFetch } from './net.js';
 import { activeRegion, routesFor } from './regions.js';
-import { profileDir, readGitResolutionCommit, readInstalled, readInstalledRepoEvidence, readLockCommits } from './profile.js';
+import { profileDir, readGitResolutionCommit, readInstalled, readInstalledRepoEvidence, readInstalledVersion, readLockCommits } from './profile.js';
 import { githubRepoOfRemote, hostedRepoKey, isGitHostedSpec, lookupRepoFromUrl, parseHostShorthand, parseSourceUrl, repoOf, repoOfTarget } from './sources.js';
-import { checkUpdates } from './updates.js';
+import { checkUpdates, compareVersions } from './updates.js';
 import { loadRegistry } from './registry.js';
 const UPDATES_PACKAGE = 'dsh-plugin-updates';
 const UPDATES_FILE = 'package/updates.json';
@@ -118,6 +118,20 @@ export function sliceCommitsAt(items, installed) {
     }
     return { items: out, found: false };
 }
+/**
+ * The version a release tag names, when it names one.
+ *
+ * Tags come as `v1.2.3`, `1.2.3`, `@scope/pkg@1.2.3` or `pkg-v1.2.3`; the
+ * FIRST semver-shaped run is the version in all of them. A tag that names no
+ * version (`nightly`) returns null, and callers must treat "unknown" as "do
+ * not judge" rather than "older".
+ */
+export function releaseVersionOf(tag) {
+    if (tag === null)
+        return null;
+    const match = /(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/.exec(tag);
+    return match?.[1] ?? null;
+}
 /** The repo url key an entry's update notes live under, or null. */
 export function repoKeyOf(spec) {
     const repo = githubIdentityOf(spec)?.split('#')[0] ?? null;
@@ -407,7 +421,23 @@ export async function updateNotesFor(profile, explicitDir, name) {
             current = statuses?.[name]?.current ?? null;
         }
         if (entry?.release !== undefined && entry.release !== null && (entry.release.body !== '' || entry.release.tag !== null)) {
-            return { kind: 'release', release: entry.release };
+            // The release feed is a DAILY snapshot while the update target is read
+            // live from npm, so the snapshot's newest release is often the version
+            // already installed (or older). Showing it next to "1.66.39 → 1.66.40"
+            // describes a change the user already has (#925). When the release
+            // names a version no newer than the installed one AND a better tier
+            // exists, take the better tier: the commit tail is sliced at this
+            // install's sha, and npm publish times are newer than the install by
+            // construction. With nothing better, the stale release still beats an
+            // empty dialog.
+            const installed = readInstalledVersion(profile, name, activeProfileDir);
+            const released = releaseVersionOf(entry.release.tag);
+            const behind = installed !== null && released !== null
+                && (compareVersions(released, installed) ?? 0) <= 0;
+            const hasCommits = (entry.commits?.length ?? 0) > 0;
+            if (!(behind && (hasCommits || (specKey === null && npmName !== null)))) {
+                return { kind: 'release', release: entry.release };
+            }
         }
         if (entry?.commits !== undefined && entry.commits.length > 0) {
             return { kind: 'commits', commits: sliceCommitsAt(entry.commits, current) };

package/lib/install.js

@@ -248,6 +248,15 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             logEvent('warn', 'install', `transient network failure while pnpm replayed the dependency tree (#83) — retrying once`);
             result = await run(profile, pluginArgs);
         }
+        else if (failure?.code === 'exact-version-missing'
+            && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove' || pluginArgs[0] === 'update')) {
+            // #927: market pinned name@x.y.z from /latest, but this registry's
+            // packument (often a mirror) does not list that version yet. Same argv
+            // once more gives pnpm a chance to re-fetch; if it still fails the
+            // classifier's message names "try later / switch Download region".
+            logEvent('warn', 'install', `exact version missing on this registry's packument (#927) — retrying once to re-fetch`);
+            result = await run(profile, pluginArgs);
+        }
         else if (failure?.code === 'fetch-timeout'
             && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
             && !pluginArgs.includes(FETCH_TIMEOUT_OVERRIDE)) {
@@ -662,7 +671,10 @@ export async function validateAddedPlugins(run, profile, before, explicitDir, ho
         const packageDir = join(dir, 'node_modules', n);
         // hasLoadableEntry, not entryArtifactExists: carrier bundles legitimately
         // ship no entry of their own (#103) and must not be uninstalled here.
-        if (!hasDshManifest(packageDir) || !hasLoadableEntry(dir, n)) {
+        // The host install tree is passed too (#906): a carrier mounting only
+        // in-box packages resolves nowhere under the profile, and judging it by
+        // that alone deleted a package the host had just installed correctly.
+        if (!hasDshManifest(packageDir) || !hasLoadableEntry(dir, n, hostDirectory ?? findDshInstallDir())) {
             removedBroken.push(n);
             await removeAndReconcile(run, profile, dir, n, hostDirectory);
             continue;

package/lib/log-redaction.js

@@ -0,0 +1,24 @@
+import { homedir } from 'node:os';
+/** Mask only this user's home prefix, leaving the rest of each path intact. */
+export function redactHomePaths(text) {
+    const directory = homedir();
+    // Detect the home path's syntax rather than the host running the exporter.
+    // Windows is case-insensitive and accepts either separator, including mixed
+    // paths from pnpm. Repeated separators also cover JSON-escaped NDJSON history.
+    const windows = /^(?:[a-z]:[\\/]|[\\/]{2})/i.test(directory);
+    const home = directory.replace(windows ? /[\\/]+$/ : /\/+$/, '');
+    // A POSIX root home must not turn every absolute path into a home path.
+    if (home === '')
+        return text;
+    const escape = (part) => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const path = windows ? home.split(/[\\/]/).map(escape).join('[\\\\/]+') : escape(home);
+    // Do not match a home embedded in another path/text, or a sibling such as
+    // Alice-other or Alice.backup. File URLs still contain an absolute home;
+    // quotes/brackets allow bare homes in log prose.
+    const before = String.raw `(?:(?<![\p{L}\p{N}_./\\-])|(?<=\bfile://)|(?<=\bfile:///))`;
+    // Trimming C:\ leaves C:, but only an absolute path belongs to that root.
+    const after = windows && /^[a-z]:$/i.test(home)
+        ? String.raw `(?=[\\/])`
+        : windows ? String.raw `(?=$|[\\/\s"'\x60<>()[\]{},;:!?])` : String.raw `(?=$|[/\s"'\x60<>()[\]{},;:!?])`;
+    return text.replace(new RegExp(before + path + after, windows ? 'giu' : 'gu'), '~');
+}

package/lib/log.js

@@ -13,7 +13,7 @@
  */
 import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
-import { homedir } from 'node:os';
+import { redactHomePaths } from './log-redaction.js';
 const MAX_ENTRIES = 200;
 const DETAIL_MAX = 600;
 const PERSISTENT_MAX_BYTES = 256 * 1024;
@@ -22,8 +22,7 @@ let persistentFile = null;
 /** Bytes in the sink file, tracked so the cap holds without a stat per event. */
 let persistentBytes = 0;
 function sanitize(text) {
-    return text
-        .replaceAll(homedir(), '~')
+    return redactHomePaths(text)
         // Log-injection guard: control characters (newlines above all) would
         // forge extra lines in the exported log file. The #98 routes pass
         // user-supplied names into logEvent (bundle-order order entries, trial

