@1e0zj/dsh-plugin-mall 0.1.2 → 0.1.4

package/README.md

@@ -4,14 +4,15 @@
 
 两个入口：
 
-1. **设置 → 插件 → 插件市场 tab**（浏览器 UI，dsh web 模式）：搜索、看详情、点安装、看进度与已装列表
-2. **会话内 4 个 agent 工具**（所有模式可用）
+1. **设置 → 插件 → 插件市场 tab**（浏览器 UI，dsh web 模式）：搜索、看详情、点安装/卸载、看进度与已装列表
+2. **会话内 5 个 agent 工具**（所有模式可用）
 
 | 工具 | 作用 |
 |---|---|
 | `market_search` | 搜索 GitHub 上带 `topic:dsh-plugin` 标签的仓库（按 star 排序，可按关键词过滤） |
 | `market_info` | 查看单个仓库详情：star、license、package.json、是否声明 `dsh.bundle.patch` / `dsh.client` |
 | `market_install` | 把插件装进某个 profile（后台任务，可用 `job_output` 查看进度） |
+| `market_uninstall` | 把插件从某个 profile 卸载（后台任务：`pnpm remove` + 剔除 bundle 层 + 删除客户端加载行） |
 | `market_installed` | 列出某 profile 已装的插件及其 bundle 状态 |
 
 ## 安装
@@ -36,7 +37,7 @@ dsh plugin --profile web add link:C:\path\to\dsh-plugin-mall
 ## 工作原理
 
 - 双面包（dual-face）插件：`dsh.bundle` 半边挂在 **host 平面**（profile bundle 层），
-  注册 4 个 agent 工具（进 global 层，所有会话可见，与 MCP 工具同理）；
+  注册 5 个 agent 工具（进 global 层，所有会话可见，与 MCP 工具同理）；
   `dsh.client` 半边是浏览器插件，往设置页插件区注册「插件市场」tab
   （`settings.plugins.tab` slot；手写无构建，经 `window.__ModuleLoader__` 加载）。
 - 浏览器 → 服务端走 Connection 服务的独立 RPC 通道 `/market`
@@ -46,6 +47,10 @@ dsh plugin --profile web add link:C:\path\to\dsh-plugin-mall
   `pnpm add <spec>`，成功后把声明了 `dsh.bundle.patch` 的依赖登记进
   `dsh.profile.bundles`（layer 列表），声明了 `dsh.client` 的依赖自动在
   profile 的 `cordis.patch.yml` 注册加载行，与官方 reconcile 逻辑一致。
+- `market_uninstall` 复刻官方 `dsh plugin remove` 的流程：在 profile 目录跑
+  `pnpm remove <package>`，成功后从 `dsh.profile.bundles` 剔除该依赖的
+  bundle 条目，并删掉 `cordis.patch.yml` 里由安装流程注册的客户端加载行
+  （文本级精准移除，用户手写的行不受影响）。
 - GitHub 源的插件安装时要跑 prepare 构建脚本，pnpm 默认拦截；本插件检测到
   拦截后会把包名自动合并进 profile 的 `pnpm-workspace.yaml` 的 `allowBuilds`
   并自动重试一次。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1e0zj/dsh-plugin-mall",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "dsh 插件市场：搜索 GitHub dsh-plugin 话题下的插件仓库，一键安装到本地 dsh profile（agent 工具 + 设置页插件市场 tab）",
   "type": "module",
   "main": "src/index.js",

