dshmarket 1.66.7 → 1.66.8

package/README.md

@@ -41,7 +41,7 @@ its own dsh: it may be older than the one `npm` would give you (#139).
 - **Themes** — a dedicated tab for community themes and skins: install → active immediately, switch with one click (themes are mutually exclusive, your choice survives restarts), uninstall to revert
 - **One-click install** — confirm the source, watch live progress; most plugins go live after a page refresh, no restart
 - **Backup & restore** — export your profile's plugin list and configuration as readable JSON, import it on another machine, store it on WebDAV with daily auto-backup, or sync through a private GitHub Gist; restores **merge** (plugins installed after the backup are kept), validate before writing, and roll back on failure
-- **Updates** — per-plugin update checks (npm version or pinned commit vs HEAD), one-click update, or update everything at once; the market updates itself the same way. Each row with an update pending carries a **What changed** link — the release notes, or the commits when the version cannot be aligned to one. A notice you are not acting on can be ignored for the rest of the boot instead of being dismissed again on every reload — scoped to the running host, so a restart brings the reminder back and ignoring it is never the same as turning it off
+- **Updates** — per-plugin update checks (npm version or pinned commit vs HEAD), one-click update, or update everything at once; the market updates itself the same way. A plugin installed from an archive link is updated only through its own source: a catalog entry that merely shares the name is never offered as its update, so updating cannot silently replace it with a different plugin. Each row with an update pending carries a **What changed** link — the release notes, or the commits when the version cannot be aligned to one. A notice you are not acting on can be ignored for the rest of the boot instead of being dismissed again on every reload — scoped to the running host, so a restart brings the reminder back and ignoring it is never the same as turning it off
 - **Resilient GitHub routes** — in the China download region, Git refs, README content, and avatars each keep their own fallback order. The market remembers the last working route, switches only after transport/HTTP/payload validation fails, and rejects proxy error pages disguised as HTTP 200. If every built-in route fails, **Settings → Plugins → Plugin configuration → GitHub acceleration** accepts one persistent custom HTTPS prefix; `DSHM_GITHUB_PROXY` remains the operator-owned override
 - **Public update API** — plugin-owned settings pages can use the versioned, capability-gated [update API v1](UPDATE-API-V1.md) (beta) instead of copying package-manager logic or depending on private Market UI responses
 - **Uninstall** — two-step confirm; plugins installed this session are removed live

package/README.zh.md

@@ -39,7 +39,7 @@ dsh plugin --profile web add dshmarket
 - **主题**——独立主题页：装完立即生效，点一下切换（主题互斥、选择跨重启保留），卸载即恢复
 - **一键安装**——确认来源，实时进度；多数插件刷新页面即可用，无需重启
 - **备份与恢复**——把 profile 的插件清单与配置导出为可读 JSON，换机导入，存到 WebDAV 并每日自动备份，或通过私有 GitHub Gist 跨机器同步；恢复采用**合并**方式（备份之后新装的插件会保留），写入前校验、失败自动回滚
-- **更新**——逐插件检测（npm 版本或锁定 commit 对比 HEAD），一键更新或全部更新；市场自己也走同一通道升级。每个有待更新的行上都有「更新内容」链接——有版本说明就是版本说明，对不上版本时给提交记录。暂时不处理的提醒可以**本次不再提醒**（本次 = 当前宿主进程），重启后提醒会回来——「忽略」永远不等于「关闭」
+- **更新**——逐插件检测（npm 版本或锁定 commit 对比 HEAD），一键更新或全部更新；市场自己也走同一通道升级。从压缩包链接装的插件只认自己的来源：市场里恰好同名的另一个插件不会被当成它的更新，更新也不会悄悄把它换成另一个插件。每个有待更新的行上都有「更新内容」链接——有版本说明就是版本说明，对不上版本时给提交记录。暂时不处理的提醒可以**本次不再提醒**（本次 = 当前宿主进程），重启后提醒会回来——「忽略」永远不等于「关闭」
 - **GitHub 多线路容错**——中国大陆下载区域会为 Git ref、README 与头像分别维护 fallback 顺序，记住上次可用线路，只在传输、HTTP 状态或响应内容校验失败后换线，并拒绝公共反代伪装成 HTTP 200 的 HTML 错误页。内置线路全部失效时，可到**设置 → 插件 → 插件配置 → GitHub 加速**填写一个持久化的自定义 HTTPS 前缀；运维设置的 `DSHM_GITHUB_PROXY` 始终优先
 - **公共更新接口**——插件自己的设置页可调用带版本号、能力探测和回滚状态的[更新 API v1](UPDATE-API-V1.md)（beta），无需复制包管理逻辑，也不依赖市场 UI 的私有响应字段
 - **卸载**——两步确认防误触；本次会话装的插件即点即卸

