dshmarket 1.66.9 → 1.66.10

package/client/client.js

@@ -326,6 +326,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			restartHint: "重启方式：关闭当前 dsh 进程后重新运行（例如 dsh web）",
 			restartHintSupervised: "本进程是 {0} 服务的主进程，重启交给它负责——市场自己重启会连带杀掉 cgroup 里的接管进程，服务将起不来。请执行 systemctl restart <你的 unit>。确认你的配置能承受市场自行重启（如 KillMode=process），可在本插件配置里手动打开「允许重启」。",
 			restartHintDebugged: "当前 dsh 进程正被调试器连接。请从 IDE 或终端停止该进程后重新启动，市场不能从界面里结束正在调试的 dsh。",
+			restartHintViaProxy: "你是通过代理或网关访问的，出于安全，重启只接受本机直连。请在运行 dsh 的机器上重启它，例如 docker restart 或 kubectl rollout restart。",
 			confirmTitle: "安装",
 			confirmWarn: "社区第三方插件，构建脚本默认不运行。",
 			installCaution: "安装前请注意",
@@ -1019,6 +1020,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			restartHint: "To restart: stop the current dsh process and run it again (e.g. dsh web)",
 			restartHintSupervised: "This process is {0}'s own service process, so restarts belong to it — restarting from here would kill the takeover process along with the cgroup and the service would not come back. Use systemctl restart &lt;your unit&gt;. If your unit can survive a self-restart (KillMode=process), turn Allow restart on in this plugin's configuration.",
 			restartHintDebugged: "This dsh process is under a debugger. Stop it from your IDE or terminal and start it again — the market cannot stop the debugged process from the UI.",
+			restartHintViaProxy: "You are reaching dsh through a proxy or gateway, and for safety restart only accepts a direct local connection. Restart it on the machine running dsh, for example with docker restart or kubectl rollout restart.",
 			confirmTitle: "Install",
 			confirmWarn: "Community third-party plugin. Build scripts do not run by default.",
 			installCaution: "Before you install",
@@ -1822,6 +1824,12 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		function isGenerationSpec(spec) {
 			return /^link:/i.test(spec) && /(?:^|[\\/])\.generations[\\/]live[\\/]/i.test(spec);
 		}
+		function restartHintKey(state) {
+			if (state.debuggerLatch !== null) return "restartHintDebugged";
+			if (!state.restartReachable) return "restartHintViaProxy";
+			if (state.supervisor !== null) return "restartHintSupervised";
+			return "restartHint";
+		}
 		function groupSwitchState(members, disabled) {
 			const list = members ?? [];
 			if (list.length === 0) return "empty";
@@ -8365,6 +8373,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const [supervisor, setSupervisor] = (0, react.useState)(null);
 			/** Debugger latch when one-click restart must not kill the host (#447). */
 			const [debuggerLatch, setDebuggerLatch] = (0, react.useState)(null);
+			const [restartReachable, setRestartReachable] = (0, react.useState)(true);
 			const [restarting, setRestarting] = (0, react.useState)(false);
 			const [showTop, setShowTop] = (0, react.useState)(false);
 			const [backupBusy, setBackupBusy] = (0, react.useState)(false);
@@ -8622,6 +8631,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					setRestartEnabled(status.restart === true);
 					setSupervisor(typeof status.supervisor === "string" ? status.supervisor : null);
 					setDebuggerLatch(typeof status.debugger === "string" ? status.debugger : null);
+					setRestartReachable(status.restartReachable !== false);
 					if (typeof status.version === "string" && status.version !== "") setVersion(status.version);
 				}).catch(() => {});
 				refreshInstalled();
@@ -11828,14 +11838,18 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 										]
 									}),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Tooltip, {
-										label: debuggerLatch !== null ? t("restartHintDebugged") : supervisor === null ? t("restartHint") : t("restartHintSupervised").replace("{0}", supervisor),
+										label: t(restartHintKey({
+											debuggerLatch,
+											restartReachable,
+											supervisor
+										})).replace("{0}", supervisor ?? ""),
 										side: "bottom",
 										children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 											className: Market_module_css_default.bannerHint,
 											children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(IconQuestionOutline14, { size: 14 })
 										})
 									}),
-									restartEnabled && debuggerLatch === null && recovery === null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+									restartEnabled && restartReachable && debuggerLatch === null && recovery === null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 										variant: "primary",
 										size: "sm",
 										disabled: restarting || hostBusy || busyUrl !== null || updatingName !== null || removingName !== null,