package/src/client.js

@@ -15,7 +15,7 @@ window.__ModuleLoader__.load({
 
     // ── styles ──────────────────────────────────────────────────────────────
     var css = [
-      ".mkt_root{display:flex;flex-direction:column;gap:12px;max-width:960px}",
+      ".mkt_root{display:flex;flex-direction:column;gap:12px;max-width:1040px}",
       ".mkt_head{display:flex;flex-direction:column;gap:2px}",
       ".mkt_title{font-size:16px;font-weight:600;color:var(--dsw-alias-label-primary)}",
       ".mkt_sub{font-size:12px;color:var(--dsw-alias-label-tertiary)}",
@@ -28,16 +28,19 @@ window.__ModuleLoader__.load({
       ".mkt_btnPrimary{background:var(--dsw-alias-state-business-primary,#2b6cb0);border-color:transparent;color:#fff}",
       ".mkt_btnPrimary:hover:not(:disabled){color:#fff;opacity:.92}",
       ".mkt_btnDanger:hover:not(:disabled){border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary)}",
+      ".mkt_btnSm{padding:3px 10px;font-size:12px}",
       ".mkt_error{color:var(--dsw-alias-state-error-primary);font-size:12px;line-height:18px}",
       ".mkt_columns{display:grid;grid-template-columns:1fr 320px;gap:14px;align-items:start}",
       "@media (max-width:860px){.mkt_columns{grid-template-columns:1fr}}",
-      ".mkt_list{display:flex;flex-direction:column;gap:10px;min-width:0}",
+      ".mkt_list{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px;align-items:stretch;min-width:0}",
+      "@media (max-width:820px){.mkt_list{grid-template-columns:minmax(0,1fr)}}",
+      ".mkt_listHead{grid-column:1/-1;font-size:12px;color:var(--dsw-alias-label-tertiary)}",
       ".mkt_card{border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:10px 12px;background:var(--dsw-alias-bg-primary,#fff);display:flex;flex-direction:column;gap:6px;min-width:0}",
       ".mkt_cardHead{display:flex;align-items:baseline;gap:8px;flex-wrap:wrap}",
       ".mkt_name{font-size:13.5px;font-weight:600;color:var(--dsw-alias-label-primary);overflow-wrap:anywhere}",
       ".mkt_meta{font-size:12px;color:var(--dsw-alias-label-tertiary)}",
       ".mkt_desc{font-size:12.5px;color:var(--dsw-alias-label-secondary);overflow-wrap:anywhere}",
-      ".mkt_cardActions{display:flex;gap:8px;align-items:center;flex-wrap:wrap}",
+      ".mkt_cardActions{display:flex;gap:8px;align-items:center;flex-wrap:wrap;margin-top:auto;padding-top:4px}",
       ".mkt_rail{display:flex;flex-direction:column;gap:10px;min-width:0}",
       ".mkt_panelTitle{font-size:13px;font-weight:600;color:var(--dsw-alias-label-primary);margin:0}",
       ".mkt_pre{font-family:Consolas,Monaco,monospace;font-size:11.5px;line-height:16px;color:var(--dsw-alias-label-secondary);background:var(--dsw-alias-bg-secondary,#f6f7f8);border-radius:6px;padding:8px;max-height:220px;overflow:auto;white-space:pre-wrap;word-break:break-all}",
@@ -46,7 +49,8 @@ window.__ModuleLoader__.load({
       ".mkt_link{color:var(--dsw-alias-state-business-primary);font-size:12px;text-decoration:none;cursor:pointer}",
