dshmarket 1.66.43 → 1.66.45

package/client/client.js

@@ -393,6 +393,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			updateNow: "立即更新",
 			updateFail: "更新失败",
 			upToDate: "已是最新",
+			updateHeldTag: "新版等待中",
+			updateHeldHint: "这个 profile 要求新版本发布满一段时间才允许安装，大约还要 {1} 小时。",
 			newerPrereleaseAvailable: "预发布版 {0} 已发布",
 			newerPrereleaseHint: "npm 上的 latest 没有更新；你在跟的这条预发布线发布了更新的版本。",
 			unreleasedCommits: "有新提交（未发版）{0}",
@@ -1132,6 +1134,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			updateNow: "Update now",
 			updateFail: "Update failed",
 			upToDate: "Up to date",
+			updateHeldTag: "new version waiting",
+			updateHeldHint: "This profile waits a while before it installs a fresh release; about {1} hour(s) left.",
 			newerPrereleaseAvailable: "prerelease {0} published",
 			newerPrereleaseHint: "The package's latest tag has no update; the prerelease line you are on published a newer build.",
 			unreleasedCommits: "New commits (unreleased) {0}",
@@ -1993,8 +1997,9 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		}
 		/** Heuristic: plugins that target a terminal surface rather than the web UI. */
 		function looksTerminal(plugin, lang) {
+			if (/\b(tui|cli|tty|terminal)\b|终端|命令行/i.test(plugin.name)) return true;
 			const positiveDesc = (plugin.description && (plugin.description[lang] || plugin.description.en) || "").replace(/\b(?:no|without)\b[^.!?;:，。！？；\n]{0,80}\b(?:tui|cli|tty|terminal)\b/gi, "").replace(/(?:无需|无须|不需要|不用)[^。！？；\n]{0,48}(?:tui|cli|tty|terminal|终端|命令行)/gi, "");
-			return /\b(tui|cli|tty|terminal)\b|终端|命令行/i.test(plugin.name + " " + positiveDesc);
+			return /\b(?:terminal|cli)[ -]only\b|\btui (?:app|plugin|client)\b|\bterminal (?:ui|app|plugin|client)\b|\bcommand[- ]line (?:tool|interface|app|client|plugin)\b|命令行(?:工具|插件|应用|界面|客户端)|终端(?:工具|插件|应用|界面|客户端)|只在终端|仅在终端|需要(?:一个)?终端|在终端(?:里|中)运行/i.test(positiveDesc);
 		}
 		/** Days per TimeRange (`all` has no cutoff and is handled by the caller). */
 		const TIME_RANGE_DAYS = {
@@ -2891,14 +2896,17 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		*
 		* The repository name IS the plugin name in the ordinary case, because a
 		* repository holding one plugin is named after it. Only the compound form
-		* needs unpicking, and its last segment is the plugin's own directory.
+		* needs unpicking. Prefer its mapped npm package when available: a generic
+		* directory such as `plugin` is not the product name. Without that mapping,
+		* keep the directory-leaf fallback for source-only entries.
 		*
 		* Not a substitute for the identity: every key, lookup and install still
 		* uses `name` unchanged.
 		*/
-		function pluginName(name) {
+		function pluginName(name, npm) {
 			const hash = name.indexOf("#");
 			if (hash === -1) return name;
+			if (typeof npm === "string" && npm.trim() !== "") return npm.trim();
 			const sub = name.slice(hash + 1);
 			const leaf = sub.slice(sub.lastIndexOf("/") + 1);
 			return leaf === "" ? name.slice(0, hash) : leaf;
@@ -7391,7 +7399,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				plugin.url
 			]);
 			const visible = (curated.length > 0 ? curated : fallback.shots).filter((src) => !broken.includes(src));
-			const name = pluginName(plugin.name);
+			const name = pluginName(plugin.name, plugin.npm);
 			if (visible.length === 0) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
 				ref: setCoverRef,
 				type: "button",
@@ -8698,7 +8706,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				const entry = data?.plugins.find((plugin) => plugin.npm === name || plugin.name === name);
 				if (entry === void 0) return { title: name };
 				return {
-					title: pluginName(entry.name),
+					title: pluginName(entry.name, entry.npm),
 					author: entry.owner === "" ? void 0 : entry.owner,
 					avatar: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(OwnerAvatar, {
 						name: entry.name,
@@ -11812,7 +11820,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 										title: p.name,
 										"aria-label": `${p.name} — ${t("repoLink")}`,
 										children: [
-											pluginName(p.name),
+											pluginName(p.name, p.npm),
 											/* @__PURE__ */ (0, react_jsx_runtime.jsx)(GithubRepoMark, { className: Market_module_css_default.repoMark }),
 											p.deprecated === true && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 												className: Market_module_css_default.depBadge,
@@ -12001,7 +12009,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 											rel: "noreferrer",
 											title: p.name,
 											"aria-label": `${p.name} — ${t("repoLink")}`,
-											children: [pluginName(p.name), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(GithubRepoMark, { className: Market_module_css_default.repoMark })]
+											children: [pluginName(p.name, p.npm), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(GithubRepoMark, { className: Market_module_css_default.repoMark })]
 										}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 											className: Market_module_css_default.byline,
 											children: [
@@ -14150,6 +14158,10 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 																else doUpdate(name);
 															},
 															children: status.restoreRequired === true ? t("restoreOnline") : t("update")
+														}) : status?.heldUpdate !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+															className: Market_module_css_default.metaTag,
+															title: t("updateHeldHint").replace("{1}", String(Math.max(1, Math.ceil((Date.parse(status.heldUpdate.until) - Date.now()) / 36e5)))),
+															children: t("updateHeldTag").replace("{0}", displayLatest(status.heldUpdate.latest))
 														}) : localDev ? null : status?.unreleasedCommit != null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 															className: Market_module_css_default.metaTag,
 															title: t("unreleasedCommitsHint"),
@@ -14381,7 +14393,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 						className: Market_module_css_default.confirmModal,
 						contentClassName: Market_module_css_default.confirmContent,
 						onClose: () => setConfirming(null),
-						title: t("confirmTitle") + " " + confirming.name + "?",
+						title: t("confirmTitle") + " " + pluginName(confirming.name, confirming.npm) + "?",
 						footer: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 							variant: "ghost",
 							onClick: () => setConfirming(null),
@@ -14537,7 +14549,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 						t
 					}),
 					commentsFor !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CommentsModal, {
-						name: pluginName(commentsFor.name),
+						name: pluginName(commentsFor.name, commentsFor.npm),
 						url: commentsFor.url,
 						lang,
 						onClose: () => setCommentsFor(null),