package/lib/check.js

@@ -31,6 +31,7 @@ import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { JSON_SCHEMA, Type, load } from 'js-yaml';
 import { desktopApplicationRoots, findDshInstallDir } from './dsh-install.js';
 import { resolveDshHome } from './home-paths.js';
+import { hostNodeModulesRoot } from './install.js';
 import { INBOX_BUNDLES, readBundleRules, suggestOrder, validateOrder } from './order.js';
 // Electron's app.asar packages can be loadable by the host while invisible to
 // filesystem probes made from a profile plugin. This is a property of the
@@ -182,7 +183,20 @@ export function corePackageNames(dshInstallDir) {
         // The install's own node_modules is the authoritative host-core inventory:
         // everything under @deepseek-ai whose bare name starts with dsh or cordis,
         // plus the app package itself.
-        for (const entry of readdirSync(join(dshInstallDir, 'node_modules', '@deepseek-ai'), { withFileTypes: true })) {
+        //
+        // `dshHostInfo()` answers either a PACKAGE directory (the CLI layout
+        // `<prefix>/node_modules/@deepseek-ai/dsh`, and the #778 nested form
+        // `<resources>/app.asar/dsh/node_modules/@deepseek-ai/dsh`) or a flat
+        // Desktop deployment root — never a constant "installation root".
+        // Splicing `node_modules` onto whichever arrived only happened to work
+        // for the flat shape. For a package directory the splice landed two
+        // levels deep and readdirSync threw, so the curated seed silently stood
+        // in for the real inventory — and when the host package carries its own
+        // nested `@deepseek-ai` scope (pnpm isolated trees), it read that
+        // truncated subset instead (#676: every package the real inventory has
+        // and the answer lacked became a fresh "will fail to boot").
+        // hostNodeModulesRoot() already derives the shared root from both shapes.
+        for (const entry of readdirSync(join(hostNodeModulesRoot(dshInstallDir), '@deepseek-ai'), { withFileTypes: true })) {
             if (!entry.isDirectory() && !entry.isSymbolicLink())
                 continue;
             if (/^(?:dsh|cordis)/.test(entry.name))
@@ -1128,7 +1142,22 @@ export function analyzeProfile(profileDirectory, options = {}) {
                 ? readNodeModulesVersion(profileDirectory, name)
                 : readProfileVisibleVersion(profileDirectory, name);
             const nested = readNodeModulesVersion(pluginDir, name);
-            const host = dshInstall !== null ? readNodeModulesVersion(dshInstall, name) : null;
+            // The located installation is asked as `host` here — and `dshInstall` is
+            // the PACKAGE directory `dshHostInfo()` answers (the CLI layout
+            // `<prefix>/node_modules/@deepseek-ai/dsh`, and the #778 nested form
+            // `<resources>/app.asar/dsh/node_modules/@deepseek-ai/dsh`), or a flat
+            // Desktop deployment root. `readNodeModulesVersion` takes a package root
+            // and appends `node_modules` itself, so passing a package directory read
+            // `<package>/node_modules/<name>`: absent in most layouts, which silently
+            // left the located installation unasked while the comment above promises
+            // it is asked; and where the host package carries its own nested
+            // `@deepseek-ai` scope (pnpm isolated trees) it answered from that
+            // truncated subset instead — the opposite of the "unknown rather than
+            // wrong" this rule promises. `hostNodeModulesRoot()` derives the shared
+            // root from both shapes (#804's fix, same arithmetic).
+            const host = dshInstall !== null
+                ? readNodeModulesVersion(dirname(hostNodeModulesRoot(dshInstall)), name)
+                : null;
             // Node resolves a plugin's peer from its OWN node_modules first
             // (nested), then the profile tree (hoisted), then the host install.
             const resolved = nested ?? hoisted ?? host;

package/lib/install.js

@@ -209,6 +209,10 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             // SAME argv succeeds — no option is needed, which also means this works
             // on the desktop bridge that refuses market options (#732).
             //
+            // Covers both lockfiles pnpm writes through the same no-retry atomic
+            // rename: the profile's `pnpm-lock.yaml` and the one inside
+            // `node_modules/.pnpm/lock.yaml`.
+            //
             // Retried here rather than in the route because `pnpmBlockedByOpenFiles`
             // and the route's rollback both read the FINAL result: leaving this
             // unretried made the route treat a transient lock as "the running host

package/lib/pnpm-compat.js

@@ -456,27 +456,42 @@ export function classifyPnpmFailure(output, exitCode) {
                 : `插件声明的一个依赖版本范围在 registry 上没有可满足的版本${zh}，通常是该版本被弃用或从未发布 / a dependency of this plugin declared a version range with no matching release on the registry${en} — the range resolves to nothing (withdrawn or never published)`,
         };
     }
-    // #786 follow-up: pnpm could not replace one of the PROFILE's own files —
-    // `package.json` or `pnpm-lock.yaml` — not a package directory.
+    // #786 follow-up: pnpm could not replace one of the profile's own files —
+    // `package.json`, `pnpm-lock.yaml` — or the lockfile it keeps INSIDE
+    // `node_modules/.pnpm/lock.yaml`. None of these is a package directory.
     //
-    // pnpm writes both through its bundled `write-file-atomic`, which does ONE
-    // rename and no retry (measured on the bundled 11.7.0: the temp name is
+    // pnpm writes all of them through its bundled `write-file-atomic`, which does
+    // ONE rename and no retry (measured on the bundled 11.7.0: the temp name is
     // `<file>.<hash>`, e.g. `pnpm-lock.yaml.3015012533`). Any momentary holder —
     // Defender scanning the just-written file, the Windows indexer, an editor —
     // fails the entire run. Measured on the reporter's own profile: 4 identical
     // `add` runs, the 4th failed this way and an immediate 5th succeeded.
     //
+    // The `.pnpm/lock.yaml` shape is the SAME failure, not a lesser one: pnpm's
+    // `writeLockfiles` writes the wanted lockfile and the current one through the
+    // same write-file-atomic inside one `Promise.all` (pnpm 11.7.0, both the
+    // equal-lockfile and the differing one branch). So a lock on the temp name
+    // `…\.pnpm\lock.yaml.<hash>` fails the run exactly like a lock on
+    // `pnpm-lock.yaml` — and answering it as the package-directory case below
+    // would roll the profile's lockfile back over a `node_modules` that already
+    // holds the new build, which is the desync this whole branch exists to stop.
+    //
     // This must be answered BEFORE the package-directory branch below, whose
     // pattern is broad enough to swallow it: that branch blames the running host
     // for holding the plugin's files open and tells the user to quit DSH, which
     // is wrong here (nothing about the plugin is locked) and is the most
     // expensive advice available for a failure that a plain retry clears.
-    // `recoverable: true` is what lets withHoistRecovery retry it automatically.
-    if (/(?:ERR_PNPM_)?EPERM[^\n]*rename[^\n]*[\\/](?:package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml)\.\d+/i.test(withDecodedPnpmDiagnostics(output))) {
+    //
+    // `recoverable: false`, like the other same-argv retries (`transient-network`,
+    // `fetch-timeout`): that flag means "re-running `pnpm install` is the
+    // documented recovery", and no code reads it to decide a retry — the retry is
+    // keyed on this code in `withHoistRecovery`. Marking it true would invite a
+    // future reader to rebuild `node_modules` over a one-file rename.
+    if (/(?:ERR_PNPM_)?EPERM[^\n]*rename[^\n]*(?:[\\/](?:package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml)\.\d+|[\\/]\.pnpm[\\/]lock\.yaml\.\d+)/i.test(withDecodedPnpmDiagnostics(output))) {
         return {
             code: 'profile-file-locked',
-            recoverable: true,
-            message: 'pnpm 替换 profile 自己的文件（package.json / pnpm-lock.yaml）时被 Windows 拒绝了一下——通常是杀毒软件或索引服务正好在读这个刚写完的文件。插件本身没有被占用，重试即可；市场会自动重试一次 / Windows briefly refused pnpm\'s replacement of one of the profile\'s own files (package.json / pnpm-lock.yaml) — usually antivirus or the search indexer reading the file pnpm had just written. Nothing about the plugin is locked; a retry clears it, and the market retries once automatically',
+            recoverable: false,
+            message: 'pnpm 写入 package.json 或 pnpm-lock.yaml 时被 Windows 拒绝了一下——通常是杀毒软件或索引服务正好在读这个刚写完的文件。插件本身没有被占用；市场已经自动重试过一次，还是失败，请再试一次 / Windows briefly refused pnpm\'s write of package.json or pnpm-lock.yaml — usually antivirus or the search indexer reading the file pnpm had just written. Nothing about the plugin is locked; the market already retried once and it still failed, so try again',
         };
     }
     // #389 by @qq1054435284: on Windows, pnpm stages the new version in a

