Plugin market / plugin updates never appear after restart — generation peer validation false-positives freeze the projection

[juanyezz]

[Bug] Plugin market / plugin updates never appear after restart — generation peer validation false-positives freeze the projection

DSH Desktop version: 0.7.2
Platform: Windows 10/11
Related component: dsh-desktop-market-installer → generations/installer.mjs → verifyGenerationPeers
Plugin market version: dshmarket 1.41.0
Severity: High (blocks installing/updating any generation plugin via the market)

---

中文摘要 / Summary (中文)

安装插件市场（dsh-market）后，界面提示“重启一次 Harness，即可加载完整的插件市场界面”，但重启后一直不出现。用市场安装/更新其他插件时也一样：装好后界面不加载。

根因已定位： verifyGenerationPeers() 对 DSH Desktop 的运行环境产生大量误报，导致 migrateProfileToGenerations() 一直失败（进入 deferred-failure），进而让 prepareGenerationsForLaunch()（即把插件投影进 dsh.profile.bundles 那一步）被整体跳过。结果新装/更新的 generation 插件永远进不了 bundles，Harness 启动时不会组合加载其界面。

---

Actual behavior (描述)

设置 → 插件市场 一直显示：

插件市场已安装 / 重启一次 Harness，即可加载完整的插件市场界面

重启后界面仍不出现。市场内安装/更新任何社区插件后，插件同样“已安装但界面不加载”。

Expected behavior (期望)

重启后插件市场完整界面（浏览/搜索/安装/更新）出现；市场内安装/更新的插件应进入 dsh.profile.bundles 并在重启后被组合加载。

---

Root cause (根因，已严格验证)

dsh-desktop-market-installer/generations/installer.mjs 的 verifyGenerationPeers() 在以下两种情形误报：

1. Type-only / 纯工具包被误判为“依赖缺失”

require.resolve() 对以下包抛错，但包其实已安装（生成树/closure 里 package.json 都存在），只是没有运行时 exports 入口：

• @types/node, @types/*, undici-types, math-intrinsics, dunder-proto

verifyGenerationPeers 把 require.resolve 抛错统一当成 resolved === undefined，再报 "does not resolve from the generation or installation closure"。

2. 解析到应用树被误判为“逃逸”

DSH Desktop 的安装 closure（$DSH_HOME/profiles/node_modules）里的宿主包（react、react-dom、@deepseek-ai/*，以及 typescript、@lexical/internal 等普通依赖）是 junction，指向 Desktop 应用自带的 resources/app/node_modules。Windows 上 require.resolve 会跟随 junction 直接落到应用树，于是：

@deepseek-ai/dsh-agent resolves outside the installation closure: D:\...\DSH Desktop\resources\app\node_modules\@deepseek-ai\dsh-agent\lib\index.js
@deepseek-ai/dsh-llm resolves outside the installation closure: ...
@deepseek-ai/dsh-skill-filesystem resolves outside the installation closure: ...

verifyGenerationPeers 用 realpath() 比较，realpath 一解析就把路径拉出 closure 的名义目录，误判为“逃逸”。这正是 aegis 插件报错的直接原因（它依赖 @deepseek-ai/dsh-agent、@deepseek-ai/dsh-llm、@deepseek-ai/dsh-skill-filesystem）。

连锁后果

任何一个 generation 插件校验失败 → migrateProfileToGenerations() 返回 deferred-failure → prepareGenerationsForLaunch()（projectGenerations，把插件写进 dsh.profile.bundles）被跳过。因此本次安装/更新的插件永远进不了 bundles。

实际环境里，除 aegis 外，dsh-better-sidebar、dsh-builtin-browser、@openviking/dsh-memory-plugin 的 generation 也因上述两类误报而校验失败，迁移整体冻结。

---

Reproduction steps (复现步骤)