package/lib/check.js

@@ -761,15 +761,27 @@ export function composeLayers(layers) {
  * patch row plus a user-patch row on the same id: fatal forever meant every
  * update of every plugin rolled back.
  *
- * Unknown version stays fatal: the conservative direction, and the case where
- * the evidence to be less strict is missing.
+ * An empty answer from the PROFILE lockfile is not "unknown" on the official
+ * Desktop: that host embeds the loader in `app.asar` and provides it to every
+ * profile, so no profile can ever name it (#943). Reading that as an old
+ * loader made the gate fatal for every update on 0.2.1-rc.2 — the exact report
+ * #853's fix was supposed to close. The host installation is asked before the
+ * evidence is treated as missing; only when both are silent does the
+ * conservative answer stand.
  */
-export function duplicateEntryIdsAreFatal(profileDirectory) {
+export function duplicateEntryIdsAreFatal(profileDirectory, dshInstallDir) {
     const versions = lockfileCoreVersions(profileDirectory).get('@deepseek-ai/cordis-plugin-loader') ?? [];
-    if (versions.length === 0)
+    if (versions.length > 0) {
+        const newest = versions.reduce((a, b) => (compareSemver(a, b) >= 0 ? a : b));
+        return compareSemver(newest, '1.0.4') < 0;
+    }
+    const install = dshInstallDir === undefined ? findDshInstallDir() : dshInstallDir;
+    const host = install === null
+        ? null
+        : readNodeModulesVersion(dirname(hostNodeModulesRoot(install)), '@deepseek-ai/cordis-plugin-loader');
+    if (host === null)
         return true;
-    const newest = versions.reduce((a, b) => (compareSemver(a, b) >= 0 ? a : b));
-    return compareSemver(newest, '1.0.4') < 0;
+    return compareSemver(host, '1.0.4') < 0;
 }
 /** Distinct versions of `@deepseek-ai/{dsh,cordis}*` packages in the lockfile. */
 function lockfileCoreVersions(profileDir) {
@@ -1349,7 +1361,7 @@ export function analyzeProfile(profileDirectory, options = {}) {
     // Rows on one id: a boot failure on an old loader, a silent override on a
     // new one (see duplicateEntryIdsAreFatal). Refusing an operation over the
     // second shape rolled back every update for the reporter's profile.
-    const duplicateFatal = duplicateEntryIdsAreFatal(profileDirectory);
+    const duplicateFatal = duplicateEntryIdsAreFatal(profileDirectory, dshInstall);
     for (const dup of composed.duplicates) {
         if (duplicateFatal) {
             errors.push(`duplicate loader entry id ${JSON.stringify(dup.id)} (${dup.count} rows: ${dup.layers.join(', ')})`);

package/lib/patch.js

@@ -319,40 +319,70 @@ function foreignDisableIds(rows) {
     return ids;
 }
 /**
- * The ids of OTHER plugins a package's bundle patch DISABLES — top-level
- * `- id: X` + `disabled: true` rows targeting plugins it does not own. This is
- * the precise marker of a bundle whose toggle-off can brick the boot (#224):
- * dsh-postgres-backends disables session-persistence-jsonl, so once the market
- * also disables the postgres backends nothing provides sessionPersistence.
+ * Top-level patch rows that add an `inject:` requirement to another plugin.
+ *
+ * Same shape rule as foreignDisableIds: anything at the top level with an id
+ * is a statement about a plugin this package does not own. An `inject` there
+ * makes that foreign row depend on a service — usually one this bundle
+ * provides — so switching this package off while leaving its patch in the
+ * stack strands the row: #938's billion-context adds
+ * `inject: [biliBasicCompactionPolicy]` to the four official agent presets,
+ * and a row-level disable left them unable to activate.
+ */
+function foreignInjectIds(rows) {
