dshmarket 1.68.0 → 1.69.0

package/README.md

@@ -29,7 +29,10 @@ desktop app needed). The market is also still a section of **Settings → Plugin
 Market**: on dsh 0.2.0 and older that is the only way in, and from 0.2.1 the
 Settings dialog lives in the account menu. If you would rather reach it in one
 click from anywhere, the market can also put its own **Plugin Market** row in
-the sidebar; turn it on from the market's card under **Plugins**.
+the sidebar; turn it on from the market's card under **Plugins**. Going the
+other way, an installed plugin's **···** menu offers **View in Plugins** on
+dsh 0.2.1+: it opens the host's own page for that plugin, which is the only
+place its individual rows can be switched one by one.
 
 A host that runs under another profile name takes the same command with that
 name instead — `dsh plugin --profile <profile> add dshmarket`. On the official

package/README.zh.md

@@ -27,7 +27,9 @@ dsh plugin --profile web add dshmarket
 （dsh 0.2.1 及以上；普通的 `dsh web` 就有，不需要桌面端）。市场仍然也是
 **设置 → 插件市场** 里的一个分区：dsh 0.2.0 及以前只有这个入口，0.2.1 起设置
 窗口挪进了账号菜单。想在任何地方一键进入的话，市场也可以在侧边栏放一行
-**插件市场**，在 **插件** 页市场的卡片上打开即可。
+**插件市场**，在 **插件** 页市场的卡片上打开即可。反过来，dsh 0.2.1 起，已装
+插件的 **···** 菜单里有 **在插件页查看**：它会打开宿主里这个插件自己的页面，
+那里是唯一能逐个开关它的各个组件（行）的地方。
 
 如果宿主用的不是 `web` 这个 profile，把它的名字写进命令即可：`dsh plugin
 --profile <profile> add dshmarket`。官方 DSH Desktop 桌面端请在应用自己的

package/client/client.js

@@ -582,6 +582,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			installedDependencyNote: "另有 {0} 个包是插件带进来的依赖，不是插件，未列在上方。",
 			heldReleaseAction: "仍安装 {0}",
 			ignoreUpdateNotice: "重启前不再提醒",
+			openInHostPage: "在插件页查看",
 			ignoreAllUpdateNotices: "重启前都不再提醒",
 			updateNoticeIgnored: "重启前不再提醒",
 			updateExemptAdd: "一直不提醒更新",
@@ -1329,6 +1330,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			installedDependencyNote: "{0} more packages came in as dependencies of plugins — they are not plugins, so they are not listed above.",
 			heldReleaseAction: "Install {0} anyway",
 			ignoreUpdateNotice: "Don't remind until restart",
+			openInHostPage: "View in Plugins",
 			ignoreAllUpdateNotices: "Don't remind any until restart",
 			updateNoticeIgnored: "No reminders until restart",
 			updateExemptAdd: "Never remind about updates",
@@ -8632,6 +8634,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const lang = String(localeSnap.active).toLowerCase().startsWith("zh") ? "zh" : "en";
 			const surface = props.surface ?? "settings";
 			const sidebar = props.sidebar;
+			const hostNavigation = props.hostNavigation;
+			const openInHost = (0, react.useSyncExternalStore)((cb) => hostNavigation?.subscribe(cb) ?? (() => {}), () => hostNavigation?.get());
 			const [sidebarSnap, setSidebarSnap] = (0, react.useState)(() => ({
 				supported: sidebar?.supported() === true,
 				enabled: sidebar?.enabled() === true,
@@ -11854,6 +11858,9 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				});
 			};
 			const renderInstalledBlockMenu = (name) => {
+				const hostPage = openInHost === void 0 ? null : () => {
+					openInHost.openBundle(name);
+				};
 				const entry = data === null ? void 0 : catalogEntryForInstalled(data.plugins, name, String(installed[name] ?? ""), repoIdentities[name], repoHints[name]);
 				const aliases = entry === void 0 ? [name] : blockAliases(entry, name);
 				const hidden = aliases.some((alias) => blockedNameSet.has(alias));
@@ -11879,6 +11886,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 						if (id === "block") toggleBlock(blockToggleName(aliases));
 						if (id === "update-exempt") toggleUpdateExempt(name);
 						if (id === "ignore-boot") ignoreUpdateNotices([name]);
+						if (id === "host-page") hostPage?.();
 						if (id === "uninstall" && !uninstallBusy) setRemoveConfirm(name);
 					},
 					align: "end",
@@ -11908,6 +11916,10 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 							id: "ignore-boot",
 							label: t("ignoreUpdateNotice")
 						}] : [],
+						...hostPage === null ? [] : [{
+							id: "host-page",
+							label: t("openInHostPage")
+						}],
 						...showExempt ? [{
 							id: "update-exempt",
 							label: exempt ? t("updateExemptRemove") : t("updateExemptAdd")
@@ -15410,6 +15422,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				themeStore: props.themeStore,
 				preferredSubsectionId: props.preferredSubsectionId,
 				sidebar: props.sidebar,
+				hostNavigation: props.hostNavigation,
 				surface: props.surface
 			}));
 		}
@@ -16156,6 +16169,25 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			}, "dsh-market: settings nav icon");
 		}
 		//#endregion
+		//#region src/client/host-navigation.ts
+		function createHostNavigation() {
+			let navigation;
+			const listeners = /* @__PURE__ */ new Set();
+			return {
+				get: () => navigation,
+				subscribe: (listener) => {
+					listeners.add(listener);
+					return () => {
+						listeners.delete(listener);
+					};
+				},
+				attach: (next) => {
+					navigation = next;
+					for (const listener of [...listeners]) listener();
+				}
+			};
+		}
+		//#endregion
 		//#region src/client/sidebar-entry.ts
 		/**
 		* The market's own row in the sidebar (#846), beside the host's Plugins page.
@@ -16333,6 +16365,12 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			installSettingsNavIcon(ctx, () => t("nav"));
 			let sidebar;
 			/**
+			* The host's `pluginNavigation` (dsh 0.2.1+), published as a store so the
+			* panel's menus can offer "在插件页查看" whether the service is there before
+			* or after this package mounts. See host-navigation.ts.
+			*/
+			const hostNavigation = createHostNavigation();
+			/**
 			* The market's own panel, as an element — one builder for the settings
 			* section this package registers and for `market.render()` (#602). Built
 			* per call: the props are live (locale, theme, the host's preferred
@@ -16357,6 +16395,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				},
 				preferredSubsectionId: ownerProps.preferredSubsectionId,
 				sidebar,
+				hostNavigation,
 				surface: ownerProps.surface ?? "settings"
 			});
 			const sectionGate = createSectionGate(() => {
@@ -16415,6 +16454,11 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			ctx.inject(["layout"], (scoped) => {
 				layout = scoped.layout;
 			});
+			ctx.inject(["pluginNavigation"], (scoped) => {
+				hostNavigation.attach({ openBundle: (name) => {
+					scoped.pluginNavigation.openBundle(name);
+				} });
+			});
 			const retire = () => {
 				sectionGate.retire();
 				sidebarGate.retire();

