dshmarket 1.72.0 → 1.73.0

package/README.md

@@ -57,7 +57,7 @@ its own dsh: it may be older than the one `npm` would give you (#139).
 ## What you get
 
 - **Browse & search** the full community catalog (4200+ plugins, growing daily) — category filters, star counts, top/new sorting, bilingual descriptions that follow your UI language
-- **Host-aware discovery** — cards show the DSH requirement declared by `engines.dsh` or lockstep `@deepseek-ai/dsh-*` peers; an opt-in filter hides only confirmed mismatches with the running host. Undeclared, malformed, unavailable, and GitHub-only entries remain visible rather than being guessed incompatible
+- **Host-aware discovery** — cards show the DSH requirement declared by `engines.dsh` or lockstep `@deepseek-ai/dsh-*` peers; the compatibility filter hides only confirmed mismatches with the running host. GitHub-only entries read the linked package's manifest, including monorepo subdirectories; Release downloads read the selected release tag, including the current tag behind `latest/download`. Undeclared, malformed or unavailable requirements stay unknown and visible. Public manifest facts are cached; compatibility is evaluated against the running host
 - **Screenshots** — AppStore-style screenshots, auto-carousel when there's more than one, click to preview full-size: author-curated shots show right on the card (zero extra requests); plugins without curated shots fall back to automatic README extraction once you open the install dialog. Images load from GitHub hosting only
 - **Comments** — every card opens the plugin's discussion thread in place. It is the same thread its pages on [dshmarket.com](https://dshmarket.com) and the [catalog](https://awesome-dsh-plugin.com) show, so a plugin has one conversation rather than three. Backed by GitHub Discussions through giscus: it loads when you open it, needs a GitHub account only to post, and the note above it says plainly that opening it contacts giscus.app and GitHub. On local dsh web, reading stays embedded while a dedicated GitHub action opens the exact discussion in a new tab for sign-in and posting, so the cross-site return never carries or depends on the host session
 - **Favorites** — bookmark plugins and themes from Discover or the Themes tab; a dedicated Favorites tab lists them with search, sort, and install actions. Bookmarks persist in the profile's market state (`state.json`); entries that leave the catalog can be cleared in one click

package/README.zh.md

@@ -50,7 +50,7 @@ profile，因此不会出现在桌面端。请通过应用内的 **设置 →
 ## 你会得到
 
 - **逛与搜**——完整社区目录（4200+ 插件，每天在涨），分类筛选、star 数、最热/最新排序，中英描述跟随界面语言
-- **按宿主发现**——卡片展示插件通过 `engines.dsh` 或同版本线 `@deepseek-ai/dsh-*` peer 声明的 DSH 要求；可选筛选只隐藏与当前宿主明确不匹配的插件。未声明、格式异常、暂时取不到清单及仅 GitHub 发布的条目仍保持可见，不猜成不兼容
+- **按宿主发现**——卡片展示插件通过 `engines.dsh` 或同版本线 `@deepseek-ai/dsh-*` peer 声明的 DSH 要求；兼容筛选只隐藏与当前宿主明确不匹配的插件。仅 GitHub 发布的条目也会读取链接所指包的清单，支持子目录；Release 下载读取对应标签，`latest/download` 则读取当前发布标签。未声明、格式异常或暂时取不到清单时保持未知并继续显示。公开清单信息会缓存，兼容结论按当前宿主重新判断
 - **截图展示**——App Store 式截图，多图自动轮播，点开还能看大图；作者在 registry 里策展的截图列表卡片就直接显示（零额外请求），没有策展的插件则在打开安装弹窗时自动从 README 抽取；图片仅从 GitHub 图床加载
 - **评论**——每张卡片都能就地打开该插件的讨论。它和插件在 [dshmarket.com](https://dshmarket.com) 与[目录站](https://awesome-dsh-plugin.com)上的页面共用同一条讨论，一个插件只有一处对话，而不是三处。底层是 GitHub Discussions（经由 giscus）：打开即加载，只有发表评论才需要 GitHub 账号；说明里也直说打开会连接 giscus.app 与 GitHub。本地 dsh web 继续内嵌评论供阅读，登录和发表则通过专用 GitHub 入口在新标签页打开当前插件的精确讨论，不让跨站回跳携带或依赖宿主会话
 - **收藏**——在「发现」或「主题」页点书签即可收藏插件/主题；「收藏」Tab 集中展示，支持搜索、排序与安装。书签写入 profile 的市场状态（`state.json`）；已下架条目可一键清除

