dshmarket 1.70.2 → 1.71.0

package/lib/catalog-npm.js

@@ -109,3 +109,38 @@ file = 'package/plugins.json') {
         throw new Error(`${pkg}@${version} carries no ${file}`);
     return { version, data: JSON.parse(bytes.toString('utf8')) };
 }
+/**
+ * One file out of a package's newest tarball, or null when it cannot be read
+ * (#1012).
+ *
+ * The install route asks a package what it declares before it installs it: a
+ * rename can only be detected from the rows the artifact carries, not from
+ * the name it was published under. A failed read is not a verdict — the
+ * caller treats null as "not declared", because a registry hiccup must never
+ * become a refusal to install.
+ *
+ * @param registry - registry base, no trailing slash.
+ * @param pkg - package name.
+ * @param file - exact entry name inside the tarball (`package/cordis.patch.yml`).
+ */
+export async function packageFileFromRegistry(registry, pkg, file) {
+    try {
+        const metaRes = await marketFetch(`${registry}/${encodeURIComponent(pkg)}/latest`, {
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+            headers: { accept: 'application/json', 'user-agent': 'dsh-market' },
+        });
+        if (!metaRes.ok)
+            return null;
+        const meta = (await metaRes.json());
+        const tarball = typeof meta.dist?.tarball === 'string' ? meta.dist.tarball : null;
+        if (tarball === null)
+            return null;
+        const tarRes = await marketFetch(tarball, { signal: AbortSignal.timeout(TIMEOUT_MS) });
+        if (!tarRes.ok)
+            return null;
+        return fileFromTarball(Buffer.from(await tarRes.arrayBuffer()), file);
+    }
+    catch {
+        return null;
+    }
+}

package/lib/hot.js

@@ -80,6 +80,10 @@ export function resolveProfileEntry(profileDir, name) {
         return name;
     }
 }
+// File URLs may contain apostrophes; YAML single-quoted scalars escape them by doubling.
+function yamlSingleQuoted(value) {
+    return value.replace(/'/g, "''");
+}
 const HOT_DIR = '.dsh-market';
 /**
  * Ceiling for one hot-mount activation, env-overridable like the install
@@ -683,7 +687,7 @@ export async function hotMount(ctx, profileDir, packageName) {
         // `cleanHotDir` wipes it on every boot and the bundle layer owns
         // persistence, so nothing reads these files back.
         const yml = rows
-            .map(row => `- id: 'mkt-${row.id}'\n  name: '${resolveProfileEntry(profileDir, row.name)}'\n`)
+            .map(row => `- id: '${yamlSingleQuoted(`mkt-${row.id}`)}'\n  name: '${yamlSingleQuoted(resolveProfileEntry(profileDir, row.name))}'\n`)
             .join('');
         writeFileSync(file, yml);
         const handle = ctx.plugin(HotTree, { path: pathToFileURL(file).href });