package/lib/pending-rows.js

@@ -0,0 +1,141 @@
+/**
+ * Patch rows an uninstall was going to orphan, recorded before the remove.
+ *
+ * Why this exists (#987): an uninstall removes the package first and clears the
+ * rows its bundle patch declares second — `rowIdsForPackage` has to be asked
+ * BEFORE the remove, because the remove deletes the patch it reads (#799). On
+ * a host that unloads this plugin in the middle of the operation (the official
+ * Desktop replays its plugin set after a profile change, #962), the second half
+ * never runs and the rows outlive their package. A `- id: pet` insert for a
+ * package that is no longer installed is not cosmetic: DSH's boot is
+ * all-or-nothing, so one row naming a missing module can keep the whole host
+ * from starting, and the way out was editing cordis.patch.yml by hand.
+ *
+ * So the intent is written down before the destructive step, exactly like the
+ * interrupted-update journal next door, and the next start settles it against
+ * disk truth: rows whose package is gone are removed, and a record whose
+ * package is still installed is dropped untouched (the remove never happened,
+ * or the user put it back — either way the rows are exactly as configuration
+ * should be).
+ *
+ * The rows this settles are the ones the market writes and `removeRowBlocks`
+ * understands — `- id: X` + `disabled:` blocks. Rows that declare a package's
+ * own config live in that package's patch; a copy of one in the profile patch
+ * is the host's (the manager's install dialog writes those) and is not this
+ * module's to interpret.
+ *
+ * What this cannot do is run when the host never starts: the repair happens
+ * inside the host, after composition. It covers the case that produced the
+ * report — a host that stayed up while this plugin was unloaded — and the next
+ * ordinary start after a restart.
+ */
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { removeRowBlocks } from './patch.js';
+import { readInstalled } from './profile.js';
+const STATE_VERSION = 1;
+/** Same directory as the other durable per-profile state (see pending-updates.ts). */
+export function pendingRowsFile(profileDirectory) {
+    return join(profileDirectory, '.dsh-market', 'pending-rows.json');
+}
+export class PendingRowJournal {
+    file;
+    constructor(file) {
+        this.file = file;
+    }
+    static forProfile(profileDirectory) {
+        return new PendingRowJournal(pendingRowsFile(profileDirectory));
+    }
+    list() {
+        return this.read().operations;
+    }
+    /** Record what a remove is about to orphan. Upserts by profile+name. */
+    begin(input) {
+        if (input.rows.length === 0)
+            return;
+        const state = this.read();
+        const existing = state.operations.find(entry => entry.profile === input.profile && entry.name === input.name);
+        const fields = {
+            profile: input.profile,
+            name: input.name,
+            patchPath: input.patchPath,
+            rows: [...input.rows],
+            startedAt: new Date().toISOString(),
+        };
+        if (existing !== undefined)
+            Object.assign(existing, fields);
+        else
+            state.operations.push({ id: `${input.profile}:${input.name}`, ...fields });
+        this.write(state);
+    }
+    /** The rows were cleaned (or the remove never happened): nothing left to settle. */
+    finish(profile, name) {
+        const state = this.read();
+        const kept = state.operations.filter(entry => !(entry.profile === profile && entry.name === name));
+        if (kept.length === state.operations.length)
+            return;
+        this.write({ version: STATE_VERSION, operations: kept });
+    }
+    read() {
+        try {
+            const parsed = JSON.parse(readFileSync(this.file, 'utf8'));
+            const operations = Array.isArray(parsed.operations) ? parsed.operations : [];
+            // Storage is not trusted: this file is user-writable and outlives
+            // versions of this code, and a malformed entry must cost its own record,
+            // never the whole repair.
+            return {
+                version: STATE_VERSION,
+                operations: operations.filter((entry) => entry !== null && typeof entry === 'object'
+                    && typeof entry.profile === 'string' && typeof entry.name === 'string'
+                    && typeof entry.patchPath === 'string'
+                    && Array.isArray(entry.rows) && entry.rows.every(row => typeof row === 'string')
+                    && typeof entry.id === 'string' && typeof entry.startedAt === 'string'),
+            };
+        }
+        catch {
+            return { version: STATE_VERSION, operations: [] };
+        }
+    }
+    write(state) {
+        try {
+            mkdirSync(dirname(this.file), { recursive: true });
+            writeFileSync(this.file, JSON.stringify(state));
+        }
+        catch { /* storage unavailable — the next start just has nothing to settle */ }
+    }
+}
+/**
+ * Settle every recorded remove against what the profile actually holds now.
+ *
+ * @param options.profile - Profile name, for reading the installed map.
+ * @param options.profileDirectory - Its directory, when the host named one.
+ * @returns what happened, per record.
+ */
+export function repairOrphanedRows(options) {
+    const directory = options.profileDirectory;
+    if (directory === undefined)
+        return { removed: [], kept: [], failed: [] };
+    const journal = PendingRowJournal.forProfile(directory);
+    const records = journal.list();
+    const report = { removed: [], kept: [], failed: [] };
+    if (records.length === 0)
+        return report;
+    const installed = readInstalled(options.profile, directory);
+    for (const record of records) {
+        if (Object.hasOwn(installed, record.name)) {
+            // The remove never landed, or the user reinstalled it. Either way these
+            // rows are configuration for a package that is here.
+            journal.finish(record.profile, record.name);
+            report.kept.push(record.name);
+            continue;
+        }
+        const cleaned = removeRowBlocks(record.patchPath, record.rows);
+        if (!cleaned.ok) {
+            report.failed.push(record.name);
+            continue;
+        }
+        journal.finish(record.profile, record.name);
+        report.removed.push(record.name);
+    }
+    return report;
+}

