dshmarket 1.70.2 → 1.70.3

package/lib/catalog-npm.js

@@ -109,3 +109,38 @@ file = 'package/plugins.json') {
         throw new Error(`${pkg}@${version} carries no ${file}`);
     return { version, data: JSON.parse(bytes.toString('utf8')) };
 }
+/**
+ * One file out of a package's newest tarball, or null when it cannot be read
+ * (#1012).
+ *
+ * The install route asks a package what it declares before it installs it: a
+ * rename can only be detected from the rows the artifact carries, not from
+ * the name it was published under. A failed read is not a verdict — the
+ * caller treats null as "not declared", because a registry hiccup must never
+ * become a refusal to install.
+ *
+ * @param registry - registry base, no trailing slash.
+ * @param pkg - package name.
+ * @param file - exact entry name inside the tarball (`package/cordis.patch.yml`).
+ */
+export async function packageFileFromRegistry(registry, pkg, file) {
+    try {
+        const metaRes = await marketFetch(`${registry}/${encodeURIComponent(pkg)}/latest`, {
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+            headers: { accept: 'application/json', 'user-agent': 'dsh-market' },
+        });
+        if (!metaRes.ok)
+            return null;
+        const meta = (await metaRes.json());
+        const tarball = typeof meta.dist?.tarball === 'string' ? meta.dist.tarball : null;
+        if (tarball === null)
+            return null;
+        const tarRes = await marketFetch(tarball, { signal: AbortSignal.timeout(TIMEOUT_MS) });
+        if (!tarRes.ok)
+            return null;
+        return fileFromTarball(Buffer.from(await tarRes.arrayBuffer()), file);
+    }
+    catch {
+        return null;
+    }
+}

package/lib/hot.js

@@ -80,6 +80,10 @@ export function resolveProfileEntry(profileDir, name) {
         return name;
     }
 }
+// File URLs may contain apostrophes; YAML single-quoted scalars escape them by doubling.
+function yamlSingleQuoted(value) {
+    return value.replace(/'/g, "''");
+}
 const HOT_DIR = '.dsh-market';
 /**
  * Ceiling for one hot-mount activation, env-overridable like the install
@@ -683,7 +687,7 @@ export async function hotMount(ctx, profileDir, packageName) {
         // `cleanHotDir` wipes it on every boot and the bundle layer owns
         // persistence, so nothing reads these files back.
         const yml = rows
-            .map(row => `- id: 'mkt-${row.id}'\n  name: '${resolveProfileEntry(profileDir, row.name)}'\n`)
+            .map(row => `- id: '${yamlSingleQuoted(`mkt-${row.id}`)}'\n  name: '${yamlSingleQuoted(resolveProfileEntry(profileDir, row.name))}'\n`)
             .join('');
         writeFileSync(file, yml);
         const handle = ctx.plugin(HotTree, { path: pathToFileURL(file).href });

package/lib/registry.js

@@ -7,6 +7,7 @@ import { logEvent } from './log.js';
 import { configuredProxy, marketFetch } from './net.js';
 import { catalogFromPackage } from './catalog-npm.js';
 import { activeRegion, catalogSourcesFor, routesFor } from './regions.js';
+import { NPM_NAME_RE } from './sources.js';
 /**
  * Category ids for one catalog entry, de-duplicated in declaration order.
  *
@@ -25,6 +26,36 @@ export function pluginCategories(plugin) {
     }
     return categories;
 }
+/**
+ * Former npm names for one catalog entry, normalized (#1012).
+ *
+ * Catalog JSON is external input, so a malformed declaration is dropped
+ * rather than trusted: only syntactically valid npm names survive, an entry
+ * may not list itself (its own `npm` or `name`), and duplicates collapse in
+ * declaration order. Cross-entry rules — a former name that is still live
+ * elsewhere, or two entries claiming one former name — cannot be judged per
+ * entry; the validator enforces them for the catalog, and
+ * `findCatalogRename` fails closed on ambiguity at runtime.
+ */
+export function pluginPreviousNpm(plugin) {
+    const declared = plugin.previousNpm;
+    const values = Array.isArray(declared) ? declared : declared === undefined || declared === null ? [] : [declared];
+    const own = new Set([plugin.name.toLowerCase()]);
+    if (typeof plugin.npm === 'string' && plugin.npm !== '')
+        own.add(plugin.npm.toLowerCase());
+    const names = [];
+    const seen = new Set();
+    for (const value of values) {
+        if (typeof value !== 'string' || value === '' || !NPM_NAME_RE.test(value))
+            continue;
+        const key = value.toLowerCase();
+        if (own.has(key) || seen.has(key))
+            continue;
+        seen.add(key);
+        names.push(value);
+    }
+    return names;
+}
 /**
  * Where the curated list comes from now lives in the region routing table
  * (src/regions.ts), because it is one of several addresses that move
@@ -115,7 +146,14 @@ function asRegistry(value) {
         const category = pluginCategories(plugin);
         if (category.length === 0)
             throw new Error(`catalog plugin ${String(index)} carries no usable category`);
-        return { ...plugin, category };
+        const previousNpm = pluginPreviousNpm(plugin);
+        // An entry with nothing usable to declare looks exactly like one that
+        // declared nothing, so the field stays absent rather than becoming [].
