dshmarket 1.73.0 → 1.73.1

package/lib/profile.js

@@ -924,19 +924,64 @@ export function bundlePatchInsertedIds(dir) {
  * conventional root cordis.patch.yml a package may ship instead.
  */
 export function bundleOptOutRowIds(dir) {
+    return declaredPatchRowIds(dir, 'disabledIds');
+}
+/**
+ * Row ids a package's own patch sources declare for one role — the loop the
+ * two readers above and below share.
+ *
+ * They read the same two sources: every declared `dsh.bundle.patch` (one file,
+ * or an ordered list of them, #792) and the conventional root
+ * `cordis.patch.yml` a package may ship instead. Keeping that loop in one place
+ * is the point — `bundlePatchInsertedIds` above is declared-files-only, and a
+ * copy of this scan that forgot the root file is exactly how the two sides of
+ * one question drift apart.
+ *
+ * A source that cannot be read contributes nothing rather than throwing: this
+ * answers "what does the package say it ships", and a file that is not there
+ * says nothing. That is the tolerant half of the family by design — the strict
+ * one (`readBundlePatchRows`) refuses the whole declaration, because the host
+ * loads none of a patch it cannot read completely.
+ */
+function declaredPatchRowIds(dir, role) {
     const ids = new Set();
     const read = (file) => {
         try {
-            for (const id of parsePatchRows(readFileSync(file, 'utf8')).disabledIds)
+            for (const id of parsePatchRows(readFileSync(file, 'utf8'))[role])
                 ids.add(id);
         }
-        catch { /* no such patch — nothing shipped off through it */ }
+        catch { /* no such patch — nothing declared through it */ }
     };
     for (const file of declaredBundlePatchFiles(dir))
         read(file);
     read(join(dir, 'cordis.patch.yml'));
     return [...ids];
 }
+/**
+ * Row ids the installed copy of a package DECLARES it inserts (#1012).
+ *
+ * The evidence half of `rowIdsForPackage`: the same two patch sources (the
+ * declared `dsh.bundle.patch`, one file or an ordered list, and the
+ * conventional root `cordis.patch.yml`), insert rows only, and — unlike that
+ * reader — no live loader rows.
+ *
+ * Live rows are exactly what this cannot use. A rename transaction asks the
+ * question twice: of the old package just before it is removed (whose rows are
+ * still live, but whose patch files are about to be the only copy left) and of
+ * the new package right after its first install (which has never been booted,
+ * so the loader has never heard of it). Only the package's own declaration can
+ * answer for both.
+ *
+ * That is the same question, and the same parser, as `renamePredecessor` asks
+ * on the install path — an install never boots the package either, so it
+ * compares declarations too and the two refusals agree on what "one plugin"
+ * means (#1012). Where they differ is the root `cordis.patch.yml`: see
+ * `declaredPatchRowIds` for why this reader covers it and that gate's
+ * declared-only reader does not.
+ */
+export function shippedInsertedRowIds(dir) {
+    return declaredPatchRowIds(dir, 'insertedIds');
+}
 /**
  * Rows of one patch file. Exported because a package may ship its patch at
  * the conventional path INSTEAD of declaring `dsh.bundle.patch`, and the