package/lib/routes.js

@@ -22,6 +22,7 @@ import { marketFetch } from './net.js';
 import { diagnosePackageManifests } from './diagnostics.js';
 import { BOOT_ID, cancelActive, probePnpm, progress, provisionPnpm, runDshPlugin, setBuildEnvSource, TARGET_RE, } from './dsh-cli.js';
 import { packageOfEntryName } from './entry-identity.js';
+import { PendingRowJournal, repairOrphanedRows } from './pending-rows.js';
 import { addProfileBundle, bundleOptOutRowIds, bundlePatchInsertedIds, bundlesDroppedFromProfile, declareProfileDependency, dropFromManifest, generationManagedNames, hasLoadableEntry, holdsNativeAddon, INBOX_BUNDLES, isDshProfileName, profileDir, readDependencyOwners, readGitResolutionCommit, readInstalled, readInstalledManifest, readInstalledPackageName, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readProfileBundles, readProfileManifestSnapshot, removeProfileBundle, restoreProfileManifest, setAllowBuilds } from './profile.js';
 import { assessProfile, classifyPeer, introducedDuplicateNames, introducedRisks } from './compatibility.js';
 import { runningAgentIds } from './agents.js';
@@ -367,6 +368,21 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         throw new Error(message);
     }
     const activeProfileDir = profileDir(config.profile, config.profileDirectory);
+    // #987: a remove that died between deleting the package and clearing the
+    // rows its bundle patch declares leaves an insert naming a missing module —
+    // and DSH's boot is all-or-nothing, so that row can keep the host from
+    // starting at all. The intent was journaled before the destructive step;
+    // settle it now, against what the profile actually holds.
+    try {
+        const settled = repairOrphanedRows({ profile: config.profile, profileDirectory: activeProfileDir });
+        if (settled.removed.length > 0)
+            logEvent('info', 'uninstall', `cleared patch rows left by an interrupted uninstall: ${settled.removed.join(', ')}`);
+        if (settled.failed.length > 0)
+            logEvent('warn', 'uninstall', `patch rows from an interrupted uninstall could not be cleared, will retry: ${settled.failed.join(', ')}`);
+    }
+    catch (error) {
+        logEvent('warn', 'uninstall', `could not settle interrupted uninstall rows — ${error instanceof Error ? error.message : String(error)}`);
+    }
     const analyzeActiveProfile = () => analyzeProfile(activeProfileDir, {
         ...(config.dshInstallDir === undefined ? {} : { dshInstallDir: config.dshInstallDir }),
     });
@@ -1449,8 +1465,15 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         // deletes. Read afterwards this returns [] and the rows survive the
         // package as boot-time orphans (#799).
         const ownedRows = rowIdsForPackage(host, activeProfileDir, name);
+        // #987: written down before the destructive step, because the process can
+        // be unloaded between the remove and the cleanup below — and a row whose
+        // package is gone can stop the next boot.
+        const rowJournal = PendingRowJournal.forProfile(activeProfileDir);
+        rowJournal.begin({ profile: config.profile, name, patchPath: userPatchPath, rows: ownedRows });
         const result = await runPlugin(config.profile, ['remove', name]);
         if (result.exitCode !== 0 || result.timedOut || result.cancelled) {
+            // Nothing was removed: the rows are still configuration, not orphans.
+            rowJournal.finish(config.profile, name);
             return { ok: false, hot: false, detail: failureDetail(result) };
         }
         // A host that owns the composition replays it instead of being
@@ -1479,6 +1502,8 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         const cleanedOwned = removeRowBlocks(userPatchPath, ownedRows);
         if (!cleanedOwned.ok)
             logEvent('warn', 'uninstall', `patch rows could not be cleared — ${cleanedOwned.reason}`);
+        else
+            rowJournal.finish(config.profile, name);
         disabled.delete(name);
         replacedWhileLive.delete(name);
         removeFromGroups({ groups, groupOrder }, name);
@@ -5805,6 +5830,13 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         // interrupted mid-remove leaves the same "where did it go" with no
                         // entry saying what was running.
                         logEvent('info', 'uninstall-start', `${name} (profile ${config.profile})`);
+                        // #987: the rows are journaled BEFORE the remove for the same
+                        // reason they are read before it — and because this process can be
+                        // unloaded in between (the official Desktop replays its plugin set
+                        // after a profile change), which used to leave an insert naming a
+                        // package that is no longer installed.
+                        const rowJournal = PendingRowJournal.forProfile(activeProfileDir);
+                        rowJournal.begin({ profile: config.profile, name, patchPath: userPatchPath, rows: ownedRows });
                         const result = await runPlugin(config.profile, ['remove', name]);
                         const cancelled = result.cancelled;
                         let ok = result.exitCode === 0 && !result.timedOut && !cancelled;
@@ -5829,6 +5861,10 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             if (isHostPortCollision(result))
                                 ok = true;
                         }
+                        // The remove did not land and nothing half-gone was found: the
+                        // package (and its rows) are exactly as they were.
+                        if (!ok && !halfGone && !cancelled)
+                            rowJournal.finish(config.profile, name);
                         let hot = false;
                         if (ok || halfGone) {
                             invalidateUpdates();
@@ -5876,6 +5912,11 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             const cleanedOwned = removeRowBlocks(userPatchPath, ownedRows);
                             if (!cleanedOwned.ok)
                                 logEvent('warn', 'uninstall', `patch rows could not be cleared — ${cleanedOwned.reason}`);
+                            // Either way the record is settled: cleaned means nothing is
+                            // left to do, and an unclean file is reported above rather than
+                            // turned into a silent retry loop on every start.
+                            else
+                                rowJournal.finish(config.profile, name);
                             // The disable list must not keep a removed plugin: a later
                             // reinstall starts enabled. Group memberships follow the same
                             // rule so no group toggle ever targets a ghost member.

