dshmarket 1.66.44 → 1.66.45

package/client/client.js

@@ -393,6 +393,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			updateNow: "立即更新",
 			updateFail: "更新失败",
 			upToDate: "已是最新",
+			updateHeldTag: "新版等待中",
+			updateHeldHint: "这个 profile 要求新版本发布满一段时间才允许安装，大约还要 {1} 小时。",
 			newerPrereleaseAvailable: "预发布版 {0} 已发布",
 			newerPrereleaseHint: "npm 上的 latest 没有更新；你在跟的这条预发布线发布了更新的版本。",
 			unreleasedCommits: "有新提交（未发版）{0}",
@@ -1132,6 +1134,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			updateNow: "Update now",
 			updateFail: "Update failed",
 			upToDate: "Up to date",
+			updateHeldTag: "new version waiting",
+			updateHeldHint: "This profile waits a while before it installs a fresh release; about {1} hour(s) left.",
 			newerPrereleaseAvailable: "prerelease {0} published",
 			newerPrereleaseHint: "The package's latest tag has no update; the prerelease line you are on published a newer build.",
 			unreleasedCommits: "New commits (unreleased) {0}",
@@ -2892,14 +2896,17 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		*
 		* The repository name IS the plugin name in the ordinary case, because a
 		* repository holding one plugin is named after it. Only the compound form
-		* needs unpicking, and its last segment is the plugin's own directory.
+		* needs unpicking. Prefer its mapped npm package when available: a generic
+		* directory such as `plugin` is not the product name. Without that mapping,
+		* keep the directory-leaf fallback for source-only entries.
 		*
 		* Not a substitute for the identity: every key, lookup and install still
 		* uses `name` unchanged.
 		*/
-		function pluginName(name) {
+		function pluginName(name, npm) {
 			const hash = name.indexOf("#");
 			if (hash === -1) return name;
+			if (typeof npm === "string" && npm.trim() !== "") return npm.trim();
 			const sub = name.slice(hash + 1);
 			const leaf = sub.slice(sub.lastIndexOf("/") + 1);
 			return leaf === "" ? name.slice(0, hash) : leaf;
@@ -7392,7 +7399,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				plugin.url
 			]);
 			const visible = (curated.length > 0 ? curated : fallback.shots).filter((src) => !broken.includes(src));
-			const name = pluginName(plugin.name);
+			const name = pluginName(plugin.name, plugin.npm);
 			if (visible.length === 0) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
 				ref: setCoverRef,
 				type: "button",
@@ -8699,7 +8706,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				const entry = data?.plugins.find((plugin) => plugin.npm === name || plugin.name === name);
 				if (entry === void 0) return { title: name };
 				return {
-					title: pluginName(entry.name),
+					title: pluginName(entry.name, entry.npm),
 					author: entry.owner === "" ? void 0 : entry.owner,
 					avatar: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(OwnerAvatar, {
 						name: entry.name,
@@ -11813,7 +11820,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 										title: p.name,
 										"aria-label": `${p.name} — ${t("repoLink")}`,
 										children: [
-											pluginName(p.name),
+											pluginName(p.name, p.npm),
 											/* @__PURE__ */ (0, react_jsx_runtime.jsx)(GithubRepoMark, { className: Market_module_css_default.repoMark }),
 											p.deprecated === true && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 												className: Market_module_css_default.depBadge,
@@ -12002,7 +12009,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 											rel: "noreferrer",
 											title: p.name,
 											"aria-label": `${p.name} — ${t("repoLink")}`,
-											children: [pluginName(p.name), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(GithubRepoMark, { className: Market_module_css_default.repoMark })]
+											children: [pluginName(p.name, p.npm), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(GithubRepoMark, { className: Market_module_css_default.repoMark })]
 										}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 											className: Market_module_css_default.byline,
 											children: [
@@ -14151,6 +14158,10 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 																else doUpdate(name);
 															},
 															children: status.restoreRequired === true ? t("restoreOnline") : t("update")
+														}) : status?.heldUpdate !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+															className: Market_module_css_default.metaTag,
+															title: t("updateHeldHint").replace("{1}", String(Math.max(1, Math.ceil((Date.parse(status.heldUpdate.until) - Date.now()) / 36e5)))),
+															children: t("updateHeldTag").replace("{0}", displayLatest(status.heldUpdate.latest))
 														}) : localDev ? null : status?.unreleasedCommit != null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 															className: Market_module_css_default.metaTag,
 															title: t("unreleasedCommitsHint"),
@@ -14382,7 +14393,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 						className: Market_module_css_default.confirmModal,
 						contentClassName: Market_module_css_default.confirmContent,
 						onClose: () => setConfirming(null),
-						title: t("confirmTitle") + " " + confirming.name + "?",
+						title: t("confirmTitle") + " " + pluginName(confirming.name, confirming.npm) + "?",
 						footer: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 							variant: "ghost",
 							onClick: () => setConfirming(null),
@@ -14538,7 +14549,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 						t
 					}),
 					commentsFor !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CommentsModal, {
-						name: pluginName(commentsFor.name),
+						name: pluginName(commentsFor.name, commentsFor.npm),
 						url: commentsFor.url,
 						lang,
 						onClose: () => setCommentsFor(null),

package/lib/check.js

@@ -761,15 +761,27 @@ export function composeLayers(layers) {
  * patch row plus a user-patch row on the same id: fatal forever meant every
  * update of every plugin rolled back.
  *
- * Unknown version stays fatal: the conservative direction, and the case where
- * the evidence to be less strict is missing.
+ * An empty answer from the PROFILE lockfile is not "unknown" on the official
+ * Desktop: that host embeds the loader in `app.asar` and provides it to every
+ * profile, so no profile can ever name it (#943). Reading that as an old
+ * loader made the gate fatal for every update on 0.2.1-rc.2 — the exact report
+ * #853's fix was supposed to close. The host installation is asked before the
+ * evidence is treated as missing; only when both are silent does the
+ * conservative answer stand.
  */
-export function duplicateEntryIdsAreFatal(profileDirectory) {
+export function duplicateEntryIdsAreFatal(profileDirectory, dshInstallDir) {
     const versions = lockfileCoreVersions(profileDirectory).get('@deepseek-ai/cordis-plugin-loader') ?? [];
-    if (versions.length === 0)
+    if (versions.length > 0) {
+        const newest = versions.reduce((a, b) => (compareSemver(a, b) >= 0 ? a : b));
+        return compareSemver(newest, '1.0.4') < 0;
+    }
+    const install = dshInstallDir === undefined ? findDshInstallDir() : dshInstallDir;
+    const host = install === null
+        ? null
+        : readNodeModulesVersion(dirname(hostNodeModulesRoot(install)), '@deepseek-ai/cordis-plugin-loader');
+    if (host === null)
         return true;
-    const newest = versions.reduce((a, b) => (compareSemver(a, b) >= 0 ? a : b));
-    return compareSemver(newest, '1.0.4') < 0;
+    return compareSemver(host, '1.0.4') < 0;
 }
 /** Distinct versions of `@deepseek-ai/{dsh,cordis}*` packages in the lockfile. */
 function lockfileCoreVersions(profileDir) {
@@ -1349,7 +1361,7 @@ export function analyzeProfile(profileDirectory, options = {}) {
     // Rows on one id: a boot failure on an old loader, a silent override on a
     // new one (see duplicateEntryIdsAreFatal). Refusing an operation over the
     // second shape rolled back every update for the reporter's profile.
-    const duplicateFatal = duplicateEntryIdsAreFatal(profileDirectory);
+    const duplicateFatal = duplicateEntryIdsAreFatal(profileDirectory, dshInstall);
     for (const dup of composed.duplicates) {
         if (duplicateFatal) {
             errors.push(`duplicate loader entry id ${JSON.stringify(dup.id)} (${dup.count} rows: ${dup.layers.join(', ')})`);