package/lib/install.js

@@ -119,6 +119,9 @@ export function isUnpublishedHostPeer(pkg, profile, explicitDir) {
  */
 export async function withHoistRecovery(run, profile, pluginArgs, profileDirectory, options = {}) {
     const marketFlags = options.marketFlags !== false;
+    // An already verified mature update must not rewrite the user's workspace
+    // policy as a side effect of market-level recovery (#991).
+    const repairProfilePolicy = options.preserveProfilePolicy !== true;
     /** The option a recovery step needed and this host does not accept (#732). */
     let unavailableOption = null;
     // Before the FIRST run, not after a failure: the shadowed duplicate rule
@@ -127,7 +130,7 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
     // small file read. Every verb that resolves the graph is covered, not just
     // add and remove: an `install` or an in-place `update` reads the same key.
     const verb = pluginArgs.find(argument => !argument.startsWith('-'));
-    if (verb === 'add' || verb === 'remove' || verb === 'install' || verb === 'update') {
+    if (repairProfilePolicy && (verb === 'add' || verb === 'remove' || verb === 'install' || verb === 'update')) {
         const merged = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory);
         if (merged.length > 0) {
             logEvent('warn', 'install', `minimumReleaseAgeExclude held several rules for ${merged.join(', ')}, and pnpm honours only the FIRST per name (#732) — merged each package's rules into one, before running`);
@@ -145,7 +148,7 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
     // appended stayed dead (@Mlte0907, 1.66.7). The merge is a no-op when
     // nothing is duplicated, so asking it costs one file read.
     let repairedDuringRun = false;
-    if (!ok(result) && !result.cancelled && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')) {
+    if (repairProfilePolicy && !ok(result) && !result.cancelled && (pluginArgs[0] === 'add' || pluginArgs[0] === 'remove')) {
         const mergedNow = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory);
         if (mergedNow.length > 0) {
             repairedDuringRun = true;
@@ -155,7 +158,7 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
     }
     if (!ok(result) && !result.cancelled && !repairedDuringRun) {
         const failure = classifyPnpmFailure(`${result.stderr}\n${result.stdout}`, result.exitCode);
-        if (failure?.code === 'unparseable-build-key') {
+        if (failure?.code === 'unparseable-build-key' && repairProfilePolicy) {
             // The profile's own allowBuilds block is what fails, so no retry of the
             // same command can pass until it is repaired (#698). Drop only the
             // source-form keys this pnpm cannot parse — bare names stay, and on
@@ -187,15 +190,14 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
             // (#732) or extending a version union (#733). Either way the same
             // rewrite fixes it, needs no option at all, and so also works on the
             // desktop bridge that refuses options. Retry the SAME argv afterwards.
-            const mergedNow = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory);
+            const mergedNow = repairProfilePolicy ? mergeDuplicateReleaseAgeExcludes(profile, profileDirectory) : [];
             if (mergedNow.length > 0) {
                 logEvent('warn', 'install', `pnpm appended a second minimumReleaseAgeExclude rule for ${mergedNow.join(', ')} and honours only the first, shadowing its own entry (#732) — merged them into one and retrying once`);
                 result = await run(profile, pluginArgs);
             }
-            else if (options.releaseAgeBypass === false) {
-                // The caller declined the bypass (#594), and the duplicates were not
-                // what failed: this violation is the profile's own policy doing its
-                // job, so the command stands as it is.
+            else if (options.releaseAgeBypass === false || options.preserveProfilePolicy === true) {
+                // Fresh installs (#594) and mature updates/recovery (#991) never
+                // bypass age enforcement. Preserve the native failure and policy.
             }
             else if (!marketFlags) {
                 unavailableOption = RELEASE_AGE_OVERRIDE;
@@ -399,7 +401,7 @@ export async function withHoistRecovery(run, profile, pluginArgs, profileDirecto
     // after a recovery retry or an official Desktop manager install. Repair
     // the final file now, before another plugin operation reads it; a successful
     // command must never be retried just because its exclusions needed merging.
-    if (ok(result) && (verb === 'add' || verb === 'remove' || verb === 'install' || verb === 'update')) {
+    if (repairProfilePolicy && ok(result) && (verb === 'add' || verb === 'remove' || verb === 'install' || verb === 'update')) {
         try {
             const merged = mergeDuplicateReleaseAgeExcludes(profile, profileDirectory);
             if (merged.length > 0) {

package/lib/registry.js

@@ -7,6 +7,7 @@ import { logEvent } from './log.js';
 import { configuredProxy, marketFetch } from './net.js';
 import { catalogFromPackage } from './catalog-npm.js';
 import { activeRegion, catalogSourcesFor, routesFor } from './regions.js';
+import { NPM_NAME_RE } from './sources.js';
 /**
  * Category ids for one catalog entry, de-duplicated in declaration order.
  *
@@ -25,6 +26,36 @@ export function pluginCategories(plugin) {
     }
     return categories;
 }
+/**
+ * Former npm names for one catalog entry, normalized (#1012).
+ *
+ * Catalog JSON is external input, so a malformed declaration is dropped
+ * rather than trusted: only syntactically valid npm names survive, an entry
+ * may not list itself (its own `npm` or `name`), and duplicates collapse in
+ * declaration order. Cross-entry rules — a former name that is still live
+ * elsewhere, or two entries claiming one former name — cannot be judged per
+ * entry; the validator enforces them for the catalog, and
+ * `findCatalogRename` fails closed on ambiguity at runtime.
+ */
+export function pluginPreviousNpm(plugin) {
+    const declared = plugin.previousNpm;
+    const values = Array.isArray(declared) ? declared : declared === undefined || declared === null ? [] : [declared];
+    const own = new Set([plugin.name.toLowerCase()]);
+    if (typeof plugin.npm === 'string' && plugin.npm !== '')
+        own.add(plugin.npm.toLowerCase());
+    const names = [];
+    const seen = new Set();
+    for (const value of values) {
+        if (typeof value !== 'string' || value === '' || !NPM_NAME_RE.test(value))
+            continue;
+        const key = value.toLowerCase();
+        if (own.has(key) || seen.has(key))
+            continue;
+        seen.add(key);
+        names.push(value);
+    }
+    return names;
+}
 /**
  * Where the curated list comes from now lives in the region routing table
  * (src/regions.ts), because it is one of several addresses that move
@@ -115,7 +146,14 @@ function asRegistry(value) {
         const category = pluginCategories(plugin);
         if (category.length === 0)
             throw new Error(`catalog plugin ${String(index)} carries no usable category`);
-        return { ...plugin, category };
+        const previousNpm = pluginPreviousNpm(plugin);
+        // An entry with nothing usable to declare looks exactly like one that
+        // declared nothing, so the field stays absent rather than becoming [].
+        if (previousNpm.length === 0) {
+            const { previousNpm: _declared, ...rest } = plugin;
+            return { ...rest, category };
+        }
+        return { ...plugin, category, previousNpm };
     });
     return { ...data, plugins };
 }