+    const ids = [];
+    for (const row of rows) {
+        if (row === null || typeof row !== 'object' || Array.isArray(row))
+            continue;
+        const record = row;
+        const id = record.id;
+        if (typeof id === 'string' && record.inject !== undefined && !ids.includes(id))
+            ids.push(id);
+    }
+    return ids;
+}
+/**
+ * The ids of OTHER plugins a package's bundle patch rewires — top-level rows
+ * that either `disabled: true` a plugin it does not own, or add an `inject:`
+ * requirement to one.
+ *
+ * Both are the marker of a bundle whose toggle-off can brick the boot while
+ * its patch keeps applying (#224, #938):
+ *  - dsh-postgres-backends disables session-persistence-jsonl, so once the
+ *    market also disables the postgres backends nothing provides
+ *    sessionPersistence;
+ *  - billion-context adds `inject: [biliBasicCompactionPolicy]` to the four
+ *    official agent presets, so disabling only its own row leaves the presets
+ *    waiting for a service that no longer exists — every preset disappears.
  *
  * A bundle that merely RECONFIGURES a neighbour is deliberately NOT counted:
  * the e2e fixture-cross tweaks dshm-fixture-b's config, and #147 requires
  * disabling it to leave that neighbour live — dropping such a bundle from the
  * stack broke its re-enable. Config-only side effects stay on the normal #147
- * path; only a foreign `disabled: true` triggers the bundle removal. Removing
- * the bundle still neutralizes any config side effects it carries, since its
- * whole patch stops applying.
+ * path. Removing the bundle still neutralizes any config side effects it
+ * carries, since its whole patch stops applying.
  *
  * Reads both patch sources like rowIdsForPackage — the declared
  * dsh.bundle.patch (one file or a LIST of them, #792) and the conventional
  * root cordis.patch.yml — so either form is detected, and every declared file
- * is attributed (a foreign disable declared in the second file is still what
- * bricks the boot, #224).
+ * is attributed.
  */
-export function carrierDisableIds(profileDirectory, packageName) {
+export function carrierRowIds(profileDirectory, packageName) {
     const packageDir = join(profileDirectory, 'node_modules', packageName);
-    const disabled = new Set();
+    const rows = new Set();
     const collectFromFile = (patchPath) => {
-        const rows = parsePatchFile(patchPath);
-        if (rows === null)
+        const parsed = parsePatchFile(patchPath);
+        if (parsed === null)
             return;
-        for (const id of foreignDisableIds(rows))
-            disabled.add(id);
+        for (const id of foreignDisableIds(parsed))
+            rows.add(id);
+        for (const id of foreignInjectIds(parsed))
+            rows.add(id);
     };
     for (const file of declaredBundlePatchFiles(packageDir))
         collectFromFile(file);
     collectFromFile(join(packageDir, 'cordis.patch.yml'));
-    return [...disabled];
+    return [...rows];
 }
 /**
  * The ids a package's bundle patch touches WITHOUT inserting them itself.
@@ -369,7 +399,7 @@ export function carrierDisableIds(profileDirectory, packageName) {
  * fixture-cross e2e exist to protect, where the neighbour must keep running
  * and the bundle must keep re-enabling.
  *
- * Reads both patch sources like carrierDisableIds: the declared
+ * Reads both patch sources like carrierRowIds: the declared
  * `dsh.bundle.patch` (one file or a LIST, #792) and the conventional root
  * cordis.patch.yml. Ownership is judged per file, because a package may ship
  * both and only the file's own `insert:` block says which ids it brings in.