package/lib/types/pending-rows.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Patch rows an uninstall was going to orphan, recorded before the remove.
+ *
+ * Why this exists (#987): an uninstall removes the package first and clears the
+ * rows its bundle patch declares second — `rowIdsForPackage` has to be asked
+ * BEFORE the remove, because the remove deletes the patch it reads (#799). On
+ * a host that unloads this plugin in the middle of the operation (the official
+ * Desktop replays its plugin set after a profile change, #962), the second half
+ * never runs and the rows outlive their package. A `- id: pet` insert for a
+ * package that is no longer installed is not cosmetic: DSH's boot is
+ * all-or-nothing, so one row naming a missing module can keep the whole host
+ * from starting, and the way out was editing cordis.patch.yml by hand.
+ *
+ * So the intent is written down before the destructive step, exactly like the
+ * interrupted-update journal next door, and the next start settles it against
+ * disk truth: rows whose package is gone are removed, and a record whose
+ * package is still installed is dropped untouched (the remove never happened,
+ * or the user put it back — either way the rows are exactly as configuration
+ * should be).
+ *
+ * The rows this settles are the ones the market writes and `removeRowBlocks`
+ * understands — `- id: X` + `disabled:` blocks. Rows that declare a package's
+ * own config live in that package's patch; a copy of one in the profile patch
+ * is the host's (the manager's install dialog writes those) and is not this
+ * module's to interpret.
+ *
+ * What this cannot do is run when the host never starts: the repair happens
+ * inside the host, after composition. It covers the case that produced the
+ * report — a host that stayed up while this plugin was unloaded — and the next
+ * ordinary start after a restart.
+ */
+export interface PendingRowCleanup {
+    id: string;
+    profile: string;
+    /** The package being removed; also what decides whether the rows are orphans. */
+    name: string;
+    /** The profile patch layer the rows live in, absolute. */
+    patchPath: string;
+    /** Loader row ids the package's own bundle patch declares. */
+    rows: string[];
+    startedAt: string;
+}
+export interface PendingRowInput {
+    profile: string;
+    name: string;
+    patchPath: string;
+    rows: readonly string[];
+}
+/** Same directory as the other durable per-profile state (see pending-updates.ts). */
+export declare function pendingRowsFile(profileDirectory: string): string;
+export declare class PendingRowJournal {
+    readonly file: string;
+    constructor(file: string);
+    static forProfile(profileDirectory: string): PendingRowJournal;
+    list(): PendingRowCleanup[];
+    /** Record what a remove is about to orphan. Upserts by profile+name. */
+    begin(input: PendingRowInput): void;
+    /** The rows were cleaned (or the remove never happened): nothing left to settle. */
+    finish(profile: string, name: string): void;
+    private read;
+    private write;
+}
+export interface OrphanRowReport {
+    /** Packages whose rows were removed this start. */
+    removed: string[];
+    /** Records dropped because the package is still installed. */
+    kept: string[];
+    /** Records whose rows could not be removed; they are retried next start. */
+    failed: string[];
+}
+/**
+ * Settle every recorded remove against what the profile actually holds now.
+ *
+ * @param options.profile - Profile name, for reading the installed map.
+ * @param options.profileDirectory - Its directory, when the host named one.
+ * @returns what happened, per record.
+ */
+export declare function repairOrphanedRows(options: {
+    profile: string;
+    profileDirectory?: string;
+}): OrphanRowReport;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.68.0",
+  "version": "1.69.0",
   "icon": "assets/logo.svg",
   "type": "module",
   "main": "lib/index.js",

