dshmarket 1.70.0 → 1.70.1

package/lib/profile.js

@@ -1491,6 +1491,10 @@ export function setAllowBuilds(profile, packages, explicitDir) {
     const SEG = '[A-Za-z0-9_-][A-Za-z0-9_.-]*';
     const NAME = '[A-Za-z0-9@/_.-]+';
     const SHA = '[0-9a-f]{40}';
+    // pnpm's exact monorepo key includes the selected directory; dropping it
+    // makes approve-and-retry write only a bare name that git builds ignore.
+    const DIR = '(?!\\.{1,2}(?:/|$))[A-Za-z0-9_.-]+';
+    const SUBPATH = `path:/${DIR}(?:/${DIR})*`;
     // The stable clone-URL key: github's (#68) and, since #637, every other
     // host's — pnpm keys a git dependency by the remote it would clone, whoever
     // serves it. Optionally pinned to a commit, which is the form pnpm 11.8.0
@@ -1502,7 +1506,7 @@ export function setAllowBuilds(profile, packages, explicitDir) {
     // authorizes under `name@git+…/repo` and NOT under `…/repo.git`, so
     // requiring the suffix dropped a correctly derived key on its way out, and
     // appending it would have written one pnpm never reads.
-    const GIT_KEY_RE = new RegExp(`^${NAME}@git\\+https://[A-Za-z0-9_.-]+(?::\\d{1,5})?/${SEG}(?:/${SEG})*(?:\\.git)?(?:#${SHA})?$`);
+    const GIT_KEY_RE = new RegExp(`^${NAME}@git\\+https://[A-Za-z0-9_.-]+(?::\\d{1,5})?/${SEG}(?:/${SEG})*(?:\\.git)?(?:#${SHA}(?:&${SUBPATH})?|#${SUBPATH})?$`);
     // The commit-pinned download a host serves, which is what pnpm below 11.21
     // matches instead (#285): codeload for github, the project archive for
     // gitlab.com and bitbucket.org (#637). Each branch names its host and its
@@ -1511,7 +1515,7 @@ export function setAllowBuilds(profile, packages, explicitDir) {
         + `codeload\\.github\\.com/${SEG}/${SEG}/tar\\.gz/${SHA}`
         + `|bitbucket\\.org/${SEG}/${SEG}/get/${SHA}\\.tar\\.gz`
         + `|gitlab\\.com/${SEG}(?:/${SEG})+/-/archive/${SHA}/${SEG}-${SHA}\\.tar\\.gz`
-        + ')$');
+        + `)(?:#${SUBPATH})?$`);
     for (const pkg of packages) {
         if (/^[A-Za-z0-9@/_.-]+$/.test(pkg) || GIT_KEY_RE.test(pkg) || ARCHIVE_KEY_RE.test(pkg))
             map[pkg] = 'true';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.70.0",
+  "version": "1.70.1",
   "icon": "assets/logo.svg",
   "type": "module",
   "main": "lib/index.js",

package/src/profile.ts

@@ -1541,6 +1541,10 @@ export function setAllowBuilds(profile: string, packages: string[], explicitDir?
   const SEG = '[A-Za-z0-9_-][A-Za-z0-9_.-]*'
   const NAME = '[A-Za-z0-9@/_.-]+'
   const SHA = '[0-9a-f]{40}'
+  // pnpm's exact monorepo key includes the selected directory; dropping it
+  // makes approve-and-retry write only a bare name that git builds ignore.
+  const DIR = '(?!\\.{1,2}(?:/|$))[A-Za-z0-9_.-]+'
+  const SUBPATH = `path:/${DIR}(?:/${DIR})*`
   // The stable clone-URL key: github's (#68) and, since #637, every other
   // host's — pnpm keys a git dependency by the remote it would clone, whoever
   // serves it. Optionally pinned to a commit, which is the form pnpm 11.8.0
@@ -1553,7 +1557,7 @@ export function setAllowBuilds(profile: string, packages: string[], explicitDir?
   // requiring the suffix dropped a correctly derived key on its way out, and
   // appending it would have written one pnpm never reads.
   const GIT_KEY_RE = new RegExp(
-    `^${NAME}@git\\+https://[A-Za-z0-9_.-]+(?::\\d{1,5})?/${SEG}(?:/${SEG})*(?:\\.git)?(?:#${SHA})?$`,
+    `^${NAME}@git\\+https://[A-Za-z0-9_.-]+(?::\\d{1,5})?/${SEG}(?:/${SEG})*(?:\\.git)?(?:#${SHA}(?:&${SUBPATH})?|#${SUBPATH})?$`,
   )
   // The commit-pinned download a host serves, which is what pnpm below 11.21
   // matches instead (#285): codeload for github, the project archive for
@@ -1564,7 +1568,7 @@ export function setAllowBuilds(profile: string, packages: string[], explicitDir?
     + `codeload\\.github\\.com/${SEG}/${SEG}/tar\\.gz/${SHA}`
     + `|bitbucket\\.org/${SEG}/${SEG}/get/${SHA}\\.tar\\.gz`
     + `|gitlab\\.com/${SEG}(?:/${SEG})+/-/archive/${SHA}/${SEG}-${SHA}\\.tar\\.gz`
-    + ')$',
+    + `)(?:#${SUBPATH})?$`,
   )
   for (const pkg of packages) {
     if (/^[A-Za-z0-9@/_.-]+$/.test(pkg) || GIT_KEY_RE.test(pkg) || ARCHIVE_KEY_RE.test(pkg)) map[pkg] = 'true'