@crazx/dsh 0.1.6-alpha.2.zw.2 → 0.2.1-rc.2.zw.2

package/README.i18n.yaml

@@ -1,6 +1,22 @@
-# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
-# side as of the last confirmed-consistent state. Both languages carry equal authority;
-# after editing either side, bring the other along and re-record with:
+# Bilingual-pair consistency record for README.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write apps/cli/README.md
-README.md: 46c6a66336839db443a825c66ebfd71dcce398af
-README.zh.md: 14838114b04977e7668e33479d1ba84a8ddc8434
+/deepseek-ai-dsh:
+  en: ebdc75fa0da18801
+  zh: 5c6cd2554b8f8a98
+/deepseek-ai-dsh/entry-modes:
+  en: a1e035a813554366
+  zh: b87053214afe71b6
+/deepseek-ai-dsh/app-arguments:
+  en: cc03e6b75206661b
+  zh: 99e41f4143198352
+/deepseek-ai-dsh/profiles:
+  en: 523477a093beb0c2
+  zh: f88ea21e5fbea969
+/deepseek-ai-dsh/optional-overlays:
+  en: 3a40ddc44e55f79c
+  zh: 8d3949132e1ef93c
+/deepseek-ai-dsh/development:
+  en: 0a289c1235869927
+  zh: a1f473f70036ad37

package/README.md

@@ -9,7 +9,7 @@ The `dsh` command is the sole supported Node application launcher: profiles are
 | Command | Purpose |
 |---|---|
 | `dsh <name>` / `dsh --profile <name>` | Boot the named profile under `$DSH_HOME/profiles/<name>`. |
-| `dsh --profile <name> --from-default-profile <template>` | Create a new custom profile from a shipped template, then boot it. |
+| `dsh --profile <name> --from-default-profile <template>` | Replace a custom profile with a fresh copy of a shipped template, then boot it. |
 | `dsh --profile acp` | Serve automation clients over ACP stdio until disconnect. |
 | `dsh --profile headless "job"` | Run one fresh persisted session, print the final answer, and exit. |
 | `dsh --profile sdk` | Serve SDK clients over JSON-RPC stdio until shutdown or disconnect. |
@@ -17,7 +17,7 @@ The `dsh` command is the sole supported Node application launcher: profiles are
 | `dsh web` | Boot the Web profile. |
 | `dsh plugin --profile <name> <pnpm args>` | Manage a profile's plugins by forwarding to pnpm in the profile directory. |
 
-The invoking directory is the default workspace root. The `web`, `headless`, `sdk`, `sdk-minimal`, and `acp` profiles auto-initialize on first use from shipped templates. Create another profile at an unused, non-shipped name with `--from-default-profile`, or initialize a base-backed profile through `dsh plugin`. The `desktop` name is reserved for the Electron-owned profile, so the CLI rejects boot, config-dump, and plugin-management requests for it.
+The invoking directory is the default workspace root. The `web`, `headless`, `sdk`, `sdk-minimal`, and `acp` profiles auto-initialize on first use from shipped templates. Create or reset another profile at a non-shipped name with `--from-default-profile`, or initialize a base-backed profile through `dsh plugin`. The `desktop` name is reserved for the Electron-owned profile, so the CLI rejects boot and config-dump requests for it. The npm CLI also rejects its plugin-management requests; the [Desktop-installed command](../desktop/README.md#bundled-command-runtime) can manage the initialized Desktop profile using that installation’s runtime.
 
 ## App arguments
 
@@ -36,6 +36,8 @@ dsh --help                          # the launcher's own help
 
 A profile directory holds a `package.json` (out-of-tree plugin dependencies plus the profile manifest `dsh.profile` with its ordered `bundles` list) and a `cordis.patch.yml` (the user's own patch layer). `dsh-hmr`, when enabled in YAML, watches the profile manifest and both profile and home patch files, then recomposes all layers through one serialized reload. Without HMR, changes apply on restart. Edits arriving during watcher registration use the same nonfatal reload reporting as later edits. [Plugin Manager](../../packages/boot/plugin-manager/README.md) shares package operations and the profile write lock with `dsh plugin`; package updates retain disabled bundle selections. CLI package commands inherit authentication variables and terminal descriptors, including interactive build approval; service calls retain their scrubbed environment and captured diagnostics.
 
+Installation and profile startup enforce the declared `engines.dsh` range, or DSH peer ranges when it is absent, against the same runtime version shown by `dsh --version`. Incompatible plugins require an explicitly acknowledged exact-version exemption. The [plugin manager's compatibility reference](../../packages/boot/plugin-manager/README.md#version-compatibility-and-exemptions) documents `version-exemptions`, `allow-version`, `revoke-version`, persistence, and risks.
+
 The tree composes over an empty root:
 - each bundle's patch in `dsh.profile.bundles` order
 - then the profile's `cordis.patch.yml`, then the home-level `$DSH_HOME/cordis.patch.yml`
@@ -43,13 +45,13 @@ The tree composes over an empty root:
 
 Bundles named in `dsh.profile.bundles` resolve from the dsh installation first (`@deepseek-ai/dsh-base`, `@deepseek-ai/dsh-web-app`, `@deepseek-ai/dsh-headless`, `@deepseek-ai/dsh-sdk-app`, `@deepseek-ai/dsh-sdk-minimal`, `@deepseek-ai/dsh-acp-app`), then from the profile's own `node_modules`, where pnpm installs out-of-tree plugins.
 
-Use `--dump-default-config` and `--dump-config` to inspect the composed tree without booting it.
+Use `--dump-default-config` and `--dump-config` to inspect the composed tree without booting it. `--dump-config-schema` imports the composed tree's declared plugin schemas and prints JSON Schema for entries and patches instead of configuration values; read the [schema-dump safety and scope](reference/README.md#config-schema-dump) before inspecting untrusted plugins.
 
 The [CLI behavior reference](reference/README.md) owns exact layer precedence, flags, shutdown behavior, deployment defaults, and source execution. The [startup and reload failure table](../../packages/boot/app-boot/README.md#startup-and-reload-failures) compares optional and required plugin failures with configuration HMR.
 
 ## Optional overlays
 
-`config/examples/` ships opt-in overlays for GitHub review webhooks, session-local Schedule, memory MCP servers, and runtime Cordis tools. They are never part of a default profile; the [user guides](../../docs/user/guide/index.md) and [developer practice guides](../../docs/user/develop/practice/index.md) own setup and safety instructions.
+`config/examples/` ships opt-in overlays for GitHub review webhooks, memory MCP servers, and runtime Cordis tools. They are never part of a default profile; the [user guides](../../docs/user/guide/index.md) and [developer practice guides](../../docs/user/develop/practice/index.md) own setup and safety instructions.
 
 ## Development
 
@@ -57,4 +59,6 @@ Production runs require built package and frontend artifacts. From the repositor
 
 The `@deepseek-ai/dsh/profile-boot` export provides the shared profile lifecycle to the Desktop host. A resolved application profile supplies its own installation anchor for runtime package resolution while retaining the Harness home patch, proxy environment, telemetry switch, patch reload, and bounded shutdown.
 
+Packaged installations call the same `runCli()` entry with their package-manager executable. The Desktop carrier also enables plugin operations for its initialized profile; npm launches omit these options. Installation-owned package environments apply only to plugin package operations; the invoking directory, ordinary profile selection, and agent-shell PATH retain their CLI meanings.
+
 The [Web failure matrix](tests/profiles/web/tests/web-failure-matrix.expected.e2e.ts) runs the built CLI through startup failures and native configuration HMR with `awaitWriteFinish` enabled in `test:expected`. It verifies authenticated HTTP responses, diagnostics, recovery, process exits, and disposal without model API calls; the [startup acceptance](tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts) also covers the shipped required Web dependencies and port conflicts.

package/README.zh.md

@@ -9,7 +9,7 @@
 | 命令 | 用途 |
 |---|---|
 | `dsh <name>` / `dsh --profile <name>` | 启动位于 `$DSH_HOME/profiles/<name>` 的指定 profile。 |
-| `dsh --profile <name> --from-default-profile <template>` | 从随附模板创建新的自定义 profile，然后启动它。 |
+| `dsh --profile <name> --from-default-profile <template>` | 用随附模板的全新副本替换自定义 profile，然后启动它。 |
 | `dsh --profile acp` | 通过 ACP stdio 为自动化客户端提供服务，直至断开连接。 |
 | `dsh --profile headless "job"` | 运行一个全新的持久化会话，打印最终答案并退出。 |
 | `dsh --profile sdk` | 通过 JSON-RPC stdio 为 SDK 客户端提供服务，直至关闭或断开连接。 |
@@ -17,7 +17,7 @@
 | `dsh web` | 启动 Web profile。 |
 | `dsh plugin --profile <name> <pnpm args>` | 通过在 profile 目录中转发给 pnpm 来管理该 profile 的插件。 |
 