package/client/client.js

@@ -2491,8 +2491,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		* Catalog matching for locally linked / file: installs. Shared by the host
 		* restore route and the Market client so both refuse the same wrong guesses.
 		*/
-		const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
-		function validSubpath(subpath) {
+		const REPO_RE$1 = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+		function validSubpath$1(subpath) {
 			if (!/^[A-Za-z0-9_./-]+$/.test(subpath)) return false;
 			return !subpath.split("/").some((seg) => seg === "" || seg === "." || seg === "..");
 		}
@@ -2503,12 +2503,12 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		*/
 		function catalogMatchKeys(url) {
 			const m = /^https:\/\/github\.com\/([^/]+\/[^/]+?)(?:\/tree\/[^/]+\/(.+?))?\/?$/.exec(url);
-			if (m === null || !REPO_RE.test(m[1])) return {
+			if (m === null || !REPO_RE$1.test(m[1])) return {
 				path: null,
 				repo: null
 			};
 			const subpath = m[2] ?? null;
-			if (subpath !== null && !validSubpath(subpath)) return {
+			if (subpath !== null && !validSubpath$1(subpath)) return {
 				path: null,
 				repo: null
 			};
@@ -2652,6 +2652,34 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			};
 		}
 		//#endregion
+		//#region src/sources.ts
+		/**
+		* Registry-source knowledge: how a curated registry entry's URL maps to an
+		* installable pnpm target. Pure string logic, no I/O.
+		*/
+		const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+		function validSubpath(subpath) {
+			if (!/^[A-Za-z0-9_./-]+$/.test(subpath)) return false;
+			return !subpath.split("/").some((seg) => seg === "" || seg === "." || seg === "..");
+		}
+		/**
+		* Parse a registry source url: a github repo, optionally with a
+		* `/tree/<branch>/<subpath>` suffix (how the curated list links monorepo
+		* subpackages, e.g. dsh-plugins#theme-gallery).
+		*/
+		function parseSourceUrl(url) {
+			const m = /^https:\/\/github\.com\/([^/]+\/[^/]+?)(?:\/tree\/[^/]+\/(.+?))?\/?$/.exec(url);
+			if (m === null || !REPO_RE.test(m[1])) return null;
+			const subpath = m[2] ?? null;
+			if (subpath !== null) {
+				if (!validSubpath(subpath)) return null;
+			}
+			return {
+				repo: m[1],
+				subpath
+			};
+		}
+		//#endregion
 		//#region src/client/market-data.ts
 		/** One registry entry from /dsh-market/registry. */
 		/**
@@ -2687,6 +2715,11 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			}
 			return categories;
 		}
+		/** Keep GitHub packages in one repository distinct, independently of their display names. */
+		function hostCompatibilityKey(plugin) {
+			if (typeof plugin.npm === "string" && plugin.npm !== "") return plugin.npm;
+			return parseSourceUrl(plugin.url) === null ? null : plugin.url;
+		}
 		/**
 		* Whether a queued operation still applies — `null` when it does.
 		*
@@ -2931,7 +2964,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				const categories = pluginCategories(plugin);
 				if (options.category !== "all" && !categories.includes(options.category)) return [];
 				if (options.sinceDays !== void 0 && !withinDays(plugin.added, options.sinceDays)) return [];
-				if (options.compatibleWithHost === true && plugin.npm != null && options.hostCompatibility?.[plugin.npm]?.status === "incompatible") return [];
+				const compatibilityKey = hostCompatibilityKey(plugin);
+				if (options.compatibleWithHost === true && compatibilityKey !== null && options.hostCompatibility?.[compatibilityKey]?.status === "incompatible") return [];
 				const relevance = query === "" ? 0 : pluginRelevance(plugin, query, tokens, options.lang, options.categories);
 				return relevance === 0 && query !== "" ? [] : [{
 					plugin,
@@ -10515,7 +10549,10 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 						const response = await fetch(api("/dsh-market/discovery-compatibility"), {
 							method: "POST",
 							headers: { "content-type": "application/json" },
-							body: JSON.stringify({ packages: chunk })
+							body: JSON.stringify({
+								packages: chunk.filter((key) => !key.startsWith("https://")),
+								...chunk.some((key) => key.startsWith("https://")) ? { entries: chunk.filter((key) => key.startsWith("https://")) } : {}