package/src/client/MarketSection.tsx

@@ -50,6 +50,7 @@ import { clearSettled, drop, enqueue, patch as patchRecord, recordForUrl, restor
 import type { OperationRecord } from './operations.ts'
 import { Diagnostics } from './Diagnostics.tsx'
 import { exportMarketLog } from './self-check.ts'
+import type { HostNavigationStore } from './host-navigation.ts'
 import type { SidebarEntry } from './sidebar-entry.ts'
 import {
   installCommandFor,
@@ -1811,6 +1812,11 @@ export interface MarketSectionProps {
   preferredSubsectionId?: string
   /** The opt-in sidebar row. Absent, the page offers no shortcut tip. */
   sidebar?: SidebarEntry
+  /**
+   * The host's `pluginNavigation` (dsh 0.2.1+). Absent, installed plugins
+   * offer no link to the host's own page for them.
+   */
+  hostNavigation?: HostNavigationStore
   /**
    * Which mount this is. Only the settings page may offer the sidebar
    * shortcut; the sidebar page must not ask to open itself, and the Plugins
@@ -1893,6 +1899,14 @@ export function MarketSection(props: MarketSectionProps) {
   const lang = String(localeSnap.active).toLowerCase().startsWith('zh') ? 'zh' : 'en'
   const surface = props.surface ?? 'settings'
   const sidebar = props.sidebar
+  // The host's own page for a bundle (dsh 0.2.1+). Subscribed rather than read
+  // once: the service arrives with the host's plugin manager, which may load
+  // after this panel is already on screen.
+  const hostNavigation = props.hostNavigation
+  const openInHost = useSyncExternalStore(
+    cb => hostNavigation?.subscribe(cb) ?? (() => {}),
+    () => hostNavigation?.get(),
+  )
   const [sidebarSnap, setSidebarSnap] = useState(() => ({
     supported: sidebar?.supported() === true,
     enabled: sidebar?.enabled() === true,
@@ -5334,6 +5348,11 @@ export function MarketSection(props: MarketSectionProps) {
   }
 
   const renderInstalledBlockMenu = (name: string) => {
+    // The host's page for this bundle, when it offers one. It is the only
+    // place a bundle's ROWS can be switched one by one, which is the reason
+    // to leave a page that already installs, updates and removes.
+    const hostPage = openInHost === undefined ? null : () => { openInHost.openBundle(name) }
+
     const entry = data === null ? undefined : catalogEntryForInstalled(data.plugins, name, String(installed[name] ?? ''), repoIdentities[name], repoHints[name])
     const aliases = entry === undefined ? [name] : blockAliases(entry, name)
     const hidden = aliases.some(alias => blockedNameSet.has(alias))
@@ -5369,6 +5388,7 @@ export function MarketSection(props: MarketSectionProps) {
           if (id === 'block') toggleBlock(blockToggleName(aliases))
           if (id === 'update-exempt') toggleUpdateExempt(name)
           if (id === 'ignore-boot') ignoreUpdateNotices([name])
+          if (id === 'host-page') hostPage?.()
           if (id === 'uninstall' && !uninstallBusy) setRemoveConfirm(name)
         }}
         align="end"
@@ -5390,6 +5410,7 @@ export function MarketSection(props: MarketSectionProps) {
           ...(favoriteUrl === undefined ? [] : [{ id: 'favorite', label: favorited ? t('favoriteRemove') : t('favoriteAdd') }]),
           { id: 'block', label: hidden ? t('blockRemove') : t('blockAdd') },
           ...(showBootIgnore ? [{ id: 'ignore-boot', label: t('ignoreUpdateNotice') }] : []),
+          ...(hostPage === null ? [] : [{ id: 'host-page', label: t('openInHostPage') }]),
           ...(showExempt ? [{ id: 'update-exempt', label: exempt ? t('updateExemptRemove') : t('updateExemptAdd') }] : []),
           { type: 'separator' as const, id: 'uninstall-sep' },
           { id: 'uninstall', label: removing ? t('uninstalling') : t('uninstall'), danger: true, disabled: uninstallBusy },

package/src/client/host-navigation.ts

@@ -0,0 +1,44 @@
+/**
+ * The host's own "open this bundle's page" entry (dsh 0.2.1+).
+ *
+ * The Plugins page documents `pluginNavigation.openBundle(packageName)` for
+ * other client plugins: it selects that page and shows the bundle, without
+ * touching the running Session. The market uses it from an installed plugin's
+ * ··· menu, because the host's page is the only place a bundle's ROWS can be
+ * switched on and off one by one — the market draws the bundle's own switch
+ * and nothing below it.
+ *
+ * A store rather than a plain value: the service arrives with the host's
+ * plugin manager, which may load after this package, and a menu drawn from a
+ * snapshot taken at setup would never offer the action on a host that has it.
+ */
+
+/** What the host offers, as much of it as this package uses. */
+export interface HostNavigation {
+  openBundle(packageName: string): void
+}
+
+export interface HostNavigationStore {
+  /** The service, or undefined on a host that never provides it. */
+  get(): HostNavigation | undefined
+  /** Re-render hook for the menus that offer the action. */
+  subscribe(listener: () => void): () => void
+  /** The host provided the service. */
+  attach(navigation: HostNavigation): void
+}
+
+export function createHostNavigation(): HostNavigationStore {
+  let navigation: HostNavigation | undefined
+  const listeners = new Set<() => void>()
+  return {
+    get: () => navigation,
+    subscribe: (listener) => {
+      listeners.add(listener)
+      return () => { listeners.delete(listener) }
+    },
+    attach: (next) => {
+      navigation = next
+      for (const listener of [...listeners]) listener()
+    },
+  }
+}

package/src/client/index.ts

@@ -18,6 +18,7 @@ import { createSectionGate } from './section-gate.ts'
 import { exportMarketLog } from './self-check.ts'
 import { SettingsCard } from './SettingsCard.tsx'
 import { installSettingsNavIcon } from './settings-nav-icon.ts'
+import { createHostNavigation } from './host-navigation.ts'
 import { createSidebarEntry, SIDEBAR_PANEL_ID, SIDEBAR_PANEL_ORDER } from './sidebar-entry.ts'
 import type { SidebarEntry } from './sidebar-entry.ts'
 import { MarketLogo } from './MarketSection.tsx'
@@ -172,6 +173,12 @@ function mountMarket(ctx: MarketClientContext): void {
   // buildMarketElement run after that assignment — a render during setup
   // would see no controller, and the page simply offers no tip.
   let sidebar: SidebarEntry | undefined
+  /**
+   * The host's `pluginNavigation` (dsh 0.2.1+), published as a store so the
+   * panel's menus can offer "在插件页查看" whether the service is there before
+   * or after this package mounts. See host-navigation.ts.
+   */
+  const hostNavigation = createHostNavigation()
   /**
    * The market's own panel, as an element — one builder for the settings
    * section this package registers and for `market.render()` (#602). Built
@@ -195,6 +202,7 @@ function mountMarket(ctx: MarketClientContext): void {
     exportLog: () => { void exportMarketLog().catch(() => {}) },
     preferredSubsectionId: ownerProps.preferredSubsectionId,
     sidebar,
+    hostNavigation,
     surface: ownerProps.surface ?? 'settings',
   })
 