+        if (previousNpm.length === 0) {
+            const { previousNpm: _declared, ...rest } = plugin;
+            return { ...rest, category };
+        }
+        return { ...plugin, category, previousNpm };
     });
     return { ...data, plugins };
 }

package/lib/routes.js

@@ -11,6 +11,7 @@ import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync
 import { dirname, join } from 'node:path';
 import { Readable } from 'node:stream';
 import { load as loadYaml } from 'js-yaml';
+import { packageFileFromRegistry } from './catalog-npm.js';
 import { forgetCatalog, loadRegistry, pluginCategories } from './registry.js';
 import { settingsNamespaceState } from './settings.js';
 import { buildEnvFromUnknown, cleanHotDir, hotMount, hotUnmount, listHotMounts, MAX_BLOCKED, MAX_BLOCKED_NAME, MAX_FAVORITES, MAX_NOTE, MAX_UPDATE_EXEMPT, mountClientOnlyDeps, purgeMarketState, readMarketState, writeMarketState, } from './hot.js';
@@ -23,7 +24,7 @@ import { diagnosePackageManifests } from './diagnostics.js';
 import { BOOT_ID, cancelActive, probePnpm, progress, provisionPnpm, runDshPlugin, setBuildEnvSource, TARGET_RE, } from './dsh-cli.js';
 import { packageOfEntryName } from './entry-identity.js';
 import { PendingRowJournal, repairOrphanedRows } from './pending-rows.js';
-import { addProfileBundle, bundleOptOutRowIds, bundlePatchInsertedIds, bundlesDroppedFromProfile, declareProfileDependency, dropFromManifest, generationManagedNames, hasLoadableEntry, holdsNativeAddon, INBOX_BUNDLES, isDshProfileName, profileDir, readDependencyOwners, readGitResolutionCommit, readInstalled, readInstalledManifest, readInstalledPackageName, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readProfileBundles, readProfileManifestSnapshot, removeProfileBundle, restoreProfileManifest, setAllowBuilds } from './profile.js';
+import { addProfileBundle, bundleOptOutRowIds, bundlePatchInsertedIds, bundlesDroppedFromProfile, declareProfileDependency, dropFromManifest, generationManagedNames, hasLoadableEntry, holdsNativeAddon, INBOX_BUNDLES, isDshProfileName, profileDir, readDependencyOwners, readGitResolutionCommit, readInstalled, readInstalledManifest, readInstalledPackageName, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readProfileBundles, readProfileManifestSnapshot, removeProfileBundle, parsePatchRows, restoreProfileManifest, setAllowBuilds } from './profile.js';
 import { assessProfile, classifyPeer, introducedDuplicateNames, introducedRisks } from './compatibility.js';
 import { runningAgentIds } from './agents.js';
 import { analyzeProfile, corePackageNames } from './check.js';
@@ -50,7 +51,7 @@ import { carrierRowIds, disableRow, enableRow, findUserPatchPath, foreignRowIds,
 import { createProfileBackup, downloadWebdav, MAX_BACKUP_BYTES, mergeRestoreManifest, restoreProfileBackup, unportableDeps, uploadWebdav, WebdavUrlError, } from './backup.js';
 import { createGist, fitsGistLimit, GistError, gistErrorCode, parseGistId, readGist, resolveGistTokenSource, updateGist, verifyGistToken, } from './gist.js';
 import { MAX_UPDATE_OPERATIONS_V1, UpdateOperationStoreV1, UPDATE_API_V1_SCHEMA } from './update-api-v1.js';
-import { findGitToNpmMigration } from './source-migration.js';
+import { declaredPredecessors, findCatalogRename, findGitToNpmMigration, findNpmTargetEntry, isRegistryRangeSpec, sameLoaderRows } from './source-migration.js';
 /**
  * Recognize the documented GitHub Release-download target shape. This does
  * not authorize a new URL: install trust remains catalog-bound in sources.ts,
@@ -1109,8 +1110,40 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
         }
         return live;
     }
+    /**
+     * The host's own rows for a package, as the loader holds them right now.