+							})
 						});
 						const body = await response.json();
 						if (!response.ok || body.plugins === null || typeof body.plugins !== "object") throw new Error(`HTTP ${String(response.status)}`);
@@ -10934,8 +10971,8 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				compatibleWithHost
 			], scrollToTop);
 			const pagePlugins = plugins.slice((currentPage - 1) * pageSize, currentPage * pageSize);
-			const pageHostPackages = [...new Set([...pagePlugins, ...recentPlugins].flatMap((plugin) => typeof plugin.npm === "string" && plugin.npm !== "" ? [plugin.npm] : []))];
-			const allHostPackages = (0, react.useMemo)(() => [...new Set((data?.plugins ?? []).flatMap((plugin) => typeof plugin.npm === "string" && plugin.npm !== "" ? [plugin.npm] : []))], [data]);
+			const pageHostPackages = [...new Set([...pagePlugins, ...recentPlugins].flatMap((plugin) => hostCompatibilityKey(plugin) === null ? [] : [hostCompatibilityKey(plugin)]))];
+			const allHostPackages = (0, react.useMemo)(() => [...new Set((data?.plugins ?? []).flatMap((plugin) => hostCompatibilityKey(plugin) === null ? [] : [hostCompatibilityKey(plugin)]))], [data]);
 			const pageHostPackagesKey = pageHostPackages.join("\0");
 			const allHostPackagesKey = allHostPackages.join("\0");
 			(0, react.useEffect)(() => {
@@ -11028,7 +11065,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 			const favoriteThemePagination = usePagination(favoriteThemes.length, favResetDeps, scrollToTop);
 			const favoritePagePlugins = favoritePlugins.slice((favoritePluginPagination.currentPage - 1) * favoritePluginPagination.pageSize, favoritePluginPagination.currentPage * favoritePluginPagination.pageSize);
 			const favoritePageThemes = favoriteThemes.slice((favoriteThemePagination.currentPage - 1) * favoriteThemePagination.pageSize, favoriteThemePagination.currentPage * favoriteThemePagination.pageSize);
-			const favoritePageHostPackages = [...new Set(favoritePagePlugins.flatMap((plugin) => typeof plugin.npm === "string" && plugin.npm !== "" ? [plugin.npm] : []))];
+			const favoritePageHostPackages = [...new Set(favoritePagePlugins.flatMap((plugin) => hostCompatibilityKey(plugin) === null ? [] : [hostCompatibilityKey(plugin)]))];
 			const favoritePageHostPackagesKey = favoritePageHostPackages.join("\0");
 			(0, react.useEffect)(() => {
 				if (tab === "favorites") loadHostCompatibility(favoritePageHostPackages);
@@ -13161,8 +13198,9 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 				const record = recordForUrl(records, p.url);
 				const blocked = record !== null && (record.state === "input" || record.state === "failed");
 				const queued = record !== null && record.state === "queued";
-				const compatibility = typeof p.npm === "string" ? hostCompatibility[p.npm] : void 0;
-				const hostRequirementLabel = compatibility?.requirement !== null && compatibility?.requirement !== void 0 ? t("hostRequirement").replace("{0}", compatibility.requirement) : typeof p.npm !== "string" ? t("hostRequirementUnavailable") : compatibility === void 0 ? t("hostRequirementLoading") : compatibility.basis === "undeclared" ? t("hostRequirementUndeclared") : t("hostRequirementUnavailable");
+				const compatibilityKey = hostCompatibilityKey(p);
+				const compatibility = compatibilityKey === null ? void 0 : hostCompatibility[compatibilityKey];
+				const hostRequirementLabel = compatibility?.requirement !== null && compatibility?.requirement !== void 0 ? t("hostRequirement").replace("{0}", compatibility.requirement) : compatibilityKey === null ? t("hostRequirementUnavailable") : compatibility === void 0 ? t("hostRequirementLoading") : compatibility.basis === "undeclared" ? t("hostRequirementUndeclared") : t("hostRequirementUnavailable");
 				const hostRequirementTitle = compatibility?.declarations.map((declaration) => declaration.kind === "engine" ? `engines.dsh: ${declaration.range}` : `${declaration.package ?? "peer"}: ${declaration.range}`).join("\n") || hostRequirementLabel;
 				return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 					className: blocked ? `${Market_module_css_default.card} ${Market_module_css_default.cardBlocked}` : Market_module_css_default.card,