package/lib/presets.js

@@ -149,7 +149,9 @@ function presetMismatch(profileDir, bundleOrder) {
  * reports the mismatch alongside the still-computable changes (relative
  * order + enabled/disabled diffs over the intersection).
  */
-export function previewPreset(profileDir, name) {
+export function previewPreset(profileDir, name, 
+/** The host's own installation anchor, when it gave one (#781 review). */
+dshInstallDir) {
     if (typeof name !== 'string')
         return { ok: false, error: 'invalid preset name / 组合名称无效' };
     const preset = readPresets(profileDir).find(item => item.name === name);
@@ -166,7 +168,7 @@ export function previewPreset(profileDir, name) {
             error: `preset is out of date — current profile differs: ${detail} / 组合已过期——当前 profile 的插件列表已变化：${detail}`,
         };
     }
-    const trial = trialValidate(profileDir, preset.bundleOrder);
+    const trial = trialValidate(profileDir, preset.bundleOrder, dshInstallDir === undefined ? {} : { dshInstallDir });
     if (!trial.ok) {
         const first = trial.errors[0];
         return {
@@ -198,7 +200,9 @@ export function previewPreset(profileDir, name) {
  * then write the bundle order and the disable list. The response carries the
  * change preview so the UI can report exactly what moved.
  */
-export function applyPreset(profileDir, name, maxSnapshots = DEFAULT_MAX_SNAPSHOTS) {
+export function applyPreset(profileDir, name, maxSnapshots = DEFAULT_MAX_SNAPSHOTS, 
+/** The host's own installation anchor, when it gave one (#781 review). */
+dshInstallDir) {
     if (typeof name !== 'string')
         return { ok: false, error: 'invalid preset name / 组合名称无效' };
     const preset = readPresets(profileDir).find(item => item.name === name);
@@ -215,7 +219,7 @@ export function applyPreset(profileDir, name, maxSnapshots = DEFAULT_MAX_SNAPSHO
             error: `preset is out of date — current profile differs: ${detail} / 组合已过期——当前 profile 的插件列表已变化：${detail}`,
         };
     }
-    const trial = trialValidate(profileDir, preset.bundleOrder);
+    const trial = trialValidate(profileDir, preset.bundleOrder, dshInstallDir === undefined ? {} : { dshInstallDir });
     if (!trial.ok) {
         const first = trial.errors[0];
         logEvent('warn', 'preset', `apply "${name}" rejected by trial validation: ${first?.message ?? 'unknown'}`);