package/lib/patch.js

@@ -115,6 +115,16 @@ export function findUserPatchPath(host, profileDir) {
 }
 /** Row ids the market is allowed to write: plain unquoted YAML scalars. */
 const ROW_ID_RE = /^[A-Za-z0-9_.-]+$/u;
+function nextPatchContentLine(lines, from) {
+    let index = from;
+    while (index < lines.length) {
+        const line = (lines[index] ?? '').trim();
+        if (line !== '' && !line.startsWith('#'))
+            break;
+        index += 1;
+    }
+    return index;
+}
 /**
  * Line-wise scan of one patch file — the plugin-hub shapes. Deliberately
  * not a YAML parse: the file may hold structures the market's dialect
@@ -146,14 +156,15 @@ export function readUserPatchState(patchPath) {
                 inserts.push(insertRow[1]);
             continue;
         }
-        const disableRow = /^- id: ([A-Za-z0-9_.-]+)\s*$/u.exec(line);
+        const disableRow = /^- id: (?:([A-Za-z0-9_.-]+)|'([A-Za-z0-9_.-]+)'|"([A-Za-z0-9_.-]+)")[ \t]*$/u.exec(line);
         if (disableRow === null)
             continue;
-        const next = lines[index + 1] ?? '';
+        const id = (disableRow[1] ?? disableRow[2] ?? disableRow[3]);
+        const next = lines[nextPatchContentLine(lines, index + 1)] ?? '';
         if (/^ {2}disabled: true\s*$/u.test(next))
-            disables.push(disableRow[1]);
+            disables.push(id);
         else if (/^ {2}disabled: false\s*$/u.test(next))
-            forced.push(disableRow[1]);
+            forced.push(id);
     }
     return { disables, forced, inserts };
 }
@@ -429,16 +440,35 @@ function rowBlock(rowId, disabled) {
     return `- id: ${rowId}\n  disabled: ${disabled ? 'true' : 'false'}\n`;
 }
 /**
- * Every two-line `- id: X` + `disabled: …` block for one row, in file order
- * (#821). A row that goes on with more keys (`config:` and the like) is not
- * one of these blocks: cutting its first two lines would leave the rest
- * hanging off the entry above it. The last block of a file may lack its
- * newline.
+ * Rewrite standalone id/flag rows while preserving the surrounding file.
+ * Comments and blank lines may separate the fields (#930). Look beyond them
+ * after the flag too: an indented config/name/key makes this a longer entry,
+ * whose first lines must never be removed (#821). Trailing comments stay put.
  */
-function rowBlocksRe(rowId, disabled) {
+function rewriteRowBlocks(text, rowId, disabled, replace) {
     const id = escapeRegExp(rowId);
-    const value = disabled === 'any' ? '(?:true|false)' : disabled;
-    return new RegExp(`^- id: (?:${id}|'${id}'|"${id}")[ \\t]*\\r?\\n  disabled: ${value}[ \\t]*(?:\\r?\\n(?![ \\t])|(?![\\s\\S]))`, 'gmu');
+    const idLine = new RegExp(`^- id: (?:${id}|'${id}'|"${id}")[ \t]*$`, 'u');
+    const lines = text.match(/[^\n]*(?:\n|$)/gu)?.filter(Boolean) ?? [];
+    const offsets = [0];
+    for (const line of lines)
+        offsets.push(offsets[offsets.length - 1] + line.length);
+    let result = '', copied = 0;
+    for (let index = 0; index < lines.length; index += 1) {
+        if (!idLine.test(lines[index].replace(/\r?\n$/u, '')))
+            continue;
+        const flagIndex = nextPatchContentLine(lines, index + 1);
+        const flag = /^ {2}disabled: (true|false)[ \t]*(?:\r?\n)?$/u.exec(lines[flagIndex] ?? '');
+        if (flag === null || (disabled !== 'any' && flag[1] !== disabled))
+            continue;
+        const following = nextPatchContentLine(lines, flagIndex + 1);
+        if (/^[ \t]/u.test(lines[following] ?? ''))
+            continue;
+        const start = offsets[index], end = offsets[flagIndex + 1];
+        result += text.slice(copied, start) + replace(text.slice(start, end));
+        copied = end;
+        index = flagIndex;
+    }
+    return result + text.slice(copied);
 }
 /**
  * What the patch file finally says about one row: the flag of its last
@@ -453,7 +483,7 @@ function lastRowFlag(text, rowId) {
     for (let index = 0; index < lines.length; index += 1) {
         if (!idLine.test(lines[index] ?? ''))
             continue;
-        const value = /^ {2}disabled: (true|false)\s*$/u.exec(lines[index + 1] ?? '');
+        const value = /^ {2}disabled: (true|false)\s*$/u.exec(lines[nextPatchContentLine(lines, index + 1)] ?? '');
         if (value !== null)
             flag = value[1];
     }
@@ -561,16 +591,14 @@ export function disableRow(patchPath, rowId) {
                 return '';
             }
         })();
-        const blocks = text.match(rowBlocksRe(rowId, 'any')) ?? [];
-        if (blocks.length > 1 || blocks.some(block => /disabled: false/u.test(block))) {
-            let kept = false;
-            const next = text.replace(rowBlocksRe(rowId, 'any'), block => {
-                if (kept)
-                    return '';
-                kept = true;
-                const flipped = rowBlock(rowId, true);
-                return block.includes('\r\n') ? flipped.replace(/\n/gu, '\r\n') : flipped;
-            });
+        let kept = false;
+        const next = rewriteRowBlocks(text, rowId, 'any', block => {
+            if (kept)
+                return '';
+            kept = true;
+            return block.replace(/^ {2}disabled: false(?=[ \t]*(?:\r?\n|$))/mu, '  disabled: true');
+        });
+        if (next !== text) {
             const flipped = writePatchFile(patchPath, next);
             if (!flipped.ok)
                 return flipped;
@@ -608,7 +636,7 @@ export function enableRow(patchPath, rowId) {
                 return '';
             }
         })();
-        const next = text.replace(rowBlocksRe(rowId, 'true'), '');
+        const next = rewriteRowBlocks(text, rowId, 'true', () => '');
         if (next !== text) {
             const written = writePatchFile(patchPath, withPlaceholderRestored(next));
             if (!written.ok)
@@ -654,7 +682,7 @@ export function removeRowBlocks(patchPath, rowIds) {
     } // no file, nothing to remove
     let next = text;
     for (const rowId of rowIds)
-        next = next.replace(rowBlocksRe(rowId, 'any'), '');
+        next = rewriteRowBlocks(next, rowId, 'any', () => '');
     if (next === text)
         return { ok: true, reason: null };
     const written = writePatchFile(patchPath, withPlaceholderRestored(next));