package/lib/discovery-compatibility.js

@@ -1,7 +1,7 @@
 /**
  * Discovery-time DSH compatibility metadata.
  *
- * The public catalog does not carry npm manifests. Fetching every manifest
+ * The public catalog does not carry package manifests. Fetching every manifest
  * while the market opens would turn one catalog request into more than a
  * thousand registry requests, so this module supplies a bounded, on-demand
  * index. Successful public manifest facts are cached beside the market's
@@ -13,6 +13,7 @@ import { dirname } from 'node:path';
 import { compareSemver, isSemver, satisfiesRange } from './check.js';
 import { classifyPeer, crossesImplicitCeiling } from './compatibility.js';
 import { marketFetch } from './net.js';
+import { parseSourceUrl } from './sources.js';
 const CACHE_SCHEMA = 'dsh-market/discovery-compatibility-cache/v1';
 const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
 const FAILURE_COOLDOWN_MS = 5 * 60 * 1000;
@@ -21,6 +22,44 @@ const FETCH_TIMEOUT_MS = 8_000;
 const DEFAULT_CONCURRENCY = 8;
 const MAX_CACHE_ENTRIES = 5_000;
 const MAX_RANGE_LENGTH = 256;
+/** Read the linked package at its selected release, never the repository root by accident. */
+async function githubManifest(source, fetcher) {
+    const parsed = parseSourceUrl(source.url);
+    if (parsed === null)
+        throw new Error('not a GitHub package source');
+    const json = async (url) => {
+        const response = await fetcher(url, {
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+            headers: { accept: 'application/json', 'user-agent': 'dsh-market' },
+        });
+        if (!response.ok)
+            throw new Error(`HTTP ${String(response.status)}`);
+        return await response.json();
+    };
+    let ref = /\/tree\/([^/]+)\//.exec(source.url)?.[1] ?? 'HEAD';
+    if (source.tarball != null) {
+        const release = /^https:\/\/github\.com\/([^/]+\/[^/]+)\/releases\/(?:download\/([^/]+)|latest\/download)\/[^/?#]+\.(?:tgz|tar\.gz)$/.exec(source.tarball);
+        if (release === null || release[1].toLowerCase() !== parsed.repo.toLowerCase()) {
+            throw new Error('archive does not name this repository release');
+        }
+        if (release[2] !== undefined)
+            ref = decodeURIComponent(release[2]);
+        else {
+            const latest = record(await json(`https://api.github.com/repos/${parsed.repo}/releases/latest`));
+            if (typeof latest?.tag_name !== 'string')
+                throw new Error('release tag unavailable');
+            ref = latest.tag_name;
+        }
+    }
+    if (ref === '' || ref.length > 256 || ref.split('/').some(part => part === '' || part === '.' || part === '..')) {
+        throw new Error('invalid GitHub reference');
+    }
+    const file = parsed.subpath === null ? 'package.json' : `${parsed.subpath}/package.json`;
+    const manifest = await json(`https://raw.githubusercontent.com/${parsed.repo}/${encodeURIComponent(ref)}/${file}`);
+    if (record(manifest) === null)
+        throw new Error('package manifest unavailable');
+    return manifest;
+}
 function range(value) {
     if (typeof value !== 'string')
         return null;
@@ -140,7 +179,7 @@ export function deriveHostCompatibility(facts, hostVersion, hostPackages) {
     return { status, basis: 'manifest', requirement, declarations };
 }
 /**
- * Durable, bounded lookup of npm `latest` manifests.
+ * Durable, bounded lookup of npm `latest` and catalog GitHub manifests.
  *
  * Failed requests are intentionally memory-only and short-lived: a mirror
  * outage must not become a day-long false "undeclared" result on disk.
@@ -212,7 +251,7 @@ export class DiscoveryManifestIndex {
             this.fetchWaiters.shift()?.();
         }
     }
-    async fetchOne(name, registry, record = true) {
+    async fetchOne(name, registry, record = true, readManifest) {
         this.load();
         const now = this.now();
         const cached = this.entries.get(name);
@@ -230,13 +269,16 @@ export class DiscoveryManifestIndex {
             return await pending;
         const request = (async () => {
             try {
-                const response = await this.withFetchPermit(async () => await this.fetcher(`${registry}/${encodeURIComponent(name)}/latest`, {
-                    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-                    headers: { accept: 'application/json', 'user-agent': 'dsh-market' },
+                const value = await this.withFetchPermit(readManifest ?? (async () => {
+                    const response = await this.fetcher(`${registry}/${encodeURIComponent(name)}/latest`, {
+                        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+                        headers: { accept: 'application/json', 'user-agent': 'dsh-market' },
+                    });
+                    if (!response.ok)
+                        throw new Error(`HTTP ${String(response.status)}`);
+                    return await response.json();
                 }));
-                if (!response.ok)
-                    throw new Error(`HTTP ${String(response.status)}`);
-                const facts = manifestFacts(await response.json());
+                const facts = manifestFacts(value);
                 if (record) {
                     this.entries.set(name, { checkedAt: this.now(), facts });
                     this.dirty = true;
@@ -324,6 +366,25 @@ export class DiscoveryManifestIndex {
         }
         return result;
     }
+    /** Catalog-approved GitHub sources, cached by both package path and selected archive. */
+    async lookupGitHub(sources) {
+        const unique = [...new Map(sources.map(source => [source.url, source])).values()];
+        const result = {};
+        let next = 0;
+        const worker = async () => {
+            while (next < unique.length) {
+                const source = unique[next++];
+                const key = `github:${source.url}\u0000${source.tarball ?? ''}`;
+                result[source.url] = await this.fetchOne(key, '', true, () => githubManifest(source, this.fetcher));
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(this.concurrency, unique.length) }, worker));
+        if (this.dirty) {
+            this.persist();
+            this.dirty = false;
+        }
+        return result;
+    }
 }
 /**
  * The newest release of `npmName` whose own declarations this host satisfies.