       ".mkt_installedHead{display:flex;align-items:center;gap:8px;width:100%;background:none;border:0;padding:0;margin:0;cursor:pointer;font:inherit;text-align:left}",
       ".mkt_installedHead:hover .mkt_panelTitle{color:var(--dsw-alias-state-business-primary)}",
-      ".mkt_depList{display:flex;flex-direction:column;gap:6px;margin-top:8px}",
+      ".mkt_depList{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:6px 14px;margin-top:8px}",
+      "@media (max-width:820px){.mkt_depList{grid-template-columns:minmax(0,1fr)}}",
       ".mkt_depRow{display:flex;justify-content:space-between;align-items:center;gap:8px}",
     ].join("\n");
     var tagId = "@1e0zj/dsh-plugin-mall/market-tab.css";
@@ -180,7 +184,7 @@ window.__ModuleLoader__.load({
       var ids = Object.keys(props.jobs);
       if (ids.length === 0) return null;
       return h("div", { className: "mkt_card" },
-        h("p", { className: "mkt_panelTitle" }, "安装任务"),
+        h("p", { className: "mkt_panelTitle" }, "任务"),
         ids.map(function (id) {
           var job = props.jobs[id];
           var done = job.status === "completed" || job.status === "failed" || job.status === "killed";
@@ -189,9 +193,9 @@ window.__ModuleLoader__.load({
               id + " · " + clip(job.spec || "", 40) + " · " + (job.status || "running")),
             job.detail ? h("div", { className: "mkt_desc" }, job.detail) : null,
             done && job.status === "completed"
-              ? h("div", { className: "mkt_ok" }, "✓ 安装完成 — 重启 dsh 后生效")
+              ? h("div", { className: "mkt_ok" }, "✓ 完成 — 重启 dsh 后生效")
               : job.status === "failed"
-                ? h("div", { className: "mkt_error" }, "安装失败，见下方输出")
+                ? h("div", { className: "mkt_error" }, "失败，见下方输出")
                 : null,
             job.output ? h("pre", { className: "mkt_pre" }, job.output.slice(-4000)) : null
           );
@@ -224,9 +228,15 @@ window.__ModuleLoader__.load({
           : (installed.deps || []).length === 0
             ? h("div", { className: "mkt_meta" }, "还没有装过插件")
             : h("div", { className: "mkt_depList" }, (installed.deps || []).map(function (dep) {
+              var busy = (props.removing || {})[dep.name] === true;
               return h("div", { key: dep.name, className: "mkt_depRow" },
                 h("span", { className: "mkt_desc" }, dep.name + "@" + dep.version),
-                h("span", { className: "mkt_badge" }, kindLabel(dep.kind)));
+                h("span", { className: "mkt_badge" }, kindLabel(dep.kind)),
+                h("button", {
+                  className: "mkt_btn mkt_btnDanger mkt_btnSm",
+                  disabled: busy,
+                  onClick: function () { props.onUninstall(dep.name); },
+                }, busy ? "卸载中…" : "卸载"));
             }))
       );
     }
@@ -258,6 +268,9 @@ window.__ModuleLoader__.load({
       var _installing = useState({});
       var installing = _installing[0];
       var setInstalling = _installing[1];
+      var _removing = useState({});
+      var removing = _removing[0];
+      var setRemoving = _removing[1];
 