-运行命令时所在的目录将作为默认 workspace 根目录。`web`、`headless`、`sdk`、`sdk-minimal` 和 `acp` profile 在首次使用时会从随附模板自动初始化。使用 `--from-default-profile` 可以基于这些模板之一，在尚未使用的非内置名称处创建其他 profile；通过 `dsh plugin` 则可以初始化一个以 base 为基础的 profile。`desktop` 名称保留给 Electron 持有的 profile，因此 CLI（命令行界面）会拒绝针对它的启动、配置 dump 和插件管理请求。
+运行命令时所在的目录将作为默认 workspace 根目录。`web`、`headless`、`sdk`、`sdk-minimal` 和 `acp` profile 在首次使用时会从随附模板自动初始化。使用 `--from-default-profile` 可以基于这些模板之一，在非内置名称处创建或重置其他 profile；通过 `dsh plugin` 则可以初始化一个以 base 为基础的 profile。`desktop` 名称保留给 Electron 持有的 profile，因此 CLI（命令行界面）会拒绝针对它的启动和配置 dump 请求。npm CLI 也会拒绝其插件管理请求；[Desktop 内置命令](../desktop/README.zh.md#bundled-command-runtime)可以使用该安装的运行时管理已初始化的 Desktop profile。
 
 ## 应用参数
 
@@ -36,6 +36,8 @@ dsh --help                          # the launcher's own help
 
 profile 目录包含一个 `package.json`，其中记录树外插件依赖，以及 profile manifest（元数据清单）`dsh.profile`、其中按顺序排列的 `bundles` 列表；还包含一个 `cordis.patch.yml`，其中保存用户自己的 patch 层。在 YAML 中启用的 `dsh-hmr` 监视 profile manifest、profile 与 home 级 patch 文件，再通过统一串行重载重新组合所有层。未启用 HMR 时，更改在重启后生效。监听器注册期间发生的编辑与后续编辑使用相同的非致命重载错误报告。[插件管理器](../../packages/boot/plugin-manager/README.zh.md) 与 `dsh plugin` 共享包操作和 profile 写锁；更新依赖会保留已停用的组合包选择。CLI 包操作继承认证环境和终端描述符，支持交互式构建批准；service 调用保留清理后的环境并捕获诊断。
 
+安装和 profile 启动会按声明的 `engines.dsh` 范围（未声明时按 DSH peer 范围），检查与 `dsh --version` 显示值相同的运行时版本。不兼容插件需要用户明确确认精确版本豁免。[插件管理器的兼容性参考](../../packages/boot/plugin-manager/README.zh.md#version-compatibility-and-exemptions)说明 `version-exemptions`、`allow-version`、`revoke-version`、持久化规则与风险。
+
 配置树以空根为起点，依次叠加以下配置层：
 - `dsh.profile.bundles` 中各组合包的 patch
 - profile 自身的 `cordis.patch.yml`，然后是 home 级的 `$DSH_HOME/cordis.patch.yml`
@@ -43,13 +45,13 @@ profile 目录包含一个 `package.json`，其中记录树外插件依赖，以
 
 `dsh.profile.bundles` 中列出的组合包先从 dsh 安装目录解析（`@deepseek-ai/dsh-base`、`@deepseek-ai/dsh-web-app`、`@deepseek-ai/dsh-headless`、`@deepseek-ai/dsh-sdk-app`、`@deepseek-ai/dsh-sdk-minimal`、`@deepseek-ai/dsh-acp-app`），再从 profile 自身的 `node_modules` 解析；pnpm 会将树外插件安装到该目录。
 
-使用 `--dump-default-config` 和 `--dump-config` 可在不启动的情况下检查组合后的配置树。
+使用 `--dump-default-config` 和 `--dump-config` 可在不启动的情况下检查组合后的配置树。`--dump-config-schema` 会导入组合树中插件声明的 schema，并打印描述 entry 与 patch 的 JSON Schema，而不是配置值；检查不受信任的插件前，请阅读 [schema dump 的安全性与范围](reference/README.zh.md#config-schema-dump)。
 
 层的确切优先级、flag、关闭行为、部署默认值和源码执行方式，以 [CLI 行为参考](reference/README.zh.md)为准。[启动与重载失败表](../../packages/boot/app-boot/README.zh.md#startup-and-reload-failures)对比 optional、required 插件启动失败与配置 HMR 的行为。
 
 ## 可选覆盖层
 
-`config/examples/` 交付 GitHub 评审 webhook、会话内 Schedule、记忆 MCP 服务器与运行时 Cordis 工具的可选覆盖层。它们绝不属于默认 profile；设置与安全说明由[用户指南](../../docs/user/guide/index.zh.md)和[开发实战指南](../../docs/user/develop/practice/index.zh.md)负责。
+`config/examples/` 交付 GitHub 评审 webhook、记忆 MCP 服务器与运行时 Cordis 工具的可选覆盖层。它们绝不属于默认 profile；设置与安全说明由[用户指南](../../docs/user/guide/index.zh.md)和[开发实战指南](../../docs/user/develop/practice/index.zh.md)负责。
 
 ## 开发
 
@@ -57,4 +59,6 @@ profile 目录包含一个 `package.json`，其中记录树外插件依赖，以
 
 `@deepseek-ai/dsh/profile-boot` 导出向 Desktop Host 提供共享 profile 生命周期。已解析的应用 profile 为运行时包解析指定自己的安装锚点，同时沿用 Harness home patch、代理环境、遥测开关、patch 热重载和有界关闭。
 
+打包安装通过同一个 `runCli()` 入口传入包管理器可执行文件。Desktop 载体还会启用其已初始化 profile 的插件操作；npm 启动不传入这些选项。安装包提供的包管理环境仅用于插件包操作；调用目录、普通 profile 选择与 agent shell 的 PATH 保留 CLI 语义。
+
 [Web 失败矩阵](tests/profiles/web/tests/web-failure-matrix.expected.e2e.ts)在 `test:expected` 中通过构建后的 CLI 验证启动失败与启用 `awaitWriteFinish` 的原生配置 HMR。它不调用模型 API，而是检查经过认证的 HTTP 响应、诊断、恢复、进程退出与 dispose；[启动验收测试](tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts)还覆盖随附 Web 的必需依赖与端口冲突。