package/lib/routes.js

@@ -30,7 +30,7 @@ import { applyBundleOrder, mergeOrder, readBundleRules, readBundleStack, validat
 import { applyPreset, deletePreset, listPresets, previewPreset, savePreset } from './presets.js';
 import { createProfileSnapshot, DEFAULT_MAX_SNAPSHOTS, deleteSnapshot, listSnapshots, restoreSnapshot } from './snapshot.js';
 import { trialValidate } from './trial.js';
-import { codeloadAllowBuildsKey, findCatalogEntryForLocal, findInstalledAlias, gitCommitOfTarget, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitRefOfTarget, gitTargetAtCommit, gitUpdateTarget, hostedRepoKey, pinnedGitAllowBuildsKey, installTargetFor, isGenerationLink, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, workspaceProtocolDeps } from './sources.js';
+import { catalogRepoKey, codeloadAllowBuildsKey, findCatalogEntryForLocal, findInstalledAlias, gitCommitOfTarget, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitRefOfTarget, gitTargetAtCommit, gitUpdateTarget, hostedRepoKey, lookupRepoFromUrl, pinnedGitAllowBuildsKey, installTargetFor, isGenerationLink, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, workspaceProtocolDeps } from './sources.js';
 import { failureDetail, groupConflictsByOwner, isStaleUpdate, parseIgnoredBuilds, parsePrepareKey, parsePrepareNotAllowed, pnpmBlockedByOpenFiles, pnpmNeverStarted, RELEASE_AGE_OVERRIDE, removeDanglingHostBridge, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.js';
 import { classifyPnpmFailure } from './pnpm-compat.js';
 import { asChannel, CHANNELS, DIST_TAG, resolveChannel } from './channels.js';
@@ -228,6 +228,23 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
     const analyzeActiveProfile = () => analyzeProfile(activeProfileDir, {
         ...(config.dshInstallDir === undefined ? {} : { dshInstallDir: config.dshInstallDir }),
     });
+    /**
+     * The running installation's own anchor, in the shape `trialValidate` wants.
+     *
+     * The host hands the market this anchor (`profileContext.installAnchor`) and
+     * the diagnostics panel has always analysed with it, while every trial
+     * validation fell back to `findDshInstallDir()`'s filesystem probe. The two
+     * were therefore judging the SAME composition from DIFFERENT inputs, and
+     * disagreeing about it: the panel reported a plugin as fine while the update
+     * route answered 422 for the identical bundle order (#781 review). On a host
+     * whose own detection fails, the probe also resolves the official bundles out
+     * of whatever profile tree it can reach, which is how an install/update gets
+     * rolled back over a layer the running host never loaded.
+     *
+     * `undefined` keeps the old fallback behaviour, so this only ever adds
+     * information.
+     */
+    const hostAnchorOption = config.dshInstallDir === undefined ? {} : { dshInstallDir: config.dshInstallDir };
     const persistentLogFile = join(activeProfileDir, '.dsh-market', 'log.ndjson');
     const discoveryManifests = new DiscoveryManifestIndex(join(activeProfileDir, '.dsh-market', 'discovery-compatibility-v1.json'));
     configurePersistentLog(persistentLogFile);
@@ -1384,6 +1401,11 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
             .filter(name => SELF_NAMES.has(name))
             .map(name => [name, channel]));
         const onlineSourceFor = new Map();
+        // Which registry name — if any — an archive-URL install may be updated
+        // through, keyed by the GitHub repo the archive came from (#768). Same
+        // failure semantics as below: a failed registry load leaves the map
+        // empty, and an empty map authorizes nothing.
+        const catalogNpmByRepo = new Map();
         try {
             const registry = await loadRegistry();
             for (const [name, spec] of Object.entries(installed)) {
@@ -1391,11 +1413,18 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                 if (source !== null)
                     onlineSourceFor.set(name, source);
             }
+            for (const plugin of registry.plugins) {
+                if (plugin.npm === null || plugin.npm === undefined)
+                    continue;
+                const repoKey = catalogRepoKey(plugin.url);
+                if (repoKey !== null)
+                    catalogNpmByRepo.set(repoKey, plugin.npm);
+            }
         }
         catch (error) {
             logEvent('warn', 'updates', `package source lookup failed — ${error instanceof Error ? error.message : String(error)}`);
         }
-        return { channelFor, onlineSourceFor };
+        return { channelFor, onlineSourceFor, catalogNpmByRepo };
     }
     /**
      * Pre-install host compatibility refusal, shared by the update route and
@@ -1514,8 +1543,8 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                     return;
                 }
                 try {
-                    const { channelFor, onlineSourceFor } = await updateCheckInputs();
-                    const updates = await checkUpdates(config.profile, forceCheckFrom(request), activeProfileDir, channelFor, onlineSourceFor);
+                    const { channelFor, onlineSourceFor, catalogNpmByRepo } = await updateCheckInputs();
+                    const updates = await checkUpdates(config.profile, forceCheckFrom(request), activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo);
                     // `packages` carries the same objects the single-package endpoint
                     // returns, so one parser serves both. Only updatable ones: a badge
                     // wants the count, a panel wants the rows, and neither wants to
@@ -1561,8 +1590,8 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         // The same inputs the market page builds, so a generation (#497)
                         // or a catalog-matched local package answers here with the
                         // release it can be compared against rather than with nothing.
-                        const { channelFor, onlineSourceFor } = await updateCheckInputs();
-                        const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor))[name];
+                        const { channelFor, onlineSourceFor, catalogNpmByRepo } = await updateCheckInputs();
+                        const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo))[name];
                         if (update === undefined) {
                             sendJson(response, 404, { schema: UPDATE_API_V1_SCHEMA, error: 'plugin is not installed' });
                             return;
@@ -2185,7 +2214,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                                 return;
                             }
                         }
-                        const trial = trialValidate(activeProfileDir, order);
+                        const trial = trialValidate(activeProfileDir, order, hostAnchorOption);
                         if (!trial.ok) {
                             const first = trial.errors[0];
                             logEvent('warn', 'bundle-order', `rejected by trial validation: ${first?.message ?? 'unknown'}`);
@@ -2267,7 +2296,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                     // a concurrent pnpm run or another direct write must not interleave
                     // (issue #98 analysis: write-route mutual exclusion).
                     if (body.action === 'preview') {
-                        const previewed = previewPreset(activeProfileDir, name);
+                        const previewed = previewPreset(activeProfileDir, name, config.dshInstallDir);
                         sendJson(response, previewed.ok ? 200 : 422, previewed);
                         return;
                     }
@@ -2280,7 +2309,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             }
                             case 'apply': {
                                 pendingRollbacks.clear();
-                                const applied = applyPreset(activeProfileDir, name, maxSnapshots);
+                                const applied = applyPreset(activeProfileDir, name, maxSnapshots, config.dshInstallDir);
                                 if (applied.ok) {
                                     invalidateUpdates();
                                     refreshMarketState();
@@ -3212,7 +3241,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                 }
                 try {
                     const force = (request.url ?? '').includes('force=1');
-                    const { channelFor, onlineSourceFor } = await updateCheckInputs();
+                    const { channelFor, onlineSourceFor, catalogNpmByRepo } = await updateCheckInputs();
                     // Migration hints are this listing's own business: the market page
                     // is where "this could come from npm now" is offered, and no other
                     // caller acts on it.
@@ -3229,7 +3258,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                     catch (error) {
                         logEvent('warn', 'updates', `package source lookup failed — ${error instanceof Error ? error.message : String(error)}`);
                     }
-                    const updates = await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor);
+                    const updates = await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo);
                     for (const [name, migration] of sourceMigrationFor) {
                         const status = updates[name];
                         if (status !== undefined)
@@ -3397,7 +3426,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             return;
                         }
                         const stack = readBundleStack(activeProfileDir);
-                        const trial = trialValidate(activeProfileDir, stack.community);
+                        const trial = trialValidate(activeProfileDir, stack.community, hostAnchorOption);
                         if (!trial.ok) {
                             await failWithRollback(`迁移后的 profile 无法通过启动校验（${trial.errors[0]?.message ?? 'unknown'}）。 / The migrated profile failed boot validation (${trial.errors[0]?.message ?? 'unknown'}).`);
                             return;
@@ -3617,6 +3646,23 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         // classification chooses rollback mechanics; it must not weaken
                         // the existing registry target/downgrade validation.
                         const usesNpmUpdateTarget = !restore && !isGit;
+                        // #768: an archive URL carries no registry identity, so
+                        // name@<tag> would not update this install — it would replace it
+                        // with whatever package shares its name. Only proceed when a
+                        // catalog entry owns both the repo the archive came from and
+                        // this name; anything else keeps the plugin exactly as it is.
+                        if (usesNpmUpdateTarget && /^https?:/i.test(spec)) {
+                            const repo = lookupRepoFromUrl(spec);
+                            const repoKey = repo === null ? null : catalogRepoKey(repo);
+                            const { catalogNpmByRepo } = await updateCheckInputs();
+                            if (repoKey === null || catalogNpmByRepo.get(repoKey) !== name) {
+                                logEvent('warn', 'updates', `refused update for ${name}: no catalog entry owns both the archive's repo and this name (${spec})`);
+                                sendJson(response, 400, {
+                                    error: `不能更新 ${name}：它是从一个压缩包链接装的，市场里的同名插件是另一个包，按名字更新会把它整个换掉。插件没有改动；想换成市场版本，先卸载它，再从市场安装。 / Cannot update ${name}: it was installed from an archive link, and the market's same-named plugin is a different package, so updating by name would replace it. Nothing was changed. To switch, uninstall it first, then install from the market.`,
+                                });
+                                return;
+                            }
+                        }
                         // `@latest` was hardcoded, so a beta subscriber would have been
                         // told an update existed and then handed the stable build. The
                         // dist-tag has to follow the same setting the offer came from.
@@ -4229,7 +4275,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         let trialError = null;
                         if (ok) {
                             const stack = readBundleStack(activeProfileDir);
-                            const trial = trialValidate(activeProfileDir, stack.community);
+                            const trial = trialValidate(activeProfileDir, stack.community, hostAnchorOption);
                             if (!trial.ok) {
                                 ok = false;
                                 // Name the LAYER, not only the message: the first error is