package/lib/restart.js

@@ -174,8 +174,17 @@ export function servingPort(request) {
     const port = Number(match[1]);
     return Number.isInteger(port) && port > 0 && port < 65536 ? port : null;
 }
-/** Whether a process-control request came from this Web host on loopback. */
-export function trustedRestartRequest(request) {
+/**
+ * The part of the restart fence that does not depend on `Origin`: a loopback
+ * peer, no forwarding trace, and a Host that names a loopback authority.
+ *
+ * One function so the route that ENFORCES the fence and the status poll that
+ * PREDICTS it cannot drift apart (#782). It deliberately leaves `Origin` out:
+ * a same-origin GET — which is what the status poll is — carries none, so a
+ * prediction that required it would call every ordinary local request
+ * impossible and take the button away from everyone.
+ */
+function directLoopbackRequest(request) {
     const address = request.socket.remoteAddress;
     if (address !== '127.0.0.1' && address !== '::1' && address !== '::ffff:127.0.0.1')
         return false;
@@ -184,14 +193,32 @@ export function trustedRestartRequest(request) {
         || request.headers['x-forwarded-for'] !== undefined
         || request.headers['x-real-ip'] !== undefined)
         return false;
-    const origin = request.headers.origin;
-    const host = request.headers.host;
     // A loopback PEER is not enough: a DNS-rebinding page reaches 127.0.0.1
     // through a name it controls, so the address proves nothing and Host/Origin
     // both carry the attacker's domain (#678). Host is what the attack cannot
     // forge, so it has to name a loopback authority.
-    if (!loopbackAuthority(host))
+    return loopbackAuthority(request.headers.host);
+}
+/**
+ * Whether a restart request made from the same page as THIS request could pass
+ * the fence (#782): the answer the status poll reports so the banner can say
+ * why there is no button, instead of rendering one that always answers 403.
+ *
+ * Read off the request that asked for status, not off configuration. Behind an
+ * Ingress or any reverse proxy the restart POST arrives from the same page over
+ * the same path, so it fails for the same reasons this request shows — a proxy
+ * peer, forwarding headers, a non-loopback Host. It is a prediction, never a
+ * grant: the route still runs the full fence, including `Origin`, on the POST.
+ */
+export function restartReachableFrom(request) {
+    return directLoopbackRequest(request);
+}
+/** Whether a process-control request came from this Web host on loopback. */
+export function trustedRestartRequest(request) {
+    if (!directLoopbackRequest(request))
         return false;
+    const origin = request.headers.origin;
+    const host = request.headers.host;
     if (origin === undefined || host === undefined)
         return false;
     try {