package/lib/bin.js

@@ -1,7 +1,5 @@
 #!/usr/bin/env node
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { StartupError, loadLayeredEnv } from "@deepseek-ai/dsh-app-boot";
+import { StartupError, getDshRuntimeVersion, loadLayeredEnv } from "@deepseek-ai/dsh-app-boot";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { Command, CommanderError, InvalidArgumentError } from "commander";
 import { randomUUID } from "node:crypto";
@@ -43,7 +41,7 @@ const HELP_EXAMPLES = `
 Examples:
   dsh web                                   boot the web profile (same as: dsh --profile web)
   dsh rescue --from-default-profile web
-                                            create rescue from the shipped web template, then boot it
+                                            recreate rescue from the shipped web template, then boot it
   dsh headless "run the tests"              answer one task, print the result, and exit
   dsh tui --patch ./extra.yml               boot a custom profile with one extra overlay
   dsh tui --resume <session>                arguments after the launcher flags reach the app
@@ -64,15 +62,26 @@ function resolveBoot(program, profile, options, args) {
 	const patches = options.patch ?? [];
 	if (patches.includes("")) program.error("error: --patch needs a path");
 	if (options.fromDefaultProfile === "") program.error("error: --from-default-profile needs a name");
-	if (options.dumpConfig !== true && options.dumpDefaultConfig !== true) return {
+	const dumps = [
+		options.dumpConfig,
+		options.dumpDefaultConfig,
+		options.dumpConfigSchema
+	].filter(Boolean);
+	if (dumps.length === 0) return {
 		mode: "profile",
 		profile,
 		fromDefaultProfile: options.fromDefaultProfile,
 		patches,
 		args
 	};
-	if (options.dumpConfig === true && options.dumpDefaultConfig === true) program.error("error: --dump-config and --dump-default-config are mutually exclusive");
+	if (dumps.length > 1) program.error("error: --dump-config, --dump-default-config, and --dump-config-schema are mutually exclusive");
 	if (args.length > 0) program.error(`error: config dumps take no app arguments, got ${args.map((argument) => JSON.stringify(argument)).join(" ")}`);
+	if (options.dumpConfigSchema === true) return {
+		mode: "dump-config-schema",
+		profile,
+		fromDefaultProfile: options.fromDefaultProfile,
+		patches
+	};
 	const defaultOnly = options.dumpDefaultConfig === true;
 	if (defaultOnly && patches.length > 0) program.error("error: --dump-default-config prints the bundle layers and takes no --patch");
 	return {
@@ -88,13 +97,14 @@ function resolveBoot(program, profile, options, args) {
 * error.
 * @param argv - arguments after the Node binary and script.
 * @param version - version string printed by `--version`.
+* @param manageDesktopProfile - permit Desktop's installed carrier to manage its reserved profile's plugins.
 * @returns the resolved invocation.
 */
-function parseDshArgs(argv, version) {
+function parseDshArgs(argv, version, manageDesktopProfile = false) {
 	const first = argv[0];
 	let resolved;
 	const program = new Command();
-	program.name("dsh").version(version, "-V, --version", "output the version number").usage("[--profile] <name> [options] [app-args...]\n       dsh plugin --profile <name> <pnpm-args...>").description("dsh: boot a DeepSeek Harness profile — an ordered stack of plugin-bundle patch layers under your own overrides.").addHelpText("after", HELP_EXAMPLES).exitOverride().helpOption(false).helpCommand(false).allowUnknownOption().passThroughOptions().enablePositionalOptions().argument("[args...]", "arguments for the booted profile's app (see: dsh --profile <name> --help)").option("--profile <name>", "the profile under $DSH_HOME/profiles to boot", selectProfile).option("--from-default-profile <name>", "initialize a new custom profile from a shipped profile template").option("--patch <path>", "extra patch-list overlay applied after the profile layer (repeatable)", collect).option("--dump-config", "print the composed profile tree and exit").option("--dump-default-config", "print the profile tree without its user layer or --patch overlays and exit").action((args, options) => {
+	program.name("dsh").version(version, "-V, --version", "output the version number").usage("[--profile] <name> [options] [app-args...]\n       dsh plugin --profile <name> <pnpm-args...>").description("dsh: boot a DeepSeek Harness profile — an ordered stack of plugin-bundle patch layers under your own overrides.").addHelpText("after", HELP_EXAMPLES).exitOverride().helpOption(false).helpCommand(false).allowUnknownOption().passThroughOptions().enablePositionalOptions().argument("[args...]", "arguments for the booted profile's app (see: dsh --profile <name> --help)").option("--profile <name>", "the profile under $DSH_HOME/profiles to boot", selectProfile).option("--from-default-profile <name>", "replace a custom profile with a fresh copy of a shipped profile template").option("--patch <path>", "extra patch-list overlay applied after the profile layer (repeatable)", collect).option("--dump-config", "print the composed profile tree and exit").option("--dump-config-schema", "print JSON Schema for profile entries and patches without mounting").option("--dump-default-config", "print the profile tree without its user layer or --patch overlays and exit").action((args, options) => {
 		if (options.profile === void 0) {
 			if (args.some((argument) => argument === "-h" || argument === "--help")) program.help();
 			program.error("error: --profile <name> is required");
@@ -131,13 +141,13 @@ function parseDshArgs(argv, version) {
 	registerWebLog("web:log:tmp", true);
 	if (first === "plugin") {
 		const plugin = program.command("plugin").description("manage a profile's plugins by forwarding the remaining arguments to pnpm in the profile directory");
-		plugin.requiredOption("--profile <name>", "the profile whose plugins to manage (initialized on first use)", selectProfile).allowUnknownOption().argument("[args...]", "pnpm arguments, forwarded verbatim (add <pkg>, remove <pkg>, why <pkg>, ...)").action((args, options) => {
+		plugin.helpOption("-h, --help", "show this help").passThroughOptions().requiredOption("--profile <name>", "the profile whose plugins to manage (initialized on first use)", selectProfile).allowUnknownOption().argument("[args...]", "pnpm arguments, forwarded verbatim (add <pkg>, remove <pkg>, why <pkg>, ...)").action((args, options) => {
 			if (options.profile === "") program.error("error: --profile needs a name");
-			rejectElectronProfile(plugin, options.profile);
+			if (!manageDesktopProfile) rejectElectronProfile(plugin, options.profile);
 			if (args.length === 0) program.error("error: plugin needs pnpm arguments to forward (e.g. add <package>)");
 			resolved = {
 				mode: "plugin",
-				profile: options.profile,
+				profile: options.profile.toLowerCase() === "desktop" ? "desktop" : options.profile,
 				args
 			};
 		});
@@ -217,17 +227,15 @@ async function reportStartupFailure(error, context, write = writeStderr) {
 * @module @deepseek-ai/dsh/bin
 */
 /* v8 ignore file -- built-bin acceptance exercises this self-executing dispatch. */
-function readVersion() {
-	const manifest = JSON.parse(readFileSync(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8"));
-	return typeof manifest.version === "string" ? manifest.version : "0.0.0";
-}
 /**
 * Run the public dsh command-line interface.
+* @param options - Package runtime and Desktop profile access supplied by the installation.
 * @returns a promise that settles when the selected command mode finishes.
 */
-async function runCli() {
-	const version = readVersion();
-	const invocation = parseDshArgs(process.argv.slice(2), version);
+async function runCli(options = {}) {
+	const version = getDshRuntimeVersion();
+	const { manageDesktopProfile, ...profileOptions } = options;
+	const invocation = parseDshArgs(process.argv.slice(2), version, manageDesktopProfile);
 	switch (invocation.mode) {
 		case "profile": {
 			const { runProfile } = await import("./profile-boot.js");
@@ -237,7 +245,8 @@ async function runCli() {
 					profile: invocation.profile,
 					fromDefaultProfile: invocation.fromDefaultProfile,
 					patchFiles: invocation.patches,
-					args: invocation.args
+					args: invocation.args,
+					...profileOptions
 				});
 			} catch (error) {
 				if (!(error instanceof StartupError)) throw error;
@@ -251,12 +260,12 @@ async function runCli() {
 			break;
 		}
 		case "plugin": {
-			const { runPlugin } = await import("./plugin-DJ-rVHUS.js");
-			process.exit(await runPlugin(invocation.profile, invocation.args));
+			const { runPlugin } = await import("./plugin-BiveYA7h.js");
+			process.exit(await runPlugin(invocation.profile, invocation.args, options.packageManager));
 			break;
 		}
 		case "web-log": {
-			const { runWebLog } = await import("./web-log-DZLBFfre.js");
+			const { runWebLog } = await import("./web-log-DVrp_oFP.js");
 			runWebLog({
 				tmp: invocation.tmp,
 				patches: invocation.patches,
@@ -265,10 +274,15 @@ async function runCli() {
 			break;
 		}
 		case "dump-config": {
-			const { runDumpConfig } = await import("./dump-config-Bb5YvFIX.js");
+			const { runDumpConfig } = await import("./dump-config-CxNkSYcK.js");
 			runDumpConfig(invocation.profile, invocation.defaultOnly, invocation.patches, invocation.fromDefaultProfile);
 			break;
 		}
+		case "dump-config-schema": {
+			const { runDumpConfigSchema } = await import("./dump-config-schema-D_PxIzpe.js");
+			await runDumpConfigSchema(invocation.profile, invocation.patches, invocation.fromDefaultProfile);
+			break;
+		}
 		default: throw new Error(`dsh: unhandled invocation mode ${JSON.stringify(invocation)}`);
 	}
 }