package/lib/sources.js

@@ -210,6 +210,20 @@ export function lookupRepoFromUrl(url) {
         return `https://github.com/${releaseAsset[1]}`;
     return null;
 }
+/**
+ * Repo identity (`owner/repo`, lowercased) of any GitHub URL, ignoring the
+ * path after the repo — the plain repo page, monorepo subpaths, and the
+ * Release asset URLs `lookupRepoFromUrl` returns all fold to one key.
+ * Non-GitHub URLs return null.
+ *
+ * Update authorization for archive-URL installs (#768): the catalog entry
+ * has to own both the repo the archive came from and the registry name the
+ * update would use, and this is the repo side of that comparison.
+ */
+export function catalogRepoKey(url) {
+    const repo = /^https?:\/\/github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)/i.exec(url);
+    return repo === null ? null : `${repo[1]}/${repo[2]}`.toLowerCase();
+}
 /**
  * Normalized identity of an install target, for comparing two targets that
  * may be spelled differently — lowercased, matching `githubRepoIdentity`.

package/lib/types/presets.d.ts

@@ -77,7 +77,9 @@ export interface PresetMismatch {
  * reports the mismatch alongside the still-computable changes (relative
  * order + enabled/disabled diffs over the intersection).
  */
-export declare function previewPreset(profileDir: string, name: unknown): PresetResult & {
+export declare function previewPreset(profileDir: string, name: unknown, 
+/** The host's own installation anchor, when it gave one (#781 review). */
+dshInstallDir?: string | null): PresetResult & {
     changes?: PresetChange;
     mismatch?: PresetMismatch;
 };
@@ -87,4 +89,6 @@ export declare function previewPreset(profileDir: string, name: unknown): Preset
  * then write the bundle order and the disable list. The response carries the
  * change preview so the UI can report exactly what moved.
  */
-export declare function applyPreset(profileDir: string, name: unknown, maxSnapshots?: number): PresetApplyResult;
+export declare function applyPreset(profileDir: string, name: unknown, maxSnapshots?: number, 
+/** The host's own installation anchor, when it gave one (#781 review). */
+dshInstallDir?: string | null): PresetApplyResult;

package/lib/types/sources.d.ts

@@ -64,6 +64,17 @@ export declare function codeloadTarball(repo: string, sha: string, proxy: string
  * URL can serve different bytes at different times).
  */
 export declare function lookupRepoFromUrl(url: string): string | null;
+/**
+ * Repo identity (`owner/repo`, lowercased) of any GitHub URL, ignoring the
+ * path after the repo — the plain repo page, monorepo subpaths, and the
+ * Release asset URLs `lookupRepoFromUrl` returns all fold to one key.
+ * Non-GitHub URLs return null.
+ *
+ * Update authorization for archive-URL installs (#768): the catalog entry
+ * has to own both the repo the archive came from and the registry name the
+ * update would use, and this is the repo side of that comparison.
+ */
+export declare function catalogRepoKey(url: string): string | null;
 /**
  * Normalized identity of an install target, for comparing two targets that
  * may be spelled differently — lowercased, matching `githubRepoIdentity`.

package/lib/types/updates.d.ts

@@ -134,4 +134,11 @@ channelFor?: ReadonlyMap<string, Channel>,
  * the generations the desktop host links in (#497). Any other `link:` is
  * a development workspace and is never opted into online updates.
  */
-onlineSourceFor?: ReadonlyMap<string, string>): Promise<Record<string, UpdateStatus>>;
+onlineSourceFor?: ReadonlyMap<string, string>, 
+/**
+ * Registry names an archive-URL install may be checked against, keyed by
+ * the GitHub repo (`owner/repo`) the archive came from (#768). Without an
+ * entry that owns both the repo and the name, the npm fallback would
+ * compare the install with whatever package merely shares its name.
+ */
+catalogNpmByRepo?: ReadonlyMap<string, string>): Promise<Record<string, UpdateStatus>>;

