@crazx/dsh 0.2.1-rc.2.zw.1 → 0.2.1-rc.2.zw.2

package/lib/bin.js

@@ -1,8 +1,11 @@
 #!/usr/bin/env node
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { loadLayeredEnv } from "@deepseek-ai/dsh-app-boot";
-import { Command, CommanderError } from "commander";
+import { StartupError, getDshRuntimeVersion, loadLayeredEnv } from "@deepseek-ai/dsh-app-boot";
+import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
+import { Command, CommanderError, InvalidArgumentError } from "commander";
+import { randomUUID } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { inspect } from "node:util";
 //#region lib/types/args.js
 /**
 * Commander adapter for the `dsh` command line.
@@ -16,9 +19,9 @@ import { Command, CommanderError } from "commander";
 * `dsh --profile tui --resume abc` boots the tui profile with `--resume abc`,
 * and `dsh --profile web -h` prints the web app's help, not this one's.
 *
-* `web` is a hardcoded alias for `--profile web`; `plugin` manages a profile's
-* plugin dependencies by forwarding to pnpm. The fork adds `web:log` /
-* `web:log:tmp`, which boot the web profile while teeing output to a log file.
+* `dsh <name>` abbreviates `dsh --profile <name>`; `plugin` manages a profile's
+* plugin dependencies by forwarding to pnpm.
+* The fork adds `web:log` / `web:log:tmp`, which boot the web profile while teeing output to a log file.
 * @module @deepseek-ai/dsh/args
 */
 /**
@@ -26,21 +29,30 @@ import { Command, CommanderError } from "commander";
 * variadic — a variadic `--patch` would swallow the inner arguments.
 */
 const collect = (value, previous = []) => [...previous, value];
+function selectProfile(value, previous) {
+	if (previous !== void 0) throw new InvalidArgumentError("select a profile only once");
+	return value;
+}
+function rejectElectronProfile(program, profile) {
+	if (profile.toLowerCase() === "desktop") program.error("error: profile \"desktop\" is managed exclusively by the Electron application");
+}
 /** The launcher's own help text; each app prints its own. */
 const HELP_EXAMPLES = `
 Examples:
-  dsh --profile web                          boot the web profile (same as: dsh web)
-  dsh --profile headless "run the tests"     answer one task, print the result, and exit
-  dsh --profile tui --patch ./extra.yml      boot a custom profile with one extra overlay
-  dsh --profile tui --resume <session>       arguments after the launcher flags reach the app
-  dsh --profile web --help                   the web app's own flags and help
-  dsh plugin --profile tui add <package>     install a plugin into the tui profile
+  dsh web                                   boot the web profile (same as: dsh --profile web)
+  dsh rescue --from-default-profile web
+                                            recreate rescue from the shipped web template, then boot it
+  dsh headless "run the tests"              answer one task, print the result, and exit
+  dsh tui --patch ./extra.yml               boot a custom profile with one extra overlay
+  dsh tui --resume <session>                arguments after the launcher flags reach the app
+  dsh web --help                            the web app's own flags and help
+  dsh plugin --profile tui add <package>    install a plugin into the tui profile
   dsh web:log --port 0                       boot web with output teed to a timestamped log file (fork-local)
 `;
 /**
 * Resolve a boot or dump invocation from the launcher flags and the leftover
 * inner arguments.
-* @param program - the command whose options were parsed (the root, or the `web` alias).
+* @param program - the command whose options were parsed.
 * @param profile - the profile these flags boot.
 * @param options - the launcher flags commander collected.
 * @param args - the leftover arguments, in argv order.