package/lib/routes.js

@@ -24,7 +24,7 @@ import { diagnosePackageManifests } from './diagnostics.js';
 import { BOOT_ID, cancelActive, probePnpm, progress, provisionPnpm, runDshPlugin, setBuildEnvSource, TARGET_RE, } from './dsh-cli.js';
 import { packageOfEntryName } from './entry-identity.js';
 import { PendingRowJournal, repairOrphanedRows } from './pending-rows.js';
-import { addProfileBundle, bundleOptOutRowIds, bundlePatchInsertedIds, bundlesDroppedFromProfile, declareProfileDependency, dropFromManifest, generationManagedNames, hasLoadableEntry, holdsNativeAddon, INBOX_BUNDLES, isDshProfileName, profileDir, readDependencyOwners, readGitResolutionCommit, readInstalled, readInstalledManifest, readInstalledPackageName, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readProfileBundles, readProfileManifestSnapshot, removeProfileBundle, parsePatchRows, restoreProfileManifest, setAllowBuilds } from './profile.js';
+import { addProfileBundle, bundleOptOutRowIds, bundlePatchInsertedIds, bundlesDroppedFromProfile, declareProfileDependency, dropFromManifest, generationManagedNames, hasLoadableEntry, holdsNativeAddon, INBOX_BUNDLES, isDshProfileName, profileDir, readDependencyOwners, readGitResolutionCommit, readInstalled, readInstalledManifest, readInstalledPackageName, readInstalledRepoEvidence, readInstalledVersion, readLockCommits, readProfileBundles, readProfileManifestSnapshot, removeProfileBundle, parsePatchRows, restoreProfileManifest, setAllowBuilds, shippedInsertedRowIds } from './profile.js';
 import { assessProfile, classifyPeer, introducedDuplicateNames, introducedRisks } from './compatibility.js';
 import { runningAgentIds } from './agents.js';
 import { analyzeProfile, corePackageNames } from './check.js';
@@ -4052,6 +4052,12 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                         const wasLive = verifyActivation(config.profile, name, liveNames(), activeProfileDir, disabled.has(name)).state === 'live'
                             && hasHostHalf(config.profile, name, activeProfileDir);
                         const oldRows = rowIdsForPackage(host, activeProfileDir, name);
+                        // Identity evidence for a rename (#1012), read BEFORE the removal:
+                        // once `remove` runs, the installed old package — and with it the
+                        // only record of what it registers — is gone.
+                        const oldInsertIds = kind === 'npm-rename'
+                            ? shippedInsertedRowIds(join(activeProfileDir, 'node_modules', name))
+                            : [];
                         const patchFlags = packagePatchFlags(host, activeProfileDir, [name], readUserPatchState(userPatchPath));
                         const wasDisabled = disabled.has(name);
                         const manifestBefore = manifestCapture.snapshot;
@@ -4077,13 +4083,21 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                                 ? { ok: true, detail: null }
                                 : { ok: false, detail: `${restoredEn} was restored without a loadable entry` };
                         };
-                        const failWithRollback = async (detail, extra = {}) => {
+                        // `noteZh`/`noteEn` carry the "what you can do next" sentence, and
+                        // only the branch that actually restored the old install may say
+                        // it: after a failed rollback there is nothing to reassure the
+                        // user with, so the note is dropped rather than contradicting the
+                        // "could not be verified" fallout.
+                        const failWithRollback = async (detail, extra = {}, status = 500, noteZh = '', noteEn = '') => {
                             const rollback = await rollbackMigration();
                             logEvent(rollback.ok ? 'warn' : 'error', 'source-migration', `${name}: migration failed — ${detail}; ${rollback.ok ? `${restoredEn} restored` : `rollback failed: ${rollback.detail ?? 'unknown'}`}`);
-                            sendJson(response, 500, {
+                            // A 409 whose rollback failed is not a conflict the user can walk
+                            // away from — the install itself is now unverified — so the
+                            // status follows the rollback, not the reason we got here.
+                            sendJson(response, rollback.ok ? status : 500, {
                                 ok: false,
                                 error: rollback.ok
-                                    ? `${detail}；已恢复${restoredZh}。 / ${detail}; ${restoredEn} was restored.`
+                                    ? `${detail}；已恢复${restoredZh}。${noteZh === '' ? '' : ` ${noteZh}`} / ${detail}; ${restoredEn} was restored.${noteEn === '' ? '' : ` ${noteEn}`}`
                                     : `${detail}；且${restoredZh}未能验证恢复（${rollback.detail ?? 'unknown'}）。 / ${detail}; restoration of ${restoredEn} could not be verified (${rollback.detail ?? 'unknown'}).`,
                                 rollback: rollback.ok,
                                 ...extra,
@@ -4107,6 +4121,37 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                             await failWithRollback('npm 目标安装完成后未形成可加载且唯一的依赖。 / The npm target did not produce one loadable replacement dependency.');
                             return;
                         }
+                        // The catalog's `previousNpm` is a CLAIM that the two package names
+                        // are one plugin, and the transaction above already acted on it by
+                        // replacing what the user had. Ask the packages themselves: the
+                        // rows each side declares it inserts are registry evidence, and two
+                        // packages that register disjoint rows are not the same plugin —
+                        // whatever the catalog says. Refuse and put the old one back rather
+                        // than leave a stranger's rows running under the old plugin's name
+                        // (#1012). Same question, same parser as the install-path gate
+                        // (`renamePredecessor`), which compares the installed package's
+                        // declared rows against the incoming registry `cordis.patch.yml`;
+                        // here both packages are already on disk, so both sides are read
+                        // the same way — including the conventional root patch file, which
+                        // that gate only knows on the incoming side.
+                        //
+                        // Both sides must SHOW evidence: a package with no patch file
+                        // declares nothing, and silence is not a contradiction.
+                        if (kind === 'npm-rename') {
+                            const newInsertIds = shippedInsertedRowIds(join(activeProfileDir, 'node_modules', targetName));
+                            if (oldInsertIds.length > 0 && newInsertIds.length > 0 && !sameLoaderRows(oldInsertIds, newInsertIds)) {
+                                // Both sides are third-party YAML: clip each id so a hostile
+                                // patch cannot turn this refusal into a megabyte response.
+                                const rows = (ids) => {
+                                    const clip = (id) => (id.length <= 48 ? id : `${id.slice(0, 48)}…`);
+                                    return ids.length <= 3
+                                        ? ids.map(clip).join(', ')
+                                        : `${ids.slice(0, 3).map(clip).join(', ')}, +${ids.length - 3}`;
+                                };
+                                await failWithRollback(`目录声明 ${name} 已改名为 ${targetName}，但两边的注册行不同（${name}: ${rows(oldInsertIds)}；${targetName}: ${rows(newInsertIds)}），说明它们不是同一个插件。 / The catalog declares ${name} was renamed to ${targetName}, but the two packages register different plugin rows (${name}: ${rows(oldInsertIds)}; ${targetName}: ${rows(newInsertIds)}), so they are not the same plugin.`, {}, 409, `原来的版本仍然可用；如果目录写错了，请报告这一条。`, `The original install is still usable; if the catalog is wrong, report that entry.`);
+                                return;
+                            }
+                        }
                         const stack = readBundleStack(activeProfileDir);
                         const trial = trialValidate(activeProfileDir, stack.community, hostAnchorOption);
                         if (!trial.ok) {
@@ -5374,6 +5419,29 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup, ho
                                 logEvent('warn', 'update-bundles-restored', `${name}: the desktop app removed its bundle row before refusing the update (bundle-in-use) — restored it so the plugin still loads on the next boot (#935)`);
                             }
                         }
+                        // A FAILED update can also drop rows it never intended to touch.
+                        // The rollback path ("restoration of the previous build could not
+                        // be verified") rewrites the manifest through pnpm and the plugin
+                        // command, and neither carries the bundle rows it did not own: a
+                        // bystander keeps its dependency and its node_modules but loses
+                        // its `dsh.profile.bundles` row, so it silently stops loading on
+                        // the next boot while this operation reported a failure about
+                        // something else entirely.
+                        //
+                        // Restoring is sound exactly because the operation FAILED: nobody
+                        // expressed a deliberate removal, and the package is still on
+                        // disk — putting the row back restores what the user had before
+                        // the operation. A successful update keeps the read-only stance
+                        // (#720/#696), where a missing row may be a deliberate switch-off.
+                        if (!ok && !cancelled) {
+                            const lostRows = bundlesDroppedFromProfile(manifestBefore, config.profile, activeProfileDir, new Set(removedDeclaration === null ? [] : [removedDeclaration.name])).filter(bundle => bundle !== name
+                                && existsSync(join(activeProfileDir, 'node_modules', bundle, 'package.json')));
+                            for (const bundle of lostRows) {
+                                if (addProfileBundle(activeProfileDir, bundle)) {
+                                    logEvent('warn', 'update-bundles-restored', `${bundle}: lost its dsh.profile.bundles row while ${name}'s update failed — restored it so the plugin still loads on the next boot (#720)`);
+                                }
+                            }
+                        }
                         logEvent(ok || cancelled ? 'info' : 'error', 'update', `${name} -> ${target} exit=${String(result.exitCode)}${result.timedOut ? ' TIMEOUT' : ''}${cancelled ? ' CANCELLED' : ''}${stale ? ` STALE(${staleReason ?? 'unknown'})` : ''}${ok || cancelled ? '' : ` err=${failureDetail(result)}`}`);
                         // A user-cancelled run is a quiet outcome, not an error.
                         sendJson(response, ok || cancelled ? 200 : result.busy === true ? 409 : 502, {