package/lib/updates.js

@@ -8,7 +8,7 @@ import { resolveHeadCommit } from './accelerate.js';
 import { marketFetch } from './net.js';
 import { activeRegion } from './regions.js';
 import { profileDir, readGitResolutionCommit, readInstalled, readInstalledVersion, readLockCommits } from './profile.js';
-import { gitCommitOfTarget, gitRefOfTarget, gitUploadPackUrl, hostedRepoKey, githubCommitOfTarget, githubRefOfTarget, isGenerationLink, isGitHostedSpec, repoOfTarget } from './sources.js';
+import { catalogRepoKey, gitCommitOfTarget, gitRefOfTarget, gitUploadPackUrl, hostedRepoKey, githubCommitOfTarget, githubRefOfTarget, isGenerationLink, isGitHostedSpec, lookupRepoFromUrl, repoOfTarget } from './sources.js';
 const UPDATES_TTL_MS = 30 * 60 * 1000;
 const GIT_REMOTE_HEAD_TIMEOUT_MS = 6000;
 let updatesCache = null;
@@ -271,13 +271,20 @@ channelFor = new Map(),
  * the generations the desktop host links in (#497). Any other `link:` is
  * a development workspace and is never opted into online updates.
  */
-onlineSourceFor = new Map()) {
+onlineSourceFor = new Map(), 
+/**
+ * Registry names an archive-URL install may be checked against, keyed by
+ * the GitHub repo (`owner/repo`) the archive came from (#768). Without an
+ * entry that owns both the repo and the name, the npm fallback would
+ * compare the install with whatever package merely shares its name.
+ */
+catalogNpmByRepo = new Map()) {
     const activeProfileDir = profileDir(profile, explicitDir);
     // The channel is part of the key: switching to betas has to change the
     // answer immediately, and a cache keyed on the profile alone would serve
     // the stable verdict for the rest of the TTL — reading as "the setting did
     // nothing".
-    const cacheKey = `${activeProfileDir}\u0000${[...channelFor].map(([n, c]) => `${n}:${c}`).sort().join(',')}\u0000${[...onlineSourceFor].map(([n, s]) => `${n}:${s}`).sort().join(',')}`;
+    const cacheKey = `${activeProfileDir}\u0000${[...channelFor].map(([n, c]) => `${n}:${c}`).sort().join(',')}\u0000${[...onlineSourceFor].map(([n, s]) => `${n}:${s}`).sort().join(',')}\u0000${[...catalogNpmByRepo].map(([n, s]) => `${n}:${s}`).sort().join(',')}`;
     if (!force && updatesCache?.key === cacheKey && Date.now() - updatesCache.at < UPDATES_TTL_MS) {
         return updatesCache.data;
     }
@@ -379,6 +386,19 @@ onlineSourceFor = new Map()) {
                 };
             }
             else {
+                // A URL install (release archive, self-hosted tarball) has no
+                // registry identity of its own. Checking npm by name alone pairs it
+                // with whatever package shares that name (#768), so only proceed
+                // when a catalog entry owns both the repo the archive came from and
+                // this name; otherwise report no update rather than a false one.
+                if (/^https?:/i.test(spec)) {
+                    const repo = lookupRepoFromUrl(spec);
+                    const repoKey = repo === null ? null : catalogRepoKey(repo);
+                    if (repoKey === null || catalogNpmByRepo.get(repoKey) !== name) {
+                        result[name] = { kind: 'npm', version, current: version, latest: null, updateAvailable: false };
+                        return;
+                    }
+                }
                 const meta = (await fetchJson(npmUrl(`${encodeURIComponent(name)}/latest`)));
                 const stable = typeof meta.version === 'string' ? meta.version : null;
                 const channel = channelFor.get(name);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.7",
+  "version": "1.66.8",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/presets.ts

@@ -211,7 +211,12 @@ function presetMismatch(profileDir: string, bundleOrder: string[]): PresetMismat
  * reports the mismatch alongside the still-computable changes (relative
  * order + enabled/disabled diffs over the intersection).
  */
-export function previewPreset(profileDir: string, name: unknown): PresetResult & { changes?: PresetChange; mismatch?: PresetMismatch } {
+export function previewPreset(
+  profileDir: string,
+  name: unknown,
+  /** The host's own installation anchor, when it gave one (#781 review). */
+  dshInstallDir?: string | null,
+): PresetResult & { changes?: PresetChange; mismatch?: PresetMismatch } {
   if (typeof name !== 'string') return { ok: false, error: 'invalid preset name / 组合名称无效' }
   const preset = readPresets(profileDir).find(item => item.name === name)
   if (preset === undefined) return { ok: false, error: 'preset not found / 组合不存在' }
@@ -228,7 +233,7 @@ export function previewPreset(profileDir: string, name: unknown): PresetResult &
     }
   }
 
-  const trial = trialValidate(profileDir, preset.bundleOrder)
+  const trial = trialValidate(profileDir, preset.bundleOrder, dshInstallDir === undefined ? {} : { dshInstallDir })
   if (!trial.ok) {
     const first = trial.errors[0]
     return {
@@ -262,7 +267,13 @@ export function previewPreset(profileDir: string, name: unknown): PresetResult &
  * then write the bundle order and the disable list. The response carries the
  * change preview so the UI can report exactly what moved.
  */
-export function applyPreset(profileDir: string, name: unknown, maxSnapshots: number = DEFAULT_MAX_SNAPSHOTS): PresetApplyResult {
+export function applyPreset(
+  profileDir: string,
+  name: unknown,
+  maxSnapshots: number = DEFAULT_MAX_SNAPSHOTS,
+  /** The host's own installation anchor, when it gave one (#781 review). */
+  dshInstallDir?: string | null,
+): PresetApplyResult {
   if (typeof name !== 'string') return { ok: false, error: 'invalid preset name / 组合名称无效' }
   const preset = readPresets(profileDir).find(item => item.name === name)
   if (preset === undefined) return { ok: false, error: 'preset not found / 组合不存在' }
@@ -279,7 +290,7 @@ export function applyPreset(profileDir: string, name: unknown, maxSnapshots: num
     }
   }
 