+     *
+     * Rows the MARKET created are left out (`mkt-` ids, see `hotMount`): a hot
+     * mount that failed in this session also leaves an entry without a fiber,
+     * and that one really does come back on the next start (#575).
+     */
+    function loaderRowsOf(name) {
+        const entries = [...host.loader.entries()];
+        const ownedRows = new Set(rowIdsForPackage(host, activeProfileDir, name));
+        const mine = (entry) => {
+            const id = typeof entry.options.id === 'string' ? entry.options.id : '';
+            const bare = id.split(':').pop() ?? id;
+            if (bare.startsWith('mkt-'))
+                return false;
+            const entryName = entry.options.name;
+            if (typeof entryName === 'string' && (entryName === name || packageOfEntryName(entryName) === name))
+                return true;
+            return ownedRows.has(bare);
+        };
+        return entries.filter(mine).map(entry => {
+            let disabled = false;
+            try {
+                disabled = entry.disabled === true;
+            }
+            catch { /* an expression that cannot be evaluated is not a switch */ }
+            return { disabled, live: entry.fiber !== undefined };
+        });
+    }
     /** A disabled loader row has no fiber but still makes its package switchable. */
     function loaderEntryObserved(name) {
+        // `loaderRowsOf` is the single reader: two callers disagreeing about what
+        // "observed" means is how a row ends up switchable and not-switchable at
+        // once (#1023).
         const entries = [...host.loader.entries()];
         if (entries.some(entry => {
             const entryName = entry.options.name;
@@ -1123,6 +1156,17 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
             return typeof id === 'string' && ownedRows.has(id.split(':').pop() ?? id);
         });
     }
+    /**
+     * Rows the loaders made for this package and never started (#1023).
+     *
+     * Only a row this START created counts: the market's own hot mounts are
+     * excluded (they retry on the next start), and a package with no row at all
+     * is the ordinary "restart to apply" case, not this one.
+     */
+    function loaderNeverStarted(name) {
+        const rows = loaderRowsOf(name);
+        return rows.length > 0 && rows.every(row => !row.live && !row.disabled);
+    }
     function isNonToggleableLibrary(name) {
         const manifest = readInstalledManifest(config.profile, name, activeProfileDir);
         if (!isDeclaredLibraryDsh(manifest?.dsh))
@@ -1172,6 +1216,45 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
     function cannotRematerializeDetail(name, pinned) {
         return `这台宿主只接受按精确版本重新安装，「${name}」改动前在 profile 里写作 ${pinned ?? '（不在 profile 里）'}，市场无法在它上面重建上一版 / this host can only reinstall an exact version, and "${name}" was declared as ${pinned ?? '(not in the profile)'}, so the previous build cannot be rematerialized there`;
     }
+    /**
+     * The installed package this entry replaces under a former name (#1012).
+     *
+     * Identity, not naming. Two packages are one plugin when they insert the
+     * same loader rows, and both sides state theirs: the installed copy in the
+     * patch files it ships, the published copy in its tarball. Comparing those
+     * costs no install and cannot be fooled by a package that merely shares a
+     * name — which is exactly what a rename breaks.
+     *
+     * The catalog's `previousNpm` narrows the candidates and supplies the only
+     * statement of intent; the rows confirm it. A row read that fails proves
+     * nothing, so the catalog's claim stands; rows that ARE readable and
+     * disjoint say these are two plugins after all, and the install proceeds.