package/lib/pnpm-compat.js

@@ -15,6 +15,7 @@
  */
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { CHINA_NPM_REGISTRY } from './regions.js';
 /**
  * Decide the argv for a `dsh plugin <add|remove> …` call in the given profile.
  *
@@ -49,6 +50,20 @@ export const HOST_NAMESPACE_RE = /^@deepseek-ai\//;
 export function isTransientPnpmFailure(output) {
     return /ERR_PNPM_FETCH_5\d\d|ERR_PNPM_META_FETCH_FAIL|FetchError|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENETUNREACH|socket hang up|network timeout/i.test(output);
 }
+/**
+ * China download route reset a package tarball mid-download (#926).
+ *
+ * Same-argv retry (#83) hits the same host again, so the generic "try again
+ * shortly" advice is wrong. Matched on ONE line: the China npm registry
+ * tarball URL and the reset must appear together — a China-mirror `.tgz`
+ * mention plus an unrelated `ECONNRESET` elsewhere (e.g. codeload) must not
+ * push the user to switch Download region.
+ */
+function isChinaMirrorTarballReset(output) {
+    const hostPath = CHINA_NPM_REGISTRY.replace(/^https?:\/\//i, '');
+    const escaped = hostPath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`${escaped}/\\S+/-/\\S+\\.tgz[^\\n]*(?:ECONNRESET|socket hang up)`, 'i').test(output);
+}
 /**
  * The package a tarball URL belongs to: `…/@types/retry/-/retry-0.12.0.tgz`
  * → `@types/retry`, `…/lodash/-/lodash-4.17.21.tgz` → `lodash`. Scoped names
@@ -540,19 +555,49 @@ export function classifyPnpmFailure(output, exitCode) {
     // error code, so the classifier names it separately and the #289 retry
     // shares it via install.ts's gate. Real output (pnpm 12.4.1): see
     // tests/pnpm-compat.spec.ts, which pins this wording.
+    //
+    // #927: when the request is an EXACT version (name@1.2.3) that this
+    // registry cannot see yet — often a mirror whose `/latest` moved ahead of
+    // its packument — the generic "withdrawn or never published" sentence is
+    // wrong. That shape gets its own code so withHoistRecovery can retry the
+    // same argv once (re-fetch packument) and the UI can say "not synced yet".
     if (output.includes('ERR_PNPM_NO_MATCHING_VERSION')) {
-        const pkg = /No matching version found for\s+((?:@[^/\s]+\/)?[^@\s]+)@/.exec(output)?.[1]
+        const asked = /No matching version found for\s+((?:@[^/\s]+\/)?[^@\s]+)@([^\s]+)/.exec(output);
+        const pkg = asked?.[1]
             ?? /GET\s+\S*\/([^/\s]+):/.exec(output)?.[1].replace(/%2[Ff]/g, '/');
+        const requested = asked?.[2];
         const zh = pkg === undefined ? '' : `（${pkg}）`;
         const en = pkg === undefined ? '' : ` (${pkg})`;
         const hostPeer = pkg !== undefined && HOST_NAMESPACE_RE.test(pkg);
+        if (hostPeer) {
+            return {
+                code: 'no-matching-version',
+                recoverable: false,
+                pkg,
+                message: `插件声明依赖的宿主包${zh}在 registry 上没有满足其版本范围的发布版（宿主运行时会自带它，npm 上不会出现这个版本）。市场会自动重试一次，放行这条 peer 依赖 / a plugin's declared host peer${en} has no published version satisfying its range — the runtime provides it, so npm carries no such version. The market retries once with that peer exempted from auto-install`,
+            };
+        }
+        const exact = requested !== undefined
+            && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(requested);
+        if (exact) {
+            const pin = pkg === undefined ? requested : `${pkg}@${requested}`;
+            const latest = pkg === undefined
+                ? undefined
+                : new RegExp(`The latest release of\\s+${pkg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s+is\\s+"([^"]+)"`, 'i').exec(output)?.[1];
+            const latestZh = latest === undefined ? '' : `（它目前看到的最新是 ${latest}）`;
+            const latestEn = latest === undefined ? '' : ` (it currently reports latest as ${latest})`;
+            return {
+                code: 'exact-version-missing',
+                recoverable: false,
+                ...(pkg === undefined ? {} : { pkg }),
+                message: `当前下载线路暂时找不到精确版本 ${pin}${latestZh}。常见原因是线路还没同步到刚发布的版本，不等于这个版本不存在。已自动重试一次仍失败——请稍后再试；若下载区域是中国大陆，也可改成「全球」后再试 / this download route cannot see the exact version ${pin} yet${latestEn}. Often the route has not synced a just-published release — that does not mean the version is missing from npm. One automatic retry failed too — try again shortly; if Download region is China mainland, you can also switch it to Global and retry`,
+            };
+        }
         return {
             code: 'no-matching-version',
             recoverable: false,
-            pkg,
-            message: hostPeer
-                ? `插件声明依赖的宿主包${zh}在 registry 上没有满足其版本范围的发布版（宿主运行时会自带它，npm 上不会出现这个版本）。市场会自动重试一次，放行这条 peer 依赖 / a plugin's declared host peer${en} has no published version satisfying its range — the runtime provides it, so npm carries no such version. The market retries once with that peer exempted from auto-install`
-                : `插件声明的一个依赖版本范围在 registry 上没有可满足的版本${zh}，通常是该版本被弃用或从未发布 / a dependency of this plugin declared a version range with no matching release on the registry${en} — the range resolves to nothing (withdrawn or never published)`,
+            ...(pkg === undefined ? {} : { pkg }),
+            message: `插件声明的一个依赖版本范围在 registry 上没有可满足的版本${zh}，通常是该版本被弃用或从未发布 / a dependency of this plugin declared a version range with no matching release on the registry${en} — the range resolves to nothing (withdrawn or never published)`,
         };
     }
     // #808 by @Tofu707: the profile's own pnpm-lock.yaml is what is wrong, in
@@ -706,6 +751,16 @@ export function classifyPnpmFailure(output, exitCode) {
     // a plain retry to succeed seconds later. withHoistRecovery retries once;
     // this message covers the case where the retry lost too.
     if (isTransientPnpmFailure(output)) {
+        // Keep code `transient-network` so withHoistRecovery still does the #83
+        // same-argv retry; only the final message changes when that retry lost
+        // against the China mirror's tarball host (#926).
+        if (isChinaMirrorTarballReset(output)) {
+            return {
+                code: 'transient-network',
+                recoverable: false,
+                message: '中国大陆下载线路在拉这个安装包时被断开了。再走同一条线路通常没用。打开设置，把「下载区域」改成「全球」，然后再装一次 / the China mainland download route was interrupted while fetching this package. Trying the same route again usually will not help. Open Settings, switch Download region to Global, and install again',
+            };
+        }
         return {
             code: 'transient-network',
             recoverable: false,

package/lib/profile.js

@@ -4,9 +4,11 @@
  * functions of the directory contents; no processes, no network.
  */
 import { existsSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { JSON_SCHEMA, load } from 'js-yaml';
+import { findDshInstallDir } from './dsh-install.js';
 import { resolveDshHome } from './home-paths.js';
 import { githubRemoteIdentities, githubRepoIdentities, hostedRepoKey, isGenerationLink, isGitHostedSpec, repoOfTarget } from './sources.js';
 /**
@@ -1296,7 +1298,7 @@ export function conflictingEntryIds(profileDirectory, candidate, installedBundle
  * @param profileDirectory - resolved profile directory (host-authoritative under Desktop).
  * @param name - installed package name.
  */
-export function hasLoadableEntry(profileDirectory, name) {
+export function hasLoadableEntry(profileDirectory, name, hostDirectory) {
     const dir = join(profileDirectory, 'node_modules', name);
     if (entryArtifactExists(dir))
         return true;
@@ -1310,11 +1312,41 @@ export function hasLoadableEntry(profileDirectory, name) {
     // exiting 0 was immediately followed by the market removing what it had
     // just, correctly, installed.
     const workspaceRoot = dirname(profileDirectory);
-    return bundlePatchTargets(dir)
-        .filter(target => target !== name)
-        .some(target => entryArtifactExists(join(profileDirectory, 'node_modules', target))
+    const targets = bundlePatchTargets(dir).filter(target => target !== name);
+    if (targets.some(target => entryArtifactExists(join(profileDirectory, 'node_modules', target))
         || entryArtifactExists(join(dir, 'node_modules', target))
-        || entryArtifactExists(join(workspaceRoot, 'node_modules', target)));
+        || entryArtifactExists(join(workspaceRoot, 'node_modules', target))))
+        return true;
+    // #906: the host's OWN packages live in its install tree, not in any
+    // profile node_modules — `<install>/dsh/node_modules/...`, often inside
+    // app.asar. A carrier whose patch mounts nothing but in-box packages
+    // (@deepseek-ai/dsh-mcp-client and the like) therefore failed every root
+    // above, was reported "broken", and — through validateAddedPlugins — was
+    // uninstalled right after a successful install. `undefined` resolves the
+    // install dir lazily (only carriers pay for it); `null` means "do not look".
+    //
+    // Inside app.asar the probe is blind for EVERY @deepseek-ai/ name (the
+    // same measurement behind #676), so there identity decides instead of the
+    // filesystem — the host publishes that scope, and our own composer loads
+    // those packages from the archive at boot.
+    const host = hostDirectory === undefined ? findDshInstallDir() : hostDirectory;
+    if (host === null || targets.length === 0)
+        return false;
+    const packaged = /[/\\]app\.asar[/\\]/iu.test(host);
+    return targets.some(target => packaged && target.startsWith('@deepseek-ai/')
+        || packageResolvableFrom(join(host, 'package.json'), target));
+}
+/** Whether `target` resolves from the host's own dependency tree. */
+function packageResolvableFrom(anchorPackageJson, target) {
+    try {
+        const paths = createRequire(anchorPackageJson).resolve.paths(target) ?? [];
+        return paths.some(searchPath => existsSync(join(searchPath, target, 'package.json')));
+    }
+    catch {
+        // An unreadable anchor says nothing about the target: treat as absent
+        // rather than loadable, so the caller keeps its conservative answer.
+        return false;
+    }
 }
 /** Plugin subdirectories (depth 2) of a collection checkout, as relative paths. */
 export function pluginSubdirs(root) {