package/lib/{dump-config-Bb5YvFIX.js → dump-config-CWs_HdOc.js}

@@ -1,7 +1,7 @@
-import { a as prepareProfile, n as PROFILE_ROOT_FILENAME, r as homePatchPath } from "./profile-boot-BNu17Y9U.js";
-import { existsSync } from "node:fs";
+import { a as prepareProfile, n as PROFILE_ROOT_FILENAME, r as homePatchPath } from "./profile-boot-C14i-8IN.js";
 import { loadOptionalPatches, loadOverlayPatches, renderConfigDump } from "@deepseek-ai/dsh-app-boot";
 import { join, resolve } from "node:path";
+import { existsSync } from "node:fs";
 //#region lib/types/dump-config.js
 /**
 * Config-dump entry for `dsh --profile <name> --dump-config`: compose the
@@ -19,10 +19,21 @@ const NAME = "dsh";
 * (the recovery diagnostic for a broken `cordis.patch.yml`, which is then
 * never parsed).
 * @param patches - `--patch` overlay paths, in argv order.
-* @param fromDefaultProfile - shipped template used once to initialize a missing profile.
+* @param fromDefaultProfile - shipped template that replaces the profile before loading it.
 */
 function runDumpConfig(profile, defaultOnly, patches, fromDefaultProfile) {
 	const loaded = prepareProfile(profile, !defaultOnly, fromDefaultProfile);
+	const layers = collectConfigDumpLayers(loaded, defaultOnly, patches);
+	process.stdout.write(renderConfigDump(NAME, join(loaded.dir, PROFILE_ROOT_FILENAME), layers));
+}
+/**
+* Read dump layers in bundle, profile, home, then argv order without composing them.
+* @param loaded - prepared profile and parsed bundle and profile patches.
+* @param defaultOnly - omit profile, home, and argv layers without reading their files.
+* @param patches - overlay paths relative to the invoking directory, in argv order.
+* @returns the labeled layers shared by YAML and schema dumps.
+*/
+function collectConfigDumpLayers(loaded, defaultOnly, patches) {
 	const layers = loaded.layers.map((layer) => ({
 		label: layer.packageName,
 		patches: layer.patches
@@ -46,8 +57,8 @@ function runDumpConfig(profile, defaultOnly, patches, fromDefaultProfile) {
 			});
 		}
 	}
-	process.stdout.write(renderConfigDump(NAME, join(loaded.dir, PROFILE_ROOT_FILENAME), layers));
+	return layers;
 }
 /* v8 ignore stop */
 //#endregion
-export { runDumpConfig };
+export { runDumpConfig as n, collectConfigDumpLayers as t };

package/lib/dump-config-CxNkSYcK.js

@@ -0,0 +1,2 @@
+import { n as runDumpConfig } from "./dump-config-CWs_HdOc.js";
+export { runDumpConfig };

package/lib/dump-config-schema-D_PxIzpe.js

@@ -0,0 +1,41 @@
+import { a as prepareProfile, t as INSTALL_ANCHOR } from "./profile-boot-C14i-8IN.js";
+import { t as collectConfigDumpLayers } from "./dump-config-CWs_HdOc.js";
+import { generateConfigSchema } from "@deepseek-ai/dsh-app-boot";
+//#region lib/types/dump-config-schema.js
+/**
+* Schema-dump entry: inspect the composed profile without applying its plugins.
+* Imports and lazy schema builders execute trusted module code.
+* @module @deepseek-ai/dsh/dump-config-schema
+*/
+/* v8 ignore file -- built-bin acceptance drives schema collection and output. */
+const NAME = "dsh";
+/**
+* Print one JSON Schema document; incomplete collection or projection sets exitCode to 1.
+* Profile initialization writes match the YAML dump. Plugin imports may execute
+* top-level code, but collection never applies plugins or evaluates `!!js`.
+* During schema generation, ordinary stdout writes are redirected to stderr.
+* @param profile - the profile name.
+* @param patches - overlay paths, in argv order.
+* @param fromDefaultProfile - shipped template that replaces the profile before loading it.
+* @returns after collection and output, with diagnostics also written to stderr.
+*/
+async function runDumpConfigSchema(profile, patches, fromDefaultProfile) {
+	const loaded = prepareProfile(profile, true, fromDefaultProfile);
+	const layers = collectConfigDumpLayers(loaded, false, patches);
+	const stdoutWrite = process.stdout.write;
+	let dump;
+	process.stdout.write = process.stderr.write.bind(process.stderr);
+	try {
+		dump = await generateConfigSchema(loaded, layers.map((layer) => layer.patches), INSTALL_ANCHOR);
+	} finally {
+		process.stdout.write = stdoutWrite;
+	}
+	process.stdout.write(`${JSON.stringify(dump, null, 2)}\n`);
+	for (const diagnostic of dump["x-cordis"].diagnostics) {
+		const location = diagnostic.path === void 0 ? "" : ` [${diagnostic.path}]`;
+		process.stderr.write(`${NAME}: ${diagnostic.level}:${location} ${diagnostic.message}\n`);
+	}
+	if (!dump["x-cordis"].complete) process.exitCode = 1;
+}
+//#endregion
+export { runDumpConfigSchema };

package/lib/plugin-BiveYA7h.js

@@ -0,0 +1,101 @@
+import { t as INSTALL_ANCHOR } from "./profile-boot-C14i-8IN.js";
+import { DEFAULT_PROFILE_BUNDLES, PROFILE_TEMPLATES, initProfile, readProfileCompatibility, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
+import { mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { runPluginCommand, runProfilePnpm, setProfileVersionExemption } from "@deepseek-ai/dsh-plugin-manager/operations";
+import { withFileLock } from "@deepseek-ai/dsh-atomic-write";
+//#region lib/types/plugin.js
+/** Profile package management and explicit, exact-version compatibility approvals. */
+function requireDesktopProfile(dir) {
+	if (!existsSync(join(dir, "package.json"))) throw new Error("Open DeepSeek Harness Desktop once to initialize its profile, then fully quit it before running dsh plugin --profile desktop.");
+}
+/** Parse only DSH-owned commands; all other arguments remain pnpm's responsibility. */
+async function versionCommand(profile, args) {
+	const [command, ...rest] = args;
+	if (command !== "allow-version" && command !== "revoke-version" && command !== "version-exemptions") return void 0;
+	try {
+		let packageVersion;
+		let runtimeVersion;
+		let acceptRisk = false;
+		const argumentsIterator = rest.values();
+		for (const argument of argumentsIterator) if (argument === "--accept-risk" && command === "allow-version" && !acceptRisk) acceptRisk = true;
+		else if (argument === "--dsh-version" && runtimeVersion === void 0) runtimeVersion = argumentsIterator.next().value;
+		else if (argument.startsWith("--dsh-version=") && runtimeVersion === void 0) runtimeVersion = argument.slice(14);
+		else if (!argument.startsWith("-") && packageVersion === void 0) packageVersion = argument;
+		else throw new Error(`unexpected argument ${JSON.stringify(argument)}`);
+		if (command === "version-exemptions" && rest.length > 0) throw new Error("usage: dsh plugin version-exemptions");
+		let request;
+		if (command !== "version-exemptions") {
+			if (packageVersion === void 0 || runtimeVersion === void 0) throw new Error(`usage: dsh plugin ${command} <package@version> --dsh-version <exact>${command === "allow-version" ? " --accept-risk" : ""}`);
+			request = {
+				packageVersion,
+				runtimeVersion
+			};
+		}
+		if (command === "allow-version") process.stderr.write("dsh: warning: allowing incompatible plugin versions can break the application or corrupt data. Approval applies only to the exact package and DSH versions.\n");
+		const dir = resolveProfileDir(profile);
+		if (profile !== "desktop") await mkdir(dir, { recursive: true });
+		await withFileLock(join(dir, "package.json"), async () => {
+			if (profile === "desktop") requireDesktopProfile(dir);
+			else if (!existsSync(join(dir, "package.json"))) initProfile(dir, PROFILE_TEMPLATES[profile]?.bundles ?? DEFAULT_PROFILE_BUNDLES);
+			if (request === void 0) {
+				const { exemptions, warnings } = readProfileCompatibility(dir);
+				for (const warning of warnings) process.stderr.write(`dsh: warning: ${warning}\n`);
+				process.stdout.write(JSON.stringify(exemptions, void 0, 2) + "\n");
+			} else {
+				await setProfileVersionExemption(dir, request.packageVersion, request.runtimeVersion, command === "allow-version", acceptRisk);
+				process.stdout.write(`dsh: ${command === "allow-version" ? "allowed" : "revoked"} ${request.packageVersion} for DSH ${request.runtimeVersion}\n`);
+			}
+		}, { waitMs: 12e4 });
+		return 0;
+	} catch (error) {
+		process.stderr.write(`dsh: ${String(error)}\n`);
+		return 1;
+	}
+}
+/** Run package management for a profile.
+* @param profile Profile name; Desktop's reserved profile must already be initialized by the application.
+* @param args DSH exemption command or pnpm arguments relative to the invoking directory.
+* @param packageManager Installation-owned executable and environment for pnpm operations.
+* @returns Zero on success; nonzero on invalid approval or package-manager failure.
+*/
+async function runPlugin(profile, args, packageManager) {
+	if (profile === "desktop") try {
+		requireDesktopProfile(resolveProfileDir(profile));
+	} catch (error) {
+		process.stderr.write(`dsh: ${String(error)}\n`);
+		return 1;
+	}
+	const versionResult = await versionCommand(profile, args);
+	if (versionResult !== void 0) return versionResult;
+	const dir = resolveProfileDir(profile);
+	if (existsSync(join(dir, "package.json"))) for (const warning of readProfileCompatibility(dir).warnings) process.stderr.write(`dsh: warning: ${warning}\n`);
+	const context = {
+		profile,
+		dir,
+		installAnchor: INSTALL_ANCHOR,
+		cwd: process.cwd()
+	};
+	const options = {
+		...packageManager,
+		execution: "cli",
+		outputBytes: 16384,
+		lockWaitMs: 12e4,
+		lookupTimeoutMs: 12e4,
+		onOutput: (text, stream) => {
+			process[stream].write(text);
+		}
+	};
+	const result = profile === "desktop" ? await withFileLock(join(dir, "package.json"), async () => {
+		requireDesktopProfile(dir);
+		return runProfilePnpm(context, args, options);
+	}, { waitMs: 12e4 }) : await runPluginCommand(context, args, options);
+	if (result.exitCode === 127) process.stderr.write("dsh: pnpm was not found; install pnpm and make it available on PATH.\n");
+	for (const { name, version, runtimeVersion } of result.incompatible ?? []) process.stderr.write(`dsh: to accept the risk, run: dsh plugin --profile ${profile} allow-version ${name}@${version} --dsh-version ${runtimeVersion} --accept-risk\n`);
+	if (result.exitCode !== 0) process.stderr.write(`dsh: plugin command failed; diagnostics: ${result.logPath}\n`);
+	if (result.exitCode !== 0 && args.some((argument) => /^git\+|^github:|\.git(?:#|$)/.test(argument))) process.stderr.write(`dsh: git-hosted plugins build on install via their prepare script, which pnpm blocks until allowed — add the exact key pnpm printed above under allowBuilds in ${join(resolveProfileDir(profile), "pnpm-workspace.yaml")}, then re-run\n`);
+	return result.exitCode;
+}
+//#endregion
+export { runPlugin };