+     */
+    async function renamePredecessor(entry, installed, registryBase) {
+        const candidates = declaredPredecessors(entry, installed);
+        if (candidates.length === 0)
+            return null;
+        if (typeof entry.npm !== 'string' || !NPM_NAME_RE.test(entry.npm))
+            return null;
+        if (candidates.length > 1) {
+            logEvent('warn', 'install', `${entry.name}: ${candidates.join(', ')} all answer to a former name — not replacing any of them`);
+            return null;
+        }
+        const current = candidates[0];
+        const installedIds = bundlePatchInsertedIds(join(activeProfileDir, 'node_modules', current));
+        if (installedIds.length === 0)
+            return current;
+        const bytes = await packageFileFromRegistry(registryBase, entry.npm, 'package/cordis.patch.yml');
+        if (bytes === null)
+            return current;
+        const incomingIds = parsePatchRows(bytes.toString('utf8')).insertedIds;
+        if (incomingIds.length === 0)
+            return current;
+        if (sameLoaderRows(installedIds, incomingIds))
+            return current;
+        logEvent('info', 'install', `${entry.name}: ${current} declares no row this release inserts — installing beside it`);
+        return null;
+    }
     /**
      * Undo a clean-exit update whose new build cannot boot. Restoring only the
      * manifest pin (the original #159 behavior) leaves the bad package files
@@ -2572,7 +2655,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                 });
                 for (const name of Object.keys(installed)) {
                     const manifest = installedManifests.get(name);
-                    const result = activationAfterReplace(verifyActivation(config.profile, name, live, activeProfileDir, disabled.has(name) || patchFlags.disabled.includes(name) || unbundled.includes(name), undefined, isDeclaredLibraryDsh(manifest?.dsh) && loaderEntryObserved(name)), replacedWhileLive.has(name));
+                    const result = activationAfterReplace(verifyActivation(config.profile, name, live, activeProfileDir, disabled.has(name) || patchFlags.disabled.includes(name) || unbundled.includes(name), undefined, isDeclaredLibraryDsh(manifest?.dsh) && loaderEntryObserved(name), loaderNeverStarted(name)), replacedWhileLive.has(name));
                     // A package with no dsh surface of its own, outside the bundle
                     // layer, that another installed package declares, is that package's
                     // library rather than a plugin that failed to start (#634). Saying
@@ -3749,6 +3832,20 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             if (migration !== null)
                                 sourceMigrationFor.set(name, migration);
                         }
+                        // A rename declared by the catalog (#1012, P1). This is the only
+                        // path that reaches a user whose old range no longer resolves:
+                        // their update fails before installing anything, so no offer was
+                        // ever recorded. The catalog states the rename up front, and the
+                        // row still has to be a plain registry range the transaction can
+                        // replace — and the successor must not already be installed.
+                        for (const [name, spec] of Object.entries(installed)) {
+                            if (sourceMigrationFor.has(name) || !isRegistryRangeSpec(spec))
+                                continue;
+                            const rename = findCatalogRename(registry.plugins, name);
+                            if (rename === null || installed[rename.target] !== undefined)
+                                continue;
+                            sourceMigrationFor.set(name, { kind: 'npm-rename', from: name, target: rename.target });
+                        }
                     }
                     catch (error) {
                         logEvent('warn', 'updates', `package source lookup failed — ${error instanceof Error ? error.message : String(error)}`);
@@ -3827,21 +3924,88 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             sendJson(response, 400, { error: 'plugin is not installed' });
                             return;
                         }
-                        let migration = null;
-                        try {
-                            const registry = await loadRegistry();
-                            migration = findGitToNpmMigration(registry.plugins, spec);
-                        }
-                        catch (error) {
-                            logEvent('warn', 'source-migration', `${name}: catalog lookup failed — ${error instanceof Error ? error.message : String(error)}`);
-                        }
-                        if (migration === null) {
+                        // Two ways in, one transaction out (#1012). The discovered
+                        // Git -> npm case needs no request body. An npm -> npm rename
+                        // cannot be discovered (the old spec names only the old package,
+                        // and the registry answers 404 for it), so the client carries the
+                        // target from the update failure's own artifact — and it is
+                        // re-verified against the catalog here rather than trusted: this
+                        // body is user-reachable, and the transaction runs `add <to>@latest`.
+                        const kind = body.kind === 'npm-rename' ? 'npm-rename' : 'git-to-npm';
+                        if (body.kind !== undefined && body.kind !== 'git-to-npm' && body.kind !== 'npm-rename') {
                             sendJson(response, 400, {
-                                error: '当前 Git 来源无法唯一核验到一个 npm 包，或包含显式 branch/tag/commit/ref；未执行迁移。 / This Git source cannot be uniquely verified to one npm package, or it carries an explicit branch/tag/commit/ref; migration was not performed.',
+                                error: '迁移请求无法识别，没有做任何改动。 / This migration request could not be recognised; nothing was changed.',
                             });
                             return;
                         }
-                        const targetName = migration.target;
+                        let targetName;
+                        if (kind === 'npm-rename') {
+                            const to = typeof body.to === 'string' ? body.to.trim() : '';
+                            if (!NPM_NAME_RE.test(to) || to === name) {
+                                sendJson(response, 400, {
+                                    error: '目标包名无效，或仍是当前包名；未执行迁移。 / The target package name is invalid, or is still the current one; migration was not performed.',
+                                });
+                                return;
+                            }
+                            // A registry dependency is a bare version range (the same shape
+                            // `isNpmRollbackSource` accepts). Everything else carries a
+                            // protocol or a path separator — `github:`, `file:`, `link:`,
+                            // `workspace:`, `catalog:`, `npm:other@1.0.0`, a tarball URL — and
+                            // replacing one of those with `to@latest` is not a rename (#1012).