package/lib/patch.js

@@ -319,40 +319,70 @@ function foreignDisableIds(rows) {
     return ids;
 }
 /**
- * The ids of OTHER plugins a package's bundle patch DISABLES — top-level
- * `- id: X` + `disabled: true` rows targeting plugins it does not own. This is
- * the precise marker of a bundle whose toggle-off can brick the boot (#224):
- * dsh-postgres-backends disables session-persistence-jsonl, so once the market
- * also disables the postgres backends nothing provides sessionPersistence.
+ * Top-level patch rows that add an `inject:` requirement to another plugin.
+ *
+ * Same shape rule as foreignDisableIds: anything at the top level with an id
+ * is a statement about a plugin this package does not own. An `inject` there
+ * makes that foreign row depend on a service — usually one this bundle
+ * provides — so switching this package off while leaving its patch in the
+ * stack strands the row: #938's billion-context adds
+ * `inject: [biliBasicCompactionPolicy]` to the four official agent presets,
+ * and a row-level disable left them unable to activate.
+ */
+function foreignInjectIds(rows) {
+    const ids = [];
+    for (const row of rows) {
+        if (row === null || typeof row !== 'object' || Array.isArray(row))
+            continue;
+        const record = row;
+        const id = record.id;
+        if (typeof id === 'string' && record.inject !== undefined && !ids.includes(id))
+            ids.push(id);
+    }
+    return ids;
+}
+/**
+ * The ids of OTHER plugins a package's bundle patch rewires — top-level rows
+ * that either `disabled: true` a plugin it does not own, or add an `inject:`
+ * requirement to one.
+ *
+ * Both are the marker of a bundle whose toggle-off can brick the boot while
+ * its patch keeps applying (#224, #938):
+ *  - dsh-postgres-backends disables session-persistence-jsonl, so once the
+ *    market also disables the postgres backends nothing provides
+ *    sessionPersistence;
+ *  - billion-context adds `inject: [biliBasicCompactionPolicy]` to the four
+ *    official agent presets, so disabling only its own row leaves the presets
+ *    waiting for a service that no longer exists — every preset disappears.
  *
  * A bundle that merely RECONFIGURES a neighbour is deliberately NOT counted:
  * the e2e fixture-cross tweaks dshm-fixture-b's config, and #147 requires
  * disabling it to leave that neighbour live — dropping such a bundle from the
  * stack broke its re-enable. Config-only side effects stay on the normal #147
- * path; only a foreign `disabled: true` triggers the bundle removal. Removing
- * the bundle still neutralizes any config side effects it carries, since its
- * whole patch stops applying.
+ * path. Removing the bundle still neutralizes any config side effects it
+ * carries, since its whole patch stops applying.
  *
  * Reads both patch sources like rowIdsForPackage — the declared
  * dsh.bundle.patch (one file or a LIST of them, #792) and the conventional
  * root cordis.patch.yml — so either form is detected, and every declared file
- * is attributed (a foreign disable declared in the second file is still what
- * bricks the boot, #224).
+ * is attributed.
  */
-export function carrierDisableIds(profileDirectory, packageName) {
+export function carrierRowIds(profileDirectory, packageName) {
     const packageDir = join(profileDirectory, 'node_modules', packageName);
-    const disabled = new Set();
+    const rows = new Set();
     const collectFromFile = (patchPath) => {
-        const rows = parsePatchFile(patchPath);
-        if (rows === null)
+        const parsed = parsePatchFile(patchPath);
+        if (parsed === null)
             return;
-        for (const id of foreignDisableIds(rows))
-            disabled.add(id);
+        for (const id of foreignDisableIds(parsed))
+            rows.add(id);
+        for (const id of foreignInjectIds(parsed))
+            rows.add(id);
     };
     for (const file of declaredBundlePatchFiles(packageDir))
         collectFromFile(file);
     collectFromFile(join(packageDir, 'cordis.patch.yml'));
-    return [...disabled];
+    return [...rows];
 }
 /**
  * The ids a package's bundle patch touches WITHOUT inserting them itself.
@@ -369,7 +399,7 @@ export function carrierDisableIds(profileDirectory, packageName) {
  * fixture-cross e2e exist to protect, where the neighbour must keep running
  * and the bundle must keep re-enabling.
  *
- * Reads both patch sources like carrierDisableIds: the declared
+ * Reads both patch sources like carrierRowIds: the declared
  * `dsh.bundle.patch` (one file or a LIST, #792) and the conventional root
  * cordis.patch.yml. Ownership is judged per file, because a package may ship
  * both and only the file's own `insert:` block says which ids it brings in.

package/lib/profile.js

@@ -127,12 +127,16 @@ export function readManifestDeps(profile, explicitDir) {
 }
 /**
  * For each installed package, the OTHER installed package that declares it —
- * as a dependency or a peer dependency — in its own manifest.
+ * as a dependency, an optional dependency, or a peer dependency — in its own
+ * manifest.
  *
  * pnpm's auto-install-peers writes a plugin's peers into the profile manifest
  * as direct dependencies, so a native binding a plugin needs shows up in the
  * installed list looking exactly like a plugin the user chose (#634). What
- * separates them is that somebody else asked for it.
+ * separates them is that somebody else asked for it. Optional dependencies
+ * count for the same reason (#941): a platform-specific binary a plugin lists
+ * under `optionalDependencies` is payload, not a plugin the user chose, even
+ * when pnpm installed that package and the card rendered.
  *
  * Ownership is decided by the first owner in sorted order, so the answer does
  * not depend on the manifest's key order. A package that declares itself is
@@ -152,7 +156,7 @@ export function readDependencyOwners(profile, names, explicitDir) {
         if (typeof manifest !== 'object' || manifest === null)
             continue;
         const declared = manifest;
-        for (const field of [declared.dependencies, declared.peerDependencies]) {
+        for (const field of [declared.dependencies, declared.optionalDependencies, declared.peerDependencies]) {
             if (typeof field !== 'object' || field === null)
                 continue;
             for (const dependency of Object.keys(field)) {