package/lib/routes.js

@@ -41,7 +41,7 @@ import { updateNotesFor } from './changelog.js';
 import { checkUpdates, isUpdatablePlugin, compareVersions, fetchNpmLatest, invalidateUpdates, resolveGitRemoteHead, isUpgrade, latestPublishedRecently, setUpdateRegistry, versionOnChannel } from './updates.js';
 import { createThemeManager } from './themes.js';
 import { readJsonBody, sameOrigin, sendJson } from './http.js';
-import { detectedDebugger, detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest } from './restart.js';
+import { detectedDebugger, detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest, restartReachableFrom } from './restart.js';
 import { activationAfterReplace, brokenClientBundles, checkClientBundle, defaultHostRuntimeFacts, hasHostHalf, hostPeerGate, newlyBrokenBundles, peerGateRemedy, verifyActivation } from './verify.js';
 import { carrierDisableIds, disableRow, enableRow, findUserPatchPath, foreignRowIds, isProtectedModule, packagePatchFlags, readUserPatchState, removeRowBlocks, rowIdsForPackage, userPatchPackageReferences, } from './patch.js';
 import { createProfileBackup, downloadWebdav, MAX_BACKUP_BYTES, mergeRestoreManifest, restoreProfileBackup, unportableDeps, uploadWebdav, } from './backup.js';
@@ -1114,6 +1114,11 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         // and the page then tells the user to refresh, which is the one thing
         // that cannot help.
         const native = holdsNativeAddon(config.profile, name, activeProfileDir);
+        // Asked BEFORE the removal, like `native` above and for the same reason:
+        // the row ids come from the package's own bundle patch, which the remove
+        // deletes. Read afterwards this returns [] and the rows survive the
+        // package as boot-time orphans (#799).
+        const ownedRows = rowIdsForPackage(host, activeProfileDir, name);
         const result = await runPlugin(config.profile, ['remove', name]);
         if (result.exitCode !== 0 || result.timedOut || result.cancelled) {
             return { ok: false, hot: false, detail: failureDetail(result) };
@@ -1141,7 +1146,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         if (native) {
             logEvent('info', 'uninstall', `${name} ships or depends on a native addon; a restart is needed before it can be installed again`);
         }
-        removeRowBlocks(userPatchPath, rowIdsForPackage(host, activeProfileDir, name));
+        removeRowBlocks(userPatchPath, ownedRows);
         disabled.delete(name);
         replacedWhileLive.delete(name);
         removeFromGroups({ groups, groupOrder }, name);
@@ -3199,6 +3204,15 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                     // "no restart button" is the state #229 reported as broken.
                     supervisor: detectedSupervisor(),
                     debugger: detectedDebugger(),
+                    // Whether a restart asked for from THIS page could pass the route's
+                    // fence (#782). Per request, not per config: behind a reverse proxy
+                    // the POST arrives over the same path as this GET, so it fails for
+                    // the same reasons — and the banner used to render a button that
+                    // answered 403 every time, with nothing saying so in advance. It is
+                    // a prediction: the route still runs the whole fence on the POST.
+                    // Deliberately NOT folded into `restart`, which is also what the
+                    // settings page reads and writes back as the user's own choice.
+                    restartReachable: restartReachableFrom(request),
                     selfManaged: installed.dshmarket !== undefined || installed['dsh-market'] !== undefined,
                     // Whether the host took the market's settings namespace (#677).
                     // `unsupported-by-host` is 0.1.7 and newer, where settings come from
@@ -4067,6 +4081,21 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         // declaration is unchanged; a failed run restores the manifest from
                         // the snapshot above.
                         //
+                        // `reresolveInPlace` is not the only shape whose diff is empty.
+                        // When the manifest holds the spelling pnpm itself wrote for a
+                        // GitHub source — `git+https://owner/repo.git` — and the market
+                        // sends the `github:owner/repo` shortcut, the target differs from
+                        // the specifier but pnpm still gives the specifier back unchanged,
+                        // so the host answers `ambiguous-install` again (#803; measured on
+                        // pnpm 11.7.0, the version DSH Desktop bundles, against the
+                        // reporter's own spec pair). One question covers both: pnpm leaves
+                        // the specifier as it was, so the diff the host reads is empty.
+                        //
+                        // The pin is the market's own write to a foreign pipeline, so it is
+                        // scoped to the host that reads the manifest itself. A host that
+                        // takes market options lets the market verify its own run, and gets
+                        // no extra manifest write.
+                        //
                         // A `#path:` spec needs the local pin instead of the host's exact
                         // rollback target: `gitTargetAtCommit` refuses the `&` that carries
                         // a selector beside a commit, because dsh-cli's target grammar has
@@ -4076,7 +4105,9 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         const pinValue = gitRollbackTarget ?? (hasGitSubpath && beforeCommit !== null
                             ? pinSpecToCommit(spec, beforeCommit)
                             : null);
-                        const pinnedForIdentification = reresolveInPlace && !inPlaceUpdate
+                        const identifiesInstalledByManifestDiff = !marketFlags;
+                        const pinnedForIdentification = isGit && !restore
+                            && identifiesInstalledByManifestDiff
                             && pinValue !== null && pinValue !== spec;
                         if (pinnedForIdentification) {
                             declareProfileDependency(config.profile, name, pinValue, activeProfileDir);
@@ -5214,6 +5245,12 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         // `hot` would send the user to a page refresh, which is the one
                         // thing that cannot help.
                         const heldNativeAddon = holdsNativeAddon(config.profile, name, activeProfileDir);
+                        // And once more, for the same reason: `rowIdsForPackage` names the
+                        // rows from the package's own bundle patch, which the remove below
+                        // deletes. Asked afterwards it answers [] on exactly the uninstall
+                        // it is meant to clean up after, and the rows outlive the package
+                        // as boot-time orphans (#799).
+                        const ownedRows = rowIdsForPackage(host, activeProfileDir, name);
                         const result = await runPlugin(config.profile, ['remove', name]);
                         const cancelled = result.cancelled;
                         const ok = result.exitCode === 0 && !result.timedOut && !cancelled;
@@ -5277,7 +5314,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             // Patch-layer rows must not survive the remove either: a
                             // `- id: X` + `disabled: true` row for a package that no longer
                             // mounts is a boot-time orphan (port of dsh-plugin-hub).
-                            removeRowBlocks(userPatchPath, rowIdsForPackage(host, activeProfileDir, name));
+                            removeRowBlocks(userPatchPath, ownedRows);
                             // The disable list must not keep a removed plugin: a later
                             // reinstall starts enabled. Group memberships follow the same
                             // rule so no group toggle ever targets a ghost member.

package/lib/types/restart.d.ts

@@ -114,6 +114,18 @@ export declare function restartAllowed(config: {
  * @returns the port, or null when the header carries none (a default port).
  */
 export declare function servingPort(request: Pick<IncomingMessage, 'headers'>): number | null;
+/**
+ * Whether a restart request made from the same page as THIS request could pass
+ * the fence (#782): the answer the status poll reports so the banner can say
+ * why there is no button, instead of rendering one that always answers 403.
+ *
+ * Read off the request that asked for status, not off configuration. Behind an
+ * Ingress or any reverse proxy the restart POST arrives from the same page over
+ * the same path, so it fails for the same reasons this request shows — a proxy
+ * peer, forwarding headers, a non-loopback Host. It is a prediction, never a
+ * grant: the route still runs the full fence, including `Origin`, on the POST.
+ */
+export declare function restartReachableFrom(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean;
 /** Whether a process-control request came from this Web host on loopback. */
 export declare function trustedRestartRequest(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean;
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.66.9",
+  "version": "1.66.10",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/check.ts

@@ -32,6 +32,7 @@ import { dirname, isAbsolute, join, resolve } from 'node:path'
 import { JSON_SCHEMA, Type, load } from 'js-yaml'
 import { desktopApplicationRoots, findDshInstallDir } from './dsh-install.ts'
 import { resolveDshHome } from './home-paths.ts'
+import { hostNodeModulesRoot } from './install.ts'
 import { INBOX_BUNDLES, readBundleRules, suggestOrder, validateOrder } from './order.ts'
 