package/lib/recovery.js

@@ -32,10 +32,10 @@ import { spawn } from 'node:child_process';
 import { appendFileSync, openSync, readFileSync } from 'node:fs';
 import { createServer } from 'node:http';
 import { connect } from 'node:net';
-import { homedir } from 'node:os';
 import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { readJsonBody, sameOrigin, sendJson } from './http.js';
+import { redactHomePaths } from './log-redaction.js';
 import { disableRow, enableRow } from './patch.js';
 import { addProfileBundle, removeProfileBundle } from './profile.js';
 /** How long the replacement gets to bind the port before it is a failure. */
@@ -464,8 +464,7 @@ async function waitForPortFree(port, timeoutMs) {
  * one unreadable line, which is the opposite of what the export is for.
  */
 function redactLog(text) {
-    return text
-        .replaceAll(homedir(), '~')
+    return redactHomePaths(text)
         .replace(/sk-[A-Za-z0-9_-]{8,}/g, 'sk-***')
         .replace(/gh[pousr]_[A-Za-z0-9]{16,}/g, 'gh*_***')
         .replace(/npm_[A-Za-z0-9]{16,}/g, 'npm_***')

package/lib/regions.js

@@ -32,7 +32,14 @@ export function asRegion(value) {
  * pnpm's registry alone and setting it.
  */
 export const DEFAULT_NPM_REGISTRY = 'https://registry.npmjs.org';
-const NPM_CHINA = 'https://mirrors.cloud.tencent.com/npm';
+/**
+ * Default npm registry for the China download region, no trailing slash.
+ *
+ * Exported so failure classifiers can recognize this host in pnpm's output
+ * (#926) without duplicating the URL.
+ */
+export const CHINA_NPM_REGISTRY = 'https://mirrors.cloud.tencent.com/npm';
+const NPM_CHINA = CHINA_NPM_REGISTRY;
 /**
  * First public prefix used for unauthenticated GitHub reads, no trailing slash.
  * Authenticated API calls and canonical codeload tarballs never use it.

package/lib/routes.js

@@ -4939,6 +4939,20 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         if (droppedBundles.length > 0) {
                             logEvent('warn', 'update-bundles-dropped', `${name}: after this update ${droppedBundles.join(', ')} ${droppedBundles.length === 1 ? 'is' : 'are'} still declared in dependencies but no longer in dsh.profile.bundles, so ${droppedBundles.length === 1 ? 'it' : 'they'} will not load — the market did not write that change (#720)`);
                         }
+                        // #935: the desktop manager's removeBundle writes the bundle row
+                        // out FIRST and only then checks whether a live fiber still uses
+                        // the package — so a `bundle-in-use` refusal leaves the row gone
+                        // while dependencies and node_modules stay. The plugin keeps
+                        // running this session and silently fails to load next boot.
+                        // Restore the row, scoped to exactly that refusal and to this
+                        // operation's own target: the read-only stance in #720/#696
+                        // still holds for every other way a row can disappear.
+                        if (!ok && !cancelled && result.refusalCode === 'bundle-in-use') {
+                            const targetRowDropped = bundlesDroppedFromProfile(manifestBefore, config.profile, activeProfileDir, new Set(removedDeclaration === null ? [] : [removedDeclaration.name])).includes(name);
+                            if (targetRowDropped && addProfileBundle(activeProfileDir, name)) {
+                                logEvent('warn', 'update-bundles-restored', `${name}: the desktop app removed its bundle row before refusing the update (bundle-in-use) — restored it so the plugin still loads on the next boot (#935)`);
+                            }
+                        }
                         logEvent(ok || cancelled ? 'info' : 'error', 'update', `${name} -> ${target} exit=${String(result.exitCode)}${result.timedOut ? ' TIMEOUT' : ''}${cancelled ? ' CANCELLED' : ''}${stale ? ` STALE(${staleReason ?? 'unknown'})` : ''}${ok || cancelled ? '' : ` err=${failureDetail(result)}`}`);
                         // A user-cancelled run is a quiet outcome, not an error.
                         sendJson(response, ok || cancelled ? 200 : result.busy === true ? 409 : 502, {
@@ -6128,7 +6142,11 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             // (a 404 for this package's own download: the classifier names
                             // the last path segment, the tarball file for that URL form).
                             const ownTarball = `${plainTarget.slice(plainTarget.lastIndexOf('/') + 1)}-${String(registryLatest)}.tgz`;
-                            const notOnMirror = (failure?.code === 'no-matching-version' && aboutThisPackage)
+                            // `exact-version-missing` (#927) is the same lag shape with a
+                            // clearer sentence; install still falls back to the bare name
+                            // after withHoistRecovery's one same-argv retry loses.
+                            const notOnMirror = ((failure?.code === 'no-matching-version' || failure?.code === 'exact-version-missing')
+                                && aboutThisPackage)
                                 || (failure?.code === 'fetch-404' && (failure.pkg === plainTarget || failure.pkg === ownTarball));
                             if (heldBack || notOnMirror) {
                                 // The user asked for the young release anyway. That request is

package/lib/types/changelog.d.ts

@@ -63,6 +63,15 @@ export declare function sliceCommitsAt(items: CommitNote[], installed: string |
     items: CommitNote[];
     found: boolean;
 };
+/**
+ * The version a release tag names, when it names one.
+ *
+ * Tags come as `v1.2.3`, `1.2.3`, `@scope/pkg@1.2.3` or `pkg-v1.2.3`; the
+ * FIRST semver-shaped run is the version in all of them. A tag that names no
+ * version (`nightly`) returns null, and callers must treat "unknown" as "do
+ * not judge" rather than "older".
+ */
+export declare function releaseVersionOf(tag: string | null): string | null;
 /** The repo url key an entry's update notes live under, or null. */
 export declare function repoKeyOf(spec: string): string | null;
 /**

package/lib/types/log-redaction.d.ts

@@ -0,0 +1,2 @@
+/** Mask only this user's home prefix, leaving the rest of each path intact. */
+export declare function redactHomePaths(text: string): string;

package/lib/types/pnpm-compat.d.ts

@@ -33,7 +33,7 @@ export declare function pluginArgsFor(profileDir: string, pluginArgs: string[]):
  */
 export declare const HOST_NAMESPACE_RE: RegExp;
 export interface PnpmFailure {
-    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch' | 'fetch-404' | 'no-matching-version' | 'transient-network' | 'fetch-timeout' | 'unexpected-store' | 'patch-failed' | 'unused-patch' | 'missing-tarball-integrity' | 'windows-file-locked' | 'profile-file-locked' | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key' | 'native-oom' | 'ssh-auth-failed' | 'host-incompatible-install' | 'lockfile-broken' | 'lockfile-outdated' | 'pnpm-stalled' | 'profile-write-lock';
+    code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation' | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch' | 'fetch-404' | 'no-matching-version' | 'exact-version-missing' | 'transient-network' | 'fetch-timeout' | 'unexpected-store' | 'patch-failed' | 'unused-patch' | 'missing-tarball-integrity' | 'windows-file-locked' | 'profile-file-locked' | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key' | 'native-oom' | 'ssh-auth-failed' | 'host-incompatible-install' | 'lockfile-broken' | 'lockfile-outdated' | 'pnpm-stalled' | 'profile-write-lock';
     /** Bilingual, actionable message shown to the user instead of the raw wall of text. */
     message: string;
     /** True when re-running `pnpm install` in the profile is the documented recovery. */

package/lib/types/profile.d.ts

@@ -412,7 +412,7 @@ export declare function conflictingEntryIds(profileDirectory: string, candidate:
  * @param profileDirectory - resolved profile directory (host-authoritative under Desktop).
  * @param name - installed package name.
  */
-export declare function hasLoadableEntry(profileDirectory: string, name: string): boolean;
+export declare function hasLoadableEntry(profileDirectory: string, name: string, hostDirectory?: string | null): boolean;
 /** Plugin subdirectories (depth 2) of a collection checkout, as relative paths. */
 export declare function pluginSubdirs(root: string): string[];
 /**

package/lib/types/regions.d.ts

@@ -32,6 +32,13 @@ export declare function asRegion(value: unknown): Region | null;
  * pnpm's registry alone and setting it.
  */
 export declare const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
+/**
+ * Default npm registry for the China download region, no trailing slash.
+ *
+ * Exported so failure classifiers can recognize this host in pnpm's output
+ * (#926) without duplicating the URL.
+ */
+export declare const CHINA_NPM_REGISTRY = "https://mirrors.cloud.tencent.com/npm";
 /** GitHub transports that fail independently on filtered networks. */
 export type GithubService = 'git' | 'raw' | 'avatar';
 /** A prefix proxy, or null for the canonical GitHub address. */