package/lib/routes.js

@@ -45,7 +45,7 @@ import { readJsonBody, refuseUnadmitted, sameOrigin, sendJson } from './http.js'
 import { resolveDshHome } from './home-paths.js';
 import { detectedDebugger, detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest, trustedSelfUninstallRequest, selfUninstallReachableFrom, restartReachableFrom } from './restart.js';
 import { activationAfterReplace, brokenClientBundles, bundlePatchIsEmpty, checkClientBundle, defaultHostRuntimeFacts, findUnservedConfigNamespaces, hasHostHalf, hostPeerGate, newlyBrokenBundles, peerGateRemedy, verifyActivation } from './verify.js';
-import { carrierDisableIds, disableRow, enableRow, findUserPatchPath, foreignRowIds, isProtectedModule, packagePatchFlags, readUserPatchState, removeRowBlocks, rowIdsForPackage, userPatchPackageReferences, } from './patch.js';
+import { carrierRowIds, disableRow, enableRow, findUserPatchPath, foreignRowIds, isProtectedModule, packagePatchFlags, readUserPatchState, removeRowBlocks, rowIdsForPackage, userPatchPackageReferences, } from './patch.js';
 import { createProfileBackup, downloadWebdav, MAX_BACKUP_BYTES, mergeRestoreManifest, restoreProfileBackup, unportableDeps, uploadWebdav, } from './backup.js';
 import { createGist, fitsGistLimit, GistError, gistErrorCode, parseGistId, readGist, resolveGistTokenSource, updateGist, verifyGistToken, } from './gist.js';
 import { MAX_UPDATE_OPERATIONS_V1, UpdateOperationStoreV1, UPDATE_API_V1_SCHEMA } from './update-api-v1.js';
@@ -856,9 +856,9 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         // A bundle that merely reconfigures a neighbour (config without
         // disabled) is NOT dropped: #147 requires disabling it to leave the
         // neighbour live, and the e2e fixture-cross re-enable breaks otherwise.
-        const disablesOthers = carrierDisableIds(activeProfileDir, name);
+        const carrierRows = carrierRowIds(activeProfileDir, name);
         const foreignRows = foreignRowIds(activeProfileDir, name);
-        const isCarrier = disablesOthers.length > 0;
+        const isCarrier = carrierRows.length > 0;
         // Both layers, or neither (#696 B). `dsh.profile.bundles` is the
         // package-level declaration the official plugins page's switch reads
         // and the loader composes; the patch rows above are the runtime
@@ -888,7 +888,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                     ? addProfileBundle(activeProfileDir, name)
                     : removeProfileBundle(activeProfileDir, name);
                 logEvent('info', 'toggle', isCarrier
-                    ? `${name}: disable-carrier ${enabled ? 're-added to' : 'removed from'} dsh.profile.bundles (disables: ${disablesOthers.join(', ')})`
+                    ? `${name}: disable-carrier ${enabled ? 're-added to' : 'removed from'} dsh.profile.bundles (carrier rows: ${carrierRows.join(', ')})`
                     : reBundle
                         ? `${name}: re-added to dsh.profile.bundles, which nothing was composing (#696)`
                         : `${name}: dsh.profile.bundles ${enabled ? 're-added' : 'removed'} so the official page's package switch agrees (#696)`);
@@ -989,7 +989,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
             }
         }
         logEvent(ok ? 'info' : 'error', 'toggle', `${name}: ${enabled ? 'on' : 'off'} ok=${String(ok)}`);
-        return { ok, reason, patchRows, userRows, patchWrite, disablesOthers, isCarrier, bundleSwitch };
+        return { ok, reason, patchRows, userRows, patchWrite, carrierRows, isCarrier, bundleSwitch };
     }
     /**
      * The plugin inventory the recovery surface is allowed to switch.
@@ -1015,7 +1015,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         const plugins = [];
         for (const name of names) {
             const rows = rowIdsForPackage(host, activeProfileDir, name);
-            const carrier = carrierDisableIds(activeProfileDir, name).length > 0;
+            const carrier = carrierRowIds(activeProfileDir, name).length > 0;
             if (rows.length === 0 && !carrier)
                 continue;
             const isProtected = isProtectedModule(name);
@@ -1958,7 +1958,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                 }
                 try {
                     const { channelFor, onlineSourceFor, catalogNpmByRepo } = await updateCheckInputs();
-                    const updates = await checkUpdates(config.profile, forceCheckFrom(request), activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo);
+                    const updates = await checkUpdates(config.profile, forceCheckFrom(request), activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo, { holdYoungReleases: config.desktopHost === true });
                     // `packages` carries the same objects the single-package endpoint
                     // returns, so one parser serves both. Only updatable ones: a badge
                     // wants the count, a panel wants the rows, and neither wants to
@@ -2005,7 +2005,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         // or a catalog-matched local package answers here with the
                         // release it can be compared against rather than with nothing.
                         const { channelFor, onlineSourceFor, catalogNpmByRepo } = await updateCheckInputs();
-                        const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo))[name];
+                        const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo, { holdYoungReleases: config.desktopHost === true }))[name];
                         if (update === undefined) {
                             sendJson(response, 404, { schema: UPDATE_API_V1_SCHEMA, error: 'plugin is not installed' });
                             return;
@@ -3066,7 +3066,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         const layers = await switchPluginLayers(name, enabled, ok, reason);
                         ok = layers.ok;
                         reason = layers.reason;
-                        const { patchRows, userRows, patchWrite, disablesOthers, isCarrier, bundleSwitch } = layers;
+                        const { patchRows, userRows, patchWrite, carrierRows, isCarrier, bundleSwitch } = layers;
                         // Activation reads the post-write truth: the switch state OR the
                         // patch layer, so a disabled plugin never reports "restart to
                         // apply".
@@ -3110,7 +3110,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             reason,
                             patchRows,
                             patchWrite: patchWrite ?? { ok: true, reason: null },
-                            carrier: disablesOthers,
+                            carrier: carrierRows,
                             bundleSwitch,
                             restart,
                             refresh,
@@ -3676,7 +3676,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                     catch (error) {
                         logEvent('warn', 'updates', `package source lookup failed — ${error instanceof Error ? error.message : String(error)}`);
                     }
-                    const updates = await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo);
+                    const updates = await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo, { holdYoungReleases: config.desktopHost === true });
                     for (const [name, migration] of sourceMigrationFor) {
                         const status = updates[name];
                         if (status !== undefined)

package/lib/trial.js

@@ -93,7 +93,7 @@ export function trialValidate(profileDir, newCommunityOrder, options = {}) {
     // id into one entry (1.0.4+) this is an override, not a refusal. Making it
     // fatal here is what rolled back every update for a profile that already
     // had a package row and a user-patch row on one id.
-    const duplicateFatal = duplicateEntryIdsAreFatal(profileDir);
+    const duplicateFatal = duplicateEntryIdsAreFatal(profileDir, dshInstall);
     for (const dup of composed.duplicates) {
         const message = `duplicate loader entry id ${JSON.stringify(dup.id)} (${dup.count} rows) / 重复的 loader 条目 id ${JSON.stringify(dup.id)}`;
         if (duplicateFatal)

package/lib/types/check.d.ts

@@ -302,10 +302,15 @@ export declare function composeLayers(layers: LayerInput[]): Composed;
  * patch row plus a user-patch row on the same id: fatal forever meant every
  * update of every plugin rolled back.
  *
- * Unknown version stays fatal: the conservative direction, and the case where
- * the evidence to be less strict is missing.
+ * An empty answer from the PROFILE lockfile is not "unknown" on the official
+ * Desktop: that host embeds the loader in `app.asar` and provides it to every
+ * profile, so no profile can ever name it (#943). Reading that as an old
+ * loader made the gate fatal for every update on 0.2.1-rc.2 — the exact report
+ * #853's fix was supposed to close. The host installation is asked before the
+ * evidence is treated as missing; only when both are silent does the
+ * conservative answer stand.
  */
-export declare function duplicateEntryIdsAreFatal(profileDirectory: string): boolean;
+export declare function duplicateEntryIdsAreFatal(profileDirectory: string, dshInstallDir?: string | null): boolean;
 /**
  * Build the bundle layer stack for a profile under a GIVEN bundle order —
  * the manifest order for analyzeProfile, or a candidate order for trial

package/lib/types/patch.d.ts

@@ -85,27 +85,32 @@ export declare function userPatchPackageReferences(patchPath: string, packageNam
  */
 export declare function rowIdsForPackage(host: PatchHost, profileDirectory: string, packageName: string): string[];
 /**
- * The ids of OTHER plugins a package's bundle patch DISABLES — top-level
- * `- id: X` + `disabled: true` rows targeting plugins it does not own. This is
- * the precise marker of a bundle whose toggle-off can brick the boot (#224):
- * dsh-postgres-backends disables session-persistence-jsonl, so once the market
- * also disables the postgres backends nothing provides sessionPersistence.
+ * The ids of OTHER plugins a package's bundle patch rewires — top-level rows
+ * that either `disabled: true` a plugin it does not own, or add an `inject:`
+ * requirement to one.
+ *
+ * Both are the marker of a bundle whose toggle-off can brick the boot while
+ * its patch keeps applying (#224, #938):
+ *  - dsh-postgres-backends disables session-persistence-jsonl, so once the
+ *    market also disables the postgres backends nothing provides
+ *    sessionPersistence;
+ *  - billion-context adds `inject: [biliBasicCompactionPolicy]` to the four
+ *    official agent presets, so disabling only its own row leaves the presets
+ *    waiting for a service that no longer exists — every preset disappears.
  *
  * A bundle that merely RECONFIGURES a neighbour is deliberately NOT counted:
  * the e2e fixture-cross tweaks dshm-fixture-b's config, and #147 requires
  * disabling it to leave that neighbour live — dropping such a bundle from the
  * stack broke its re-enable. Config-only side effects stay on the normal #147
- * path; only a foreign `disabled: true` triggers the bundle removal. Removing
- * the bundle still neutralizes any config side effects it carries, since its
- * whole patch stops applying.
+ * path. Removing the bundle still neutralizes any config side effects it
+ * carries, since its whole patch stops applying.
  *
  * Reads both patch sources like rowIdsForPackage — the declared
  * dsh.bundle.patch (one file or a LIST of them, #792) and the conventional
  * root cordis.patch.yml — so either form is detected, and every declared file
- * is attributed (a foreign disable declared in the second file is still what
- * bricks the boot, #224).
+ * is attributed.
  */
-export declare function carrierDisableIds(profileDirectory: string, packageName: string): string[];
+export declare function carrierRowIds(profileDirectory: string, packageName: string): string[];
 /**
  * The ids a package's bundle patch touches WITHOUT inserting them itself.
  *
@@ -121,7 +126,7 @@ export declare function carrierDisableIds(profileDirectory: string, packageName:
  * fixture-cross e2e exist to protect, where the neighbour must keep running
  * and the bundle must keep re-enabling.
  *
- * Reads both patch sources like carrierDisableIds: the declared
+ * Reads both patch sources like carrierRowIds: the declared
  * `dsh.bundle.patch` (one file or a LIST, #792) and the conventional root
  * cordis.patch.yml. Ownership is judged per file, because a package may ship
  * both and only the file's own `insert:` block says which ids it brings in.