-  const trial = trialValidate(profileDir, preset.bundleOrder)
+  const trial = trialValidate(profileDir, preset.bundleOrder, dshInstallDir === undefined ? {} : { dshInstallDir })
   if (!trial.ok) {
     const first = trial.errors[0]
     logEvent('warn', 'preset', `apply "${name}" rejected by trial validation: ${first?.message ?? 'unknown'}`)

package/src/routes.ts

@@ -38,7 +38,7 @@ import { applyBundleOrder, mergeOrder, readBundleRules, readBundleStack, validat
 import { applyPreset, deletePreset, listPresets, previewPreset, savePreset } from './presets.ts'
 import { createProfileSnapshot, DEFAULT_MAX_SNAPSHOTS, deleteSnapshot, listSnapshots, restoreSnapshot } from './snapshot.ts'
 import { trialValidate } from './trial.ts'
-import { codeloadAllowBuildsKey, findCatalogEntryForLocal, findInstalledAlias, gitCommitOfTarget, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitRefOfTarget, gitTargetAtCommit, gitUpdateTarget, hostedRepoKey, pinnedGitAllowBuildsKey, installTargetFor, isGenerationLink, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, workspaceProtocolDeps } from './sources.ts'
+import { catalogRepoKey, codeloadAllowBuildsKey, findCatalogEntryForLocal, findInstalledAlias, gitCommitOfTarget, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitRefOfTarget, gitTargetAtCommit, gitUpdateTarget, hostedRepoKey, lookupRepoFromUrl, pinnedGitAllowBuildsKey, installTargetFor, isGenerationLink, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, workspaceProtocolDeps } from './sources.ts'
 import { failureDetail, groupConflictsByOwner, isStaleUpdate, parseIgnoredBuilds, parsePrepareKey, parsePrepareNotAllowed, pnpmBlockedByOpenFiles, pnpmNeverStarted, RELEASE_AGE_OVERRIDE, removeDanglingHostBridge, retargetCollections, validateAddedPlugins, withHoistRecovery } from './install.ts'
 import { classifyPnpmFailure } from './pnpm-compat.ts'
 import { asChannel, CHANNELS, DIST_TAG, resolveChannel, type Channel } from './channels.ts'
@@ -326,6 +326,23 @@ export function mountMarketRoutes(
   const analyzeActiveProfile = () => analyzeProfile(activeProfileDir, {
     ...(config.dshInstallDir === undefined ? {} : { dshInstallDir: config.dshInstallDir }),
   })
+  /**
+   * The running installation's own anchor, in the shape `trialValidate` wants.
+   *
+   * The host hands the market this anchor (`profileContext.installAnchor`) and
+   * the diagnostics panel has always analysed with it, while every trial
+   * validation fell back to `findDshInstallDir()`'s filesystem probe. The two
+   * were therefore judging the SAME composition from DIFFERENT inputs, and
+   * disagreeing about it: the panel reported a plugin as fine while the update
+   * route answered 422 for the identical bundle order (#781 review). On a host
+   * whose own detection fails, the probe also resolves the official bundles out
+   * of whatever profile tree it can reach, which is how an install/update gets
+   * rolled back over a layer the running host never loaded.
+   *
+   * `undefined` keeps the old fallback behaviour, so this only ever adds
+   * information.
+   */
+  const hostAnchorOption = config.dshInstallDir === undefined ? {} : { dshInstallDir: config.dshInstallDir }
   const persistentLogFile = join(activeProfileDir, '.dsh-market', 'log.ndjson')
   const discoveryManifests = new DiscoveryManifestIndex(
     join(activeProfileDir, '.dsh-market', 'discovery-compatibility-v1.json'),
@@ -1528,6 +1545,7 @@ export function mountMarketRoutes(
   async function updateCheckInputs(): Promise<{
     channelFor: Map<string, Channel>
     onlineSourceFor: Map<string, string>
+    catalogNpmByRepo: Map<string, string>
   }> {
     // Only the market itself follows the channel setting (see
     // MarketSettings.channel): a user opting into betas is volunteering to
@@ -1541,16 +1559,26 @@ export function mountMarketRoutes(
         .map(name => [name, channel] as const),
     )
     const onlineSourceFor = new Map<string, string>()
+    // Which registry name — if any — an archive-URL install may be updated
+    // through, keyed by the GitHub repo the archive came from (#768). Same
+    // failure semantics as below: a failed registry load leaves the map
+    // empty, and an empty map authorizes nothing.
+    const catalogNpmByRepo = new Map<string, string>()
     try {
       const registry = await loadRegistry()
       for (const [name, spec] of Object.entries(installed)) {
         const source = onlineSourceOf(registry.plugins, name, spec)
         if (source !== null) onlineSourceFor.set(name, source)
       }
+      for (const plugin of registry.plugins) {
+        if (plugin.npm === null || plugin.npm === undefined) continue
+        const repoKey = catalogRepoKey(plugin.url)
+        if (repoKey !== null) catalogNpmByRepo.set(repoKey, plugin.npm)
+      }
     } catch (error) {
       logEvent('warn', 'updates', `package source lookup failed — ${error instanceof Error ? error.message : String(error)}`)
     }
-    return { channelFor, onlineSourceFor }
+    return { channelFor, onlineSourceFor, catalogNpmByRepo }
   }
 