package/lib/profile.js

@@ -1491,6 +1491,11 @@ export function setAllowBuilds(profile, packages, explicitDir) {
     const SEG = '[A-Za-z0-9_-][A-Za-z0-9_.-]*';
     const NAME = '[A-Za-z0-9@/_.-]+';
     const SHA = '[0-9a-f]{40}';
+    // A dependency pnpm resolved from a BRANCH keys its decision by the ref,
+    // not by a commit: `name@https://codeload.github.com/o/r/tar.gz/refs/heads/main`
+    // (#1034). The ref is path segments only — no `.`/`..`, no empty piece —
+    // so it cannot walk out of the URL it is written into.
+    const REF = `refs/(?:heads|tags)/${SEG}(?:/${SEG})*`;
     // pnpm's exact monorepo key includes the selected directory; dropping it
     // makes approve-and-retry write only a bare name that git builds ignore.
     const DIR = '(?!\\.{1,2}(?:/|$))[A-Za-z0-9_.-]+';
@@ -1512,9 +1517,9 @@ export function setAllowBuilds(profile, packages, explicitDir) {
     // gitlab.com and bitbucket.org (#637). Each branch names its host and its
     // exact path shape.
     const ARCHIVE_KEY_RE = new RegExp(`^${NAME}@https://(?:`
-        + `codeload\\.github\\.com/${SEG}/${SEG}/tar\\.gz/${SHA}`
-        + `|bitbucket\\.org/${SEG}/${SEG}/get/${SHA}\\.tar\\.gz`
-        + `|gitlab\\.com/${SEG}(?:/${SEG})+/-/archive/${SHA}/${SEG}-${SHA}\\.tar\\.gz`
+        + `codeload\\.github\\.com/${SEG}/${SEG}/tar\\.gz/(?:${SHA}|${REF})`
+        + `|bitbucket\\.org/${SEG}/${SEG}/get/(?:${SHA}|${REF})\\.tar\\.gz`
+        + `|gitlab\\.com/${SEG}(?:/${SEG})+/-/archive/(?:${SHA}|${REF})/${SEG}-(?:${SHA}|${REF})\\.tar\\.gz`
         + `)(?:#${SUBPATH})?$`);
     for (const pkg of packages) {
         if (/^[A-Za-z0-9@/_.-]+$/.test(pkg) || GIT_KEY_RE.test(pkg) || ARCHIVE_KEY_RE.test(pkg))