package/lib/types/profile.d.ts

@@ -55,12 +55,16 @@ export declare function generationManagedNames(profile: string, explicitDir?: st
 export declare function readManifestDeps(profile: string, explicitDir?: string): Record<string, string>;
 /**
  * For each installed package, the OTHER installed package that declares it —
- * as a dependency or a peer dependency — in its own manifest.
+ * as a dependency, an optional dependency, or a peer dependency — in its own
+ * manifest.
  *
  * pnpm's auto-install-peers writes a plugin's peers into the profile manifest
  * as direct dependencies, so a native binding a plugin needs shows up in the
  * installed list looking exactly like a plugin the user chose (#634). What
- * separates them is that somebody else asked for it.
+ * separates them is that somebody else asked for it. Optional dependencies
+ * count for the same reason (#941): a platform-specific binary a plugin lists
+ * under `optionalDependencies` is payload, not a plugin the user chose, even
+ * when pnpm installed that package and the card rendered.
  *
  * Ownership is decided by the first owner in sorted order, so the answer does
  * not depend on the manifest's key order. A package that declares itself is

package/lib/types/updates.d.ts

@@ -63,6 +63,18 @@ export interface UpdateStatus {
         repo: string;
         target: string;
     };
+    /**
+     * A newer release exists but this profile's `minimumReleaseAge` will not let
+     * pnpm install it yet (#945). The official Desktop takes no one-shot bypass,
+     * so offering the update there means offering a button that is guaranteed
+     * to fail; the market names the wait instead. `updateAvailable` is false —
+     * an update the user cannot apply is not available — and `until` is when
+     * pnpm will accept it.
+     */
+    heldUpdate?: {
+        latest: string;
+        until: string;
+    };
     /**
      * The version this package's channel points at, when it differs from what
      * is installed and is NOT newer.
@@ -210,4 +222,14 @@ onlineSourceFor?: ReadonlyMap<string, string>,
  * entry that owns both the repo and the name, the npm fallback would
  * compare the install with whatever package merely shares its name.
  */
-catalogNpmByRepo?: ReadonlyMap<string, string>): Promise<Record<string, UpdateStatus>>;
+catalogNpmByRepo?: ReadonlyMap<string, string>, 
+/**
+ * Hold back releases that this profile's `minimumReleaseAge` will refuse
+ * (#945). Only true where the install path has no bypass: the official
+ * Desktop's manager takes no pnpm options, while the CLI path retries once
+ * with `--config.minimum-release-age=0` and CAN install a young release.
+ * Hiding those on the CLI would suppress updates that work.
+ */
+options?: {
+    holdYoungReleases?: boolean;
+}): Promise<Record<string, UpdateStatus>>;

package/lib/updates.js

@@ -9,6 +9,7 @@ import { DIST_TAG } from './channels.js';
 import { resolveHeadCommit } from './accelerate.js';
 import { marketFetch } from './net.js';
 import { activeRegion, githubRoutesFor, rememberGithubRoute, throughProxy } from './regions.js';
+import { readMinimumReleaseAgeMs } from './install.js';
 import { hasDshManifest, profileDir, readGitResolutionCommit, readInstalled, readInstalledVersion, readLockCommits, readProfileBundles } from './profile.js';
 import { userPatchPackageReferences } from './patch.js';
 import { catalogRepoKey, gitCommitOfTarget, gitRefOfTarget, gitUploadPackUrl, hasSemverSelector, hostedRepoKey, githubCommitOfTarget, githubRefOfTarget, isGenerationLink, isGitHostedSpec, lookupRepoFromUrl, parseGitHubRemote, repoOfTarget } from './sources.js';
@@ -235,6 +236,24 @@ export async function latestPublishedRecently(name, windowMs = 26 * 60 * 60 * 10
         return null;
     }
 }
+/**
+ * When a specific version was published, from the packument's own time map
+ * (#945). Null when the registry cannot answer — callers must not claim a
+ * wait on null.
+ */
+async function npmPublishedAt(name, version) {
+    try {
+        const doc = (await fetchJson(npmUrl(encodeURIComponent(name))));
+        const published = doc.time?.[version];
+        if (published === undefined)
+            return null;
+        const at = Date.parse(published);
+        return Number.isFinite(at) ? at : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** The registry's current `latest` version for a package, or null when it can't be read. */
 /**
  * The version a channel subscriber should be offered: the newest build in
@@ -448,6 +467,42 @@ async function gitVersionUpdate(spec, installedVersion, region) {
     const compared = compareVersions(remoteVersion, installedVersion);
     return compared === null ? null : compared > 0;
 }
+/**
+ * A held update whose window has passed is available again. The cache lives
+ * 30 minutes; without this a user would watch "in about 1 hour" sit there
+ * after the hour ended, and could not update until the TTL happened to turn
+ * over. Pure: returns the same map when nothing expired.
+ */
+/**
+ * When the profile's fresh-release wait ends for `latest`, or null when the
+ * release is old enough to install now (or the registry cannot say).
+ */
+async function releaseAgeHold(name, latest, profile, activeProfileDir) {
+    if (latest === null)
+        return null;
+    const windowMs = readMinimumReleaseAgeMs(profile, activeProfileDir);
+    if (windowMs === null)
+        return null;
+    const published = await npmPublishedAt(name, latest);
+    if (published === null)
+        return null;
+    const until = published + windowMs;
+    return until > Date.now() ? new Date(until).toISOString() : null;
+}
+function refreshExpiredHolds(data) {
+    let changed = false;
+    const out = {};
+    for (const [name, status] of Object.entries(data)) {
+        if (status.heldUpdate === undefined || Date.parse(status.heldUpdate.until) > Date.now()) {
+            out[name] = status;
+            continue;
+        }
+        const { heldUpdate: _held, ...rest } = status;
+        out[name] = { ...rest, updateAvailable: true };
+        changed = true;
+    }
+    return changed ? out : data;
+}
 /** Per-plugin update checks; a failed check reports no update rather than failing the listing. */
 export async function checkUpdates(profile, force = false, explicitDir, 
 /**
@@ -470,15 +525,23 @@ onlineSourceFor = new Map(),
  * entry that owns both the repo and the name, the npm fallback would
  * compare the install with whatever package merely shares its name.
  */
-catalogNpmByRepo = new Map()) {
+catalogNpmByRepo = new Map(), 
+/**
+ * Hold back releases that this profile's `minimumReleaseAge` will refuse
+ * (#945). Only true where the install path has no bypass: the official
+ * Desktop's manager takes no pnpm options, while the CLI path retries once
+ * with `--config.minimum-release-age=0` and CAN install a young release.
+ * Hiding those on the CLI would suppress updates that work.
+ */
+options = {}) {
     const activeProfileDir = profileDir(profile, explicitDir);
     // The channel is part of the key: switching to betas has to change the
     // answer immediately, and a cache keyed on the profile alone would serve
     // the stable verdict for the rest of the TTL — reading as "the setting did
     // nothing".
-    const cacheKey = `${activeProfileDir}\u0000${[...channelFor].map(([n, c]) => `${n}:${c}`).sort().join(',')}\u0000${[...onlineSourceFor].map(([n, s]) => `${n}:${s}`).sort().join(',')}\u0000${[...catalogNpmByRepo].map(([n, s]) => `${n}:${s}`).sort().join(',')}`;
+    const cacheKey = `${activeProfileDir}\u0000${options.holdYoungReleases === true ? 'hold' : 'any'}\u0000${[...channelFor].map(([n, c]) => `${n}:${c}`).sort().join(',')}\u0000${[...onlineSourceFor].map(([n, s]) => `${n}:${s}`).sort().join(',')}\u0000${[...catalogNpmByRepo].map(([n, s]) => `${n}:${s}`).sort().join(',')}`;
     if (!force && updatesCache?.key === cacheKey && Date.now() - updatesCache.at < UPDATES_TTL_MS) {
-        return updatesCache.data;
+        return refreshExpiredHolds(updatesCache.data);
     }
     const installed = readInstalled(profile, activeProfileDir);
     const lockCommits = readLockCommits(profile, activeProfileDir);
@@ -490,10 +553,15 @@ catalogNpmByRepo = new Map()) {
             const onlineSource = onlineSourceFor.get(name);
             if (onlineSource !== undefined) {
                 const latest = await fetchNpmLatest(onlineSource);
-                const updateAvailable = isUpgrade(version, latest);
+                const upgrade = isUpgrade(version, latest);
+                const heldUntil = upgrade && options.holdYoungReleases === true
+                    ? await releaseAgeHold(onlineSource, latest, profile, activeProfileDir)
+                    : null;
                 result[name] = {
-                    kind: 'linked', version, current: version, latest, updateAvailable,
-                    ...(updateAvailable ? { restoreRequired: true } : {}),
+                    kind: 'linked', version, current: version, latest,
+                    updateAvailable: upgrade && heldUntil === null,
+                    ...(heldUntil === null ? {} : { heldUpdate: { latest: latest, until: heldUntil } }),
+                    ...(upgrade ? { restoreRequired: true } : {}),
                 };
                 return;
             }
@@ -619,9 +687,13 @@ catalogNpmByRepo = new Map()) {
                 const mayFollowATag = !upgrade
                     && (version?.includes('-') === true || (stable !== null && version !== null && isUpgrade(stable, version) === false && stable !== version));
                 const newerPrerelease = mayFollowATag ? await newerPrereleaseFor(name, version) : null;
+                const heldUntil = upgrade && options.holdYoungReleases === true
+                    ? await releaseAgeHold(name, latest, profile, activeProfileDir)
+                    : null;
                 result[name] = {
                     kind: 'npm', version, current: version, latest,
-                    updateAvailable: upgrade,
+                    updateAvailable: upgrade && heldUntil === null,
+                    ...(heldUntil === null ? {} : { heldUpdate: { latest: latest, until: heldUntil } }),
                     ...(newerPrerelease === null ? {} : { newerPrerelease }),
                     ...(sideways ? { channelSwitch: latest } : {}),
                 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.44",
+  "version": "1.66.45",
   "icon": "assets/logo.svg",
   "type": "module",
   "main": "lib/index.js",