@@ -264,6 +272,18 @@ function mountMarket(ctx: MarketClientContext): void {
   setTimeout(() => { sidebar?.refresh() }, 0)
   ;(ctx as unknown as { inject(services: string[], callback: (scoped: { layout: LayoutService }) => void): void })
     .inject(['layout'], (scoped) => { layout = scoped.layout })
+
+  // The host's own page for a bundle (dsh 0.2.1+). Its Plugins page documents
+  // `pluginNavigation.openBundle(packageName)` for other client plugins: the
+  // bundle's page is where its rows are switched one by one, which no public
+  // contract lets a third party draw. Nested inject, like the settings card
+  // below: naming the service in the module-level `inject` would keep the
+  // whole plugin unmounted on every host without it, and this one is young.
+  ;(ctx as unknown as {
+    inject(services: string[], callback: (scoped: { pluginNavigation: { openBundle(name: string): void } }) => void): void
+  }).inject(['pluginNavigation'], (scoped) => {
+    hostNavigation.attach({ openBundle: (name) => { scoped.pluginNavigation.openBundle(name) } })
+  })
   const retire = (): void => {
     sectionGate.retire()
     sidebarGate.retire()

package/src/client/locales.ts

@@ -393,6 +393,9 @@ export const zh = {
   installedDependencyNote: '另有 {0} 个包是插件带进来的依赖，不是插件，未列在上方。',
   heldReleaseAction: '仍安装 {0}',
   ignoreUpdateNotice: '重启前不再提醒',
+  // The host's own page for a plugin. Named for what the user gets there —
+  // the switches below the plugin (行), which the market does not draw.
+  openInHostPage: '在插件页查看',
   ignoreAllUpdateNotices: '重启前都不再提醒',
   updateNoticeIgnored: '重启前不再提醒',
   updateExemptAdd: '一直不提醒更新',
@@ -1160,6 +1163,7 @@ export const en: Record<MarketKey, string> = {
   installedDependencyNote: '{0} more packages came in as dependencies of plugins — they are not plugins, so they are not listed above.',
   heldReleaseAction: 'Install {0} anyway',
   ignoreUpdateNotice: "Don't remind until restart",
+  openInHostPage: 'View in Plugins',
   ignoreAllUpdateNotices: "Don't remind any until restart",
   updateNoticeIgnored: 'No reminders until restart',
   updateExemptAdd: 'Never remind about updates',

package/src/client/market-element.ts

@@ -19,6 +19,7 @@ import { MarketErrorBoundary } from './ErrorBoundary.tsx'
 import { MarketSection } from './MarketSection.tsx'
 import type { MarketSectionProps } from './MarketSection.tsx'
 import type { Translate } from './market-data.ts'
+import type { HostNavigationStore } from './host-navigation.ts'
 import type { SidebarEntry } from './sidebar-entry.ts'
 
 /** Everything the panel needs from the client context, plus its own actions. */
@@ -35,6 +36,11 @@ export interface MarketElementProps {
   preferredSubsectionId?: string
   /** The opt-in sidebar row. Absent, the panel offers no shortcut tip. */
   sidebar?: SidebarEntry
+  /**
+   * The host's `pluginNavigation`, when it provides one. Absent, an installed
+   * plugin's menu offers no way to the host's own page for it.
+   */
+  hostNavigation?: HostNavigationStore
   /**
    * Where this panel is mounted. Only the settings page offers the sidebar
    * shortcut; the sidebar page must not offer itself, and the Plugins page's
@@ -68,6 +74,7 @@ export function marketElement(props: MarketElementProps): unknown {
     themeStore: props.themeStore,
     preferredSubsectionId: props.preferredSubsectionId,
     sidebar: props.sidebar,
+    hostNavigation: props.hostNavigation,
     surface: props.surface,
   }))
 }