 // Electron's app.asar packages can be loadable by the host while invisible to
@@ -381,7 +382,20 @@ export function corePackageNames(dshInstallDir: string | null): Set<string> {
     // The install's own node_modules is the authoritative host-core inventory:
     // everything under @deepseek-ai whose bare name starts with dsh or cordis,
     // plus the app package itself.
-    for (const entry of readdirSync(join(dshInstallDir, 'node_modules', '@deepseek-ai'), { withFileTypes: true })) {
+    //
+    // `dshHostInfo()` answers either a PACKAGE directory (the CLI layout
+    // `<prefix>/node_modules/@deepseek-ai/dsh`, and the #778 nested form
+    // `<resources>/app.asar/dsh/node_modules/@deepseek-ai/dsh`) or a flat
+    // Desktop deployment root — never a constant "installation root".
+    // Splicing `node_modules` onto whichever arrived only happened to work
+    // for the flat shape. For a package directory the splice landed two
+    // levels deep and readdirSync threw, so the curated seed silently stood
+    // in for the real inventory — and when the host package carries its own
+    // nested `@deepseek-ai` scope (pnpm isolated trees), it read that
+    // truncated subset instead (#676: every package the real inventory has
+    // and the answer lacked became a fresh "will fail to boot").
+    // hostNodeModulesRoot() already derives the shared root from both shapes.
+    for (const entry of readdirSync(join(hostNodeModulesRoot(dshInstallDir), '@deepseek-ai'), { withFileTypes: true })) {
       if (!entry.isDirectory() && !entry.isSymbolicLink()) continue
       if (/^(?:dsh|cordis)/.test(entry.name)) names.add(`@deepseek-ai/${entry.name}`)
     }
@@ -1346,7 +1360,22 @@ export function analyzeProfile(profileDirectory: string, options: CheckOptions =
         ? readNodeModulesVersion(profileDirectory, name)
         : readProfileVisibleVersion(profileDirectory, name)
       const nested = readNodeModulesVersion(pluginDir, name)
-      const host = dshInstall !== null ? readNodeModulesVersion(dshInstall, name) : null
+      // The located installation is asked as `host` here — and `dshInstall` is
+      // the PACKAGE directory `dshHostInfo()` answers (the CLI layout
+      // `<prefix>/node_modules/@deepseek-ai/dsh`, and the #778 nested form
+      // `<resources>/app.asar/dsh/node_modules/@deepseek-ai/dsh`), or a flat
+      // Desktop deployment root. `readNodeModulesVersion` takes a package root
+      // and appends `node_modules` itself, so passing a package directory read
+      // `<package>/node_modules/<name>`: absent in most layouts, which silently
+      // left the located installation unasked while the comment above promises
+      // it is asked; and where the host package carries its own nested
+      // `@deepseek-ai` scope (pnpm isolated trees) it answered from that
+      // truncated subset instead — the opposite of the "unknown rather than
+      // wrong" this rule promises. `hostNodeModulesRoot()` derives the shared
+      // root from both shapes (#804's fix, same arithmetic).
+      const host = dshInstall !== null
+        ? readNodeModulesVersion(dirname(hostNodeModulesRoot(dshInstall)), name)
+        : null
       // Node resolves a plugin's peer from its OWN node_modules first
       // (nested), then the profile tree (hoisted), then the host install.
       const resolved = nested ?? hoisted ?? host

package/src/client/MarketSection.tsx

@@ -51,7 +51,7 @@ import { Diagnostics } from './Diagnostics.tsx'
 import { exportMarketLog } from './self-check.ts'
 import {
   api, applyGithubRouting, avatarColor, catalogEntryForInstalled, entryForDep, githubRouteCandidates, groupSwitchState, humanOutput, installedForCatalog, isGenerationSpec, isInstalled, localizeBilingual, localizeBilingualList, looksTerminal, matchInstalledName, orderedCategories, pluginCategories,
-  formatCount, pageItems, pluginName, blockAliases, pluginScreenshotCandidates, pluginScreenshots, pluginsForFavorites, queuedRowApplies, rankThemeScreenshots, readSession, releaseNotesHttpsImage, rememberGithubRoute, resetScreenshotsCache, resolveCatalogRestore, safeScreenshots, sanitizeReleaseNotesBody, staleFavoriteUrls, themePlugins as themePluginsOf, themeSwatch, TIME_RANGE_DAYS, visiblePlugins,
+  formatCount, pageItems, pluginName, blockAliases, pluginScreenshotCandidates, pluginScreenshots, pluginsForFavorites, queuedRowApplies, rankThemeScreenshots, readSession, releaseNotesHttpsImage, rememberGithubRoute, resetScreenshotsCache, resolveCatalogRestore, safeScreenshots, sanitizeReleaseNotesBody, staleFavoriteUrls, themePlugins as themePluginsOf, themeSwatch, TIME_RANGE_DAYS, visiblePlugins, restartHintKey,
 } from './market-data.ts'
 import type {
 ActivationInfo, ActivationState, GistExportResult, InstalledMap, InstalledRepoHints, InstalledRepoIdentities, MarketStatus, Registry, RegistryPlugin,
@@ -2236,6 +2236,9 @@ export function MarketSection(props: MarketSectionProps) {
   const [supervisor, setSupervisor] = useState<string | null>(null)
   /** Debugger latch when one-click restart must not kill the host (#447). */
   const [debuggerLatch, setDebuggerLatch] = useState<string | null>(null)
+  // False when this page reaches dsh through a proxy: a restart from here is refused
+  // every time, so the banner says so instead of offering a button (#782).
+  const [restartReachable, setRestartReachable] = useState(true)
   const [restarting, setRestarting] = useState(false)
   const [showTop, setShowTop] = useState(false)
   const [backupBusy, setBackupBusy] = useState(false)
@@ -2533,6 +2536,9 @@ export function MarketSection(props: MarketSectionProps) {
         setRestartEnabled(status.restart === true)
         setSupervisor(typeof status.supervisor === 'string' ? status.supervisor : null)
         setDebuggerLatch(typeof status.debugger === 'string' ? status.debugger : null)
+        // Only an explicit false takes the button away. Absent (an older host) or
+        // anything else keeps it: never remove an action on a guess.
+        setRestartReachable(status.restartReachable !== false)
         if (typeof status.version === 'string' && status.version !== '') setVersion(status.version)
       })
       .catch(() => {})
@@ -5674,18 +5680,12 @@ export function MarketSection(props: MarketSectionProps) {
             <IconRefreshOutline14 size={14} className={css.bannerIcon} />
             <span className={css.grow}><b>{pendingRestart}</b> {t('restartBanner')}</span>
             <Tooltip
-              label={
-                debuggerLatch !== null
-                  ? t('restartHintDebugged')
-                  : supervisor === null
-                    ? t('restartHint')
-                    : t('restartHintSupervised').replace('{0}', supervisor)
-              }
+              label={t(restartHintKey({ debuggerLatch, restartReachable, supervisor })).replace('{0}', supervisor ?? '')}
               side="bottom"
             >
               <span className={css.bannerHint}><IconQuestionOutline14 size={14} /></span>
             </Tooltip>
-            {restartEnabled && debuggerLatch === null && recovery === null && (
+            {restartEnabled && restartReachable && debuggerLatch === null && recovery === null && (
               <Button
                 variant="primary"
                 size="sm"