package/src/check.ts

@@ -979,14 +979,26 @@ export function composeLayers(layers: LayerInput[]): Composed {
  * patch row plus a user-patch row on the same id: fatal forever meant every
  * update of every plugin rolled back.
  *
- * Unknown version stays fatal: the conservative direction, and the case where
- * the evidence to be less strict is missing.
+ * An empty answer from the PROFILE lockfile is not "unknown" on the official
+ * Desktop: that host embeds the loader in `app.asar` and provides it to every
+ * profile, so no profile can ever name it (#943). Reading that as an old
+ * loader made the gate fatal for every update on 0.2.1-rc.2 — the exact report
+ * #853's fix was supposed to close. The host installation is asked before the
+ * evidence is treated as missing; only when both are silent does the
+ * conservative answer stand.
  */
-export function duplicateEntryIdsAreFatal(profileDirectory: string): boolean {
+export function duplicateEntryIdsAreFatal(profileDirectory: string, dshInstallDir?: string | null): boolean {
   const versions = lockfileCoreVersions(profileDirectory).get('@deepseek-ai/cordis-plugin-loader') ?? []
-  if (versions.length === 0) return true
-  const newest = versions.reduce((a, b) => (compareSemver(a, b) >= 0 ? a : b))
-  return compareSemver(newest, '1.0.4') < 0
+  if (versions.length > 0) {
+    const newest = versions.reduce((a, b) => (compareSemver(a, b) >= 0 ? a : b))
+    return compareSemver(newest, '1.0.4') < 0
+  }
+  const install = dshInstallDir === undefined ? findDshInstallDir() : dshInstallDir
+  const host = install === null
+    ? null
+    : readNodeModulesVersion(dirname(hostNodeModulesRoot(install)), '@deepseek-ai/cordis-plugin-loader')
+  if (host === null) return true
+  return compareSemver(host, '1.0.4') < 0
 }
 
 /** Distinct versions of `@deepseek-ai/{dsh,cordis}*` packages in the lockfile. */
@@ -1564,7 +1576,7 @@ export function analyzeProfile(profileDirectory: string, options: CheckOptions =
   // Rows on one id: a boot failure on an old loader, a silent override on a
   // new one (see duplicateEntryIdsAreFatal). Refusing an operation over the
   // second shape rolled back every update for the reporter's profile.
-  const duplicateFatal = duplicateEntryIdsAreFatal(profileDirectory)
+  const duplicateFatal = duplicateEntryIdsAreFatal(profileDirectory, dshInstall)
   for (const dup of composed.duplicates) {
     if (duplicateFatal) {
       errors.push(`duplicate loader entry id ${JSON.stringify(dup.id)} (${dup.count} rows: ${dup.layers.join(', ')})`)

package/src/client/MarketSection.tsx

@@ -774,7 +774,7 @@ function ThemeCover({ plugin, onOpen, t }: {
   }, [curatedKey, near, plugin.url])
   const shots = curated.length > 0 ? curated : fallback.shots
   const visible = shots.filter(src => !broken.includes(src))
-  const name = pluginName(plugin.name)
+  const name = pluginName(plugin.name, plugin.npm)
 
   if (visible.length === 0) {
     return (
@@ -2107,7 +2107,7 @@ export function MarketSection(props: MarketSectionProps) {
     const entry = data?.plugins.find(plugin => plugin.npm === name || plugin.name === name)
     if (entry === undefined) return { title: name }
     return {
-      title: pluginName(entry.name),
+      title: pluginName(entry.name, entry.npm),
       author: entry.owner === '' ? undefined : entry.owner,
       avatar: <OwnerAvatar name={entry.name} owner={entry.owner || ''} />,
     }
@@ -5421,7 +5421,7 @@ export function MarketSection(props: MarketSectionProps) {
               the same name without either card needing a qualifier. */}
           <div style={{ minWidth: 0 }}>
             <a className={`${css.nm} ${css.nmLink}`} href={p.url} target="_blank" rel="noreferrer" title={p.name} aria-label={`${p.name} — ${t('repoLink')}`}>
-              {pluginName(p.name)}
+              {pluginName(p.name, p.npm)}
               <GithubRepoMark className={css.repoMark} />
               {p.deprecated === true && <span className={css.depBadge}>{t('deprecatedBadge')}</span>}
             </a>
@@ -5569,7 +5569,7 @@ export function MarketSection(props: MarketSectionProps) {
           <div className={css.themeCardHead}>
             <div className={css.themeIdentity}>
               <a className={`${css.nm} ${css.nmLink}`} href={p.url} target="_blank" rel="noreferrer" title={p.name} aria-label={`${p.name} — ${t('repoLink')}`}>
-                {pluginName(p.name)}
+                {pluginName(p.name, p.npm)}
                 <GithubRepoMark className={css.repoMark} />
               </a>
               <div className={css.byline}>
@@ -7358,6 +7358,17 @@ export function MarketSection(props: MarketSectionProps) {
                                               }}
                                             >{status.restoreRequired === true ? t('restoreOnline') : t('update')}</Button>
                                           )
+                                        : status?.heldUpdate !== undefined
+                                          // A newer release exists but pnpm will refuse
+                                          // it until the profile's fresh-release wait
+                                          // passes (#945). The official Desktop has no
+                                          // bypass, so the honest state is "waiting",
+                                          // not a button that fails by construction.
+                                          ? (
+                                              <span className={css.metaTag} title={t('updateHeldHint').replace('{1}', String(Math.max(1, Math.ceil((Date.parse(status.heldUpdate.until) - Date.now()) / 3_600_000))))}>
+                                                {t('updateHeldTag').replace('{0}', displayLatest(status.heldUpdate.latest))}
+                                              </span>
+                                            )
                                         : localDev
                                           ? null
                                           : status?.unreleasedCommit != null
@@ -7556,7 +7567,7 @@ export function MarketSection(props: MarketSectionProps) {
           className={css.confirmModal}
           contentClassName={css.confirmContent}
           onClose={() => setConfirming(null)}
-          title={t('confirmTitle') + ' ' + confirming.name + '?'}
+          title={t('confirmTitle') + ' ' + pluginName(confirming.name, confirming.npm) + '?'}
           footer={(
             <>
               <Button variant="ghost" onClick={() => setConfirming(null)}>{t('cancel')}</Button>
@@ -7682,7 +7693,7 @@ export function MarketSection(props: MarketSectionProps) {
       {commentsFor !== null && (
         <CommentsModal
           key={commentsFor.url}
-          name={pluginName(commentsFor.name)}
+          name={pluginName(commentsFor.name, commentsFor.npm)}
           url={commentsFor.url}
           lang={lang}
           onClose={() => setCommentsFor(null)}