@@ -49,19 +61,33 @@ Examples:
 function resolveBoot(program, profile, options, args) {
 	const patches = options.patch ?? [];
 	if (patches.includes("")) program.error("error: --patch needs a path");
-	if (options.dumpConfig !== true && options.dumpDefaultConfig !== true) return {
+	if (options.fromDefaultProfile === "") program.error("error: --from-default-profile needs a name");
+	const dumps = [
+		options.dumpConfig,
+		options.dumpDefaultConfig,
+		options.dumpConfigSchema
+	].filter(Boolean);
+	if (dumps.length === 0) return {
 		mode: "profile",
 		profile,
+		fromDefaultProfile: options.fromDefaultProfile,
 		patches,
 		args
 	};
-	if (options.dumpConfig === true && options.dumpDefaultConfig === true) program.error("error: --dump-config and --dump-default-config are mutually exclusive");
+	if (dumps.length > 1) program.error("error: --dump-config, --dump-default-config, and --dump-config-schema are mutually exclusive");
 	if (args.length > 0) program.error(`error: config dumps take no app arguments, got ${args.map((argument) => JSON.stringify(argument)).join(" ")}`);
+	if (options.dumpConfigSchema === true) return {
+		mode: "dump-config-schema",
+		profile,
+		fromDefaultProfile: options.fromDefaultProfile,
+		patches
+	};
 	const defaultOnly = options.dumpDefaultConfig === true;
 	if (defaultOnly && patches.length > 0) program.error("error: --dump-default-config prints the bundle layers and takes no --patch");
 	return {
 		mode: "dump-config",
 		profile,
+		fromDefaultProfile: options.fromDefaultProfile,
 		defaultOnly,
 		patches
 	};
@@ -71,30 +97,28 @@ function resolveBoot(program, profile, options, args) {
 * error.
 * @param argv - arguments after the Node binary and script.
 * @param version - version string printed by `--version`.
+* @param manageDesktopProfile - permit Desktop's installed carrier to manage its reserved profile's plugins.
 * @returns the resolved invocation.
 */
-function parseDshArgs(argv, version) {
+function parseDshArgs(argv, version, manageDesktopProfile = false) {
+	const first = argv[0];
 	let resolved;
 	const program = new Command();
-	program.name("dsh").version(version, "-V, --version", "output the version number").description("dsh: boot a DeepSeek Harness profile — an ordered stack of plugin-bundle patch layers under your own overrides.").addHelpText("after", HELP_EXAMPLES).exitOverride().helpOption(false).allowUnknownOption().passThroughOptions().enablePositionalOptions().argument("[args...]", "arguments for the booted profile's app (see: dsh --profile <name> --help)").option("--profile <name>", "the profile under $DSH_HOME/profiles to boot").option("--patch <path>", "extra patch-list overlay applied after the profile layer (repeatable)", collect).option("--dump-config", "print the composed profile tree and exit").option("--dump-default-config", "print the profile tree without its user layer or --patch overlays and exit").action((args, options) => {
+	program.name("dsh").version(version, "-V, --version", "output the version number").usage("[--profile] <name> [options] [app-args...]\n       dsh plugin --profile <name> <pnpm-args...>").description("dsh: boot a DeepSeek Harness profile — an ordered stack of plugin-bundle patch layers under your own overrides.").addHelpText("after", HELP_EXAMPLES).exitOverride().helpOption(false).helpCommand(false).allowUnknownOption().passThroughOptions().enablePositionalOptions().argument("[args...]", "arguments for the booted profile's app (see: dsh --profile <name> --help)").option("--profile <name>", "the profile under $DSH_HOME/profiles to boot", selectProfile).option("--from-default-profile <name>", "replace a custom profile with a fresh copy of a shipped profile template").option("--patch <path>", "extra patch-list overlay applied after the profile layer (repeatable)", collect).option("--dump-config", "print the composed profile tree and exit").option("--dump-config-schema", "print JSON Schema for profile entries and patches without mounting").option("--dump-default-config", "print the profile tree without its user layer or --patch overlays and exit").action((args, options) => {
 		if (options.profile === void 0) {
 			if (args.some((argument) => argument === "-h" || argument === "--help")) program.help();
 			program.error("error: --profile <name> is required");
 		}
 		const profile = options.profile;
 		if (profile === "") program.error("error: --profile needs a name");
+		rejectElectronProfile(program, profile);
 		resolved = resolveBoot(program, profile, options, args);
 	});
 	/** Reject parent options supplied before a subcommand. */
 	const rejectParentOptions = (command) => {
 		const parent = program.opts();