package/lib/updates.js

@@ -289,7 +289,22 @@ async function tagVersion(name, tag) {
 export async function fetchNpmLatest(name) {
     try {
         const meta = (await fetchJson(npmUrl(`${encodeURIComponent(name)}/latest`)));
-        return typeof meta.version === 'string' ? meta.version : null;
+        if (typeof meta.version === 'string')
+            return meta.version;
+    }
+    catch {
+        // Fall through to the full packument (#932).
+    }
+    // #932: the `/latest` shortcut can fail on its own — measured HTTP 429 from
+    // registry.npmjs.org while the full packument answered 200 with the same
+    // dist-tag. Returning null there made a fresh install fall back to the bare
+    // name, and pnpm's fresh-release hold then installed an OLDER version than
+    // the catalog and the confirmation screen had just shown. The packument is
+    // a bigger read, so it is only asked when the shortcut failed.
+    try {
+        const doc = (await fetchJson(npmUrl(encodeURIComponent(name))));
+        const latest = doc['dist-tags']?.latest;
+        return typeof latest === 'string' ? latest : null;
     }
     catch {
         return null;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.41",
+  "version": "1.66.43",
   "icon": "assets/logo.svg",
   "type": "module",
   "main": "lib/index.js",

package/src/changelog.ts

@@ -24,9 +24,9 @@
 import { fileFromTarball } from './catalog-npm.ts'
 import { marketFetch } from './net.ts'
 import { activeRegion, routesFor } from './regions.ts'
-import { profileDir, readGitResolutionCommit, readInstalled, readInstalledRepoEvidence, readLockCommits } from './profile.ts'
+import { profileDir, readGitResolutionCommit, readInstalled, readInstalledRepoEvidence, readInstalledVersion, readLockCommits } from './profile.ts'
 import { githubRepoOfRemote, hostedRepoKey, isGitHostedSpec, lookupRepoFromUrl, parseHostShorthand, parseSourceUrl, repoOf, repoOfTarget } from './sources.ts'
-import { checkUpdates } from './updates.ts'
+import { checkUpdates, compareVersions } from './updates.ts'
 import { loadRegistry, type RegistryPlugin } from './registry.ts'
 
 const UPDATES_PACKAGE = 'dsh-plugin-updates'
@@ -141,6 +141,20 @@ export function sliceCommitsAt(items: CommitNote[], installed: string | null): {
   return { items: out, found: false }
 }
 
+/**
+ * The version a release tag names, when it names one.
+ *
+ * Tags come as `v1.2.3`, `1.2.3`, `@scope/pkg@1.2.3` or `pkg-v1.2.3`; the
+ * FIRST semver-shaped run is the version in all of them. A tag that names no
+ * version (`nightly`) returns null, and callers must treat "unknown" as "do
+ * not judge" rather than "older".
+ */
+export function releaseVersionOf(tag: string | null): string | null {
+  if (tag === null) return null
+  const match = /(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/.exec(tag)
+  return match?.[1] ?? null
+}
+
 /** The repo url key an entry's update notes live under, or null. */
 export function repoKeyOf(spec: string): string | null {
   const repo = githubIdentityOf(spec)?.split('#')[0] ?? null
@@ -450,7 +464,23 @@ export async function updateNotesFor(
     }
 
     if (entry?.release !== undefined && entry.release !== null && (entry.release.body !== '' || entry.release.tag !== null)) {
-      return { kind: 'release', release: entry.release }
+      // The release feed is a DAILY snapshot while the update target is read
+      // live from npm, so the snapshot's newest release is often the version
+      // already installed (or older). Showing it next to "1.66.39 → 1.66.40"
+      // describes a change the user already has (#925). When the release
+      // names a version no newer than the installed one AND a better tier
+      // exists, take the better tier: the commit tail is sliced at this
+      // install's sha, and npm publish times are newer than the install by
+      // construction. With nothing better, the stale release still beats an
+      // empty dialog.
+      const installed = readInstalledVersion(profile, name, activeProfileDir)
+      const released = releaseVersionOf(entry.release.tag)
+      const behind = installed !== null && released !== null
+        && (compareVersions(released, installed) ?? 0) <= 0
+      const hasCommits = (entry.commits?.length ?? 0) > 0
+      if (!(behind && (hasCommits || (specKey === null && npmName !== null)))) {
+        return { kind: 'release', release: entry.release }
+      }
     }
     if (entry?.commits !== undefined && entry.commits.length > 0) {
       return { kind: 'commits', commits: sliceCommitsAt(entry.commits, current) }

package/src/install.ts

@@ -256,6 +256,16 @@ export async function withHoistRecovery(
       // Do that retry ourselves instead of reporting a false failure.
       logEvent('warn', 'install', `transient network failure while pnpm replayed the dependency tree (#83) — retrying once`)
       result = await run(profile, pluginArgs)
+    } else if (
+      failure?.code === 'exact-version-missing'
+      && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove' || pluginArgs[0] === 'update')
+    ) {
+      // #927: market pinned name@x.y.z from /latest, but this registry's
+      // packument (often a mirror) does not list that version yet. Same argv
+      // once more gives pnpm a chance to re-fetch; if it still fails the
+      // classifier's message names "try later / switch Download region".
+      logEvent('warn', 'install', `exact version missing on this registry's packument (#927) — retrying once to re-fetch`)
+      result = await run(profile, pluginArgs)
     } else if (
       failure?.code === 'fetch-timeout'
       && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')
@@ -659,7 +669,10 @@ export async function validateAddedPlugins(
     const packageDir = join(dir, 'node_modules', n)
     // hasLoadableEntry, not entryArtifactExists: carrier bundles legitimately
     // ship no entry of their own (#103) and must not be uninstalled here.
-    if (!hasDshManifest(packageDir) || !hasLoadableEntry(dir, n)) {
+    // The host install tree is passed too (#906): a carrier mounting only
+    // in-box packages resolves nowhere under the profile, and judging it by
+    // that alone deleted a package the host had just installed correctly.
+    if (!hasDshManifest(packageDir) || !hasLoadableEntry(dir, n, hostDirectory ?? findDshInstallDir())) {
       removedBroken.push(n)
       await removeAndReconcile(run, profile, dir, n, hostDirectory)
       continue

package/src/log-redaction.ts

@@ -0,0 +1,24 @@
+import { homedir } from 'node:os'
+
+/** Mask only this user's home prefix, leaving the rest of each path intact. */
+export function redactHomePaths(text: string): string {
+  const directory = homedir()
+  // Detect the home path's syntax rather than the host running the exporter.
+  // Windows is case-insensitive and accepts either separator, including mixed
+  // paths from pnpm. Repeated separators also cover JSON-escaped NDJSON history.
+  const windows = /^(?:[a-z]:[\\/]|[\\/]{2})/i.test(directory)
+  const home = directory.replace(windows ? /[\\/]+$/ : /\/+$/, '')
+  // A POSIX root home must not turn every absolute path into a home path.
+  if (home === '') return text
+  const escape = (part: string): string => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  const path = windows ? home.split(/[\\/]/).map(escape).join('[\\\\/]+') : escape(home)
+  // Do not match a home embedded in another path/text, or a sibling such as
+  // Alice-other or Alice.backup. File URLs still contain an absolute home;
+  // quotes/brackets allow bare homes in log prose.
+  const before = String.raw`(?:(?<![\p{L}\p{N}_./\\-])|(?<=\bfile://)|(?<=\bfile:///))`
+  // Trimming C:\ leaves C:, but only an absolute path belongs to that root.
+  const after = windows && /^[a-z]:$/i.test(home)
+    ? String.raw`(?=[\\/])`
+    : windows ? String.raw`(?=$|[\\/\s"'\x60<>()[\]{},;:!?])` : String.raw`(?=$|[/\s"'\x60<>()[\]{},;:!?])`
+  return text.replace(new RegExp(before + path + after, windows ? 'giu' : 'gu'), '~')
+}

package/src/log.ts

@@ -14,7 +14,7 @@
 
 import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs'
 import { dirname } from 'node:path'
-import { homedir } from 'node:os'
+import { redactHomePaths } from './log-redaction.ts'
 
 export type LogLevel = 'info' | 'warn' | 'error'
 
@@ -35,8 +35,7 @@ let persistentFile: string | null = null
 let persistentBytes = 0
 
 function sanitize(text: string): string {
-  return text
-    .replaceAll(homedir(), '~')
+  return redactHomePaths(text)
     // Log-injection guard: control characters (newlines above all) would
     // forge extra lines in the exported log file. The #98 routes pass
     // user-supplied names into logEvent (bundle-order order entries, trial

package/src/patch.ts

@@ -137,6 +137,16 @@ export interface PatchState {
 /** Row ids the market is allowed to write: plain unquoted YAML scalars. */
 const ROW_ID_RE = /^[A-Za-z0-9_.-]+$/u
 