package/src/pending-rows.ts

@@ -0,0 +1,178 @@
+/**
+ * Patch rows an uninstall was going to orphan, recorded before the remove.
+ *
+ * Why this exists (#987): an uninstall removes the package first and clears the
+ * rows its bundle patch declares second — `rowIdsForPackage` has to be asked
+ * BEFORE the remove, because the remove deletes the patch it reads (#799). On
+ * a host that unloads this plugin in the middle of the operation (the official
+ * Desktop replays its plugin set after a profile change, #962), the second half
+ * never runs and the rows outlive their package. A `- id: pet` insert for a
+ * package that is no longer installed is not cosmetic: DSH's boot is
+ * all-or-nothing, so one row naming a missing module can keep the whole host
+ * from starting, and the way out was editing cordis.patch.yml by hand.
+ *
+ * So the intent is written down before the destructive step, exactly like the
+ * interrupted-update journal next door, and the next start settles it against
+ * disk truth: rows whose package is gone are removed, and a record whose
+ * package is still installed is dropped untouched (the remove never happened,
+ * or the user put it back — either way the rows are exactly as configuration
+ * should be).
+ *
+ * The rows this settles are the ones the market writes and `removeRowBlocks`
+ * understands — `- id: X` + `disabled:` blocks. Rows that declare a package's
+ * own config live in that package's patch; a copy of one in the profile patch
+ * is the host's (the manager's install dialog writes those) and is not this
+ * module's to interpret.
+ *
+ * What this cannot do is run when the host never starts: the repair happens
+ * inside the host, after composition. It covers the case that produced the
+ * report — a host that stayed up while this plugin was unloaded — and the next
+ * ordinary start after a restart.
+ */
+
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { removeRowBlocks } from './patch.ts'
+import { readInstalled } from './profile.ts'
+
+export interface PendingRowCleanup {
+  id: string
+  profile: string
+  /** The package being removed; also what decides whether the rows are orphans. */
+  name: string
+  /** The profile patch layer the rows live in, absolute. */
+  patchPath: string
+  /** Loader row ids the package's own bundle patch declares. */
+  rows: string[]
+  startedAt: string
+}
+
+export interface PendingRowInput {
+  profile: string
+  name: string
+  patchPath: string
+  rows: readonly string[]
+}
+
+interface PendingRowState {
+  version: 1
+  operations: PendingRowCleanup[]
+}
+
+const STATE_VERSION = 1 as const
+
+/** Same directory as the other durable per-profile state (see pending-updates.ts). */
+export function pendingRowsFile(profileDirectory: string): string {
+  return join(profileDirectory, '.dsh-market', 'pending-rows.json')
+}
+
+export class PendingRowJournal {
+  constructor(readonly file: string) {}
+
+  static forProfile(profileDirectory: string): PendingRowJournal {
+    return new PendingRowJournal(pendingRowsFile(profileDirectory))
+  }
+
+  list(): PendingRowCleanup[] {
+    return this.read().operations
+  }
+
+  /** Record what a remove is about to orphan. Upserts by profile+name. */
+  begin(input: PendingRowInput): void {
+    if (input.rows.length === 0) return
+    const state = this.read()
+    const existing = state.operations.find(entry => entry.profile === input.profile && entry.name === input.name)
+    const fields = {
+      profile: input.profile,
+      name: input.name,
+      patchPath: input.patchPath,
+      rows: [...input.rows],
+      startedAt: new Date().toISOString(),
+    }
+    if (existing !== undefined) Object.assign(existing, fields)
+    else state.operations.push({ id: `${input.profile}:${input.name}`, ...fields })
+    this.write(state)
+  }
+
+  /** The rows were cleaned (or the remove never happened): nothing left to settle. */
+  finish(profile: string, name: string): void {
+    const state = this.read()
+    const kept = state.operations.filter(entry => !(entry.profile === profile && entry.name === name))
+    if (kept.length === state.operations.length) return
+    this.write({ version: STATE_VERSION, operations: kept })
+  }
+
+  private read(): PendingRowState {
+    try {
+      const parsed = JSON.parse(readFileSync(this.file, 'utf8')) as Partial<PendingRowState>
+      const operations = Array.isArray(parsed.operations) ? parsed.operations : []
+      // Storage is not trusted: this file is user-writable and outlives
+      // versions of this code, and a malformed entry must cost its own record,
+      // never the whole repair.
+      return {
+        version: STATE_VERSION,
+        operations: operations.filter((entry): entry is PendingRowCleanup =>
+          entry !== null && typeof entry === 'object'
+          && typeof entry.profile === 'string' && typeof entry.name === 'string'
+          && typeof entry.patchPath === 'string'
+          && Array.isArray(entry.rows) && entry.rows.every(row => typeof row === 'string')
+          && typeof entry.id === 'string' && typeof entry.startedAt === 'string'),
+      }
+    } catch {
+      return { version: STATE_VERSION, operations: [] }
+    }
+  }
+
+  private write(state: PendingRowState): void {
+    try {
+      mkdirSync(dirname(this.file), { recursive: true })
+      writeFileSync(this.file, JSON.stringify(state))
+    } catch { /* storage unavailable — the next start just has nothing to settle */ }
+  }
+}
+
+export interface OrphanRowReport {
+  /** Packages whose rows were removed this start. */
+  removed: string[]
+  /** Records dropped because the package is still installed. */
+  kept: string[]
+  /** Records whose rows could not be removed; they are retried next start. */
+  failed: string[]
+}
+
+/**
+ * Settle every recorded remove against what the profile actually holds now.
+ *
+ * @param options.profile - Profile name, for reading the installed map.
+ * @param options.profileDirectory - Its directory, when the host named one.
+ * @returns what happened, per record.
+ */
+export function repairOrphanedRows(options: {
+  profile: string
+  profileDirectory?: string
+}): OrphanRowReport {
+  const directory = options.profileDirectory
+  if (directory === undefined) return { removed: [], kept: [], failed: [] }
+  const journal = PendingRowJournal.forProfile(directory)
+  const records = journal.list()
+  const report: OrphanRowReport = { removed: [], kept: [], failed: [] }
+  if (records.length === 0) return report
+  const installed = readInstalled(options.profile, directory)
+  for (const record of records) {
+    if (Object.hasOwn(installed, record.name)) {
+      // The remove never landed, or the user reinstalled it. Either way these
+      // rows are configuration for a package that is here.
+      journal.finish(record.profile, record.name)
+      report.kept.push(record.name)
+      continue
+    }
+    const cleaned = removeRowBlocks(record.patchPath, record.rows)
+    if (!cleaned.ok) {
+      report.failed.push(record.name)
+      continue
+    }
+    journal.finish(record.profile, record.name)
+    report.removed.push(record.name)
+  }
+  return report
+}