package/src/client/locales.ts

@@ -196,6 +196,8 @@ export const zh = {
   updateNow: '立即更新',
   updateFail: '更新失败',
   upToDate: '已是最新',
+  updateHeldTag: '新版等待中',
+  updateHeldHint: '这个 profile 要求新版本发布满一段时间才允许安装，大约还要 {1} 小时。',
   newerPrereleaseAvailable: '预发布版 {0} 已发布',
   newerPrereleaseHint: 'npm 上的 latest 没有更新；你在跟的这条预发布线发布了更新的版本。',
   unreleasedCommits: '有新提交（未发版）{0}',
@@ -959,6 +961,8 @@ export const en: Record<MarketKey, string> = {
   updateNow: 'Update now',
   updateFail: 'Update failed',
   upToDate: 'Up to date',
+  updateHeldTag: 'new version waiting',
+  updateHeldHint: 'This profile waits a while before it installs a fresh release; about {1} hour(s) left.',
   newerPrereleaseAvailable: 'prerelease {0} published',
   newerPrereleaseHint: 'The package\'s latest tag has no update; the prerelease line you are on published a newer build.',
   unreleasedCommits: 'New commits (unreleased) {0}',

package/src/client/market-data.ts

@@ -212,6 +212,10 @@ export interface UpdateStatus {
   unreleasedCommit?: string
   /** Updating this local package switches it to its matched online release. */
   restoreRequired?: boolean
+  /** A newer release exists but the profile's fresh-release wait has not
+      passed yet (#945). `updateAvailable` is false and this names the wait;
+      on the official Desktop there is no bypass to offer. */
+  heldUpdate?: { latest: string; until: string }
   /** Explicit source migration; never part of update-all. */
   sourceMigration?: { kind: 'git-to-npm'; repo: string; target: string }
 }
@@ -1610,14 +1614,17 @@ export function localizeBilingualList(parts: string[], lang: 'zh' | 'en'): strin
  *
  * The repository name IS the plugin name in the ordinary case, because a
  * repository holding one plugin is named after it. Only the compound form
- * needs unpicking, and its last segment is the plugin's own directory.
+ * needs unpicking. Prefer its mapped npm package when available: a generic
+ * directory such as `plugin` is not the product name. Without that mapping,
+ * keep the directory-leaf fallback for source-only entries.
  *
  * Not a substitute for the identity: every key, lookup and install still
  * uses `name` unchanged.
  */
-export function pluginName(name: string): string {
+export function pluginName(name: string, npm?: string | null): string {
   const hash = name.indexOf('#')
   if (hash === -1) return name
+  if (typeof npm === 'string' && npm.trim() !== '') return npm.trim()
   const sub = name.slice(hash + 1)
   const leaf = sub.slice(sub.lastIndexOf('/') + 1)
   // A sub-path that is empty or trailing-slashed tells us nothing; the

package/src/patch.ts

@@ -325,37 +325,65 @@ function foreignDisableIds(rows: unknown[]): string[] {
 }
 
 /**
- * The ids of OTHER plugins a package's bundle patch DISABLES — top-level
- * `- id: X` + `disabled: true` rows targeting plugins it does not own. This is
- * the precise marker of a bundle whose toggle-off can brick the boot (#224):
- * dsh-postgres-backends disables session-persistence-jsonl, so once the market
- * also disables the postgres backends nothing provides sessionPersistence.
+ * Top-level patch rows that add an `inject:` requirement to another plugin.
+ *
+ * Same shape rule as foreignDisableIds: anything at the top level with an id
+ * is a statement about a plugin this package does not own. An `inject` there
+ * makes that foreign row depend on a service — usually one this bundle
+ * provides — so switching this package off while leaving its patch in the
+ * stack strands the row: #938's billion-context adds
+ * `inject: [biliBasicCompactionPolicy]` to the four official agent presets,
+ * and a row-level disable left them unable to activate.
+ */
+function foreignInjectIds(rows: unknown[]): string[] {
+  const ids: string[] = []
+  for (const row of rows) {
+    if (row === null || typeof row !== 'object' || Array.isArray(row)) continue
+    const record = row as Record<string, unknown>
+    const id = record.id
+    if (typeof id === 'string' && record.inject !== undefined && !ids.includes(id)) ids.push(id)
+  }
+  return ids
+}
+
+/**
+ * The ids of OTHER plugins a package's bundle patch rewires — top-level rows
+ * that either `disabled: true` a plugin it does not own, or add an `inject:`
+ * requirement to one.
+ *
+ * Both are the marker of a bundle whose toggle-off can brick the boot while
+ * its patch keeps applying (#224, #938):
+ *  - dsh-postgres-backends disables session-persistence-jsonl, so once the
+ *    market also disables the postgres backends nothing provides
+ *    sessionPersistence;
+ *  - billion-context adds `inject: [biliBasicCompactionPolicy]` to the four
+ *    official agent presets, so disabling only its own row leaves the presets
+ *    waiting for a service that no longer exists — every preset disappears.
  *
  * A bundle that merely RECONFIGURES a neighbour is deliberately NOT counted:
  * the e2e fixture-cross tweaks dshm-fixture-b's config, and #147 requires
  * disabling it to leave that neighbour live — dropping such a bundle from the
  * stack broke its re-enable. Config-only side effects stay on the normal #147
- * path; only a foreign `disabled: true` triggers the bundle removal. Removing
- * the bundle still neutralizes any config side effects it carries, since its
- * whole patch stops applying.
+ * path. Removing the bundle still neutralizes any config side effects it
+ * carries, since its whole patch stops applying.
  *
  * Reads both patch sources like rowIdsForPackage — the declared
  * dsh.bundle.patch (one file or a LIST of them, #792) and the conventional
  * root cordis.patch.yml — so either form is detected, and every declared file
- * is attributed (a foreign disable declared in the second file is still what
- * bricks the boot, #224).
+ * is attributed.
  */
-export function carrierDisableIds(profileDirectory: string, packageName: string): string[] {
+export function carrierRowIds(profileDirectory: string, packageName: string): string[] {
   const packageDir = join(profileDirectory, 'node_modules', packageName)
-  const disabled = new Set<string>()
+  const rows = new Set<string>()
   const collectFromFile = (patchPath: string): void => {
-    const rows = parsePatchFile(patchPath)
-    if (rows === null) return
-    for (const id of foreignDisableIds(rows)) disabled.add(id)
+    const parsed = parsePatchFile(patchPath)
+    if (parsed === null) return
+    for (const id of foreignDisableIds(parsed)) rows.add(id)
+    for (const id of foreignInjectIds(parsed)) rows.add(id)
   }
   for (const file of declaredBundlePatchFiles(packageDir)) collectFromFile(file)
   collectFromFile(join(packageDir, 'cordis.patch.yml'))
-  return [...disabled]
+  return [...rows]
 }
 
 /**
@@ -373,7 +401,7 @@ export function carrierDisableIds(profileDirectory: string, packageName: string)
  * fixture-cross e2e exist to protect, where the neighbour must keep running
  * and the bundle must keep re-enabling.
  *
- * Reads both patch sources like carrierDisableIds: the declared
+ * Reads both patch sources like carrierRowIds: the declared
  * `dsh.bundle.patch` (one file or a LIST, #792) and the conventional root
  * cordis.patch.yml. Ownership is judged per file, because a package may ship
  * both and only the file's own `insert:` block says which ids it brings in.

package/src/profile.ts

@@ -135,12 +135,16 @@ export function readManifestDeps(profile: string, explicitDir?: string): Record<
 