   /**
@@ -1681,8 +1709,8 @@ export function mountMarketRoutes(
           return
         }
         try {
-          const { channelFor, onlineSourceFor } = await updateCheckInputs()
-          const updates = await checkUpdates(config.profile, forceCheckFrom(request), activeProfileDir, channelFor, onlineSourceFor)
+          const { channelFor, onlineSourceFor, catalogNpmByRepo } = await updateCheckInputs()
+          const updates = await checkUpdates(config.profile, forceCheckFrom(request), activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo)
           // `packages` carries the same objects the single-package endpoint
           // returns, so one parser serves both. Only updatable ones: a badge
           // wants the count, a panel wants the rows, and neither wants to
@@ -1728,8 +1756,8 @@ export function mountMarketRoutes(
             // The same inputs the market page builds, so a generation (#497)
             // or a catalog-matched local package answers here with the
             // release it can be compared against rather than with nothing.
-            const { channelFor, onlineSourceFor } = await updateCheckInputs()
-            const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor))[name]
+            const { channelFor, onlineSourceFor, catalogNpmByRepo } = await updateCheckInputs()
+            const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo))[name]
             if (update === undefined) {
               sendJson(response, 404, { schema: UPDATE_API_V1_SCHEMA, error: 'plugin is not installed' })
               return
@@ -2363,7 +2391,7 @@ export function mountMarketRoutes(
                   return
                 }
               }
-              const trial = trialValidate(activeProfileDir, order)
+              const trial = trialValidate(activeProfileDir, order, hostAnchorOption)
               if (!trial.ok) {
                 const first = trial.errors[0]
                 logEvent('warn', 'bundle-order', `rejected by trial validation: ${first?.message ?? 'unknown'}`)
@@ -2444,7 +2472,7 @@ export function mountMarketRoutes(
           // a concurrent pnpm run or another direct write must not interleave
           // (issue #98 analysis: write-route mutual exclusion).
           if (body.action === 'preview') {
-            const previewed = previewPreset(activeProfileDir, name)
+            const previewed = previewPreset(activeProfileDir, name, config.dshInstallDir)
             sendJson(response, previewed.ok ? 200 : 422, previewed)
             return
           }
@@ -2457,7 +2485,7 @@ export function mountMarketRoutes(
               }
               case 'apply': {
                 pendingRollbacks.clear()
-                const applied = applyPreset(activeProfileDir, name, maxSnapshots)
+                const applied = applyPreset(activeProfileDir, name, maxSnapshots, config.dshInstallDir)
                 if (applied.ok) {
                   invalidateUpdates()
                   refreshMarketState()
@@ -3375,7 +3403,7 @@ export function mountMarketRoutes(
         }
         try {
           const force = (request.url ?? '').includes('force=1')
-          const { channelFor, onlineSourceFor } = await updateCheckInputs()
+          const { channelFor, onlineSourceFor, catalogNpmByRepo } = await updateCheckInputs()
           // Migration hints are this listing's own business: the market page
           // is where "this could come from npm now" is offered, and no other
           // caller acts on it.
@@ -3390,7 +3418,7 @@ export function mountMarketRoutes(
           } catch (error) {
             logEvent('warn', 'updates', `package source lookup failed — ${error instanceof Error ? error.message : String(error)}`)
           }
-          const updates = await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor)
+          const updates = await checkUpdates(config.profile, force, activeProfileDir, channelFor, onlineSourceFor, catalogNpmByRepo)
           for (const [name, migration] of sourceMigrationFor) {
             const status = updates[name]
             if (status !== undefined) updates[name] = { ...status, sourceMigration: migration }
@@ -3571,7 +3599,7 @@ sendJson(response, 200, { updates })
             }
 
             const stack = readBundleStack(activeProfileDir)
-            const trial = trialValidate(activeProfileDir, stack.community)
+            const trial = trialValidate(activeProfileDir, stack.community, hostAnchorOption)
             if (!trial.ok) {
               await failWithRollback(`迁移后的 profile 无法通过启动校验（${trial.errors[0]?.message ?? 'unknown'}）。 / The migrated profile failed boot validation (${trial.errors[0]?.message ?? 'unknown'}).`)
               return
@@ -3788,6 +3816,23 @@ sendJson(response, 200, { updates })
             // classification chooses rollback mechanics; it must not weaken
             // the existing registry target/downgrade validation.
             const usesNpmUpdateTarget = !restore && !isGit
+            // #768: an archive URL carries no registry identity, so
+            // name@<tag> would not update this install — it would replace it
+            // with whatever package shares its name. Only proceed when a
+            // catalog entry owns both the repo the archive came from and
+            // this name; anything else keeps the plugin exactly as it is.
+            if (usesNpmUpdateTarget && /^https?:/i.test(spec)) {
+              const repo = lookupRepoFromUrl(spec)
+              const repoKey = repo === null ? null : catalogRepoKey(repo)
+              const { catalogNpmByRepo } = await updateCheckInputs()
+              if (repoKey === null || catalogNpmByRepo.get(repoKey) !== name) {
+                logEvent('warn', 'updates', `refused update for ${name}: no catalog entry owns both the archive's repo and this name (${spec})`)
+                sendJson(response, 400, {
+                  error: `不能更新 ${name}：它是从一个压缩包链接装的，市场里的同名插件是另一个包，按名字更新会把它整个换掉。插件没有改动；想换成市场版本，先卸载它，再从市场安装。 / Cannot update ${name}: it was installed from an archive link, and the market's same-named plugin is a different package, so updating by name would replace it. Nothing was changed. To switch, uninstall it first, then install from the market.`,
+                })
+                return
+              }
+            }
             // `@latest` was hardcoded, so a beta subscriber would have been
             // told an update existed and then handed the stable build. The
             // dist-tag has to follow the same setting the offer came from.
@@ -4399,7 +4444,7 @@ sendJson(response, 200, { updates })
             let trialError: string | null = null
             if (ok) {
               const stack = readBundleStack(activeProfileDir)
-              const trial = trialValidate(activeProfileDir, stack.community)
+              const trial = trialValidate(activeProfileDir, stack.community, hostAnchorOption)
               if (!trial.ok) {
                 ok = false
                 // Name the LAYER, not only the message: the first error is