package/lib/profile.js

@@ -127,12 +127,16 @@ export function readManifestDeps(profile, explicitDir) {
 }
 /**
  * For each installed package, the OTHER installed package that declares it —
- * as a dependency or a peer dependency — in its own manifest.
+ * as a dependency, an optional dependency, or a peer dependency — in its own
+ * manifest.
  *
  * pnpm's auto-install-peers writes a plugin's peers into the profile manifest
  * as direct dependencies, so a native binding a plugin needs shows up in the
  * installed list looking exactly like a plugin the user chose (#634). What
- * separates them is that somebody else asked for it.
+ * separates them is that somebody else asked for it. Optional dependencies
+ * count for the same reason (#941): a platform-specific binary a plugin lists
+ * under `optionalDependencies` is payload, not a plugin the user chose, even
+ * when pnpm installed that package and the card rendered.
  *
  * Ownership is decided by the first owner in sorted order, so the answer does
  * not depend on the manifest's key order. A package that declares itself is
@@ -152,7 +156,7 @@ export function readDependencyOwners(profile, names, explicitDir) {
         if (typeof manifest !== 'object' || manifest === null)
             continue;
         const declared = manifest;
-        for (const field of [declared.dependencies, declared.peerDependencies]) {
+        for (const field of [declared.dependencies, declared.optionalDependencies, declared.peerDependencies]) {
             if (typeof field !== 'object' || field === null)
                 continue;
             for (const dependency of Object.keys(field)) {