package/lib/types/profile.d.ts

@@ -324,6 +324,29 @@ export declare function bundlePatchInsertedIds(dir: string): string[];
  * conventional root cordis.patch.yml a package may ship instead.
  */
 export declare function bundleOptOutRowIds(dir: string): string[];
+/**
+ * Row ids the installed copy of a package DECLARES it inserts (#1012).
+ *
+ * The evidence half of `rowIdsForPackage`: the same two patch sources (the
+ * declared `dsh.bundle.patch`, one file or an ordered list, and the
+ * conventional root `cordis.patch.yml`), insert rows only, and — unlike that
+ * reader — no live loader rows.
+ *
+ * Live rows are exactly what this cannot use. A rename transaction asks the
+ * question twice: of the old package just before it is removed (whose rows are
+ * still live, but whose patch files are about to be the only copy left) and of
+ * the new package right after its first install (which has never been booted,
+ * so the loader has never heard of it). Only the package's own declaration can
+ * answer for both.
+ *
+ * That is the same question, and the same parser, as `renamePredecessor` asks
+ * on the install path — an install never boots the package either, so it
+ * compares declarations too and the two refusals agree on what "one plugin"
+ * means (#1012). Where they differ is the root `cordis.patch.yml`: see
+ * `declaredPatchRowIds` for why this reader covers it and that gate's
+ * declared-only reader does not.
+ */
+export declare function shippedInsertedRowIds(dir: string): string[];
 /**
  * Rows of one patch file. Exported because a package may ship its patch at
  * the conventional path INSTEAD of declaring `dsh.bundle.patch`, and the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.73.0",
+  "version": "1.73.1",
   "icon": "assets/logo.svg",
   "type": "module",
   "main": "lib/index.js",