+                            if (!isRegistryRangeSpec(spec)) {
+                                sendJson(response, 400, {
+                                    error: '当前安装不是 npm 依赖，不能按包名迁移。 / The current install is not an npm dependency, so it cannot be migrated by package name.',
+                                });
+                                return;
+                            }
+                            // Verified the same way discovery finds it: exactly one catalog
+                            // entry declares this package as a former name of ITSELF, and
+                            // the target is the one it publishes under (#1012). A name pair
+                            // that nobody declares is not a rename, and two declarations are
+                            // ambiguity — both refuse, because the transaction removes an
+                            // installed package before this is answered.
+                            let verified = false;
+                            try {
+                                const registry = await loadRegistry();
+                                const declared = findCatalogRename(registry.plugins, name);
+                                const named = findNpmTargetEntry(registry.plugins, to);
+                                verified = declared !== null && named !== null
+                                    && declared.target.toLowerCase() === to.toLowerCase()
+                                    && declared.entry === named;
+                            }
+                            catch (error) {
+                                logEvent('warn', 'source-migration', `${name}: catalog lookup failed — ${error instanceof Error ? error.message : String(error)}`);
+                            }
+                            if (!verified) {
+                                sendJson(response, 400, {
+                                    error: `目标包名 ${to} 不在市场目录里，或目录没有声明它是「${name}」的新名字；未执行迁移。 / The target ${to} is not in the market catalog, or the catalog does not declare it as the new name of "${name}"; migration was not performed.`,
+                                });
+                                return;
+                            }
+                            targetName = to;
+                        }
+                        else {
+                            let migration = null;
+                            try {
+                                const registry = await loadRegistry();
+                                migration = findGitToNpmMigration(registry.plugins, spec);
+                            }
+                            catch (error) {
+                                logEvent('warn', 'source-migration', `${name}: catalog lookup failed — ${error instanceof Error ? error.message : String(error)}`);
+                            }
+                            if (migration === null) {
+                                sendJson(response, 400, {
+                                    error: '当前 Git 来源无法唯一核验到一个 npm 包，或包含显式 branch/tag/commit/ref；未执行迁移。 / This Git source cannot be uniquely verified to one npm package, or it carries an explicit branch/tag/commit/ref; migration was not performed.',
+                                });
+                                return;
+                            }
+                            targetName = migration.target;
+                        }
+                        // "The previous source" is the Git ref for a discovered migration
+                        // and the old package for a rename; every rollback sentence below
+                        // has to name whichever one this run actually restores.
+                        const restoredZh = kind === 'npm-rename' ? '原来的安装' : '原 Git 来源';
+                        const restoredEn = kind === 'npm-rename' ? 'the original install' : 'the previous Git source';
                         if (targetName !== name && manifestCapture.snapshot.dependencies[targetName] !== undefined) {
                             sendJson(response, 409, {
                                 error: `目标 npm 包 ${targetName} 已经作为独立依赖安装；为避免覆盖现有安装，未执行迁移。 / The target npm package ${targetName} is already installed as a separate dependency; migration was not performed to avoid overwriting it.`,
@@ -3888,16 +4052,16 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             }
                             return hasLoadableEntry(activeProfileDir, name)
                                 ? { ok: true, detail: null }
-                                : { ok: false, detail: 'the previous Git source was restored without a loadable entry' };
+                                : { ok: false, detail: `${restoredEn} was restored without a loadable entry` };
                         };
                         const failWithRollback = async (detail, extra = {}) => {
                             const rollback = await rollbackMigration();
-                            logEvent(rollback.ok ? 'warn' : 'error', 'source-migration', `${name}: migration failed — ${detail}; ${rollback.ok ? 'previous Git source restored' : `rollback failed: ${rollback.detail ?? 'unknown'}`}`);
+                            logEvent(rollback.ok ? 'warn' : 'error', 'source-migration', `${name}: migration failed — ${detail}; ${rollback.ok ? `${restoredEn} restored` : `rollback failed: ${rollback.detail ?? 'unknown'}`}`);
                             sendJson(response, 500, {
                                 ok: false,
                                 error: rollback.ok
-                                    ? `${detail}；已恢复原 Git 来源。 / ${detail}; the previous Git source was restored.`
-                                    : `${detail}；且原 Git 来源未能验证恢复（${rollback.detail ?? 'unknown'}）。 / ${detail}; restoration of the previous Git source could not be verified (${rollback.detail ?? 'unknown'}).`,
+                                    ? `${detail}；已恢复${restoredZh}。 / ${detail}; ${restoredEn} was restored.`
+                                    : `${detail}；且${restoredZh}未能验证恢复（${rollback.detail ?? 'unknown'}）。 / ${detail}; restoration of ${restoredEn} could not be verified (${rollback.detail ?? 'unknown'}).`,
                                 rollback: rollback.ok,
                                 ...extra,
                             });
@@ -3995,11 +4159,12 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         const activation = {
                             [targetName]: activationAfterReplace(verifyActivation(config.profile, targetName, liveNames(), activeProfileDir, disabled.has(targetName)), wasLive),
                         };
-                        logEvent('info', 'source-migration', `${name}: ${spec} -> ${targetName}`);
+                        logEvent('info', 'source-migration', `${name}: ${spec} -> ${targetName} (${kind})`);
                         sendJson(response, 200, {
                             ok: true,
                             from: { name, source: spec },
                             to: { name: targetName, source: 'npm' },
+                            kind,
                             activation,
                             warnings: [stateWarning, ...patchWarnings].filter((value) => value !== null && value !== ''),
                         });
@@ -5044,8 +5209,8 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         // rewriting the profile's bundle list.