 /**
  * For each installed package, the OTHER installed package that declares it —
- * as a dependency or a peer dependency — in its own manifest.
+ * as a dependency, an optional dependency, or a peer dependency — in its own
+ * manifest.
  *
  * pnpm's auto-install-peers writes a plugin's peers into the profile manifest
  * as direct dependencies, so a native binding a plugin needs shows up in the
  * installed list looking exactly like a plugin the user chose (#634). What
- * separates them is that somebody else asked for it.
+ * separates them is that somebody else asked for it. Optional dependencies
+ * count for the same reason (#941): a platform-specific binary a plugin lists
+ * under `optionalDependencies` is payload, not a plugin the user chose, even
+ * when pnpm installed that package and the card rendered.
  *
  * Ownership is decided by the first owner in sorted order, so the answer does
  * not depend on the manifest's key order. A package that declares itself is
@@ -162,8 +166,12 @@ export function readDependencyOwners(
   for (const owner of topLevelPackageNames(profile, names, explicitDir)) {
     const manifest = readInstalledManifest(profile, owner, explicitDir)
     if (typeof manifest !== 'object' || manifest === null) continue
-    const declared = manifest as { dependencies?: unknown; peerDependencies?: unknown }
-    for (const field of [declared.dependencies, declared.peerDependencies]) {
+    const declared = manifest as {
+      dependencies?: unknown
+      optionalDependencies?: unknown
+      peerDependencies?: unknown
+    }
+    for (const field of [declared.dependencies, declared.optionalDependencies, declared.peerDependencies]) {
       if (typeof field !== 'object' || field === null) continue
       for (const dependency of Object.keys(field as Record<string, unknown>)) {
         if (dependency === owner || !installed.has(dependency)) continue

package/src/routes.ts

@@ -59,7 +59,7 @@ import { detectedDebugger, detectedSupervisor, restartAllowed, scheduleRestart,
 import type { RecoveryPlugin } from './recovery.ts'
 import { activationAfterReplace, brokenClientBundles, bundlePatchIsEmpty, checkClientBundle, defaultHostRuntimeFacts, findUnservedConfigNamespaces, hasHostHalf, hostPeerGate, newlyBrokenBundles, peerGateRemedy, verifyActivation } from './verify.ts'
 import {
-  carrierDisableIds, disableRow, enableRow, findUserPatchPath, foreignRowIds, isProtectedModule, packagePatchFlags,
+  carrierRowIds, disableRow, enableRow, findUserPatchPath, foreignRowIds, isProtectedModule, packagePatchFlags,
   readUserPatchState, removeRowBlocks, rowIdsForPackage, userPatchPackageReferences,
 } from './patch.ts'
 import {
@@ -946,7 +946,8 @@ export function mountMarketRoutes(
     /** The subset a user decision can be read from (#876). */
     userRows: string[]
     patchWrite: { ok: boolean; reason: string | null } | null
-    disablesOthers: string[]
+    /** Foreign rows this bundle rewires: disabled or given a new inject (#224, #938). */
+    carrierRows: string[]
     isCarrier: boolean
     bundleSwitch: { ok: boolean; reason: string | null }
   }> {
@@ -979,9 +980,9 @@ export function mountMarketRoutes(
     // A bundle that merely reconfigures a neighbour (config without
     // disabled) is NOT dropped: #147 requires disabling it to leave the
     // neighbour live, and the e2e fixture-cross re-enable breaks otherwise.
-    const disablesOthers = carrierDisableIds(activeProfileDir, name)
+    const carrierRows = carrierRowIds(activeProfileDir, name)
     const foreignRows = foreignRowIds(activeProfileDir, name)
-    const isCarrier = disablesOthers.length > 0
+    const isCarrier = carrierRows.length > 0
     // Both layers, or neither (#696 B). `dsh.profile.bundles` is the
     // package-level declaration the official plugins page's switch reads
     // and the loader composes; the patch rows above are the runtime
@@ -1011,7 +1012,7 @@ export function mountMarketRoutes(
           ? addProfileBundle(activeProfileDir, name)
           : removeProfileBundle(activeProfileDir, name)
         logEvent('info', 'toggle', isCarrier
-          ? `${name}: disable-carrier ${enabled ? 're-added to' : 'removed from'} dsh.profile.bundles (disables: ${disablesOthers.join(', ')})`
+          ? `${name}: disable-carrier ${enabled ? 're-added to' : 'removed from'} dsh.profile.bundles (carrier rows: ${carrierRows.join(', ')})`
           : reBundle
             ? `${name}: re-added to dsh.profile.bundles, which nothing was composing (#696)`
             : `${name}: dsh.profile.bundles ${enabled ? 're-added' : 'removed'} so the official page's package switch agrees (#696)`)
@@ -1106,7 +1107,7 @@ export function mountMarketRoutes(
       }
     }
     logEvent(ok ? 'info' : 'error', 'toggle', `${name}: ${enabled ? 'on' : 'off'} ok=${String(ok)}`)
-    return { ok, reason, patchRows, userRows, patchWrite, disablesOthers, isCarrier, bundleSwitch }
+    return { ok, reason, patchRows, userRows, patchWrite, carrierRows, isCarrier, bundleSwitch }
   }
 
   /**
@@ -1133,7 +1134,7 @@ export function mountMarketRoutes(
     const plugins: RecoveryPlugin[] = []
     for (const name of names) {
       const rows = rowIdsForPackage(host, activeProfileDir, name)
-      const carrier = carrierDisableIds(activeProfileDir, name).length > 0
+      const carrier = carrierRowIds(activeProfileDir, name).length > 0
       if (rows.length === 0 && !carrier) continue
       const isProtected = isProtectedModule(name)
       plugins.push({
@@ -2154,7 +2155,7 @@ export function mountMarketRoutes(
         }
         try {
           const { channelFor, onlineSourceFor, catalogNpmByRepo } = await updateCheckInputs()
-          const updates = await checkUpdates(config.profile, forceCheckFrom(request), activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo)
+          const updates = await checkUpdates(config.profile, forceCheckFrom(request), activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo, { holdYoungReleases: config.desktopHost === true })
           // `packages` carries the same objects the single-package endpoint
           // returns, so one parser serves both. Only updatable ones: a badge
           // wants the count, a panel wants the rows, and neither wants to
@@ -2201,7 +2202,7 @@ export function mountMarketRoutes(
             // or a catalog-matched local package answers here with the
             // release it can be compared against rather than with nothing.
             const { channelFor, onlineSourceFor, catalogNpmByRepo } = await updateCheckInputs()
-            const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo))[name]
+            const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo, { holdYoungReleases: config.desktopHost === true }))[name]
             if (update === undefined) {
               sendJson(response, 404, { schema: UPDATE_API_V1_SCHEMA, error: 'plugin is not installed' })
               return
@@ -3277,7 +3278,7 @@ export function mountMarketRoutes(
           const layers = await switchPluginLayers(name, enabled, ok, reason)
           ok = layers.ok
           reason = layers.reason
-          const { patchRows, userRows, patchWrite, disablesOthers, isCarrier, bundleSwitch } = layers
+          const { patchRows, userRows, patchWrite, carrierRows, isCarrier, bundleSwitch } = layers
           // Activation reads the post-write truth: the switch state OR the
           // patch layer, so a disabled plugin never reports "restart to
           // apply".
@@ -3324,7 +3325,7 @@ export function mountMarketRoutes(
               reason,
               patchRows,
               patchWrite: patchWrite ?? { ok: true, reason: null },
-              carrier: disablesOthers,
+              carrier: carrierRows,
               bundleSwitch,
               restart,
               refresh,
@@ -3879,7 +3880,7 @@ export function mountMarketRoutes(
           } catch (error) {
             logEvent('warn', 'updates', `package source lookup failed — ${error instanceof Error ? error.message : String(error)}`)
           }
-          const updates = await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo)
+          const updates = await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo, { holdYoungReleases: config.desktopHost === true })
           for (const [name, migration] of sourceMigrationFor) {
             const status = updates[name]
             if (status !== undefined) updates[name] = { ...status, sourceMigration: migration }

package/src/trial.ts

@@ -130,7 +130,7 @@ export function trialValidate(
   // id into one entry (1.0.4+) this is an override, not a refusal. Making it
   // fatal here is what rolled back every update for a profile that already
   // had a package row and a user-patch row on one id.
-  const duplicateFatal = duplicateEntryIdsAreFatal(profileDir)
+  const duplicateFatal = duplicateEntryIdsAreFatal(profileDir, dshInstall)
   for (const dup of composed.duplicates) {
     const message = `duplicate loader entry id ${JSON.stringify(dup.id)} (${dup.count} rows) / 重复的 loader 条目 id ${JSON.stringify(dup.id)}`
     if (duplicateFatal) errors.push({ layer: dup.layers.join(' / '), message })