+function nextPatchContentLine(lines: readonly string[], from: number): number {
+  let index = from
+  while (index < lines.length) {
+    const line = (lines[index] ?? '').trim()
+    if (line !== '' && !line.startsWith('#')) break
+    index += 1
+  }
+  return index
+}
+
 /**
  * Line-wise scan of one patch file — the plugin-hub shapes. Deliberately
  * not a YAML parse: the file may hold structures the market's dialect
@@ -165,11 +175,12 @@ export function readUserPatchState(patchPath: string): PatchState {
       if (insertRow !== null) inserts.push(insertRow[1])
       continue
     }
-    const disableRow = /^- id: ([A-Za-z0-9_.-]+)\s*$/u.exec(line)
+    const disableRow = /^- id: (?:([A-Za-z0-9_.-]+)|'([A-Za-z0-9_.-]+)'|"([A-Za-z0-9_.-]+)")[ \t]*$/u.exec(line)
     if (disableRow === null) continue
-    const next = lines[index + 1] ?? ''
-    if (/^ {2}disabled: true\s*$/u.test(next)) disables.push(disableRow[1])
-    else if (/^ {2}disabled: false\s*$/u.test(next)) forced.push(disableRow[1])
+    const id = (disableRow[1] ?? disableRow[2] ?? disableRow[3])!
+    const next = lines[nextPatchContentLine(lines, index + 1)] ?? ''
+    if (/^ {2}disabled: true\s*$/u.test(next)) disables.push(id)
+    else if (/^ {2}disabled: false\s*$/u.test(next)) forced.push(id)
   }
   return { disables, forced, inserts }
 }
@@ -436,16 +447,31 @@ function rowBlock(rowId: string, disabled: boolean): string {
 }
 
 /**
- * Every two-line `- id: X` + `disabled: …` block for one row, in file order
- * (#821). A row that goes on with more keys (`config:` and the like) is not
- * one of these blocks: cutting its first two lines would leave the rest
- * hanging off the entry above it. The last block of a file may lack its
- * newline.
+ * Rewrite standalone id/flag rows while preserving the surrounding file.
+ * Comments and blank lines may separate the fields (#930). Look beyond them
+ * after the flag too: an indented config/name/key makes this a longer entry,
+ * whose first lines must never be removed (#821). Trailing comments stay put.
  */
-function rowBlocksRe(rowId: string, disabled: 'true' | 'false' | 'any'): RegExp {
+function rewriteRowBlocks(text: string, rowId: string, disabled: 'true' | 'false' | 'any', replace: (block: string) => string): string {
   const id = escapeRegExp(rowId)
-  const value = disabled === 'any' ? '(?:true|false)' : disabled
-  return new RegExp(`^- id: (?:${id}|'${id}'|"${id}")[ \\t]*\\r?\\n  disabled: ${value}[ \\t]*(?:\\r?\\n(?![ \\t])|(?![\\s\\S]))`, 'gmu')
+  const idLine = new RegExp(`^- id: (?:${id}|'${id}'|"${id}")[ \t]*$`, 'u')
+  const lines = text.match(/[^\n]*(?:\n|$)/gu)?.filter(Boolean) ?? []
+  const offsets: number[] = [0]
+  for (const line of lines) offsets.push(offsets[offsets.length - 1]! + line.length)
+  let result = '', copied = 0
+  for (let index = 0; index < lines.length; index += 1) {
+    if (!idLine.test(lines[index]!.replace(/\r?\n$/u, ''))) continue
+    const flagIndex = nextPatchContentLine(lines, index + 1)
+    const flag = /^ {2}disabled: (true|false)[ \t]*(?:\r?\n)?$/u.exec(lines[flagIndex] ?? '')
+    if (flag === null || (disabled !== 'any' && flag[1] !== disabled)) continue
+    const following = nextPatchContentLine(lines, flagIndex + 1)
+    if (/^[ \t]/u.test(lines[following] ?? '')) continue
+    const start = offsets[index]!, end = offsets[flagIndex + 1]!
+    result += text.slice(copied, start) + replace(text.slice(start, end))
+    copied = end
+    index = flagIndex
+  }
+  return result + text.slice(copied)
 }
 
 /**
@@ -460,7 +486,7 @@ function lastRowFlag(text: string, rowId: string): 'true' | 'false' | null {
   let flag: 'true' | 'false' | null = null
   for (let index = 0; index < lines.length; index += 1) {
     if (!idLine.test(lines[index] ?? '')) continue
-    const value = /^ {2}disabled: (true|false)\s*$/u.exec(lines[index + 1] ?? '')
+    const value = /^ {2}disabled: (true|false)\s*$/u.exec(lines[nextPatchContentLine(lines, index + 1)] ?? '')
     if (value !== null) flag = value[1] as 'true' | 'false'
   }
   return flag
@@ -563,15 +589,13 @@ export function disableRow(patchPath: string, rowId: string): Promise<{ ok: bool
     const text = (() => {
       try { return readFileSync(patchPath, 'utf8') } catch { return '' }
     })()
-    const blocks = text.match(rowBlocksRe(rowId, 'any')) ?? []
-    if (blocks.length > 1 || blocks.some(block => /disabled: false/u.test(block))) {
-      let kept = false
-      const next = text.replace(rowBlocksRe(rowId, 'any'), block => {
-        if (kept) return ''
-        kept = true
-        const flipped = rowBlock(rowId, true)
-        return block.includes('\r\n') ? flipped.replace(/\n/gu, '\r\n') : flipped
-      })
+    let kept = false
+    const next = rewriteRowBlocks(text, rowId, 'any', block => {
+      if (kept) return ''
+      kept = true
+      return block.replace(/^ {2}disabled: false(?=[ \t]*(?:\r?\n|$))/mu, '  disabled: true')
+    })
+    if (next !== text) {
       const flipped = writePatchFile(patchPath, next)
       if (!flipped.ok) return flipped
       // A longer entry for the row further down still has the last word.
@@ -601,7 +625,7 @@ export function enableRow(patchPath: string, rowId: string): Promise<{ ok: boole
     const text = (() => {
       try { return readFileSync(patchPath, 'utf8') } catch { return '' }
     })()
-    const next = text.replace(rowBlocksRe(rowId, 'true'), '')
+    const next = rewriteRowBlocks(text, rowId, 'true', () => '')
     if (next !== text) {
       const written = writePatchFile(patchPath, withPlaceholderRestored(next))
       if (!written.ok) return written
@@ -640,7 +664,7 @@ export function removeRowBlocks(patchPath: string, rowIds: readonly string[]): {
     text = readFileSync(patchPath, 'utf8')
   } catch { return { ok: true, reason: null } } // no file, nothing to remove
   let next = text
-  for (const rowId of rowIds) next = next.replace(rowBlocksRe(rowId, 'any'), '')
+  for (const rowId of rowIds) next = rewriteRowBlocks(next, rowId, 'any', () => '')
   if (next === text) return { ok: true, reason: null }
   const written = writePatchFile(patchPath, withPlaceholderRestored(next))
   if (written.ok) logEvent('info', 'patch', `removed patch rows for ${rowIds.join(', ')}`)

package/src/pnpm-compat.ts

@@ -16,7 +16,7 @@
 
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
-
+import { CHINA_NPM_REGISTRY } from './regions.ts'
 
 /**
  * Decide the argv for a `dsh plugin <add|remove> …` call in the given profile.
@@ -46,7 +46,7 @@ export const HOST_NAMESPACE_RE = /^@deepseek-ai\//
 export interface PnpmFailure {
   code: 'adding-to-root' | 'not-a-workspace' | 'hoist-pattern-diff' | 'pnpm-missing' | 'release-age-violation'
     | 'ignored-builds' | 'git-prepare-not-allowed' | 'git-prepare-failed' | 'tarball-url-mismatch'
-    | 'fetch-404' | 'no-matching-version' | 'transient-network' | 'fetch-timeout'
+    | 'fetch-404' | 'no-matching-version' | 'exact-version-missing' | 'transient-network' | 'fetch-timeout'
     | 'unexpected-store' | 'patch-failed' | 'unused-patch' | 'missing-tarball-integrity' | 'windows-file-locked'
     | 'profile-file-locked'
     | 'pnpm-unusable' | 'missing-local-dependency' | 'unparseable-build-key' | 'native-oom' | 'ssh-auth-failed'
@@ -89,6 +89,24 @@ export function isTransientPnpmFailure(output: string): boolean {
   return /ERR_PNPM_FETCH_5\d\d|ERR_PNPM_META_FETCH_FAIL|FetchError|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENETUNREACH|socket hang up|network timeout/i.test(output)
 }
 