package/src/client/locales.ts

@@ -129,6 +129,7 @@ export const zh = {
   restartHint: '重启方式：关闭当前 dsh 进程后重新运行（例如 dsh web）',
   restartHintSupervised: '本进程是 {0} 服务的主进程，重启交给它负责——市场自己重启会连带杀掉 cgroup 里的接管进程，服务将起不来。请执行 systemctl restart <你的 unit>。确认你的配置能承受市场自行重启（如 KillMode=process），可在本插件配置里手动打开「允许重启」。',
   restartHintDebugged: '当前 dsh 进程正被调试器连接。请从 IDE 或终端停止该进程后重新启动，市场不能从界面里结束正在调试的 dsh。',
+  restartHintViaProxy: '你是通过代理或网关访问的，出于安全，重启只接受本机直连。请在运行 dsh 的机器上重启它，例如 docker restart 或 kubectl rollout restart。',
   confirmTitle: '安装',
   confirmWarn: '社区第三方插件，构建脚本默认不运行。',
   installCaution: '安装前请注意',
@@ -842,6 +843,7 @@ export const en: Record<MarketKey, string> = {
   restartHint: 'To restart: stop the current dsh process and run it again (e.g. dsh web)',
   restartHintSupervised: 'This process is {0}\'s own service process, so restarts belong to it — restarting from here would kill the takeover process along with the cgroup and the service would not come back. Use systemctl restart &lt;your unit&gt;. If your unit can survive a self-restart (KillMode=process), turn Allow restart on in this plugin\'s configuration.',
   restartHintDebugged: 'This dsh process is under a debugger. Stop it from your IDE or terminal and start it again — the market cannot stop the debugged process from the UI.',
+  restartHintViaProxy: 'You are reaching dsh through a proxy or gateway, and for safety restart only accepts a direct local connection. Restart it on the machine running dsh, for example with docker restart or kubectl rollout restart.',
   confirmTitle: 'Install',
   confirmWarn: 'Community third-party plugin. Build scripts do not run by default.',
   installCaution: 'Before you install',

package/src/client/market-data.ts

@@ -260,6 +260,36 @@ export interface MarketStatus {
    * `restart` so `allowRestart` settings are not conflated with debug state.
    */
   debugger?: string | null
+  /**
+   * Whether a restart asked for from THIS page could pass the host's fence
+   * (#782). False behind a reverse proxy: the restart request is refused there
+   * every time, so the banner explains instead of offering a button that cannot
+   * work. Absent from an older host, which reads as "reachable" — the old
+   * behaviour, never a button taken away on a guess.
+   */
+  restartReachable?: boolean
+}
+
+/**
+ * Which explanation the restart banner carries when it has one (#229, #447,
+ * #782). Order matters and is the point: a debugger is the strongest reason (the
+ * host will not stop at all), then a proxy (the request itself cannot pass),
+ * then a supervisor (restart is someone else's job), else the plain how-to.
+ *
+ * A pure function so the order is pinned by a test and not by the shape of a JSX
+ * ternary — the three earlier states each added a branch to that ternary, and
+ * the position of a new one is exactly what is easy to get wrong.
+ */
+export type RestartHintKey = 'restartHintDebugged' | 'restartHintViaProxy' | 'restartHintSupervised' | 'restartHint'
+export function restartHintKey(state: {
+  debuggerLatch: string | null
+  restartReachable: boolean
+  supervisor: string | null
+}): RestartHintKey {
+  if (state.debuggerLatch !== null) return 'restartHintDebugged'
+  if (!state.restartReachable) return 'restartHintViaProxy'
+  if (state.supervisor !== null) return 'restartHintSupervised'
+  return 'restartHint'
 }
 
 /** Post-install activation state (P0-2), per installed package. */

package/src/install.ts

@@ -218,6 +218,10 @@ export async function withHoistRecovery(
       // SAME argv succeeds — no option is needed, which also means this works
       // on the desktop bridge that refuses market options (#732).
       //
+      // Covers both lockfiles pnpm writes through the same no-retry atomic
+      // rename: the profile's `pnpm-lock.yaml` and the one inside
+      // `node_modules/.pnpm/lock.yaml`.
+      //
       // Retried here rather than in the route because `pnpmBlockedByOpenFiles`
       // and the route's rollback both read the FINAL result: leaving this
       // unretried made the route treat a transient lock as "the running host