package/lib/release-candidates.js

@@ -0,0 +1,101 @@
+function semver(value) {
+    if (typeof value !== 'string')
+        return null;
+    const matched = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/.exec(value);
+    if (!matched)
+        return null;
+    const prerelease = matched[4]?.split('.') ?? [];
+    if (prerelease.some(part => /^\d+$/.test(part) && part.length > 1 && part.startsWith('0')))
+        return null;
+    return { core: [BigInt(matched[1]), BigInt(matched[2]), BigInt(matched[3])], prerelease };
+}
+/** Accept stable SemVer, including build metadata, at both API boundaries. */
+export function isStableReleaseVersion(value) {
+    const parsed = semver(value);
+    return parsed !== null && parsed.prerelease.length === 0;
+}
+function compare(a, b) {
+    for (let i = 0; i < 3; i++) {
+        if (a.core[i] !== b.core[i])
+            return a.core[i] > b.core[i] ? 1 : -1;
+    }
+    if (a.prerelease.length === 0 || b.prerelease.length === 0)
+        return Math.sign(b.prerelease.length - a.prerelease.length);
+    for (let i = 0; i < Math.max(a.prerelease.length, b.prerelease.length); i++) {
+        const x = a.prerelease[i], y = b.prerelease[i];
+        if (x === undefined)
+            return -1;
+        if (y === undefined)
+            return 1;
+        if (x === y)
+            continue;
+        const xn = /^\d+$/.test(x), yn = /^\d+$/.test(y);
+        if (xn && yn)
+            return BigInt(x) > BigInt(y) ? 1 : -1;
+        if (xn !== yn)
+            return xn ? -1 : 1;
+        return x > y ? 1 : -1;
+    }
+    return 0;
+}
+export function strictPublishTime(value) {
+    if (typeof value !== 'string' || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z$/.test(value))
+        return null;
+    const timestamp = Date.parse(value);
+    if (!Number.isFinite(timestamp))
+        return null;
+    return new Date(timestamp).toISOString().slice(0, 19) === value.slice(0, 19) ? timestamp : null;
+}
+export function selectMatureUpdate(packument, installed, now, policy) {
+    const latest = typeof packument?.['dist-tags']?.latest === 'string' ? packument['dist-tags'].latest : null;
+    const empty = (reason) => ({ candidate: null, latest, held: null, reason, nextMaturityAt: null, latestMaturityAt: null });
+    const top = semver(latest);
+    if (!top || top.prerelease.length || !packument.versions || !packument.time ||
+        typeof packument.versions !== 'object' || typeof packument.time !== 'object' ||
+        !Object.hasOwn(packument.versions, latest) ||
+        (policy.latestFromEndpoint != null && policy.latestFromEndpoint !== latest))
+        return empty('inconsistent');
+    const ceiling = policy.maxVersion === undefined ? top : semver(policy.maxVersion);
+    if (!ceiling || ceiling.prerelease.length ||
+        (policy.maxVersion !== undefined && !Object.hasOwn(packument.versions, policy.maxVersion)))
+        return empty('inconsistent');
+    const current = semver(installed);
+    if (!current || current.prerelease.length)
+        return empty('invalid-installed');
+    const ageMs = policy.minimumReleaseAgeMs;
+    if (!Number.isSafeInteger(ageMs) || ageMs < 0 || !Number.isFinite(now))
+        return empty('policy-unknown');
+    let candidate = null;
+    let candidateSemver = null;
+    let nextMaturityAt = null;
+    for (const version of Object.keys(packument.versions)) {
+        const parsed = semver(version);
+        if (!parsed || parsed.prerelease.length || compare(parsed, current) <= 0 || compare(parsed, top) > 0 || compare(parsed, ceiling) > 0)
+            continue;
+        const published = strictPublishTime(packument.time[version]);
+        const exempt = policy.exemptPackage === true || policy.exemptVersions?.has(version) === true;
+        // A declared exemption is not evidence for a fabricated or absent timestamp.
+        if (published === null || published > now || (!exempt && published > now - ageMs)) {
+            if (published !== null && published <= now && Number.isFinite(published + ageMs)) {
+                const at = published + ageMs;
+                if (nextMaturityAt === null || at < nextMaturityAt)
+                    nextMaturityAt = at;
+            }
+            continue;
+        }
+        if (candidateSemver === null || compare(parsed, candidateSemver) > 0) {
+            candidate = version;
+            candidateSemver = parsed;
+        }
+    }
+    const latestPublished = strictPublishTime(packument.time[latest]);
+    const latestExempt = policy.exemptPackage === true || policy.exemptVersions?.has(latest) === true;
+    const latestMature = latestPublished !== null && latestPublished <= now &&
+        (latestExempt || latestPublished <= now - ageMs);
+    return {
+        candidate, latest, held: latestMature ? null : latest,
+        reason: candidate ? 'eligible' : latestMature ? 'current' : latestPublished === null ? 'unknown-age' : 'held',
+        nextMaturityAt,
+        latestMaturityAt: latestPublished === null || latestExempt ? null : latestPublished + ageMs,
+    };
+}