       var call = useCallback(function (endpoint, payload) {
         return rpc.call("/market", endpoint, payload || {}).then(function (res) {
@@ -325,6 +338,25 @@ window.__ModuleLoader__.load({
         });
       }, [call, track]);
 
+      var doUninstall = useCallback(function (name) {
+        setRemoving(function (prev) {
+          var next = Object.assign({}, prev, { [name]: true });
+          return next;
+        });
+        setError(null);
+        call("uninstall", { package: name }).then(function (value) {
+          track(value.jobId, name);
+        }).catch(function (e) {
+          setError(errorText(e));
+        }).finally(function () {
+          setRemoving(function (prev) {
+            var next = Object.assign({}, prev);
+            delete next[name];
+            return next;
+          });
+        });
+      }, [call, track]);
+
       useEffect(function () {
         refreshInstalled();
       }, [refreshInstalled]);
@@ -332,7 +364,7 @@ window.__ModuleLoader__.load({
       return h("div", { className: "mkt_root" },
         h("div", { className: "mkt_head" },
           h("div", { className: "mkt_title" }, "插件市场"),
-          h("div", { className: "mkt_sub" }, "搜索 GitHub dsh-plugin 话题插件 · 安装后需重启 dsh 生效")
+          h("div", { className: "mkt_sub" }, "搜索 GitHub dsh-plugin 话题插件 · 装/卸后需重启 dsh 生效")
         ),
         h("div", { className: "mkt_row" },
           h("input", {
@@ -355,14 +387,15 @@ window.__ModuleLoader__.load({
           h("button", { className: "mkt_btn", onClick: refreshInstalled }, "刷新已装")
         ),
         error ? h("div", { className: "mkt_error" }, error) : null,
+        h(InstalledPanel, { installed: installed, removing: removing, onUninstall: doUninstall }),
         h("div", { className: "mkt_columns" },
           h("div", { className: "mkt_list" },
             results == null
-              ? h("div", { className: "mkt_meta" }, loading ? "正在加载最热插件…" : "—")
+              ? h("div", { className: "mkt_meta mkt_listHead" }, loading ? "正在加载最热插件…" : "—")
               : results.items.length === 0
-                ? h("div", { className: "mkt_meta" }, "没有匹配的仓库。")
+                ? h("div", { className: "mkt_meta mkt_listHead" }, "没有匹配的仓库。")
                 : h(React.Fragment, null,
-                  h("div", { className: "mkt_meta" }, "共 " + results.total + " 个仓库（显示 " + results.items.length + " 个）"),
+                  h("div", { className: "mkt_meta mkt_listHead" }, "共 " + results.total + " 个仓库（显示 " + results.items.length + " 个）"),
                   results.items.map(function (item) {
                     return h(RepoCard, {
                       key: item.fullName,
@@ -375,7 +408,6 @@ window.__ModuleLoader__.load({
                 )
           ),
           h("div", { className: "mkt_rail" },
-            h(InstalledPanel, { installed: installed }),
             h(InfoPanel, { info: info, onInstall: doInstall }),
             h(JobsPanel, { jobs: jobs })
           )

package/src/index.js

@@ -2,10 +2,11 @@
 //
 // A Cordis plugin mounted at the host plane (profile bundle layer), so its
 // tools land in the tools registry's global layer and every session sees
-// them. It exposes four tools:
+// them. It exposes five tools:
 //   market_search     search GitHub repositories tagged topic:dsh-plugin
 //   market_info       inspect one repository (stars, license, package.json, dsh.bundle)
 //   market_install    install a plugin into a local dsh profile (background job)
+//   market_uninstall  remove a plugin from a local dsh profile (background job)
 //   market_installed  list a profile's installed plugins
 //
 // Plugin contract (see @deepseek-ai/cordis-plugin-loader): the loader imports
@@ -18,7 +19,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { repoInfo, searchPlugins } from "./github.js";
-import { ensureProfile, listInstalled, normalizeSpec, runInstall, createInstallTracker } from "./installer.js";
+import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, createJobTracker } from "./installer.js";
 
 export const name = "@1e0zj/dsh-plugin-mall";
 export const inject = ["tools", "jobs", "systemPrompt"];
@@ -104,7 +105,7 @@ function renderInstalled(result, profile) {
     lines.push(`  ${dep.name}@${dep.version}  ${markers[dep.kind] ?? markers.plain}`);
   }
   lines.push("");
-  lines.push(`Remove with: dsh plugin --profile ${profile} remove <name> (then restart dsh).`);
+  lines.push(`Remove with: market_uninstall (package: "<name>"), or dsh plugin --profile ${profile} remove <name>; then restart dsh.`);
   return lines.join("\n");
 }
 