package/lib/routes.js

@@ -33,7 +33,7 @@ import { applyPreset, deletePreset, listPresets, previewPreset, savePreset } fro
 import { createProfileSnapshot, DEFAULT_MAX_SNAPSHOTS, deleteSnapshot, listSnapshots, restoreSnapshot } from './snapshot.js';
 import { readHostRecoveryView, restoreHostRecoveryBackup } from './host-recovery.js';
 import { trialValidate } from './trial.js';
-import { catalogRepoKey, findCatalogEntryForLocal, findInstalledAlias, gitCommitOfTarget, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitRefOfTarget, gitTargetAtCommit, gitUpdateTarget, hostedRepoKey, lookupRepoFromUrl, pinnedAllowBuildsKeys, installTargetFor, isGenerationLink, isLocalSpec, NPM_NAME_RE, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, sourceFallbackFor, workspaceProtocolDeps } from './sources.js';
+import { catalogRepoKey, findCatalogEntryForLocal, findInstalledAlias, gitCommitOfTarget, githubCommitOfTarget, githubTargetAtCommit, gitAllowBuildsKey, gitRefOfTarget, gitTargetAtCommit, gitUpdateTarget, hostedRepoKey, lookupRepoFromUrl, pinnedAllowBuildsKeys, installTargetFor, isGenerationLink, isLocalSpec, NPM_NAME_RE, parseSourceUrl, repoOfTarget, restoreBlockedByWorkspace, restoreTargetForLocal, sourceFallbackFor, workspaceProtocolDeps } from './sources.js';
 import { failureDetail, groupConflictsByOwner, installApplied, isHostPortCollision, isStaleUpdate, parseIgnoredBuildEntries, parseIgnoredBuilds, parsePrepareKey, parsePrepareNotAllowed, pnpmBlockedByOpenFiles, pnpmNeverStarted, pnpmRefusedYoungRelease, RELEASE_AGE_OVERRIDE, removeDanglingHostBridge, retargetCollections, updateApplied, validateAddedPlugins, withHoistRecovery } from './install.js';
 import { classifyPnpmFailure } from './pnpm-compat.js';
 import { asChannel, CHANNELS, DIST_TAG, resolveChannel } from './channels.js';
@@ -407,6 +407,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
     const hostAnchorOption = config.dshInstallDir === undefined ? {} : { dshInstallDir: config.dshInstallDir };
     const persistentLogFile = join(activeProfileDir, '.dsh-market', 'log.ndjson');
     const discoveryManifests = new DiscoveryManifestIndex(join(activeProfileDir, '.dsh-market', 'discovery-compatibility-v1.json'));
+    const githubDiscoveryManifests = new DiscoveryManifestIndex(join(activeProfileDir, '.dsh-market', 'discovery-github-compatibility-v1.json'));
     configurePersistentLog(persistentLogFile);
     let agentGuardUnavailableLogged = false;
     /** Running-agent ids for the mutation gate; logs once when the host exposes no agents service. */
@@ -2536,13 +2537,29 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                     sendJson(response, 400, { error: 'packages must be an array of at most 64 npm package names' });
                     return;
                 }
+                const requestedEntries = body.entries ?? [];
+                if (!Array.isArray(requestedEntries) || requestedEntries.length + requested.length > 64
+                    || !requestedEntries.every(url => typeof url === 'string' && parseSourceUrl(url) !== null)) {
+                    sendJson(response, 400, { error: 'entries must be GitHub catalog URLs; at most 64 packages and entries per batch' });
+                    return;
+                }
                 const packages = [...new Set(requested)];
                 try {
+                    const urls = new Set(requestedEntries);
+                    const entries = urls.size === 0 ? [] : (await loadRegistry()).plugins.filter(entry => urls.has(entry.url) && (entry.npm == null || entry.npm === ''));
+                    if (new Set(entries.map(entry => entry.url)).size !== urls.size) {
+                        sendJson(response, 400, { error: 'entries must name GitHub-only plugins in the current catalog' });
+                        return;
+                    }
                     const host = dshHostInfo();
                     const hostVersion = host?.version ?? null;
                     const hostPackages = corePackageNames(host?.directory ?? null);
-                    const facts = await discoveryManifests.lookup(packages, routesFor(region).npmRegistry);
-                    const plugins = Object.fromEntries(packages.map(name => [
+                    const [npmFacts, githubFacts] = await Promise.all([
+                        discoveryManifests.lookup(packages, routesFor(region).npmRegistry),
+                        githubDiscoveryManifests.lookupGitHub(entries),
+                    ]);
+                    const facts = { ...npmFacts, ...githubFacts };
+                    const plugins = Object.fromEntries([...packages, ...urls].map(name => [
                         name,
                         deriveHostCompatibility(facts[name] ?? null, hostVersion, hostPackages),
                     ]));
@@ -6923,7 +6940,13 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                                             // where the button is not (#314). The panel now carries
                                             // the action on this very row, so the text can just say
                                             // what to press.
-                                            ? `构建脚本被 pnpm 默认拦截（${ignoredBuilds.join(', ')}），点击「放行构建脚本并重试」即可放行并重装 / build scripts are blocked by pnpm by default (${ignoredBuilds.join(', ')}); use "Allow build scripts and retry" to approve and reinstall`
+                                            // #1034: pnpm reports every undecided build in the
+                                            // workspace, not only the ones this operation needed — an
+                                            // entry left from an earlier install shows up here too, and
+                                            // saying "this install needs dsh-purge approved" was wrong
+                                            // for a plugin that never depended on it. Name them as
+                                            // decisions, with where the decision is written.
+                                            ? `pnpm 要求先决定这些依赖能否运行构建脚本（${ignoredBuilds.join(', ')}）：有的是这次安装带进来的，也可能是之前留下的未决定条目。点「放行构建脚本并重试」会把它们写进 pnpm-workspace.yaml 的 allowBuilds，然后重新安装 / pnpm wants a decision on these packages before it runs their build scripts (${ignoredBuilds.join(', ')}); some came in with this install, and some may be entries an earlier one left undecided. "Allow build scripts and retry" writes them into allowBuilds in pnpm-workspace.yaml and installs again`
                                             // Same last resort as the update route (#848), and on THIS
                                             // route too: a recognized failure like an expired
                                             // `patchedDependencies` key had no branch here either.