                         const renamedError = renamedTo === null ? null
                             : rollbackOk
-                                ? `${name} 的上游已把包改名为 ${renamedTo}：新版本会装在旧名字下，DSH 下次启动会拒绝这个 profile，所以本次更新已自动回滚、原版本已恢复。要用新版本，请卸载 ${name} 后按新名字 ${renamedTo} 重新安装。 / ${name} was renamed upstream to ${renamedTo}: the new version would sit under the old name and DSH would refuse to start this profile, so the update was rolled back and the previous build restored. To move to the new version, remove ${name} and install ${renamedTo}.`
-                                : `${name} 的上游已把包改名为 ${renamedTo}，且未能验证恢复原版本（${rollbackDetail ?? 'unknown'}）；在卸载 ${name} 之前 DSH 会拒绝启动这个 profile，卸载后再按新名字 ${renamedTo} 重新安装。 / ${name} was renamed upstream to ${renamedTo}, and restoration of the previous build could not be verified (${rollbackDetail ?? 'unknown'}); DSH will refuse to start this profile until ${name} is removed — then install ${renamedTo}.`;
+                                ? `${name} 的上游已把包改名为 ${renamedTo}：新版本会装在旧名字下，DSH 下次启动会拒绝这个 profile，所以本次更新已自动回滚、原版本已恢复。目录如果声明了这次改名，「已安装」里会出现迁移入口。 / ${name} was renamed upstream to ${renamedTo}: the new version would sit under the old name and DSH would refuse to start this profile, so the update was rolled back and the previous build restored. If the catalog declares this rename, the installed list offers the migration.`
+                                : `${name} 的上游已把包改名为 ${renamedTo}，且未能验证恢复原版本（${rollbackDetail ?? 'unknown'}）。 / ${name} was renamed upstream to ${renamedTo}, and restoration of the previous build could not be verified (${rollbackDetail ?? 'unknown'}).`;
                         const cancelDiff = cancelled ? changedSince(beforeInstalled) : null;
                         // Build-script blocks hit updates too (#69): a leftover invalid
                         // allowBuilds entry (pnpm's placeholder bug, #56) or a newly
@@ -6238,6 +6403,28 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                                 return;
                             }
                         }
+                        // Rename guard (#1012): the package this entry used to publish
+                        // under may still be in the profile, and a rename re-registers the
+                        // same loader rows — installing the successor beside it registers
+                        // them twice and bricks the next start (#122). The market does not
+                        // answer that with "uninstall, then install": when the old copy is
+                        // a registry dependency the migration replaces it in place and
+                        // carries switches, groups and notes across, so the response names
+                        // both ends and the client continues straight into that
+                        // transaction. A Git or path copy cannot be moved by that
+                        // transaction, so it is named without promising the dialog.