package/lib/{profile-boot-BNu17Y9U.js → profile-boot-C14i-8IN.js}

@@ -1,8 +1,8 @@
-import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { PROFILE_PATCH_FILENAME, PROFILE_TEMPLATES, PluginPackages, boot, createProfileResolutionGeneration, healIsolatedProfileModuleFallback, healProfilesModuleFallback, initProfile, installFailLoud, loadOverlayPatches, loadProfile, readProfilePatches, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
+import { PROFILE_PATCH_FILENAME, PROFILE_TEMPLATES, PluginPackages, boot, createRuntimeResolution, initProfile, installFailLoud, loadOverlayPatches, loadProfile, readProfilePatches, reportSkippedBundles, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { dirname, join, resolve } from "node:path";
+import { existsSync, mkdirSync, mkdtempSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { installProxyFromEnvironment } from "@deepseek-ai/dsh-http-proxy";
 import { DSH_LAUNCH_ENVIRONMENT_KEY } from "@deepseek-ai/dsh-launch-environment";
 import { provideCmdline } from "@deepseek-ai/dsh-cmdline";
@@ -126,15 +126,22 @@ const PROFILE_ROOT_CONFIG = `# dsh profile root — an empty entry list. The tre
 /** Root config filename inside a profile directory. */
 const PROFILE_ROOT_FILENAME = "cordis.yml";
 /**
-* Initialize a missing profile from one shipped template. This copies only
-* the template's bundle list; local state from the
+* Replace the named custom profile with a fresh copy of one shipped template.
+* This copies only the template's bundle list; local state from the
 * same-named shipped profile is not read, and no inheritance metadata is
-* persisted. Shipped profile names are reserved, and the target directory is
-* claimed exclusively so existing or concurrent state is never reused.
-* @param name - the new profile name.
+* persisted. The new profile is assembled in a `.<name>.staging-*` directory
+* under the profiles directory and moved into place; only then is any previous
+* target directory, including its dependencies and user patch, deleted. A
+* failed move restores the previous directory; when restoring also fails, it
+* stays in the staging directory. Shipped profile names, compared without
+* case, are reserved. Concurrent replacements leave one complete copy; each
+* one either succeeds or reports the concurrent recreation.
+* @param name - the profile name to create or replace.
 * @param fromDefaultProfile - shipped profile template to copy.
 * @param home - Harness home containing the profile directory.
-* @throws when the template is unknown, the target name is shipped, or the target directory exists.
+* @throws when the template is unknown, the target name is shipped, another process recreates the target
+*   between the two renames, or a file-system operation fails; a restore failure is an `AggregateError`
+*   that names the staging path holding the previous profile.
 */
 function initializeProfileFromDefault(name, fromDefaultProfile, home = resolveDshHome()) {
 	const dir = resolveProfileDir(name, home);
@@ -143,28 +150,52 @@ function initializeProfileFromDefault(name, fromDefaultProfile, home = resolveDs
 		const expected = Object.keys(PROFILE_TEMPLATES).sort().map((value) => JSON.stringify(value)).join(", ");
 		throw new Error(`${NAME}: unknown default profile ${JSON.stringify(fromDefaultProfile)}; expected one of ${expected}`);
 	}
-	if (Object.hasOwn(PROFILE_TEMPLATES, name)) throw new Error(`${NAME}: profile ${JSON.stringify(name)} is shipped and cannot be a custom profile target; omit --from-default-profile to use it`);
+	const shipped = Object.keys(PROFILE_TEMPLATES).find((shippedName) => shippedName.toLowerCase() === name.toLowerCase());
+	if (shipped !== void 0) throw new Error(`${NAME}: profile ${JSON.stringify(name)} names shipped profile ${JSON.stringify(shipped)} and cannot be a custom profile target; omit --from-default-profile to use it`);
 	mkdirSync(dirname(dir), { recursive: true });
+	const staging = mkdtempSync(join(dirname(dir), `.${name}.staging-`));
+	const previous = join(staging, "previous");
 	try {
-		mkdirSync(dir);
+		const fresh = join(staging, "new", name);
+		initProfile(fresh, template.bundles);
+		let moved = false;
+		try {
+			renameSync(dir, previous);
+			moved = true;
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		try {
+			renameSync(fresh, dir);
+		} catch (error) {
+			if (existsSync(dir)) {
+				rmSync(previous, {
+					recursive: true,
+					force: true
+				});
+				throw new Error(`${NAME}: profile ${JSON.stringify(name)} was recreated concurrently at ${dir}`, { cause: error });
+			}
+			if (moved) try {
+				renameSync(previous, dir);
+			} catch (restoreError) {
+				throw new AggregateError([error, restoreError], `${NAME}: profile replacement failed and ${dir} could not be restored from ${previous}`);
+			}
+			throw error;
+		}
 	} catch (error) {
-		if (error.code !== "EEXIST") throw error;
-		const manifestPath = join(dir, "package.json");
-		if (existsSync(manifestPath)) throw new Error(`${NAME}: profile ${JSON.stringify(name)} already exists at ${manifestPath}; omit --from-default-profile to use it`);
-		throw new Error(`${NAME}: profile directory ${dir} already exists; choose an unused profile name`);
+		if (!existsSync(previous)) rmSync(staging, {
+			recursive: true,
+			force: true
+		});
+		throw error;
 	}
 	try {
-		initProfile(dir, template.bundles);
+		rmSync(staging, {
+			recursive: true,
+			force: true
+		});
 	} catch (error) {
-		try {
-			rmSync(dir, {
-				recursive: true,
-				force: true
-			});
-		} catch (cleanupError) {
-			throw new AggregateError([error, cleanupError], `${NAME}: profile initialization failed and ${dir} could not be removed`);
-		}
-		throw error;
+		process.stderr.write(`${NAME}: replaced profile ${JSON.stringify(name)} but could not remove ${staging}: ${String(error)}\n`);
 	}
 }
 /**
@@ -178,13 +209,14 @@ function initializeProfileFromDefault(name, fromDefaultProfile, home = resolveDs
 * the identical base).
 * @param name - the profile name.
 * @param userLayer - `false` skips parsing `cordis.patch.yml` (the default dump).
-* @param fromDefaultProfile - shipped template used once to initialize a missing profile.
+* @param fromDefaultProfile - shipped template that replaces the profile before loading it.
 * @returns the loaded profile.
-* @throws when explicit initialization names an unknown template or an existing profile.
+* @throws when explicit initialization names an unknown template or a shipped target.
 */
 function prepareProfile(name, userLayer = true, fromDefaultProfile) {
 	if (fromDefaultProfile !== void 0) initializeProfileFromDefault(name, fromDefaultProfile);
 	const profile = loadProfile(NAME, name, INSTALL_ANCHOR, void 0, { userLayer });
+	reportSkippedBundles(NAME, profile);
 	writeFileSync(join(profile.dir, PROFILE_ROOT_FILENAME), PROFILE_ROOT_CONFIG);
 	return profile;
 }
@@ -197,22 +229,19 @@ function prepareProfile(name, userLayer = true, fromDefaultProfile) {
 * then the telemetry switch.
 * @param name - the profile name.
 * @param patchFiles - `--patch` overlay paths, in argv order.
-* @param resolutionMode - runtime lookup, disk links, or dual verification of both.
-* @param fromDefaultProfile - shipped template for a missing named profile.
+* @param fromDefaultProfile - shipped template that replaces the named profile.
 * @param resolvedProfile - application-owned profile and installation.
 * @returns the profile and its patch layers.
 */
-async function composeProfile(name, patchFiles, resolutionMode, fromDefaultProfile, resolvedProfile) {
+async function composeProfile(name, patchFiles, fromDefaultProfile, resolvedProfile) {
 	const profile = resolvedProfile?.profile ?? prepareProfile(name, true, fromDefaultProfile);
 	if (resolvedProfile !== void 0) writeFileSync(join(profile.dir, PROFILE_ROOT_FILENAME), PROFILE_ROOT_CONFIG);
-	const resolutionOptions = {
-		installAnchor: resolvedProfile?.installAnchor ?? INSTALL_ANCHOR,
-		profile
-	};
-	if (resolvedProfile !== void 0 && resolutionMode !== "runtime") healIsolatedProfileModuleFallback(resolvedProfile);
 	return {
 		profile,
-		resolution: resolutionMode === "runtime" || resolvedProfile !== void 0 ? await createProfileResolutionGeneration(resolutionOptions) : await healProfilesModuleFallback(resolutionOptions),
+		resolution: await createRuntimeResolution({
+			installAnchor: resolvedProfile?.installAnchor ?? INSTALL_ANCHOR,
+			profile
+		}),
 		overlays: patchFiles.flatMap((file) => loadOverlayPatches(NAME, resolve(file)))
 	};
 }
@@ -227,7 +256,6 @@ async function runProfile(options) {
 	const disposeProxy = await installProxyFromEnvironment(options.environment, (message) => {
 		process.stderr.write(`${NAME}: ${message}\n`);
 	});
-	const resolutionMode = process.pkg !== void 0 ? "runtime" : options.resolutionMode ?? "runtime";
 	const app = {};
 	let disposal;
 	const dispose = () => disposal ??= (async () => {
@@ -241,7 +269,7 @@ async function runProfile(options) {
 		if (failures.length > 1) throw new AggregateError(failures, "dsh: profile cleanup failed");
 	})();
 	try {
-		const composed = await composeProfile(options.profile, options.patchFiles, resolutionMode, options.fromDefaultProfile, options.resolvedProfile);
+		const composed = await composeProfile(options.profile, options.patchFiles, options.fromDefaultProfile, options.resolvedProfile);
 		const appReady = createAppReady();
 		const shutdown = createProcessShutdown(dispose);
 		const signalShutdown = new AbortController();
@@ -275,10 +303,7 @@ async function runProfile(options) {
 			app.current = hostCtx;
 			hostCtx.provide("profileContext", profileContext);
 			hostCtx.provide(DSH_LAUNCH_ENVIRONMENT_KEY, options.environment);
-			await hostCtx.plugin(PluginPackages, resolutionMode === "link" ? {} : {
-				generation: composed.resolution,
-				behavior: resolutionMode === "dual" ? "verify" : "enforce"
-			});
+			await hostCtx.plugin(PluginPackages, { resolution: composed.resolution });
 			provideCmdline(hostCtx, {
 				args: options.args,
 				exit: (code) => void shutdown.shutdown(code),