package/lib/types/discovery-compatibility.d.ts

@@ -1,7 +1,7 @@
 /**
  * Discovery-time DSH compatibility metadata.
  *
- * The public catalog does not carry npm manifests. Fetching every manifest
+ * The public catalog does not carry package manifests. Fetching every manifest
  * while the market opens would turn one catalog request into more than a
  * thousand registry requests, so this module supplies a bounded, on-demand
  * index. Successful public manifest facts are cached beside the market's
@@ -32,6 +32,10 @@ type FetchLike = (url: string, init?: {
     signal?: AbortSignal;
     headers?: Record<string, string>;
 }) => Promise<Response>;
+export interface GitHubManifestSource {
+    url: string;
+    tarball?: string | null;
+}
 /** Keep only the small public subset of an npm manifest needed by discovery. */
 export declare function manifestFacts(value: unknown): NpmManifestFacts;
 /**
@@ -43,7 +47,7 @@ export declare function manifestFacts(value: unknown): NpmManifestFacts;
  */
 export declare function deriveHostCompatibility(facts: NpmManifestFacts | null, hostVersion: string | null, hostPackages: ReadonlySet<string>): HostCompatibility;
 /**
- * Durable, bounded lookup of npm `latest` manifests.
+ * Durable, bounded lookup of npm `latest` and catalog GitHub manifests.
  *
  * Failed requests are intentionally memory-only and short-lived: a mirror
  * outage must not become a day-long false "undeclared" result on disk.
@@ -107,6 +111,8 @@ export declare class DiscoveryManifestIndex {
     lookup(names: readonly string[], registry: string, options?: {
         record?: boolean;
     }): Promise<Record<string, NpmManifestFacts | null>>;
+    /** Catalog-approved GitHub sources, cached by both package path and selected archive. */
+    lookupGitHub(sources: readonly GitHubManifestSource[]): Promise<Record<string, NpmManifestFacts | null>>;
 }
 /**
  * The newest release of `npmName` whose own declarations this host satisfies.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.72.0",
+  "version": "1.73.0",
   "icon": "assets/logo.svg",
   "type": "module",
   "main": "lib/index.js",
@@ -76,7 +76,6 @@
     "assets/logo.svg",
     "locale",
     "lib",
-    "src",
     "client",
     "UPDATE-API-V1.md",
     "cordis.patch.yml",