+                        const predecessor = await renamePredecessor(entry, installedNow, routesFor(region).npmRegistry);
+                        if (predecessor !== null && typeof entry.npm === 'string') {
+                            const movable = isRegistryRangeSpec(String(installedNow[predecessor] ?? ''));
+                            logEvent('warn', 'install-rejected', `${entry.name}: predecessor ${predecessor} is installed — ${movable ? 'migration replaces it' : 'not a registry dependency, cannot be migrated here'}`);
+                            sendJson(response, 409, {
+                                error: movable
+                                    ? `「${predecessor}」是这个插件改名前用的名字，已经装在 profile 里。装新名字会把同一个插件装成两份、下次启动可能失败；改用迁移把它换过来，开关、分组和备注都会保留。 / "${predecessor}" is already installed under this plugin's former package name. Installing the new name would put two copies of one plugin in the profile and can break the next start — migrate it instead; switches, groups and notes come along.`
+                                    : `「${predecessor}」是这个插件改名前用的名字，已经装在 profile 里，而它是从 Git 或本地路径装的。装新名字会把同一个插件装成两份、下次启动可能失败；请先把旧的那份换成 npm 包（「已安装」里会给出可用的移动方式）。 / "${predecessor}" is already installed under this plugin's former package name, and it comes from a Git or local path. Installing the new name would put two copies of one plugin in the profile and can break the next start — move the old copy to the npm package first (the installed list shows what can be moved).`,
+                                ...(movable ? { migration: { kind: 'npm-rename', from: predecessor, target: entry.npm } } : {}),
+                            });
+                            return;
+                        }
                         // Fresh installs ask the host requirement too (#404/#473: the
                         // update route refuses a declared-incompatible release before
                         // installing; an unguarded fresh install would hit exactly the

package/lib/source-migration.js

@@ -10,7 +10,7 @@
  * - branch/tag/commit/semver selectors are not migrated in v1;
  * - more than one matching verified npm entry is ambiguous and fails closed.
  */
-import { NPM_NAME_RE, parseSourceUrl, repoOfTarget } from './sources.js';
+import { NPM_NAME_RE, isGitHostedSpec, isLocalSpec, parseSourceUrl, repoOfTarget } from './sources.js';
 function migratableGitIdentity(spec) {
     if (!spec.startsWith('github:'))
         return null;
@@ -52,3 +52,113 @@ export function findGitToNpmMigration(plugins, spec) {
         return null;
     return { kind: 'git-to-npm', repo: identity, target: candidates[0] };
 }
+/**
+ * The catalog entry that publishes `to` on npm, or null when no single entry
+ * does.
+ *
+ * The rename target arrives from an update failure's own artifact, but the
+ * `migrate-source` body is user-reachable all the same: this keeps the route
+ * from pointing a profile at a package name the catalog does not publish on
+ * npm. Two entries claiming one npm name is ambiguous and fails closed, the
+ * same rule {@link findGitToNpmMigration} follows.
+ */
+export function findNpmTargetEntry(plugins, to) {
+    // Compare against the install target, not the display name: that is what the
+    // route is about to `add`, and it is what the catalog rules (E10/E11) keep
+    // unique. A listing whose npm target is another package cannot satisfy a
+    // rename to its display name.
+    const matches = plugins.filter(plugin => {
+        const target = typeof plugin.npm === 'string' ? plugin.npm : plugin.name;
+        return NPM_NAME_RE.test(target) && target === to;
+    });
+    return matches.length === 1 ? matches[0] : null;
+}
+/**
+ * The catalog entry that declares `from` as a package it used to be (#1012).
+ *
+ * This is the discovery the update failure cannot provide: a user whose old
+ * version range no longer resolves never installs anything, so no
+ * "came back under another name" evidence is produced. The catalog states the
+ * rename up front instead — but it is external input, so two entries claiming
+ * one former name is ambiguity, and ambiguity fails closed exactly like
+ * {@link findGitToNpmMigration}.
+ *
+ * Only entries that can actually be installed from npm qualify: an entry whose
+ * own target is not a valid npm name has no successor this transaction could
+ * install.
+ */
+export function findCatalogRename(plugins, from) {
+    const wanted = from.toLowerCase();
+    const candidates = [];
+    for (const plugin of plugins) {
+        const previous = Array.isArray(plugin.previousNpm) ? plugin.previousNpm : [];
+        if (!previous.some(name => typeof name === 'string' && name.toLowerCase() === wanted))
+            continue;
+        const target = typeof plugin.npm === 'string' && NPM_NAME_RE.test(plugin.npm) ? plugin.npm : null;
+        // An entry may never name itself as its own predecessor; the runtime
+        // normalizer drops that, and this keeps a hand-built catalog honest too.
+        if (target === null || target.toLowerCase() === wanted)
+            continue;
+        candidates.push({ entry: plugin, target });
+    }
+    return candidates.length === 1 ? candidates[0] : null;
+}
+/**
+ * Installed packages that answer to one of this entry's former names (#1012).
+ *
+ * A renamed package usually re-registers the very same bundle ids, so two
+ * package names that were one plugin cannot coexist in a profile: the trial
+ * boot rejects duplicate loader ids while the two sit side by side. That makes
+ * "install the new name as well" the one obvious move that bricks the next
+ * start, which is why the install route refuses it before pnpm runs.
+ *
+ * A name on this list is a claim, not proof: the caller still compares the
+ * rows both sides declare before it refuses anything, so a stale catalog
+ * field can cost a click at worst and never a wrong refusal.