package/src/routes.ts

@@ -31,6 +31,7 @@ import {
   type PluginCommandRuntime,
 } from './dsh-cli.ts'
 import { packageOfEntryName } from './entry-identity.ts'
+import { PendingRowJournal, repairOrphanedRows } from './pending-rows.ts'
 import { addProfileBundle, bundleOptOutRowIds, bundlePatchInsertedIds, bundlesDroppedFromProfile, declareProfileDependency, dropFromManifest, generationManagedNames, hasLoadableEntry, holdsNativeAddon, INBOX_BUNDLES, isDshProfileName, profileDir, readDependencyOwners, readGitResolutionCommit, readInstalled, readInstalledManifest, readInstalledPackageName, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readProfileBundles, readProfileManifestSnapshot, removeProfileBundle, restoreProfileManifest, setAllowBuilds, type ProfileManifestSnapshot } from './profile.ts'
 import { assessProfile, classifyPeer, introducedDuplicateNames, introducedRisks, type CompatibilityRisk } from './compatibility.ts'
 import { runningAgentIds, type AgentsLookup } from './agents.ts'
@@ -492,6 +493,18 @@ export function mountMarketRoutes(
     throw new Error(message)
   }
   const activeProfileDir = profileDir(config.profile, config.profileDirectory)
+  // #987: a remove that died between deleting the package and clearing the
+  // rows its bundle patch declares leaves an insert naming a missing module —
+  // and DSH's boot is all-or-nothing, so that row can keep the host from
+  // starting at all. The intent was journaled before the destructive step;
+  // settle it now, against what the profile actually holds.
+  try {
+    const settled = repairOrphanedRows({ profile: config.profile, profileDirectory: activeProfileDir })
+    if (settled.removed.length > 0) logEvent('info', 'uninstall', `cleared patch rows left by an interrupted uninstall: ${settled.removed.join(', ')}`)
+    if (settled.failed.length > 0) logEvent('warn', 'uninstall', `patch rows from an interrupted uninstall could not be cleared, will retry: ${settled.failed.join(', ')}`)
+  } catch (error) {
+    logEvent('warn', 'uninstall', `could not settle interrupted uninstall rows — ${error instanceof Error ? error.message : String(error)}`)
+  }
   const analyzeActiveProfile = () => analyzeProfile(activeProfileDir, {
     ...(config.dshInstallDir === undefined ? {} : { dshInstallDir: config.dshInstallDir }),
   })
@@ -1635,8 +1648,15 @@ export function mountMarketRoutes(
     // deletes. Read afterwards this returns [] and the rows survive the
     // package as boot-time orphans (#799).
     const ownedRows = rowIdsForPackage(host, activeProfileDir, name)
+    // #987: written down before the destructive step, because the process can
+    // be unloaded between the remove and the cleanup below — and a row whose
+    // package is gone can stop the next boot.
+    const rowJournal = PendingRowJournal.forProfile(activeProfileDir)
+    rowJournal.begin({ profile: config.profile, name, patchPath: userPatchPath, rows: ownedRows })
     const result = await runPlugin(config.profile, ['remove', name])
     if (result.exitCode !== 0 || result.timedOut || result.cancelled) {
+      // Nothing was removed: the rows are still configuration, not orphans.
+      rowJournal.finish(config.profile, name)
       return { ok: false, hot: false, detail: failureDetail(result) }
     }
     // A host that owns the composition replays it instead of being
@@ -1664,6 +1684,7 @@ export function mountMarketRoutes(
     }
     const cleanedOwned = removeRowBlocks(userPatchPath, ownedRows)
     if (!cleanedOwned.ok) logEvent('warn', 'uninstall', `patch rows could not be cleared — ${cleanedOwned.reason}`)
+    else rowJournal.finish(config.profile, name)
     disabled.delete(name)
     replacedWhileLive.delete(name)
     removeFromGroups({ groups, groupOrder }, name)
@@ -6041,6 +6062,13 @@ sendJson(response, 200, { updates })
             // interrupted mid-remove leaves the same "where did it go" with no
             // entry saying what was running.
             logEvent('info', 'uninstall-start', `${name} (profile ${config.profile})`)
+            // #987: the rows are journaled BEFORE the remove for the same
+            // reason they are read before it — and because this process can be
+            // unloaded in between (the official Desktop replays its plugin set
+            // after a profile change), which used to leave an insert naming a
+            // package that is no longer installed.
+            const rowJournal = PendingRowJournal.forProfile(activeProfileDir)
+            rowJournal.begin({ profile: config.profile, name, patchPath: userPatchPath, rows: ownedRows })
             const result = await runPlugin(config.profile, ['remove', name])
             const cancelled = result.cancelled
             let ok = result.exitCode === 0 && !result.timedOut && !cancelled
@@ -6064,6 +6092,9 @@ sendJson(response, 200, { updates })
               // client does not treat a finished uninstall as a failure.
               if (isHostPortCollision(result)) ok = true
             }
+            // The remove did not land and nothing half-gone was found: the
+            // package (and its rows) are exactly as they were.
+            if (!ok && !halfGone && !cancelled) rowJournal.finish(config.profile, name)
             let hot = false
             if (ok || halfGone) {
               invalidateUpdates()
@@ -6110,6 +6141,10 @@ sendJson(response, 200, { updates })
               // mounts is a boot-time orphan (port of dsh-plugin-hub).
               const cleanedOwned = removeRowBlocks(userPatchPath, ownedRows)
               if (!cleanedOwned.ok) logEvent('warn', 'uninstall', `patch rows could not be cleared — ${cleanedOwned.reason}`)
+              // Either way the record is settled: cleaned means nothing is
+              // left to do, and an unclean file is reported above rather than
+              // turned into a silent retry loop on every start.
+              else rowJournal.finish(config.profile, name)
               // The disable list must not keep a removed plugin: a later
               // reinstall starts enabled. Group memberships follow the same
               // rule so no group toggle ever targets a ghost member.