package/lib/routes.js

@@ -45,7 +45,7 @@ import { readJsonBody, refuseUnadmitted, sameOrigin, sendJson } from './http.js'
 import { resolveDshHome } from './home-paths.js';
 import { detectedDebugger, detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest, trustedSelfUninstallRequest, selfUninstallReachableFrom, restartReachableFrom } from './restart.js';
 import { activationAfterReplace, brokenClientBundles, bundlePatchIsEmpty, checkClientBundle, defaultHostRuntimeFacts, findUnservedConfigNamespaces, hasHostHalf, hostPeerGate, newlyBrokenBundles, peerGateRemedy, verifyActivation } from './verify.js';
-import { carrierDisableIds, disableRow, enableRow, findUserPatchPath, foreignRowIds, isProtectedModule, packagePatchFlags, readUserPatchState, removeRowBlocks, rowIdsForPackage, userPatchPackageReferences, } from './patch.js';
+import { carrierRowIds, disableRow, enableRow, findUserPatchPath, foreignRowIds, isProtectedModule, packagePatchFlags, readUserPatchState, removeRowBlocks, rowIdsForPackage, userPatchPackageReferences, } from './patch.js';
 import { createProfileBackup, downloadWebdav, MAX_BACKUP_BYTES, mergeRestoreManifest, restoreProfileBackup, unportableDeps, uploadWebdav, } from './backup.js';
 import { createGist, fitsGistLimit, GistError, gistErrorCode, parseGistId, readGist, resolveGistTokenSource, updateGist, verifyGistToken, } from './gist.js';
 import { MAX_UPDATE_OPERATIONS_V1, UpdateOperationStoreV1, UPDATE_API_V1_SCHEMA } from './update-api-v1.js';
@@ -856,9 +856,9 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         // A bundle that merely reconfigures a neighbour (config without
         // disabled) is NOT dropped: #147 requires disabling it to leave the
         // neighbour live, and the e2e fixture-cross re-enable breaks otherwise.
-        const disablesOthers = carrierDisableIds(activeProfileDir, name);
+        const carrierRows = carrierRowIds(activeProfileDir, name);
         const foreignRows = foreignRowIds(activeProfileDir, name);
-        const isCarrier = disablesOthers.length > 0;
+        const isCarrier = carrierRows.length > 0;
         // Both layers, or neither (#696 B). `dsh.profile.bundles` is the
         // package-level declaration the official plugins page's switch reads
         // and the loader composes; the patch rows above are the runtime
@@ -888,7 +888,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                     ? addProfileBundle(activeProfileDir, name)
                     : removeProfileBundle(activeProfileDir, name);
                 logEvent('info', 'toggle', isCarrier
-                    ? `${name}: disable-carrier ${enabled ? 're-added to' : 'removed from'} dsh.profile.bundles (disables: ${disablesOthers.join(', ')})`
+                    ? `${name}: disable-carrier ${enabled ? 're-added to' : 'removed from'} dsh.profile.bundles (carrier rows: ${carrierRows.join(', ')})`
                     : reBundle
                         ? `${name}: re-added to dsh.profile.bundles, which nothing was composing (#696)`
                         : `${name}: dsh.profile.bundles ${enabled ? 're-added' : 'removed'} so the official page's package switch agrees (#696)`);
@@ -989,7 +989,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
             }
         }
         logEvent(ok ? 'info' : 'error', 'toggle', `${name}: ${enabled ? 'on' : 'off'} ok=${String(ok)}`);
-        return { ok, reason, patchRows, userRows, patchWrite, disablesOthers, isCarrier, bundleSwitch };
+        return { ok, reason, patchRows, userRows, patchWrite, carrierRows, isCarrier, bundleSwitch };
     }
     /**
      * The plugin inventory the recovery surface is allowed to switch.
@@ -1015,7 +1015,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         const plugins = [];
         for (const name of names) {
             const rows = rowIdsForPackage(host, activeProfileDir, name);
-            const carrier = carrierDisableIds(activeProfileDir, name).length > 0;
+            const carrier = carrierRowIds(activeProfileDir, name).length > 0;
             if (rows.length === 0 && !carrier)
                 continue;
             const isProtected = isProtectedModule(name);
@@ -1855,6 +1855,12 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                 version,
                 requirement: verdict.requirement,
                 hostVersion: host?.version ?? null,
+                // #923: the client's "find a compatible version" search is keyed by
+                // the npm name, and the install branch could fall back to the catalog
+                // entry's `npm` while the update branch had nothing. The value is
+                // already here — it is this function's first argument and the key the
+                // registry lookup above used — so publish it.
+                npmName,
             },
             error: nothingWasInstalled
                 ? `${displayName} ${version ?? ''} 要求的 DSH 版本是 ${verdict.requirement ?? '未知'}，而当前运行的是 ${host?.version ?? '未知版本'}，装上多半会直接报错。已停止，没有安装任何东西。 / ${displayName} ${version ?? ''} declares it needs DSH ${verdict.requirement ?? '(unknown)'}, and this host is ${host?.version ?? 'unknown'}; installing it would most likely break the plugin. Nothing was installed.`
@@ -1952,7 +1958,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                 }