1. 安装 DSH Desktop 0.7.2。
2. 设置 → 插件市场，安装 dsh-market（提示重启生效）。
3. 重启，进入插件市场，安装任一社区插件（例如 dsh-better-sidebar）。
4. 安装完成提示“重启后生效”，再次重启。
5. 观察：该插件界面不出现；profiles/web/package.json 的 dsh.profile.bundles 里没有该插件；.generations-deferred.json 出现，reason 为 aegis failed peer validation: ... resolves outside the installation closure。

---

Suggested fix (建议修复)

放宽 verifyGenerationPeers() 对 Desktop 布局的判定，同时保留“依赖真缺失”的报错：

1. type-only 容忍： 当 require.resolve 失败时，若该依赖作为真实目录（含 package.json）存在于 generation 或 installation closure，则不报“缺失”（type-only / 纯工具包运行时不会被 require，无需报错）。真正缺失的包仍应报错。
2. junction 宿主容忍： 依赖解析到应用树时，若它在 closure 里存在指向该位置的 junction（链接目标），则视为宿主提供的正常布局，不判为“逃逸”。该判定对 host 单例（react、@deepseek-ai/*）与普通依赖统一适用。

验证：18 个 generation 目录全部通过；阴性对照（依赖真缺失）仍正确报错，安全边界未被削弱。

（如需具体 diff，可见本 issue 附带的补丁说明。）

---

Impact & why this matters (影响)

不修复此问题，DSH Desktop 的插件市场只能安装、无法真正生效——所有 generation 插件的安装/更新都会被冻结在“已安装但不加载”状态。这会影响任何通过 dsh-market 安装社区插件的用户。感谢确认与修复！

---

Evidence / 复现证据 (reproduction evidence)

Below are the actual artifacts observed on a 0.7.2 installation. These reflect the pre-fix failing state (presented as evidence of the bug).

1. .generations-deferred.json (freeze marker written on every boot)

{
  "protocol": 4,
  "fingerprint": "1beb0ec7eeaadecd0bffa9aaa4c13298d359f4585ee55480f31ae76994a404ae",
  "reason": "aegis failed peer validation: @deepseek-ai/dsh-agent resolves outside the installation closure: D:\\software\\deepseek harness\\DSH Desktop\\resources\\app\\node_modules\\@deepseek-ai\\dsh-agent\\lib\\index.js; @deepseek-ai/dsh-llm resolves outside the installation closure: D:\\software\\deepseek harness\\DSH Desktop\\resources\\app\\node_modules\\@deepseek-ai\\dsh-llm\\lib\\index.js; @deepseek-ai/dsh-skill-filesystem resolves outside the installation closure: D:\\software\\deepseek harness\\DSH Desktop\\resources\\app\\node_modules\\@deepseek-ai\\dsh-skill-filesystem\\lib\\index.js",
  "failedAt": "2026-09-03T15:22:31.843Z",
  "retryAfter": "2026-09-03T21:22:31.843Z"
}

2. profiles/web/package.json → dsh.profile.bundles (the installed plugin is missing)

The plugin market (dshmarket) and the community plugins are installed and in desired.json, but dshmarket is absent from dsh.profile.bundles, so the harness never composes its UI:

"dsh": {
  "profile": {
    "bundles": [
      "@deepseek-ai/dsh-base",
      "@deepseek-ai/dsh-web-app",
      "aegis",
      "@linxin666/dsh-client-ui-git-graph",
      "@linxin666/dsh-client-ui-skill-explorer",
      "@openviking/dsh-memory-plugin",
      "dsh-better-sidebar",
      "dsh-builtin-browser",
      "dsh-cost-meter",
      "@linxin666/dsh-client-ui-task-board"
      // note: dshmarket is missing here
    ]
  }
}

3. The junction host-package layout (Root cause of the "escaped" misreport)

$DSH_HOME/profiles/node_modules/@deepseek-ai/dsh-agent
  -> LinkType: Junction
  -> Target:   D:\software\deepseek harness\DSH Desktop\resources\app\node_modules\@deepseek-ai\dsh-agent