package/lib/profile-boot.js

@@ -1,2 +1,2 @@
-import { a as prepareProfile, i as initializeProfileFromDefault, n as PROFILE_ROOT_FILENAME, o as runProfile, r as homePatchPath, t as INSTALL_ANCHOR } from "./profile-boot-BNu17Y9U.js";
+import { a as prepareProfile, i as initializeProfileFromDefault, n as PROFILE_ROOT_FILENAME, o as runProfile, r as homePatchPath, t as INSTALL_ANCHOR } from "./profile-boot-C14i-8IN.js";
 export { INSTALL_ANCHOR, PROFILE_ROOT_FILENAME, homePatchPath, initializeProfileFromDefault, prepareProfile, runProfile };

package/lib/types/args.d.ts

@@ -19,7 +19,7 @@
 interface ProfileInvocation {
     mode: 'profile';
     profile: string;
-    /** Shipped template used once to initialize a missing profile. */
+    /** Shipped template that replaces the named profile. */
     fromDefaultProfile?: string | undefined;
     /** Extra patch-list overlays applied after the profile's own layer, in argv order. */
     patches: string[];
@@ -30,12 +30,20 @@ interface ProfileInvocation {
 interface DumpConfigInvocation {
     mode: 'dump-config';
     profile: string;
-    /** Shipped template used once to initialize a missing profile. */
+    /** Shipped template that replaces the named profile. */
     fromDefaultProfile?: string | undefined;
     /** Omit the profile's user layer and --patch overlays; print bundle layers only. */
     defaultOnly: boolean;
     patches: string[];
 }
+/** Print declared plugin schemas without mounting the profile. */
+interface DumpConfigSchemaInvocation {
+    mode: 'dump-config-schema';
+    profile: string;
+    /** Shipped template that replaces the named profile. */
+    fromDefaultProfile?: string | undefined;
+    patches: string[];
+}
 /** Manage a profile's plugins: forward `args` to pnpm inside the profile directory. */
 interface PluginInvocation {
     mode: 'plugin';
@@ -53,14 +61,15 @@ interface WebLogInvocation {
     args: string[];
 }
 /** The resolved `dsh` invocation. Help, version, and errors exit inside {@link parseDshArgs}. */
-export type DshInvocation = ProfileInvocation | DumpConfigInvocation | PluginInvocation | WebLogInvocation;
+export type DshInvocation = ProfileInvocation | DumpConfigInvocation | DumpConfigSchemaInvocation | PluginInvocation | WebLogInvocation;
 /**
  * Resolve argv into one invocation, or print and exit for help, version, or an
  * error.
  * @param argv - arguments after the Node binary and script.
  * @param version - version string printed by `--version`.
+ * @param manageDesktopProfile - permit Desktop's installed carrier to manage its reserved profile's plugins.
  * @returns the resolved invocation.
  */
-export declare function parseDshArgs(argv: readonly string[], version: string): DshInvocation;
+export declare function parseDshArgs(argv: readonly string[], version: string, manageDesktopProfile?: boolean): DshInvocation;
 export {};
 //# sourceMappingURL=args.d.ts.map

package/lib/types/bin.d.ts

@@ -3,9 +3,16 @@
  * Command-line entry for dsh.
  * @module @deepseek-ai/dsh/bin
  */
+import type { RunProfileOptions } from './profile-boot.ts';
+/** Installation-owned dependencies supplied by a packaged CLI launcher. */
+export type RunCliOptions = Pick<RunProfileOptions, 'packageManager'> & {
+    /** Permit plugin commands for Desktop's existing profile; reserved for its installed carrier. */
+    manageDesktopProfile?: boolean;
+};
 /**
  * Run the public dsh command-line interface.
+ * @param options - Package runtime and Desktop profile access supplied by the installation.
  * @returns a promise that settles when the selected command mode finishes.
  */
-export declare function runCli(): Promise<void>;
+export declare function runCli(options?: RunCliOptions): Promise<void>;
 //# sourceMappingURL=bin.d.ts.map