                 try {
                     const { channelFor, onlineSourceFor, catalogNpmByRepo } = await updateCheckInputs();
-                    const updates = await checkUpdates(config.profile, forceCheckFrom(request), activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo);
+                    const updates = await checkUpdates(config.profile, forceCheckFrom(request), activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo, { holdYoungReleases: config.desktopHost === true });
                     // `packages` carries the same objects the single-package endpoint
                     // returns, so one parser serves both. Only updatable ones: a badge
                     // wants the count, a panel wants the rows, and neither wants to
@@ -1999,7 +2005,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         // or a catalog-matched local package answers here with the
                         // release it can be compared against rather than with nothing.
                         const { channelFor, onlineSourceFor, catalogNpmByRepo } = await updateCheckInputs();
-                        const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo))[name];
+                        const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo, { holdYoungReleases: config.desktopHost === true }))[name];
                         if (update === undefined) {
                             sendJson(response, 404, { schema: UPDATE_API_V1_SCHEMA, error: 'plugin is not installed' });
                             return;
@@ -3060,7 +3066,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         const layers = await switchPluginLayers(name, enabled, ok, reason);
                         ok = layers.ok;
                         reason = layers.reason;
-                        const { patchRows, userRows, patchWrite, disablesOthers, isCarrier, bundleSwitch } = layers;
+                        const { patchRows, userRows, patchWrite, carrierRows, isCarrier, bundleSwitch } = layers;
                         // Activation reads the post-write truth: the switch state OR the
                         // patch layer, so a disabled plugin never reports "restart to
                         // apply".
@@ -3104,7 +3110,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             reason,
                             patchRows,
                             patchWrite: patchWrite ?? { ok: true, reason: null },
-                            carrier: disablesOthers,
+                            carrier: carrierRows,
                             bundleSwitch,
                             restart,
                             refresh,
@@ -3670,7 +3676,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                     catch (error) {
                         logEvent('warn', 'updates', `package source lookup failed — ${error instanceof Error ? error.message : String(error)}`);
                     }
-                    const updates = await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo);
+                    const updates = await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo, { holdYoungReleases: config.desktopHost === true });
                     for (const [name, migration] of sourceMigrationFor) {
                         const status = updates[name];
                         if (status !== undefined)
@@ -4478,6 +4484,12 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         if (pinnedForIdentification) {
                             declareProfileDependency(config.profile, name, pinValue, activeProfileDir);
                         }
+                        // #928: an update is remove-then-add, and a host killed between
+                        // the two leaves a package that is simply gone — with no record
+                        // of what was being attempted, because the completion log never
+                        // runs. Write the intent first, so the log can answer "where did
+                        // my plugin go" after the fact.
+                        logEvent('info', 'update-start', `${name} -> ${target} (profile ${config.profile})`);
                         const result = await runPlugin(config.profile, addArgs);
                         const cancelled = result.cancelled;
                         // The pin above is the market's own write, so it is undone whenever
@@ -5745,6 +5757,10 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         // it is meant to clean up after, and the rows outlive the package
                         // as boot-time orphans (#799).
                         const ownedRows = rowIdsForPackage(host, activeProfileDir, name);
+                        // #928: the same intent record as the update path — an uninstall
+                        // interrupted mid-remove leaves the same "where did it go" with no
+                        // entry saying what was running.
+                        logEvent('info', 'uninstall-start', `${name} (profile ${config.profile})`);
                         const result = await runPlugin(config.profile, ['remove', name]);
                         const cancelled = result.cancelled;
                         const ok = result.exitCode === 0 && !result.timedOut && !cancelled;