package/src/sources.ts

@@ -208,6 +208,21 @@ export function lookupRepoFromUrl(url: string): string | null {
   return null
 }
 
+/**
+ * Repo identity (`owner/repo`, lowercased) of any GitHub URL, ignoring the
+ * path after the repo — the plain repo page, monorepo subpaths, and the
+ * Release asset URLs `lookupRepoFromUrl` returns all fold to one key.
+ * Non-GitHub URLs return null.
+ *
+ * Update authorization for archive-URL installs (#768): the catalog entry
+ * has to own both the repo the archive came from and the registry name the
+ * update would use, and this is the repo side of that comparison.
+ */
+export function catalogRepoKey(url: string): string | null {
+  const repo = /^https?:\/\/github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)/i.exec(url)
+  return repo === null ? null : `${repo[1]}/${repo[2]}`.toLowerCase()
+}
+
 /**
  * Normalized identity of an install target, for comparing two targets that
  * may be spelled differently — lowercased, matching `githubRepoIdentity`.

package/src/updates.ts

@@ -9,7 +9,7 @@ import { resolveHeadCommit } from './accelerate.ts'
 import { marketFetch } from './net.ts'
 import { activeRegion } from './regions.ts'
 import { profileDir, readGitResolutionCommit, readInstalled, readInstalledVersion, readLockCommits } from './profile.ts'
-import { gitCommitOfTarget, gitRefOfTarget, gitUploadPackUrl, hostedRepoKey, githubCommitOfTarget, githubRefOfTarget, isGenerationLink, isGitHostedSpec, repoOfTarget } from './sources.ts'
+import { catalogRepoKey, gitCommitOfTarget, gitRefOfTarget, gitUploadPackUrl, hostedRepoKey, githubCommitOfTarget, githubRefOfTarget, isGenerationLink, isGitHostedSpec, lookupRepoFromUrl, repoOfTarget } from './sources.ts'
 
 export interface UpdateStatus {
   /**
@@ -317,13 +317,20 @@ export async function checkUpdates(
    * a development workspace and is never opted into online updates.
    */
   onlineSourceFor: ReadonlyMap<string, string> = new Map(),
+  /**
+   * Registry names an archive-URL install may be checked against, keyed by
+   * the GitHub repo (`owner/repo`) the archive came from (#768). Without an
+   * entry that owns both the repo and the name, the npm fallback would
+   * compare the install with whatever package merely shares its name.
+   */
+  catalogNpmByRepo: ReadonlyMap<string, string> = new Map(),
 ): Promise<Record<string, UpdateStatus>> {
   const activeProfileDir = profileDir(profile, explicitDir)
   // The channel is part of the key: switching to betas has to change the
   // answer immediately, and a cache keyed on the profile alone would serve
   // the stable verdict for the rest of the TTL — reading as "the setting did
   // nothing".
-  const cacheKey = `${activeProfileDir}\u0000${[...channelFor].map(([n, c]) => `${n}:${c}`).sort().join(',')}\u0000${[...onlineSourceFor].map(([n, s]) => `${n}:${s}`).sort().join(',')}`
+  const cacheKey = `${activeProfileDir}\u0000${[...channelFor].map(([n, c]) => `${n}:${c}`).sort().join(',')}\u0000${[...onlineSourceFor].map(([n, s]) => `${n}:${s}`).sort().join(',')}\u0000${[...catalogNpmByRepo].map(([n, s]) => `${n}:${s}`).sort().join(',')}`
   if (!force && updatesCache?.key === cacheKey && Date.now() - updatesCache.at < UPDATES_TTL_MS) {
     return updatesCache.data
   }
@@ -425,6 +432,19 @@ export async function checkUpdates(
           updateAvailable: current !== null && latest !== null && current !== latest,
         }
       } else {
+        // A URL install (release archive, self-hosted tarball) has no
+        // registry identity of its own. Checking npm by name alone pairs it
+        // with whatever package shares that name (#768), so only proceed
+        // when a catalog entry owns both the repo the archive came from and
+        // this name; otherwise report no update rather than a false one.
+        if (/^https?:/i.test(spec)) {
+          const repo = lookupRepoFromUrl(spec)
+          const repoKey = repo === null ? null : catalogRepoKey(repo)
+          if (repoKey === null || catalogNpmByRepo.get(repoKey) !== name) {
+            result[name] = { kind: 'npm', version, current: version, latest: null, updateAvailable: false }
+            return
+          }
+        }
         const meta = (await fetchJson(npmUrl(`${encodeURIComponent(name)}/latest`))) as { version?: string }
         const stable = typeof meta.version === 'string' ? meta.version : null
         const channel = channelFor.get(name)