package/lib/types/dump-config-schema.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Schema-dump entry: inspect the composed profile without applying its plugins.
+ * Imports and lazy schema builders execute trusted module code.
+ * @module @deepseek-ai/dsh/dump-config-schema
+ */
+/**
+ * Print one JSON Schema document; incomplete collection or projection sets exitCode to 1.
+ * Profile initialization writes match the YAML dump. Plugin imports may execute
+ * top-level code, but collection never applies plugins or evaluates `!!js`.
+ * During schema generation, ordinary stdout writes are redirected to stderr.
+ * @param profile - the profile name.
+ * @param patches - overlay paths, in argv order.
+ * @param fromDefaultProfile - shipped template that replaces the profile before loading it.
+ * @returns after collection and output, with diagnostics also written to stderr.
+ */
+export declare function runDumpConfigSchema(profile: string, patches: readonly string[], fromDefaultProfile?: string): Promise<void>;
+//# sourceMappingURL=dump-config-schema.d.ts.map

package/lib/types/dump-config.d.ts

@@ -5,6 +5,7 @@
  * profile's own patch file, and each `--patch` overlay.
  * @module @deepseek-ai/dsh/dump-config
  */
+import { type ConfigDumpLayer, type Profile } from '@deepseek-ai/dsh-app-boot';
 /**
  * Print a profile composition with comments naming each source file and patch layer.
  * @param profile - the profile name.
@@ -12,7 +13,15 @@
  * (the recovery diagnostic for a broken `cordis.patch.yml`, which is then
  * never parsed).
  * @param patches - `--patch` overlay paths, in argv order.
- * @param fromDefaultProfile - shipped template used once to initialize a missing profile.
+ * @param fromDefaultProfile - shipped template that replaces the profile before loading it.
  */
 export declare function runDumpConfig(profile: string, defaultOnly: boolean, patches: readonly string[], fromDefaultProfile?: string): void;
+/**
+ * Read dump layers in bundle, profile, home, then argv order without composing them.
+ * @param loaded - prepared profile and parsed bundle and profile patches.
+ * @param defaultOnly - omit profile, home, and argv layers without reading their files.
+ * @param patches - overlay paths relative to the invoking directory, in argv order.
+ * @returns the labeled layers shared by YAML and schema dumps.
+ */
+export declare function collectConfigDumpLayers(loaded: Profile, defaultOnly: boolean, patches: readonly string[]): ConfigDumpLayer[];
 //# sourceMappingURL=dump-config.d.ts.map

package/lib/types/plugin.d.ts

@@ -1,7 +1,9 @@
+import { type ProfileContext } from '@deepseek-ai/dsh-app-boot';
 /** Run package management for a profile.
- * @param profile Profile name.
- * @param args Pnpm arguments relative to the invoking directory.
- * @returns Pnpm exit code.
+ * @param profile Profile name; Desktop's reserved profile must already be initialized by the application.
+ * @param args DSH exemption command or pnpm arguments relative to the invoking directory.
+ * @param packageManager Installation-owned executable and environment for pnpm operations.
+ * @returns Zero on success; nonzero on invalid approval or package-manager failure.
  */
-export declare function runPlugin(profile: string, args: readonly string[]): Promise<number>;
+export declare function runPlugin(profile: string, args: readonly string[], packageManager?: ProfileContext['packageManager']): Promise<number>;
 //# sourceMappingURL=plugin.d.ts.map