package/lib/trial.js

@@ -93,7 +93,7 @@ export function trialValidate(profileDir, newCommunityOrder, options = {}) {
     // id into one entry (1.0.4+) this is an override, not a refusal. Making it
     // fatal here is what rolled back every update for a profile that already
     // had a package row and a user-patch row on one id.
-    const duplicateFatal = duplicateEntryIdsAreFatal(profileDir);
+    const duplicateFatal = duplicateEntryIdsAreFatal(profileDir, dshInstall);
     for (const dup of composed.duplicates) {
         const message = `duplicate loader entry id ${JSON.stringify(dup.id)} (${dup.count} rows) / 重复的 loader 条目 id ${JSON.stringify(dup.id)}`;
         if (duplicateFatal)

package/lib/types/check.d.ts

@@ -302,10 +302,15 @@ export declare function composeLayers(layers: LayerInput[]): Composed;
  * patch row plus a user-patch row on the same id: fatal forever meant every
  * update of every plugin rolled back.
  *
- * Unknown version stays fatal: the conservative direction, and the case where
- * the evidence to be less strict is missing.
+ * An empty answer from the PROFILE lockfile is not "unknown" on the official
+ * Desktop: that host embeds the loader in `app.asar` and provides it to every
+ * profile, so no profile can ever name it (#943). Reading that as an old
+ * loader made the gate fatal for every update on 0.2.1-rc.2 — the exact report
+ * #853's fix was supposed to close. The host installation is asked before the
+ * evidence is treated as missing; only when both are silent does the
+ * conservative answer stand.
  */
-export declare function duplicateEntryIdsAreFatal(profileDirectory: string): boolean;
+export declare function duplicateEntryIdsAreFatal(profileDirectory: string, dshInstallDir?: string | null): boolean;
 /**
  * Build the bundle layer stack for a profile under a GIVEN bundle order —
  * the manifest order for analyzeProfile, or a candidate order for trial

package/lib/types/patch.d.ts

@@ -85,27 +85,32 @@ export declare function userPatchPackageReferences(patchPath: string, packageNam
  */
 export declare function rowIdsForPackage(host: PatchHost, profileDirectory: string, packageName: string): string[];
 /**
- * The ids of OTHER plugins a package's bundle patch DISABLES — top-level
- * `- id: X` + `disabled: true` rows targeting plugins it does not own. This is
- * the precise marker of a bundle whose toggle-off can brick the boot (#224):
- * dsh-postgres-backends disables session-persistence-jsonl, so once the market
- * also disables the postgres backends nothing provides sessionPersistence.
+ * The ids of OTHER plugins a package's bundle patch rewires — top-level rows
+ * that either `disabled: true` a plugin it does not own, or add an `inject:`
+ * requirement to one.
+ *
+ * Both are the marker of a bundle whose toggle-off can brick the boot while
+ * its patch keeps applying (#224, #938):
+ *  - dsh-postgres-backends disables session-persistence-jsonl, so once the
+ *    market also disables the postgres backends nothing provides
+ *    sessionPersistence;
+ *  - billion-context adds `inject: [biliBasicCompactionPolicy]` to the four
+ *    official agent presets, so disabling only its own row leaves the presets
+ *    waiting for a service that no longer exists — every preset disappears.
  *
  * A bundle that merely RECONFIGURES a neighbour is deliberately NOT counted:
  * the e2e fixture-cross tweaks dshm-fixture-b's config, and #147 requires
  * disabling it to leave that neighbour live — dropping such a bundle from the
  * stack broke its re-enable. Config-only side effects stay on the normal #147
- * path; only a foreign `disabled: true` triggers the bundle removal. Removing
- * the bundle still neutralizes any config side effects it carries, since its
- * whole patch stops applying.
+ * path. Removing the bundle still neutralizes any config side effects it
+ * carries, since its whole patch stops applying.
  *
  * Reads both patch sources like rowIdsForPackage — the declared
  * dsh.bundle.patch (one file or a LIST of them, #792) and the conventional
  * root cordis.patch.yml — so either form is detected, and every declared file
- * is attributed (a foreign disable declared in the second file is still what
- * bricks the boot, #224).
+ * is attributed.
  */
-export declare function carrierDisableIds(profileDirectory: string, packageName: string): string[];
+export declare function carrierRowIds(profileDirectory: string, packageName: string): string[];
 /**
  * The ids a package's bundle patch touches WITHOUT inserting them itself.
  *
@@ -121,7 +126,7 @@ export declare function carrierDisableIds(profileDirectory: string, packageName:
  * fixture-cross e2e exist to protect, where the neighbour must keep running
  * and the bundle must keep re-enabling.
  *
- * Reads both patch sources like carrierDisableIds: the declared
+ * Reads both patch sources like carrierRowIds: the declared
  * `dsh.bundle.patch` (one file or a LIST, #792) and the conventional root
  * cordis.patch.yml. Ownership is judged per file, because a package may ship
  * both and only the file's own `insert:` block says which ids it brings in.