+/**
+ * China download route reset a package tarball mid-download (#926).
+ *
+ * Same-argv retry (#83) hits the same host again, so the generic "try again
+ * shortly" advice is wrong. Matched on ONE line: the China npm registry
+ * tarball URL and the reset must appear together — a China-mirror `.tgz`
+ * mention plus an unrelated `ECONNRESET` elsewhere (e.g. codeload) must not
+ * push the user to switch Download region.
+ */
+function isChinaMirrorTarballReset(output: string): boolean {
+  const hostPath = CHINA_NPM_REGISTRY.replace(/^https?:\/\//i, '')
+  const escaped = hostPath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  return new RegExp(
+    `${escaped}/\\S+/-/\\S+\\.tgz[^\\n]*(?:ECONNRESET|socket hang up)`,
+    'i',
+  ).test(output)
+}
+
 /**
  * The package a tarball URL belongs to: `…/@types/retry/-/retry-0.12.0.tgz`
  * → `@types/retry`, `…/lodash/-/lodash-4.17.21.tgz` → `lodash`. Scoped names
@@ -578,19 +596,52 @@ export function classifyPnpmFailure(output: string, exitCode?: number | null): P
   // error code, so the classifier names it separately and the #289 retry
   // shares it via install.ts's gate. Real output (pnpm 12.4.1): see
   // tests/pnpm-compat.spec.ts, which pins this wording.
+  //
+  // #927: when the request is an EXACT version (name@1.2.3) that this
+  // registry cannot see yet — often a mirror whose `/latest` moved ahead of
+  // its packument — the generic "withdrawn or never published" sentence is
+  // wrong. That shape gets its own code so withHoistRecovery can retry the
+  // same argv once (re-fetch packument) and the UI can say "not synced yet".
   if (output.includes('ERR_PNPM_NO_MATCHING_VERSION')) {
-    const pkg = /No matching version found for\s+((?:@[^/\s]+\/)?[^@\s]+)@/.exec(output)?.[1]
+    const asked = /No matching version found for\s+((?:@[^/\s]+\/)?[^@\s]+)@([^\s]+)/.exec(output)
+    const pkg = asked?.[1]
       ?? /GET\s+\S*\/([^/\s]+):/.exec(output)?.[1].replace(/%2[Ff]/g, '/')
+    const requested = asked?.[2]
     const zh = pkg === undefined ? '' : `（${pkg}）`
     const en = pkg === undefined ? '' : ` (${pkg})`
     const hostPeer = pkg !== undefined && HOST_NAMESPACE_RE.test(pkg)
+    if (hostPeer) {
+      return {
+        code: 'no-matching-version',
+        recoverable: false,
+        pkg,
+        message: `插件声明依赖的宿主包${zh}在 registry 上没有满足其版本范围的发布版（宿主运行时会自带它，npm 上不会出现这个版本）。市场会自动重试一次，放行这条 peer 依赖 / a plugin's declared host peer${en} has no published version satisfying its range — the runtime provides it, so npm carries no such version. The market retries once with that peer exempted from auto-install`,
+      }
+    }
+    const exact = requested !== undefined
+      && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(requested)
+    if (exact) {
+      const pin = pkg === undefined ? requested : `${pkg}@${requested}`
+      const latest = pkg === undefined
+        ? undefined
+        : new RegExp(
+          `The latest release of\\s+${pkg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s+is\\s+"([^"]+)"`,
+          'i',
+        ).exec(output)?.[1]
+      const latestZh = latest === undefined ? '' : `（它目前看到的最新是 ${latest}）`
+      const latestEn = latest === undefined ? '' : ` (it currently reports latest as ${latest})`
+      return {
+        code: 'exact-version-missing',
+        recoverable: false,
+        ...(pkg === undefined ? {} : { pkg }),
+        message: `当前下载线路暂时找不到精确版本 ${pin}${latestZh}。常见原因是线路还没同步到刚发布的版本，不等于这个版本不存在。已自动重试一次仍失败——请稍后再试；若下载区域是中国大陆，也可改成「全球」后再试 / this download route cannot see the exact version ${pin} yet${latestEn}. Often the route has not synced a just-published release — that does not mean the version is missing from npm. One automatic retry failed too — try again shortly; if Download region is China mainland, you can also switch it to Global and retry`,
+      }
+    }
     return {
       code: 'no-matching-version',
       recoverable: false,
-      pkg,
-      message: hostPeer
-        ? `插件声明依赖的宿主包${zh}在 registry 上没有满足其版本范围的发布版（宿主运行时会自带它，npm 上不会出现这个版本）。市场会自动重试一次，放行这条 peer 依赖 / a plugin's declared host peer${en} has no published version satisfying its range — the runtime provides it, so npm carries no such version. The market retries once with that peer exempted from auto-install`
-        : `插件声明的一个依赖版本范围在 registry 上没有可满足的版本${zh}，通常是该版本被弃用或从未发布 / a dependency of this plugin declared a version range with no matching release on the registry${en} — the range resolves to nothing (withdrawn or never published)`,
+      ...(pkg === undefined ? {} : { pkg }),
+      message: `插件声明的一个依赖版本范围在 registry 上没有可满足的版本${zh}，通常是该版本被弃用或从未发布 / a dependency of this plugin declared a version range with no matching release on the registry${en} — the range resolves to nothing (withdrawn or never published)`,
     }
   }
   // #808 by @Tofu707: the profile's own pnpm-lock.yaml is what is wrong, in
@@ -746,6 +797,16 @@ export function classifyPnpmFailure(output: string, exitCode?: number | null): P
   // a plain retry to succeed seconds later. withHoistRecovery retries once;
   // this message covers the case where the retry lost too.
   if (isTransientPnpmFailure(output)) {
+    // Keep code `transient-network` so withHoistRecovery still does the #83
+    // same-argv retry; only the final message changes when that retry lost
+    // against the China mirror's tarball host (#926).
+    if (isChinaMirrorTarballReset(output)) {
+      return {
+        code: 'transient-network',
+        recoverable: false,
+        message: '中国大陆下载线路在拉这个安装包时被断开了。再走同一条线路通常没用。打开设置，把「下载区域」改成「全球」，然后再装一次 / the China mainland download route was interrupted while fetching this package. Trying the same route again usually will not help. Open Settings, switch Download region to Global, and install again',
+      }
+    }
     return {
       code: 'transient-network',
       recoverable: false,

package/src/profile.ts

@@ -5,9 +5,11 @@
  */
 
 import { existsSync, readdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
 import { isDeepStrictEqual } from 'node:util'
 import { JSON_SCHEMA, load } from 'js-yaml'
+import { findDshInstallDir } from './dsh-install.ts'
 import { resolveDshHome } from './home-paths.ts'
 import { githubRemoteIdentities, githubRepoIdentities, hostedRepoKey, isGenerationLink, isGitHostedSpec, repoOfTarget } from './sources.ts'
 