package/lib/types/profile-boot.d.ts

@@ -10,7 +10,7 @@
  * @module @deepseek-ai/dsh/profile-boot
  */
 import { type Context } from '@deepseek-ai/cordis';
-import { type ProfileContext, type Profile, type ProfileResolutionMode } from '@deepseek-ai/dsh-app-boot';
+import { type ProfileContext, type Profile } from '@deepseek-ai/dsh-app-boot';
 import { type LaunchEnvironmentSnapshot } from '@deepseek-ai/dsh-launch-environment';
 import { type ProcessShutdown } from './process-shutdown.ts';
 /**
@@ -25,15 +25,22 @@ export declare const INSTALL_ANCHOR: string;
 /** Root config filename inside a profile directory. */
 export declare const PROFILE_ROOT_FILENAME = "cordis.yml";
 /**
- * Initialize a missing profile from one shipped template. This copies only
- * the template's bundle list; local state from the
+ * Replace the named custom profile with a fresh copy of one shipped template.
+ * This copies only the template's bundle list; local state from the
  * same-named shipped profile is not read, and no inheritance metadata is
- * persisted. Shipped profile names are reserved, and the target directory is
- * claimed exclusively so existing or concurrent state is never reused.
- * @param name - the new profile name.
+ * persisted. The new profile is assembled in a `.<name>.staging-*` directory
+ * under the profiles directory and moved into place; only then is any previous
+ * target directory, including its dependencies and user patch, deleted. A
+ * failed move restores the previous directory; when restoring also fails, it
+ * stays in the staging directory. Shipped profile names, compared without
+ * case, are reserved. Concurrent replacements leave one complete copy; each
+ * one either succeeds or reports the concurrent recreation.
+ * @param name - the profile name to create or replace.
  * @param fromDefaultProfile - shipped profile template to copy.
  * @param home - Harness home containing the profile directory.
- * @throws when the template is unknown, the target name is shipped, or the target directory exists.
+ * @throws when the template is unknown, the target name is shipped, another process recreates the target
+ *   between the two renames, or a file-system operation fails; a restore failure is an `AggregateError`
+ *   that names the staging path holding the previous profile.
  */
 export declare function initializeProfileFromDefault(name: string, fromDefaultProfile: string, home?: string): void;
 /**
@@ -47,9 +54,9 @@ export declare function initializeProfileFromDefault(name: string, fromDefaultPr
  * the identical base).
  * @param name - the profile name.
  * @param userLayer - `false` skips parsing `cordis.patch.yml` (the default dump).
- * @param fromDefaultProfile - shipped template used once to initialize a missing profile.
+ * @param fromDefaultProfile - shipped template that replaces the profile before loading it.
  * @returns the loaded profile.
- * @throws when explicit initialization names an unknown template or an existing profile.
+ * @throws when explicit initialization names an unknown template or a shipped target.
  */
 export declare function prepareProfile(name: string, userLayer?: boolean, fromDefaultProfile?: string): Profile;
 /** An application-owned profile and its independent installation fallback. */
@@ -67,7 +74,7 @@ export interface RunProfileOptions {
     profile: string;
     /** Loaded application profile; bypasses named profile initialization when supplied. */
     resolvedProfile?: ResolvedProfileRuntime | undefined;
-    /** Shipped template used once to initialize a missing profile. */
+    /** Shipped template that replaces the named profile before boot. */
     fromDefaultProfile?: string | undefined;
     /** `--patch` overlay paths, in argv order. */
     patchFiles: readonly string[];
@@ -75,8 +82,6 @@ export interface RunProfileOptions {
     args: readonly string[];
     /** Application-owned package runtime, scoped to plugin package operations. */
     packageManager?: ProfileContext['packageManager'];
-    /** Module fallback backend; defaults to runtime. Plain Node callers may override it; pkg executables always use runtime. */
-    resolutionMode?: ProfileResolutionMode;
 }
 /**
  * Boot one profile invocation end to end and leave process lifetime to the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@crazx/dsh",
   "description": "dsh CLI: profile launch, plugin management, and configuration inspection",
-  "version": "0.1.6-alpha.2.zw.2",
+  "version": "0.2.1-rc.2.zw.2",
   "publishConfig": {
     "access": "public"
   },
@@ -18,140 +18,149 @@
     "lib/*.js",
     "lib/types/*.d.ts"
   ],
-  "dsh": {
-    "configTrees": [
-      {
-        "mount": "config/agent-presets",
-        "path": "../../packages/preset/agent-presets/presets",
-        "scanRoster": true
-      }
-    ]
-  },
   "license": "MIT",
   "dependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-hmr": "^0.1.6-alpha.2",
-    "@deepseek-ai/cordis-plugin-include": "^1.0.7",
-    "@deepseek-ai/cordis-plugin-loader": "^1.0.3",
-    "@deepseek-ai/cordis-plugin-timer": "^1.1.4",
-    "@deepseek-ai/dsh-acp-app": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-agent-instructions": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-agent-tool-presentation": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-app-boot": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-base": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-client-ui-agent-preset": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-client-ui-cordis": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-cmdline": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-command-compact": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-command-goal": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-compaction-basic": "npm:@crazx/dsh-compaction-basic@0.1.6-alpha.2.zw.2",
-    "@deepseek-ai/dsh-compaction-tool-result-pruner": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-cordis-client-runner": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-experimental-agent-team-profile": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-experimental-agent-team-web-profile": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-fs-local": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-goal": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-goal-round-driver": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-headless": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-home-paths": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-hooks-claude-code": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-hooks-codex": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-jobs-local": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-launch-environment": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-mcp-client": "npm:@crazx/dsh-mcp-client@0.1.6-alpha.2.zw.2",
-    "@deepseek-ai/dsh-persona": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-plan-mode": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-pwsh-local": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-pwsh-sandbox": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-schedule": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-sdk-app": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-sdk-minimal": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session-projection": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session-reference": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-skill": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-skill-filesystem": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-terminal": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-terminal-bash": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-time-context": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tmux-context": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-token-meter": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-ask-user": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-bash": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-bash-persistent": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-cordis": "npm:@crazx/dsh-tool-cordis@0.1.6-alpha.2.zw.2",
-    "@deepseek-ai/dsh-tool-present": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-fs": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-fs-search": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-goal": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-jobs": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-pwsh": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-pwsh-persistent": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-ralph": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-skill": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-str-replace-editor": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-subagent": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-subagent-control": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-todo": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-web": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tool-workflow": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-web-app": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-webhook": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-webhook-github": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-workflow-ptc": "^0.1.6-alpha.2",
-    "@deepseek-ai/schemastery": "^3.18.2",
+    "@deepseek-ai/cordis": "~4.0.5",
+    "@deepseek-ai/dsh-hmr": "0.2.1-rc.2",
+    "@deepseek-ai/cordis-plugin-include": "~1.0.10",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.6",
+    "@deepseek-ai/cordis-plugin-timer": "~1.1.7",
+    "@deepseek-ai/dsh-acp-app": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent-instructions": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent-tool-presentation": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-app-boot": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-base": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-agent-preset": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-cordis": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-cmdline": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-command-compact": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-command-goal": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-compaction-basic": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-compaction-tool-result-pruner": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-cordis-client-runner": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-agent-team-profile": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-inspector-profile": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-goal": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-goal-round-driver": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-headless": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-home-paths": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-jobs-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-mcp-client": "npm:@crazx/dsh-mcp-client@0.2.1-rc.2.zw.2",
+    "@deepseek-ai/dsh-persona": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-plan-mode": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-pwsh-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-pwsh-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-schedule": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sdk-app": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sdk-minimal": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session-reference": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-skill": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-skill-filesystem": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-skill-office": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-workspace-dependencies": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-terminal": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-terminal-bash": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-time-context": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tmux-context": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-token-meter": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-ask-user": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-bash": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-bash-persistent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-cordis": "npm:@crazx/dsh-tool-cordis@0.2.1-rc.2.zw.2",
+    "@deepseek-ai/dsh-tool-present": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-fs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-fs-search": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-goal": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-jobs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-pwsh": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-pwsh-persistent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-schedule": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-skill": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-str-replace-editor": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-subagent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-subagent-control": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-todo": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-web": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-workflow": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-web-app": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-workflow-ptc": "0.2.1-rc.2",
+    "@deepseek-ai/schemastery": "~3.18.5",
     "commander": "^15.0.0",
-    "js-yaml": "^4.2.0",
-    "node-addon-require-builtin": "^0.1.6",
-    "@deepseek-ai/dsh-http-proxy": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-mcp-resources": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-plugin-manager": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-atomic-write": "^0.1.6-alpha.2"
+    "js-yaml": "^4.3.2",
+    "node-addon-require-builtin": "^0.1.9",
+    "@deepseek-ai/dsh-http-proxy": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-mcp-resources": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-plugin-manager": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-atomic-write": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent-preset": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-voice-input-bundle": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-auto-review": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-cot-translation-bundle": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-badge-skill-bundle": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-ralph-bundle": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-session-titles-bundle": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-terminal-bundle": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-session-search": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-tool-worktree": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-plugin-market-bundle": "0.2.1-rc.2"
   },
   "devDependencies": {
+    "@deepseek-ai/dsh-skill-badge": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-webhook-github": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-webhook": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-ralph": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-hooks-codex": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-hooks-claude-code": "0.2.1-rc.2",
     "@agentclientprotocol/sdk": "1.4.0",
-    "@deepseek-ai/dsh-acp": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-agent": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-agent-loop": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-agent-loop-testkit": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-attachment-local": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-bash-local": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-credentials-local": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-deepseek-llm-api-extensions": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-experimental-agent-team": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-experimental-ptc-runtime-python": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-experimental-tool-agent-team": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-fs-observation-policy": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-fs-sandbox": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-host-frontend-static": "npm:@crazx/dsh-host-frontend-static@0.1.6-alpha.2.zw.2",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-llm": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-llm-deepseek": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-llm-mock-server": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-llm-pi-ai": "npm:@crazx/dsh-llm-pi-ai@0.1.6-alpha.2.zw.2",
-    "@deepseek-ai/dsh-llm-replay": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-loader-smoke": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-plugin-package-inventory-deepseek": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-sandbox-local": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session-checkpoint-policy": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session-log-deepseek": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session-persistence-jsonl": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session-query": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-shell-env": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-settings": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-settings-file": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-subagent": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-subagent-fork-in-process": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-subagent-spawn-in-process": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-subprocess-local": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-tools": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-user-approval": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-acp": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent-loop": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent-loop-testkit": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-attachment-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-bash-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-credentials-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-deepseek-llm-api-extensions": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-agent-team": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-ptc-runtime-python": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-experimental-tool-agent-team": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-observation-policy": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-frontend-static": "npm:@crazx/dsh-host-frontend-static@0.2.1-rc.2.zw.2",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek-api-key": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek-account": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm-mock-server": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "npm:@crazx/dsh-llm-pi-ai@0.2.1-rc.2.zw.2",
+    "@deepseek-ai/dsh-llm-replay": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-loader-smoke": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-plugin-package-inventory-deepseek": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sdk-client": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session-checkpoint-policy": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session-log-deepseek": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session-query": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-shell-env": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-settings": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subagent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subagent-fork-in-process": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subagent-spawn-in-process": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subprocess-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-rc.2",
     "@types/js-yaml": "^4.0.9",
     "@types/ws": "8.18.1",
-    "execa": "^10.0.0",
-    "ws": "8.21.0"
+    "ajv": "^8.20.0",
+    "execa": "^10.0.1",
+    "ws": "8.21.3"
   },
   "exports": {
     "./profile-boot": {

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 DeepSeek
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/lib/plugin-DJ-rVHUS.js

@@ -1,31 +0,0 @@
-import { t as INSTALL_ANCHOR } from "./profile-boot-BNu17Y9U.js";
-import { resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
-import { join } from "node:path";
-import { runPluginCommand } from "@deepseek-ai/dsh-plugin-manager/operations";
-//#region lib/types/plugin.js
-/** dsh plugin forwards pnpm through the shared profile package operations. */
-/** Run package management for a profile.
-* @param profile Profile name.
-* @param args Pnpm arguments relative to the invoking directory.
-* @returns Pnpm exit code.
-*/
-async function runPlugin(profile, args) {
-	const result = await runPluginCommand({
-		profile,
-		installAnchor: INSTALL_ANCHOR,
-		cwd: process.cwd()
-	}, args, {
-		execution: "cli",
-		outputBytes: 16384,
-		lockWaitMs: 12e4,
-		onOutput: (text, stream) => {
-			process[stream].write(text);
-		}
-	});
-	if (result.exitCode === 127) process.stderr.write("dsh: pnpm was not found; install pnpm and make it available on PATH.\n");
-	if (result.exitCode !== 0) process.stderr.write(`dsh: pnpm failed; diagnostics: ${result.logPath}\n`);
-	if (result.exitCode !== 0 && args.some((argument) => /^git\+|^github:|\.git(?:#|$)/.test(argument))) process.stderr.write(`dsh: git-hosted plugins build on install via their prepare script, which pnpm blocks until allowed — add the exact key pnpm printed above under allowBuilds in ${join(resolveProfileDir(profile), "pnpm-workspace.yaml")}, then re-run\n`);
-	return result.exitCode;
-}
-//#endregion
-export { runPlugin };

package/lib/{web-log-DZLBFfre.js → web-log-DVrp_oFP.js}

@@ -1,5 +1,5 @@
-import { createWriteStream, mkdirSync, rmSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
+import { createWriteStream, mkdirSync, rmSync, symlinkSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { homedir, tmpdir } from "node:os";
 //#region lib/types/web-log.js