package/src/updates.ts

@@ -10,6 +10,7 @@ import { DIST_TAG, type Channel } from './channels.ts'
 import { resolveHeadCommit } from './accelerate.ts'
 import { marketFetch } from './net.ts'
 import { activeRegion, githubRoutesFor, rememberGithubRoute, throughProxy, type Region } from './regions.ts'
+import { readMinimumReleaseAgeMs } from './install.ts'
 import { hasDshManifest, profileDir, readGitResolutionCommit, readInstalled, readInstalledVersion, readLockCommits, readProfileBundles } from './profile.ts'
 import { userPatchPackageReferences } from './patch.ts'
 import { catalogRepoKey, gitCommitOfTarget, gitRefOfTarget, gitUploadPackUrl, hasSemverSelector, hostedRepoKey, githubCommitOfTarget, githubRefOfTarget, isGenerationLink, isGitHostedSpec, lookupRepoFromUrl, parseGitHubRemote, repoOfTarget } from './sources.ts'
@@ -69,6 +70,15 @@ export interface UpdateStatus {
   restoreRequired?: boolean
   /** Independent, explicit source switch offered for verified legacy Git installs. */
   sourceMigration?: { kind: 'git-to-npm'; repo: string; target: string }
+  /**
+   * A newer release exists but this profile's `minimumReleaseAge` will not let
+   * pnpm install it yet (#945). The official Desktop takes no one-shot bypass,
+   * so offering the update there means offering a button that is guaranteed
+   * to fail; the market names the wait instead. `updateAvailable` is false —
+   * an update the user cannot apply is not available — and `until` is when
+   * pnpm will accept it.
+   */
+  heldUpdate?: { latest: string; until: string }
   /**
    * The version this package's channel points at, when it differs from what
    * is installed and is NOT newer.
@@ -304,6 +314,23 @@ export async function latestPublishedRecently(name: string, windowMs = 26 * 60 *
   }
 }
 
+/**
+ * When a specific version was published, from the packument's own time map
+ * (#945). Null when the registry cannot answer — callers must not claim a
+ * wait on null.
+ */
+async function npmPublishedAt(name: string, version: string): Promise<number | null> {
+  try {
+    const doc = (await fetchJson(npmUrl(encodeURIComponent(name)))) as { time?: Record<string, string> }
+    const published = doc.time?.[version]
+    if (published === undefined) return null
+    const at = Date.parse(published)
+    return Number.isFinite(at) ? at : null
+  } catch {
+    return null
+  }
+}
+
 /** The registry's current `latest` version for a package, or null when it can't be read. */
 /**
  * The version a channel subscriber should be offered: the newest build in
@@ -518,6 +545,41 @@ async function gitVersionUpdate(
   return compared === null ? null : compared > 0
 }
 
+/**
+ * A held update whose window has passed is available again. The cache lives
+ * 30 minutes; without this a user would watch "in about 1 hour" sit there
+ * after the hour ended, and could not update until the TTL happened to turn
+ * over. Pure: returns the same map when nothing expired.
+ */
+/**
+ * When the profile's fresh-release wait ends for `latest`, or null when the
+ * release is old enough to install now (or the registry cannot say).
+ */
+async function releaseAgeHold(name: string, latest: string | null, profile: string, activeProfileDir: string): Promise<string | null> {
+  if (latest === null) return null
+  const windowMs = readMinimumReleaseAgeMs(profile, activeProfileDir)
+  if (windowMs === null) return null
+  const published = await npmPublishedAt(name, latest)
+  if (published === null) return null
+  const until = published + windowMs
+  return until > Date.now() ? new Date(until).toISOString() : null
+}
+
+function refreshExpiredHolds(data: Record<string, UpdateStatus>): Record<string, UpdateStatus> {
+  let changed = false
+  const out: Record<string, UpdateStatus> = {}
+  for (const [name, status] of Object.entries(data)) {
+    if (status.heldUpdate === undefined || Date.parse(status.heldUpdate.until) > Date.now()) {
+      out[name] = status
+      continue
+    }
+    const { heldUpdate: _held, ...rest } = status
+    out[name] = { ...rest, updateAvailable: true }
+    changed = true
+  }
+  return changed ? out : data
+}
+
 /** Per-plugin update checks; a failed check reports no update rather than failing the listing. */
 export async function checkUpdates(
   profile: string,
@@ -544,15 +606,23 @@ export async function checkUpdates(
    * compare the install with whatever package merely shares its name.
    */
   catalogNpmByRepo: ReadonlyMap<string, string> = new Map(),
+  /**
+   * Hold back releases that this profile's `minimumReleaseAge` will refuse
+   * (#945). Only true where the install path has no bypass: the official
+   * Desktop's manager takes no pnpm options, while the CLI path retries once
+   * with `--config.minimum-release-age=0` and CAN install a young release.
+   * Hiding those on the CLI would suppress updates that work.
+   */
+  options: { holdYoungReleases?: boolean } = {},
 ): Promise<Record<string, UpdateStatus>> {
   const activeProfileDir = profileDir(profile, explicitDir)
   // The channel is part of the key: switching to betas has to change the
   // answer immediately, and a cache keyed on the profile alone would serve
   // the stable verdict for the rest of the TTL — reading as "the setting did
   // nothing".
-  const cacheKey = `${activeProfileDir}\u0000${[...channelFor].map(([n, c]) => `${n}:${c}`).sort().join(',')}\u0000${[...onlineSourceFor].map(([n, s]) => `${n}:${s}`).sort().join(',')}\u0000${[...catalogNpmByRepo].map(([n, s]) => `${n}:${s}`).sort().join(',')}`
+  const cacheKey = `${activeProfileDir}\u0000${options.holdYoungReleases === true ? 'hold' : 'any'}\u0000${[...channelFor].map(([n, c]) => `${n}:${c}`).sort().join(',')}\u0000${[...onlineSourceFor].map(([n, s]) => `${n}:${s}`).sort().join(',')}\u0000${[...catalogNpmByRepo].map(([n, s]) => `${n}:${s}`).sort().join(',')}`
   if (!force && updatesCache?.key === cacheKey && Date.now() - updatesCache.at < UPDATES_TTL_MS) {
-    return updatesCache.data
+    return refreshExpiredHolds(updatesCache.data)
   }
   const installed = readInstalled(profile, activeProfileDir)
   const lockCommits = readLockCommits(profile, activeProfileDir)
@@ -564,10 +634,15 @@ export async function checkUpdates(
       const onlineSource = onlineSourceFor.get(name)
       if (onlineSource !== undefined) {
         const latest = await fetchNpmLatest(onlineSource)
-        const updateAvailable = isUpgrade(version, latest)
+        const upgrade = isUpgrade(version, latest)
+        const heldUntil = upgrade && options.holdYoungReleases === true
+          ? await releaseAgeHold(onlineSource, latest, profile, activeProfileDir)
+          : null
         result[name] = {
-          kind: 'linked', version, current: version, latest, updateAvailable,
-          ...(updateAvailable ? { restoreRequired: true } : {}),
+          kind: 'linked', version, current: version, latest,
+          updateAvailable: upgrade && heldUntil === null,
+          ...(heldUntil === null ? {} : { heldUpdate: { latest: latest!, until: heldUntil } }),
+          ...(upgrade ? { restoreRequired: true } : {}),
         }
         return
       }
@@ -693,9 +768,13 @@ export async function checkUpdates(
         const mayFollowATag = !upgrade
           && (version?.includes('-') === true || (stable !== null && version !== null && isUpgrade(stable, version) === false && stable !== version))
         const newerPrerelease = mayFollowATag ? await newerPrereleaseFor(name, version) : null
+        const heldUntil = upgrade && options.holdYoungReleases === true
+          ? await releaseAgeHold(name, latest, profile, activeProfileDir)
+          : null
         result[name] = {
           kind: 'npm', version, current: version, latest,
-          updateAvailable: upgrade,
+          updateAvailable: upgrade && heldUntil === null,
+          ...(heldUntil === null ? {} : { heldUpdate: { latest: latest!, until: heldUntil } }),
           ...(newerPrerelease === null ? {} : { newerPrerelease }),
           ...(sideways ? { channelSwitch: latest } : {}),
         }