$DSH_HOME/profiles/node_modules/@deepseek-ai/dsh-llm
$DSH_HOME/profiles/node_modules/@deepseek-ai/dsh-skill-filesystem
$DSH_HOME/profiles/node_modules/react
  -> all junctions pointing into the bundled app tree

4. Type-only / no-exports packages that failed require.resolve but are installed

@types/node, @types/*, undici-types, math-intrinsics, dunder-proto
  -> present as real directories with a package.json in the generation & closure,
     but require.resolve throws (MODULE_NOT_FOUND / ERR_PACKAGE_PATH_NOT_EXPORTED)

[juanyezz]

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: reporter reporter@localhost
Date: Thu, 03 Sep 2026 15:40:00 +0800
Subject: [PATCH] VerifyGenerationPeers: accept DSH Desktop junction targets and
present-but-unresolvable packages

verifyGenerationPeers() in generations/installer.mjs reported generation
plugins as broken in two DSH Desktop-specific situations. Because any single
failed plugin makes migrateProfileToGenerations() return deferred-failure,
the whole profile migration is frozen, prepareGenerationsForLaunch() /
projectGenerations() are skipped, and newly installed or updated generation
plugins never enter dsh.profile.bundles — so after a restart the plugin's UI
(including the plugin market itself) never appears.

Part 1 — Type-only / pure-tool packages are reported as "does not resolve":
@types/node, @types/*, undici-types, math-intrinsics, dunder-proto
are physically installed (their package.json is present in the generation and
the installation closure) but expose no runtime exports entry, so
require.resolve() throws while the package is healthy.

Part 2 — Host-backed packages are reported as "resolves outside the closure":
The installation closure's host packages (react, react-dom, @deepseek-ai/*)
and ordinary dependencies (typescript, @lexical/internal, @types/node) are
Windows junctions pointing into the bundled app tree
(resources/app/node_modules). On Windows require.resolve() follows the
junction and realpath() then resolves the path outside the nominal closure
directory, so the check misreads it as an escape.

This patch accepts those two legitimate situations while keeping the "dependency
genuinely missing" error for packages absent everywhere.

Verified with all 18 real generation directories: every one passes after the
patch, and a negative control (a dependency that is truly absent) still fails.

Signed-off-by: reporter reporter@localhost

generations/installer.mjs | 93 +++++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 84 insertions(+), 9 deletions(-)

diff --git a/generations/installer.mjs b/generations/installer.mjs
--- a/generations/installer.mjs
+++ b/generations/installer.mjs
@@ -1,7 +1,7 @@
import { spawn } from 'node:child_process'
import { randomUUID } from 'node:crypto'
import { existsSync } from 'node:fs'
-import { cp, lstat, mkdir, readFile, readdir, realpath, rename, rm, unlink, writeFile } from 'node:fs/promises'
-import { isAbsolute, join, relative } from 'node:path'
+import { cp, lstat, mkdir, readFile, readdir, readlink, realpath, rename, rm, unlink, writeFile } from 'node:fs/promises'
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
import { ensureRegistryDirectories, generationId, writeGenerationMeta } from './registry.mjs'

@@ -2,9 +2,15 @@
// 1. the helper functions + 2. the verifyGenerationPeers host/dependency checks
//
-// (a) Insert these two helper functions directly after isInsideDirectory():
+// (a) Insert these two helper functions directly after isInsideDirectory():
+/**