+ */
+export function declaredPredecessors(plugin, installed) {
+    const previous = Array.isArray(plugin.previousNpm) ? plugin.previousNpm : [];
+    const found = [];
+    for (const value of previous) {
+        if (typeof value !== 'string' || value === '')
+            continue;
+        const wanted = value.toLowerCase();
+        for (const name of Object.keys(installed)) {
+            if (name.toLowerCase() === wanted && !found.includes(name))
+                found.push(name);
+        }
+    }
+    return found;
+}
+/**
+ * True when the two sides still register at least one of the same loader rows.
+ *
+ * This is the check that keeps a stale catalog from refusing an install it has
+ * no business refusing: two packages that insert different rows can coexist in
+ * a profile, so a `previousNpm` that points at one of them is a guess, not the
+ * plugin coming back. Only readable, non-empty row sets can prove sameness —
+ * a missing side proves nothing and the caller falls back to the declaration.
+ */
+export function sameLoaderRows(installed, incoming) {
+    if (installed.length === 0 || incoming.length === 0)
+        return false;
+    const present = new Set(installed);
+    return incoming.some(id => present.has(id));
+}
+/**
+ * True when a dependency spec is a plain registry version range — the only
+ * shape the rename transaction can replace.
+ *
+ * The route refuses anything carrying a protocol, a path prefix or an alias
+ * (`github:`, `file:`, `workspace:`, `npm:` …), because those describe a
+ * source this transaction cannot reproduce for the new name. Discovery is
+ * kept to the exact same test so the market never offers a migration the
+ * route would answer with 400.
+ */
+export function isRegistryRangeSpec(spec) {
+    if (spec === '')
+        return false;
+    if (isGitHostedSpec(spec) || isLocalSpec(spec))
+        return false;
+    return !/[:/\\]/.test(spec);
+}

package/lib/types/catalog-npm.d.ts

@@ -45,3 +45,18 @@ file?: string): Promise<{
     version: string;
     data: unknown | null;
 }>;
+/**
+ * One file out of a package's newest tarball, or null when it cannot be read
+ * (#1012).
+ *
+ * The install route asks a package what it declares before it installs it: a
+ * rename can only be detected from the rows the artifact carries, not from
+ * the name it was published under. A failed read is not a verdict — the
+ * caller treats null as "not declared", because a registry hiccup must never
+ * become a refusal to install.
+ *
+ * @param registry - registry base, no trailing slash.
+ * @param pkg - package name.
+ * @param file - exact entry name inside the tarball (`package/cordis.patch.yml`).
+ */
+export declare function packageFileFromRegistry(registry: string, pkg: string, file: string): Promise<Buffer | null>;

package/lib/types/registry.d.ts

@@ -47,6 +47,21 @@ export interface RegistryPlugin {
     deprecated?: boolean;
     /** Catalog name of the suggested replacement plugin, when deprecated. */
     replacement?: string;
+    /**
+     * npm package names this entry used BEFORE its current one (#1012).
+     *
+     * The catalog is the only place a rename can be stated ahead of time: the
+     * old name's npm metadata is gone (no dist-tags, no `deprecated` message),
+     * so nothing the market can fetch still knows the two names are one plugin.
+     * Same trust boundary as `deprecated`/`replacement` — absent for every
+     * normal entry, and a catalog without the field behaves exactly as before.
+     *
+     * Values are validated where they are consumed (normalized by
+     * {@link pluginPreviousNpm}, cross-entry rules in scripts/validate-registry.mjs):
+     * a former name must never be a live package in the catalog, and one former
+     * name may only have one successor.
+     */
+    previousNpm?: string[];
     /**
      * Capability disclosure (#401): what a static scan of the artifact a user
      * would install reported touching — `shell`, `network`, `credentials`,
@@ -77,6 +92,18 @@ export interface Registry {
     categories: Record<string, Record<string, string>>;
     plugins: RegistryPlugin[];
 }
+/**
+ * Former npm names for one catalog entry, normalized (#1012).
+ *
+ * Catalog JSON is external input, so a malformed declaration is dropped
+ * rather than trusted: only syntactically valid npm names survive, an entry
+ * may not list itself (its own `npm` or `name`), and duplicates collapse in
+ * declaration order. Cross-entry rules — a former name that is still live
+ * elsewhere, or two entries claiming one former name — cannot be judged per
+ * entry; the validator enforces them for the catalog, and
+ * `findCatalogRename` fails closed on ambiguity at runtime.
+ */
+export declare function pluginPreviousNpm(plugin: Pick<RegistryPlugin, 'name' | 'npm' | 'previousNpm'>): string[];
 /**
  * Drop what we remember, so the next call is unconditional.
  *