package/lib/types/profile.d.ts

@@ -55,12 +55,16 @@ export declare function generationManagedNames(profile: string, explicitDir?: st
 export declare function readManifestDeps(profile: string, explicitDir?: string): Record<string, string>;
 /**
  * For each installed package, the OTHER installed package that declares it —
- * as a dependency or a peer dependency — in its own manifest.
+ * as a dependency, an optional dependency, or a peer dependency — in its own
+ * manifest.
  *
  * pnpm's auto-install-peers writes a plugin's peers into the profile manifest
  * as direct dependencies, so a native binding a plugin needs shows up in the
  * installed list looking exactly like a plugin the user chose (#634). What
- * separates them is that somebody else asked for it.
+ * separates them is that somebody else asked for it. Optional dependencies
+ * count for the same reason (#941): a platform-specific binary a plugin lists
+ * under `optionalDependencies` is payload, not a plugin the user chose, even
+ * when pnpm installed that package and the card rendered.
  *
  * Ownership is decided by the first owner in sorted order, so the answer does
  * not depend on the manifest's key order. A package that declares itself is

package/lib/types/updates.d.ts

@@ -63,6 +63,18 @@ export interface UpdateStatus {
         repo: string;
         target: string;
     };
+    /**
+     * A newer release exists but this profile's `minimumReleaseAge` will not let
+     * pnpm install it yet (#945). The official Desktop takes no one-shot bypass,
+     * so offering the update there means offering a button that is guaranteed
+     * to fail; the market names the wait instead. `updateAvailable` is false —
+     * an update the user cannot apply is not available — and `until` is when
+     * pnpm will accept it.
+     */
+    heldUpdate?: {
+        latest: string;
+        until: string;
+    };
     /**
      * The version this package's channel points at, when it differs from what
      * is installed and is NOT newer.
@@ -210,4 +222,14 @@ onlineSourceFor?: ReadonlyMap<string, string>,
  * entry that owns both the repo and the name, the npm fallback would
  * compare the install with whatever package merely shares its name.
  */
-catalogNpmByRepo?: ReadonlyMap<string, string>): Promise<Record<string, UpdateStatus>>;
+catalogNpmByRepo?: ReadonlyMap<string, string>, 
+/**
+ * Hold back releases that this profile's `minimumReleaseAge` will refuse
+ * (#945). Only true where the install path has no bypass: the official
+ * Desktop's manager takes no pnpm options, while the CLI path retries once
+ * with `--config.minimum-release-age=0` and CAN install a young release.
+ * Hiding those on the CLI would suppress updates that work.
+ */
+options?: {
+    holdYoungReleases?: boolean;
+}): Promise<Record<string, UpdateStatus>>;