• • The real target of the closure's entry for dependency, when that entry is a
• • directory link (Windows junction / symlink). Host singletons are linked into
• • the shared installation closure from the bundled host, so when a generation
• • resolves one it follows the link straight to the host tree. Resolving the
• • link target here lets the peer check accept exactly that host-provided
• • location instead of misreading the (realpath'd) resolution as an escape.
• • Returns undefined when the closure entry is absent or not a link.
• */
  +async function closureJunctionTarget(closure, dependency) {
• const linkPath = join(closure, dependency)
• let info
• try {
• info = await lstat(linkPath)
• } catch {
• return undefined
• }
• if (!info.isSymbolicLink()) return undefined
• let target
• try {
• target = await readlink(linkPath)
• } catch {
• return undefined
• }
• if (target === '') return undefined
• // A junction target is absolute; a relative symlink resolves against the link dir.
• return isAbsolute(target) ? target : resolve(dirname(linkPath), target)
  +}

+/**

• • Whether dependency is physically installed as a directory (with a package
• • manifest) under any of the given roots. Module resolution can legitimately
• • fail for a package that is present: type-only packages (@types/*), pure tool
• • packages without a runtime exports entry (undici-types, math-intrinsics, …),
• • and internal scoped packages all install fine but have nothing for
• • require.resolve to return. Such a package is not "missing" — the plugin simply
• • never loads it at runtime — so it must not be reported as an unresolved
• • dependency. A package absent from every root is genuinely missing.
• */
  +async function packageExistsInRoots(roots, dependency) {
• for (const root of roots) {
• if (root === undefined) continue
• if (existsSync(join(root, dependency, 'package.json'))) return true
• }
• return false
  +}

+// (b) verifyGenerationPeers: replace the host-singleton branch:
+//
+// BEFORE:
+// if (isHostSingleton(dependency)) {
+// if (!insideClosure) {
+// problems.push(${prefix}${dependency} resolves outside the installation closure: ${realResolved})
+// }
+// } else if (!insideClosure && !isInsideDirectory(generationRoot, realResolved)) {
+// problems.push(
+// ${prefix}${dependency} resolves outside the generation and installation closure: ${realResolved}
+// )
+// }
+//
+// AFTER:
+// if (isHostSingleton(dependency)) {
+// const closureLinkTarget = await closureJunctionTarget(closure, dependency)
+// const hostProvided =
+// insideClosure ||
+// (closureLinkTarget !== undefined && isInsideDirectory(closureLinkTarget, realResolved))
+// if (!hostProvided) {
+// problems.push(${prefix}${dependency} resolves outside the installation closure: ${realResolved})
+// }
+// } else if (!insideClosure && !isInsideDirectory(generationRoot, realResolved)) {
+// const closureLinkTarget = await closureJunctionTarget(closure, dependency)
+// const hostProvided =
+// closureLinkTarget !== undefined && isInsideDirectory(closureLinkTarget, realResolved)
+// if (!hostProvided) {
+// problems.push(${prefix}${dependency} resolves outside the generation and installation closure: ${realResolved})
+// }
+// }
+//
+// (c) verifyGenerationPeers: replace the resolved === undefined branch:
+//
+// BEFORE:
+// if (resolved === undefined) {
+// if (!optional) {
+// problems.push(
+// isHostSingleton(dependency)
+// ? ${prefix}${dependency} does not resolve from the installation closure
+// : ${prefix}${dependency} does not resolve from the generation or installation closure
+// )
+// }
+// continue
+// }
+//
+// AFTER:
+// if (resolved === undefined) {
+// if (!optional) {
+// const present =
+// isHostSingleton(dependency) ||
+// (await packageExistsInRoots(
+// [join(generationRoot, 'node_modules'), closure],
+// dependency
+// ))
+// if (!present) {
+// problems.push(
+// isHostSingleton(dependency)
+// ? ${prefix}${dependency} does not resolve from the installation closure
+// : ${prefix}${dependency} does not resolve from the generation or installation closure
+// )
+// }
+// }
+// continue
+// }
+//
+// NOTE: @@ hunk headers and line counts above are illustrative; because this
+// patch targets a bundled (non-git) release copy, apply it by matching the
+// BEFORE code blocks and substituting the AFTER blocks, or regenerate with
+// git diff --no-index <original> <patched> against the upstream source.
+//
*** End of patch