@@ -136,7 +137,7 @@ function rpcFail(error) {
  * tools keep using ctx.jobs; the browser surface uses `tracker` because the
  * web host plane has no job controller for ctx.jobs to serve.
  * @param ctx - plugin context.
- * @param endpoint - "search" | "info" | "installed" | "install" | "job" | "jobCancel".
+ * @param endpoint - "search" | "info" | "installed" | "install" | "uninstall" | "job" | "jobCancel".
  * @param payload - endpoint arguments from the browser.
  * @param config - the row config (defaultProfile, apiBase, perPageMax).
  * @param token - GitHub token from the environment.
@@ -192,6 +193,25 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
         return rpcFail(error);
       }
     }
+    case "uninstall": {
+      const profile = String(payload?.profile ?? defaultProfile).trim();
+      const packageName = String(payload?.package ?? "").trim();
+      if (packageName.length === 0) return rpcFail(new Error("uninstall: package name is required"));
+      try {
+        const profileDir = resolveProfileDir(profile);
+        if (!existsSync(join(profileDir, "package.json"))) {
+          return rpcFail(new Error(`profile "${profile}" has no package.json — nothing installed to remove`));
+        }
+      } catch (error) {
+        return rpcFail(new Error(`invalid profile: ${error.message}`));
+      }
+      try {
+        const jobId = tracker.start({ profile, spec: packageName, verb: "remove" });
+        return rpcOk({ jobId, profile, package: packageName });
+      } catch (error) {
+        return rpcFail(error);
+      }
+    }
     case "job": {
       try {
         return rpcOk(tracker.get(payload?.jobId));
@@ -221,7 +241,7 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
  * @param token - GitHub token from the environment.
  */
 function registerRpcChannel(ctx, config, token) {
-  const tracker = createInstallTracker();
+  const tracker = createJobTracker();
   ctx.inject(["connection"], (connectionCtx) => {
     connectionCtx.connection.rpc.handle("/market", (endpoint, payload, signal) => rpcDispatch(ctx, endpoint, payload ?? {}, config, token, tracker), { authority: "loopback" });
   });
@@ -234,7 +254,7 @@ export function apply(ctx, config = {}) {
   ctx.systemPrompt.section({
     name: "tool:market",
     order: 120,
-    text: "The dsh plugin marketplace tools are available: market_search discovers plugins on the GitHub dsh-plugin topic, market_info inspects one repository, market_install installs a plugin into a dsh profile as a background job (poll with job_output), and market_installed lists a profile's plugins. A successful market_install only takes effect after the dsh process restarts — remind the user to restart. Prefer plugins with meaningful stars and a dsh.bundle declaration (market_info shows both).",
+    text: "The dsh plugin marketplace tools are available: market_search discovers plugins on the GitHub dsh-plugin topic, market_info inspects one repository, market_install installs a plugin into a dsh profile as a background job (poll with job_output), market_uninstall removes an installed plugin from a dsh profile as a background job, and market_installed lists a profile's plugins. A successful market_install or market_uninstall only takes effect after the dsh process restarts — remind the user to restart. Prefer plugins with meaningful stars and a dsh.bundle declaration (market_info shows both).",
   });
 
   ctx.tools.register(defineTool({
@@ -363,6 +383,56 @@ export function apply(ctx, config = {}) {
     }),
   }));
 
+  ctx.tools.register(defineTool({
+    name: "market_uninstall",
+    description: "Remove a plugin from a local dsh profile by running `pnpm remove` in that profile's directory, dropping its entry from the profile's bundle layer list, and deleting its client loader row from cordis.patch.yml if one was registered. Same flow as `dsh plugin --profile <name> remove <package>`. ALWAYS runs as a background job: the call returns a job id immediately; poll with job_output and cancel with job_kill. A successful removal only takes effect after the dsh process restarts.",
+    parameters: {
+      package: {
+        type: "string",
+        required: true,
+        description: "Installed package name to remove, e.g. \"@1e0zj/dsh-plugin-mall\" or \"dsh-at-file\".",
+      },
+      profile: {
+        type: "string",
+        description: `Target profile under $DSH_HOME/profiles. Defaults to "${defaultProfile}".`,
+      },
+    },
+    output: {
+      schema: {
+        type: "object",
+        additionalProperties: false,
+        properties: BACKGROUND_OUTPUT_PROPERTIES,
+      },
+      render: (args, value) => [{
+        type: "text",
+        text: `started background job ${value.jobId} (${args.package} ← profile "${args.profile ?? defaultProfile}"); poll with job_output, cancel with job_kill. Restart dsh after a successful uninstall.`,
+      }],
+    },
+    async execute(args, exec) {
+      const profile = String(args.profile ?? defaultProfile).trim();
+      const packageName = String(args.package ?? "").trim();
+      if (packageName.length === 0) throw new Error("market_uninstall: package name is required");
+      try {
+        resolveProfileDir(profile);
+      } catch (error) {
+        throw new Error(`market_uninstall: invalid profile: ${error.message}`);
+      }
+      const jobId = ctx.jobs.start({
+        kind: "dsh-plugin-uninstall",
+        label: `dsh plugin --profile ${profile} remove ${packageName}`,
+        ...exec.agent ? { owner: exec.agent } : {},
+        run: () => runRemove({ profile, packageName }),
+      });
+      return { kind: "background", jobId };
+    },
+    presentCall: (args) => ({
+      card: "generic",
+      title: `dsh plugin --profile ${args.profile ?? defaultProfile} remove ${args.package}`,
+      kind: "execute",
+      content: [{ type: "text", text: "Remove a plugin from a dsh profile (background job)" }],
+    }),
+  }));
+
   ctx.tools.register(defineTool({
     name: "market_installed",
     description: "List the plugins installed in a local dsh profile: every dependency with its installed version and whether it declares a dsh bundle (i.e. is an active plugin layer).",