package/src/pnpm-compat.ts

@@ -494,29 +494,44 @@ export function classifyPnpmFailure(output: string, exitCode?: number | null): P
         : `插件声明的一个依赖版本范围在 registry 上没有可满足的版本${zh}，通常是该版本被弃用或从未发布 / a dependency of this plugin declared a version range with no matching release on the registry${en} — the range resolves to nothing (withdrawn or never published)`,
     }
   }
-  // #786 follow-up: pnpm could not replace one of the PROFILE's own files —
-  // `package.json` or `pnpm-lock.yaml` — not a package directory.
+  // #786 follow-up: pnpm could not replace one of the profile's own files —
+  // `package.json`, `pnpm-lock.yaml` — or the lockfile it keeps INSIDE
+  // `node_modules/.pnpm/lock.yaml`. None of these is a package directory.
   //
-  // pnpm writes both through its bundled `write-file-atomic`, which does ONE
-  // rename and no retry (measured on the bundled 11.7.0: the temp name is
+  // pnpm writes all of them through its bundled `write-file-atomic`, which does
+  // ONE rename and no retry (measured on the bundled 11.7.0: the temp name is
   // `<file>.<hash>`, e.g. `pnpm-lock.yaml.3015012533`). Any momentary holder —
   // Defender scanning the just-written file, the Windows indexer, an editor —
   // fails the entire run. Measured on the reporter's own profile: 4 identical
   // `add` runs, the 4th failed this way and an immediate 5th succeeded.
   //
+  // The `.pnpm/lock.yaml` shape is the SAME failure, not a lesser one: pnpm's
+  // `writeLockfiles` writes the wanted lockfile and the current one through the
+  // same write-file-atomic inside one `Promise.all` (pnpm 11.7.0, both the
+  // equal-lockfile and the differing one branch). So a lock on the temp name
+  // `…\.pnpm\lock.yaml.<hash>` fails the run exactly like a lock on
+  // `pnpm-lock.yaml` — and answering it as the package-directory case below
+  // would roll the profile's lockfile back over a `node_modules` that already
+  // holds the new build, which is the desync this whole branch exists to stop.
+  //
   // This must be answered BEFORE the package-directory branch below, whose
   // pattern is broad enough to swallow it: that branch blames the running host
   // for holding the plugin's files open and tells the user to quit DSH, which
   // is wrong here (nothing about the plugin is locked) and is the most
   // expensive advice available for a failure that a plain retry clears.
-  // `recoverable: true` is what lets withHoistRecovery retry it automatically.
-  if (/(?:ERR_PNPM_)?EPERM[^\n]*rename[^\n]*[\\/](?:package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml)\.\d+/i.test(
+  //
+  // `recoverable: false`, like the other same-argv retries (`transient-network`,
+  // `fetch-timeout`): that flag means "re-running `pnpm install` is the
+  // documented recovery", and no code reads it to decide a retry — the retry is
+  // keyed on this code in `withHoistRecovery`. Marking it true would invite a
+  // future reader to rebuild `node_modules` over a one-file rename.
+  if (/(?:ERR_PNPM_)?EPERM[^\n]*rename[^\n]*(?:[\\/](?:package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml)\.\d+|[\\/]\.pnpm[\\/]lock\.yaml\.\d+)/i.test(
     withDecodedPnpmDiagnostics(output),
   )) {
     return {
       code: 'profile-file-locked',
-      recoverable: true,
-      message: 'pnpm 替换 profile 自己的文件（package.json / pnpm-lock.yaml）时被 Windows 拒绝了一下——通常是杀毒软件或索引服务正好在读这个刚写完的文件。插件本身没有被占用，重试即可；市场会自动重试一次 / Windows briefly refused pnpm\'s replacement of one of the profile\'s own files (package.json / pnpm-lock.yaml) — usually antivirus or the search indexer reading the file pnpm had just written. Nothing about the plugin is locked; a retry clears it, and the market retries once automatically',
+      recoverable: false,
+      message: 'pnpm 写入 package.json 或 pnpm-lock.yaml 时被 Windows 拒绝了一下——通常是杀毒软件或索引服务正好在读这个刚写完的文件。插件本身没有被占用；市场已经自动重试过一次，还是失败，请再试一次 / Windows briefly refused pnpm\'s write of package.json or pnpm-lock.yaml — usually antivirus or the search indexer reading the file pnpm had just written. Nothing about the plugin is locked; the market already retried once and it still failed, so try again',
     }
   }
   // #389 by @qq1054435284: on Windows, pnpm stages the new version in a

package/src/restart.ts

@@ -194,21 +194,50 @@ export function servingPort(request: Pick<IncomingMessage, 'headers'>): number |
   return Number.isInteger(port) && port > 0 && port < 65536 ? port : null
 }
 
-/** Whether a process-control request came from this Web host on loopback. */
-export function trustedRestartRequest(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean {
+/**
+ * The part of the restart fence that does not depend on `Origin`: a loopback
+ * peer, no forwarding trace, and a Host that names a loopback authority.
+ *
+ * One function so the route that ENFORCES the fence and the status poll that
+ * PREDICTS it cannot drift apart (#782). It deliberately leaves `Origin` out:
+ * a same-origin GET — which is what the status poll is — carries none, so a
+ * prediction that required it would call every ordinary local request
+ * impossible and take the button away from everyone.
+ */
+function directLoopbackRequest(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean {
   const address = request.socket.remoteAddress
   if (address !== '127.0.0.1' && address !== '::1' && address !== '::ffff:127.0.0.1') return false
   // Any forwarding trace means the loopback peer is a proxy, not the user.
   if (request.headers.forwarded !== undefined
     || request.headers['x-forwarded-for'] !== undefined
     || request.headers['x-real-ip'] !== undefined) return false
-  const origin = request.headers.origin
-  const host = request.headers.host
   // A loopback PEER is not enough: a DNS-rebinding page reaches 127.0.0.1
   // through a name it controls, so the address proves nothing and Host/Origin
   // both carry the attacker's domain (#678). Host is what the attack cannot
   // forge, so it has to name a loopback authority.
-  if (!loopbackAuthority(host)) return false
+  return loopbackAuthority(request.headers.host)
+}
+
+/**
+ * Whether a restart request made from the same page as THIS request could pass
+ * the fence (#782): the answer the status poll reports so the banner can say
+ * why there is no button, instead of rendering one that always answers 403.
+ *
+ * Read off the request that asked for status, not off configuration. Behind an
+ * Ingress or any reverse proxy the restart POST arrives from the same page over
+ * the same path, so it fails for the same reasons this request shows — a proxy
+ * peer, forwarding headers, a non-loopback Host. It is a prediction, never a
+ * grant: the route still runs the full fence, including `Origin`, on the POST.
+ */
+export function restartReachableFrom(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean {
+  return directLoopbackRequest(request)
+}
+
+/** Whether a process-control request came from this Web host on loopback. */
+export function trustedRestartRequest(request: Pick<IncomingMessage, 'headers' | 'socket'>): boolean {
+  if (!directLoopbackRequest(request)) return false
+  const origin = request.headers.origin
+  const host = request.headers.host
   if (origin === undefined || host === undefined) return false
   try {
     const parsed = new URL(origin)