@@ -1340,7 +1342,7 @@ export function conflictingEntryIds(
  * @param profileDirectory - resolved profile directory (host-authoritative under Desktop).
  * @param name - installed package name.
  */
-export function hasLoadableEntry(profileDirectory: string, name: string): boolean {
+export function hasLoadableEntry(profileDirectory: string, name: string, hostDirectory?: string | null): boolean {
   const dir = join(profileDirectory, 'node_modules', name)
   if (entryArtifactExists(dir)) return true
   // A carrier is only sound when something it mounts is itself loadable.
@@ -1353,11 +1355,39 @@ export function hasLoadableEntry(profileDirectory: string, name: string): boolea
   // exiting 0 was immediately followed by the market removing what it had
   // just, correctly, installed.
   const workspaceRoot = dirname(profileDirectory)
-  return bundlePatchTargets(dir)
-    .filter(target => target !== name)
-    .some(target => entryArtifactExists(join(profileDirectory, 'node_modules', target))
-      || entryArtifactExists(join(dir, 'node_modules', target))
-      || entryArtifactExists(join(workspaceRoot, 'node_modules', target)))
+  const targets = bundlePatchTargets(dir).filter(target => target !== name)
+  if (targets.some(target => entryArtifactExists(join(profileDirectory, 'node_modules', target))
+    || entryArtifactExists(join(dir, 'node_modules', target))
+    || entryArtifactExists(join(workspaceRoot, 'node_modules', target)))) return true
+  // #906: the host's OWN packages live in its install tree, not in any
+  // profile node_modules — `<install>/dsh/node_modules/...`, often inside
+  // app.asar. A carrier whose patch mounts nothing but in-box packages
+  // (@deepseek-ai/dsh-mcp-client and the like) therefore failed every root
+  // above, was reported "broken", and — through validateAddedPlugins — was
+  // uninstalled right after a successful install. `undefined` resolves the
+  // install dir lazily (only carriers pay for it); `null` means "do not look".
+  //
+  // Inside app.asar the probe is blind for EVERY @deepseek-ai/ name (the
+  // same measurement behind #676), so there identity decides instead of the
+  // filesystem — the host publishes that scope, and our own composer loads
+  // those packages from the archive at boot.
+  const host = hostDirectory === undefined ? findDshInstallDir() : hostDirectory
+  if (host === null || targets.length === 0) return false
+  const packaged = /[/\\]app\.asar[/\\]/iu.test(host)
+  return targets.some(target => packaged && target.startsWith('@deepseek-ai/')
+    || packageResolvableFrom(join(host, 'package.json'), target))
+}
+
+/** Whether `target` resolves from the host's own dependency tree. */
+function packageResolvableFrom(anchorPackageJson: string, target: string): boolean {
+  try {
+    const paths = createRequire(anchorPackageJson).resolve.paths(target) ?? []
+    return paths.some(searchPath => existsSync(join(searchPath, target, 'package.json')))
+  } catch {
+    // An unreadable anchor says nothing about the target: treat as absent
+    // rather than loadable, so the caller keeps its conservative answer.
+    return false
+  }
 }
 
 /** Plugin subdirectories (depth 2) of a collection checkout, as relative paths. */

package/src/recovery.ts

@@ -33,10 +33,10 @@ import { spawn } from 'node:child_process'
 import { appendFileSync, openSync, readFileSync } from 'node:fs'
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http'
 import { connect } from 'node:net'
-import { homedir } from 'node:os'
 import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { readJsonBody, sameOrigin, sendJson } from './http.ts'
+import { redactHomePaths } from './log-redaction.ts'
 import { disableRow, enableRow } from './patch.ts'
 import { addProfileBundle, removeProfileBundle } from './profile.ts'
 
@@ -566,8 +566,7 @@ async function waitForPortFree(port: number, timeoutMs: number): Promise<boolean
  * one unreadable line, which is the opposite of what the export is for.
  */
 function redactLog(text: string): string {
-  return text
-    .replaceAll(homedir(), '~')
+  return redactHomePaths(text)
     .replace(/sk-[A-Za-z0-9_-]{8,}/g, 'sk-***')
     .replace(/gh[pousr]_[A-Za-z0-9]{16,}/g, 'gh*_***')
     .replace(/npm_[A-Za-z0-9]{16,}/g, 'npm_***')

package/src/regions.ts

@@ -38,7 +38,14 @@ export function asRegion(value: unknown): Region | null {
  * pnpm's registry alone and setting it.
  */
 export const DEFAULT_NPM_REGISTRY = 'https://registry.npmjs.org'
-const NPM_CHINA = 'https://mirrors.cloud.tencent.com/npm'
+/**
+ * Default npm registry for the China download region, no trailing slash.
+ *
+ * Exported so failure classifiers can recognize this host in pnpm's output
+ * (#926) without duplicating the URL.
+ */
+export const CHINA_NPM_REGISTRY = 'https://mirrors.cloud.tencent.com/npm'
+const NPM_CHINA = CHINA_NPM_REGISTRY
 
 /**
  * First public prefix used for unauthenticated GitHub reads, no trailing slash.

package/src/routes.ts

@@ -5167,6 +5167,24 @@ sendJson(response, 200, { updates })
               logEvent('warn', 'update-bundles-dropped',
                 `${name}: after this update ${droppedBundles.join(', ')} ${droppedBundles.length === 1 ? 'is' : 'are'} still declared in dependencies but no longer in dsh.profile.bundles, so ${droppedBundles.length === 1 ? 'it' : 'they'} will not load — the market did not write that change (#720)`)
             }
+            // #935: the desktop manager's removeBundle writes the bundle row
+            // out FIRST and only then checks whether a live fiber still uses
+            // the package — so a `bundle-in-use` refusal leaves the row gone
+            // while dependencies and node_modules stay. The plugin keeps
+            // running this session and silently fails to load next boot.
+            // Restore the row, scoped to exactly that refusal and to this
+            // operation's own target: the read-only stance in #720/#696
+            // still holds for every other way a row can disappear.
+            if (!ok && !cancelled && result.refusalCode === 'bundle-in-use') {
+              const targetRowDropped = bundlesDroppedFromProfile(
+                manifestBefore, config.profile, activeProfileDir,
+                new Set(removedDeclaration === null ? [] : [removedDeclaration.name]),
+              ).includes(name)
+              if (targetRowDropped && addProfileBundle(activeProfileDir, name)) {
+                logEvent('warn', 'update-bundles-restored',
+                  `${name}: the desktop app removed its bundle row before refusing the update (bundle-in-use) — restored it so the plugin still loads on the next boot (#935)`)
+              }
+            }
             logEvent(ok || cancelled ? 'info' : 'error', 'update',
               `${name} -> ${target} exit=${String(result.exitCode)}${result.timedOut ? ' TIMEOUT' : ''}${cancelled ? ' CANCELLED' : ''}${stale ? ` STALE(${staleReason ?? 'unknown'})` : ''}${ok || cancelled ? '' : ` err=${failureDetail(result)}`}`)
             // A user-cancelled run is a quiet outcome, not an error.
@@ -6355,7 +6373,13 @@ sendJson(response, 200, { updates })
               // (a 404 for this package's own download: the classifier names
               // the last path segment, the tarball file for that URL form).
               const ownTarball = `${plainTarget.slice(plainTarget.lastIndexOf('/') + 1)}-${String(registryLatest)}.tgz`
-              const notOnMirror = (failure?.code === 'no-matching-version' && aboutThisPackage)
+              // `exact-version-missing` (#927) is the same lag shape with a
+              // clearer sentence; install still falls back to the bare name
+              // after withHoistRecovery's one same-argv retry loses.
+              const notOnMirror = (
+                (failure?.code === 'no-matching-version' || failure?.code === 'exact-version-missing')
+                && aboutThisPackage
+              )
                 || (failure?.code === 'fetch-404' && (failure.pkg === plainTarget || failure.pkg === ownTarball))
               if (heldBack || notOnMirror) {
                 // The user asked for the young release anyway. That request is

package/src/updates.ts

@@ -363,7 +363,20 @@ async function tagVersion(name: string, tag: string): Promise<string | null> {
 export async function fetchNpmLatest(name: string): Promise<string | null> {
   try {
     const meta = (await fetchJson(npmUrl(`${encodeURIComponent(name)}/latest`))) as { version?: string }
-    return typeof meta.version === 'string' ? meta.version : null
+    if (typeof meta.version === 'string') return meta.version
+  } catch {
+    // Fall through to the full packument (#932).
+  }
+  // #932: the `/latest` shortcut can fail on its own — measured HTTP 429 from
+  // registry.npmjs.org while the full packument answered 200 with the same
+  // dist-tag. Returning null there made a fresh install fall back to the bare
+  // name, and pnpm's fresh-release hold then installed an OLDER version than
+  // the catalog and the confirmation screen had just shown. The packument is
+  // a bigger read, so it is only asked when the shortcut failed.
+  try {
+    const doc = (await fetchJson(npmUrl(encodeURIComponent(name)))) as { 'dist-tags'?: { latest?: unknown } }
+    const latest = doc['dist-tags']?.latest
+    return typeof latest === 'string' ? latest : null
   } catch {
     return null
   }