package/src/installer.js

@@ -187,6 +187,34 @@ export function ensureClientRow(profileDir, packageName) {
   return { added: true, rowId };
 }
 
+/**
+ * Remove the cordis.patch.yml loader row `ensureClientRow` registered for a
+ * package. Textual and idempotent: only the exact block the register emitted
+ * is spliced out, so user-authored rows survive byte-for-byte. An emptied
+ * file falls back to the stock `[]` template.
+ * @returns {{ removed: boolean, rowId?: string }}
+ */
+export function removeClientRow(profileDir, packageName) {
+  const patchPath = join(profileDir, PROFILE_PATCH_FILENAME);
+  if (!existsSync(patchPath)) return { removed: false };
+  const content = readFileSync(patchPath, "utf8");
+  const rowId = clientRowId(packageName);
+  const lines = content.split("\n");
+  let removed = false;
+  for (let index = 0; index < lines.length - 2; index++) {
+    if (lines[index] !== "- insert:") continue;
+    if (lines[index + 1] !== `    - id: ${rowId}`) continue;
+    if (lines[index + 2] !== `      name: '${packageName}'`) continue;
+    lines.splice(index, 3);
+    removed = true;
+    break;
+  }
+  if (!removed) return { removed: false };
+  const next = lines.join("\n").replace(/\n{3,}/g, "\n\n").trim();
+  writeFileSync(patchPath, next.length === 0 ? "[]\n" : `${next}\n`);
+  return { removed: true, rowId };
+}
+
 // ── build-script allow-listing ──────────────────────────────────────────────
 
 /** Extract package names from pnpm's "Ignored build scripts: ..." output. */
@@ -250,8 +278,12 @@ function ensureAllowBuilds(profileDir, names) {
 
 let trackerCounter = 0;
 