package/src/routes.ts

@@ -52,7 +52,7 @@ import { updateNotesFor } from './changelog.ts'
 import { checkUpdates, isUpdatablePlugin, compareVersions, fetchNpmLatest, invalidateUpdates, resolveGitRemoteHead, isUpgrade, latestPublishedRecently, setUpdateRegistry, versionOnChannel } from './updates.ts'
 import { createThemeManager, type LoaderEntry } from './themes.ts'
 import { readJsonBody, sameOrigin, sendJson } from './http.ts'
-import { detectedDebugger, detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest, type RecoveryHandoffConfig } from './restart.ts'
+import { detectedDebugger, detectedSupervisor, restartAllowed, scheduleRestart, servingPort, trustedRestartRequest, trustedDownloadRequest, type RecoveryHandoffConfig, restartReachableFrom } from './restart.ts'
 import type { RecoveryPlugin } from './recovery.ts'
 import { activationAfterReplace, brokenClientBundles, checkClientBundle, defaultHostRuntimeFacts, hasHostHalf, hostPeerGate, newlyBrokenBundles, peerGateRemedy, verifyActivation } from './verify.ts'
 import {
@@ -1266,6 +1266,11 @@ export function mountMarketRoutes(
     // and the page then tells the user to refresh, which is the one thing
     // that cannot help.
     const native = holdsNativeAddon(config.profile, name, activeProfileDir)
+    // Asked BEFORE the removal, like `native` above and for the same reason:
+    // the row ids come from the package's own bundle patch, which the remove
+    // deletes. Read afterwards this returns [] and the rows survive the
+    // package as boot-time orphans (#799).
+    const ownedRows = rowIdsForPackage(host, activeProfileDir, name)
     const result = await runPlugin(config.profile, ['remove', name])
     if (result.exitCode !== 0 || result.timedOut || result.cancelled) {
       return { ok: false, hot: false, detail: failureDetail(result) }
@@ -1293,7 +1298,7 @@ export function mountMarketRoutes(
     if (native) {
       logEvent('info', 'uninstall', `${name} ships or depends on a native addon; a restart is needed before it can be installed again`)
     }
-    removeRowBlocks(userPatchPath, rowIdsForPackage(host, activeProfileDir, name))
+    removeRowBlocks(userPatchPath, ownedRows)
     disabled.delete(name)
     replacedWhileLive.delete(name)
     removeFromGroups({ groups, groupOrder }, name)
@@ -3361,6 +3366,15 @@ export function mountMarketRoutes(
           // "no restart button" is the state #229 reported as broken.
           supervisor: detectedSupervisor(),
           debugger: detectedDebugger(),
+          // Whether a restart asked for from THIS page could pass the route's
+          // fence (#782). Per request, not per config: behind a reverse proxy
+          // the POST arrives over the same path as this GET, so it fails for
+          // the same reasons — and the banner used to render a button that
+          // answered 403 every time, with nothing saying so in advance. It is
+          // a prediction: the route still runs the whole fence on the POST.
+          // Deliberately NOT folded into `restart`, which is also what the
+          // settings page reads and writes back as the user's own choice.
+          restartReachable: restartReachableFrom(request),
           selfManaged: installed.dshmarket !== undefined || installed['dsh-market'] !== undefined,
           // Whether the host took the market's settings namespace (#677).
           // `unsupported-by-host` is 0.1.7 and newer, where settings come from
@@ -4234,6 +4248,21 @@ sendJson(response, 200, { updates })
             // declaration is unchanged; a failed run restores the manifest from
             // the snapshot above.
             //
+            // `reresolveInPlace` is not the only shape whose diff is empty.
+            // When the manifest holds the spelling pnpm itself wrote for a
+            // GitHub source — `git+https://owner/repo.git` — and the market
+            // sends the `github:owner/repo` shortcut, the target differs from
+            // the specifier but pnpm still gives the specifier back unchanged,
+            // so the host answers `ambiguous-install` again (#803; measured on
+            // pnpm 11.7.0, the version DSH Desktop bundles, against the
+            // reporter's own spec pair). One question covers both: pnpm leaves
+            // the specifier as it was, so the diff the host reads is empty.
+            //
+            // The pin is the market's own write to a foreign pipeline, so it is
+            // scoped to the host that reads the manifest itself. A host that
+            // takes market options lets the market verify its own run, and gets
+            // no extra manifest write.
+            //
             // A `#path:` spec needs the local pin instead of the host's exact
             // rollback target: `gitTargetAtCommit` refuses the `&` that carries
             // a selector beside a commit, because dsh-cli's target grammar has
@@ -4243,7 +4272,9 @@ sendJson(response, 200, { updates })
             const pinValue = gitRollbackTarget ?? (hasGitSubpath && beforeCommit !== null
               ? pinSpecToCommit(spec, beforeCommit)
               : null)
-            const pinnedForIdentification = reresolveInPlace && !inPlaceUpdate
+            const identifiesInstalledByManifestDiff = !marketFlags
+            const pinnedForIdentification = isGit && !restore
+              && identifiesInstalledByManifestDiff
               && pinValue !== null && pinValue !== spec
             if (pinnedForIdentification) {
               declareProfileDependency(config.profile, name, pinValue, activeProfileDir)
@@ -5402,6 +5433,12 @@ sendJson(response, 200, { updates })
             // `hot` would send the user to a page refresh, which is the one
             // thing that cannot help.
             const heldNativeAddon = holdsNativeAddon(config.profile, name, activeProfileDir)
+            // And once more, for the same reason: `rowIdsForPackage` names the
+            // rows from the package's own bundle patch, which the remove below
+            // deletes. Asked afterwards it answers [] on exactly the uninstall
+            // it is meant to clean up after, and the rows outlive the package
+            // as boot-time orphans (#799).
+            const ownedRows = rowIdsForPackage(host, activeProfileDir, name)
             const result = await runPlugin(config.profile, ['remove', name])
             const cancelled = result.cancelled
             const ok = result.exitCode === 0 && !result.timedOut && !cancelled
@@ -5465,7 +5502,7 @@ sendJson(response, 200, { updates })
               // Patch-layer rows must not survive the remove either: a
               // `- id: X` + `disabled: true` row for a package that no longer
               // mounts is a boot-time orphan (port of dsh-plugin-hub).
-              removeRowBlocks(userPatchPath, rowIdsForPackage(host, activeProfileDir, name))
+              removeRowBlocks(userPatchPath, ownedRows)
               // The disable list must not keep a removed plugin: a later
               // reinstall starts enabled. Group memberships follow the same
               // rule so no group toggle ever targets a ghost member.