-/** Create a tracker for browser-started installs (see runInstall). */
-export function createInstallTracker() {
+/**
+ * Create a tracker for browser-started install/uninstall jobs (see runInstall
+ * and runRemove). Same producer shape as the jobs registry ({cancel, done,
+ * readOutput}), just an independent registry.
+ */
+export function createJobTracker() {
   const records = new Map();
   const prune = () => {
     const now = Date.now();
@@ -268,12 +300,14 @@ export function createInstallTracker() {
     }
   };
   return {
-    start({ profile, spec }) {
+    start({ profile, spec, verb = "add" }) {
       const id = `market-${++trackerCounter}`;
-      const producer = runInstall({ profile, spec });
+      const kind = verb === "remove" ? "dsh-plugin-uninstall" : "dsh-plugin-install";
+      const producer = verb === "remove" ? runRemove({ profile, packageName: spec }) : runInstall({ profile, spec });
       const record = {
         id,
-        label: `dsh plugin --profile ${profile} add ${spec}`,
+        kind,
+        label: `dsh plugin --profile ${profile} ${verb} ${spec}`,
         profile,
         spec,
         status: "running",
@@ -297,7 +331,7 @@ export function createInstallTracker() {
       return {
         snapshot: {
           id: record.id,
-          kind: "dsh-plugin-install",
+          kind: record.kind,
           label: record.label,
           status: record.status,
           detail: record.detail,
@@ -427,3 +461,86 @@ export function runInstall({ profile, spec }) {
     },
   };
 }
+
+// ── the background uninstall job ────────────────────────────────────────────
+
+/** A terminal producer for fast-fail cases (no pnpm spawn needed). */
+function failedNow(detail) {
+  return {
+    cancel: () => {},
+    done: Promise.resolve({ status: "failed", detail }),
+    readOutput: () => "",
+  };
+}
+
+/**
+ * Run `pnpm remove <package>` in the profile directory as a job producer with
+ * the same shape as `runInstall`. On success it reconciles
+ * `dsh.profile.bundles` (the removed dependency's bundle entry drops out) and
+ * deletes the client loader row `ensureClientRow` had registered for it.
+ */
+export function runRemove({ profile, packageName }) {
+  let profileDir;
+  try {
+    profileDir = resolveProfileDir(profile);
+  } catch (error) {
+    return failedNow(`invalid profile: ${error.message}`);
+  }
+  const manifestPath = join(profileDir, "package.json");
+  if (!existsSync(manifestPath)) {
+    return failedNow(`profile "${profile}" has no package.json — nothing installed to remove`);
+  }
+  const beforeDeps = new Set(Object.keys(readManifest(profileDir).dependencies ?? {}));
+  if (!beforeDeps.has(packageName)) {
+    return failedNow(`"${packageName}" is not a dependency of profile "${profile}" (installed: ${[...beforeDeps].join(", ") || "none"})`);
+  }
+  const deltaQueue = [];
+  const push = (text) => {
+    deltaQueue.push(text);
+  };
+  let current = undefined;
+
+  const proc = spawn("pnpm", ["remove", packageName, "--reporter=append-only"], {
+    cwd: profileDir,
+    env: process.env,
+    shell: process.platform === "win32",
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true,
+  });
+  current = proc;
+  const done = new Promise((resolve) => {
+    proc.on("error", (error) => resolve({ spawnError: error }));
+    proc.on("close", (exitCode) => resolve({ exitCode, signal: proc.signalCode }));
+  }).then((outcome) => {
+    if (outcome.spawnError !== undefined) {
+      const hint = outcome.spawnError.code === "ENOENT"
+        ? "pnpm not found on PATH — install pnpm (e.g. `corepack enable pnpm`) to manage profile plugins"
+        : `could not start pnpm: ${outcome.spawnError.message}`;
+      return { status: "failed", detail: hint };
+    }
+    if (outcome.exitCode === null) {
+      return { status: "killed", detail: outcome.signal ? `signal: ${outcome.signal}` : "killed before exit" };
+    }
+    if (outcome.exitCode !== 0) {
+      return { status: "failed", detail: `pnpm remove ${packageName} failed (exit code ${outcome.exitCode}). See job output.` };
+    }
+    const bundles = reconcileBundles(profileDir, beforeDeps);
+    const clientRow = removeClientRow(profileDir, packageName);
+    const notes = [`bundle layer(s) now: ${bundles.join(", ") || "none (template only)"}`];
+    if (clientRow.removed) notes.push(`removed client loader row "${clientRow.rowId}" from cordis.patch.yml`);
+    return { status: "completed", detail: `removed ${packageName} from profile "${profile}" — ${notes.join("; ")}. Restart dsh for the change to take effect.` };
+  });
+  proc.stdout?.on("data", (data) => push(data.toString()));
+  proc.stderr?.on("data", (data) => push(data.toString()));
+
+  return {
+    cancel: () => {
+      current?.kill();
+    },
+    done,
+    readOutput: () => {
+      if (deltaQueue.length === 0) return "";
+      return deltaQueue.splice(0).join("");
+    },
+  };
+}