-		if (parent.profile !== void 0 || parent.patch !== void 0 || parent.dumpConfig !== void 0 || parent.dumpDefaultConfig !== void 0) program.error(`error: ${command} takes none of parent --profile, --patch, --dump-config, or --dump-default-config`);
+		if (parent.profile !== void 0 || parent.patch !== void 0 || parent.dumpConfig !== void 0 || parent.dumpDefaultConfig !== void 0 || parent.fromDefaultProfile !== void 0) program.error(`error: ${command} takes none of parent --profile, --from-default-profile, --patch, --dump-config, or --dump-default-config`);
 	};
-	const web = program.command("web").description("boot the web profile (alias of --profile web); the web app's own flags follow");
-	web.helpOption(false).allowUnknownOption().passThroughOptions().enablePositionalOptions().argument("[args...]", "arguments for the web app (see: dsh web --help)").option("--patch <path>", "extra patch-list overlay applied after the profile layer (repeatable)", collect).option("--dump-config", "print the composed web-profile tree (with the user layer and any --patch) and exit").option("--dump-default-config", "print the web profile's bundle layers (no user layer) and exit").action((args, options) => {
-		rejectParentOptions("web");
-		resolved = resolveBoot(web, "web", options, args);
-	});
 	/**
 	* Fork-local logged web boots: `dsh web:log` tees the web app's output to a
 	* timestamped file under $DSH_HOME/logs, `dsh web:log:tmp` under the OS temp
@@ -115,18 +139,23 @@ function parseDshArgs(argv, version) {
 	};
 	registerWebLog("web:log", false);
 	registerWebLog("web:log:tmp", true);
-	program.command("plugin").description("manage a profile's plugins by forwarding the remaining arguments to pnpm in the profile directory").requiredOption("--profile <name>", "the profile whose plugins to manage (initialized on first use)").allowUnknownOption().argument("[args...]", "pnpm arguments, forwarded verbatim (add <pkg>, remove <pkg>, why <pkg>, ...)").action((args, options) => {
-		rejectParentOptions("plugin");
-		if (options.profile === "") program.error("error: --profile needs a name");
-		if (args.length === 0) program.error("error: plugin needs pnpm arguments to forward (e.g. add <package>)");
-		resolved = {
-			mode: "plugin",
-			profile: options.profile,
-			args
-		};
-	});
+	if (first === "plugin") {
+		const plugin = program.command("plugin").description("manage a profile's plugins by forwarding the remaining arguments to pnpm in the profile directory");
+		plugin.helpOption("-h, --help", "show this help").passThroughOptions().requiredOption("--profile <name>", "the profile whose plugins to manage (initialized on first use)", selectProfile).allowUnknownOption().argument("[args...]", "pnpm arguments, forwarded verbatim (add <pkg>, remove <pkg>, why <pkg>, ...)").action((args, options) => {
+			if (options.profile === "") program.error("error: --profile needs a name");
+			if (!manageDesktopProfile) rejectElectronProfile(plugin, options.profile);
+			if (args.length === 0) program.error("error: plugin needs pnpm arguments to forward (e.g. add <package>)");
+			resolved = {
+				mode: "plugin",
+				profile: options.profile.toLowerCase() === "desktop" ? "desktop" : options.profile,
+				args
+			};
+		});
+	}
 	try {
-		program.parse(argv, { from: "user" });
+		const forkCommand = first === "plugin" || first === "web:log" || first === "web:log:tmp";
+		const expanded = first !== void 0 && !first.startsWith("-") && !forkCommand ? ["--profile", ...argv] : argv;
+		program.parse(expanded, { from: "user" });
 	} catch (error) {
 		return process.exit(error instanceof CommanderError ? error.exitCode : 1);
 	}
@@ -135,51 +164,128 @@ function parseDshArgs(argv, version) {
 	return resolved;
 }
 //#endregion
-//#region lib/types/bin.js
+//#region lib/types/startup-diagnostics.js
+/** Save original startup diagnostics while keeping the terminal report concise. */
+/** Wait for stderr to finish the write before the failed process exits. */
+function writeStderr(text) {
+	return new Promise((resolve, reject) => {
+		process.stderr.write(text, (error) => {
+			if (error) reject(error);
+			else resolve();
+		});
+	});
+}
 /**
-* dsh — command-line entry. Dynamic imports per mode keep unrelated modes out
-* of each dispatch path; the adapter prints and exits for
-* `--help`/`--version`/a parse error, so only a valid mode reaches the switch.
-* @module @deepseek-ai/dsh/bin
+* Print the startup summary and save a private, uniquely named report under DSH_HOME/logs.
+* Failed writes print the complete report to stderr instead of claiming a saved path.
+* @param error - startup audit failure retaining plugin metadata and original errors.
+* @param context - resolved Harness home, application version, and selected profile.
+* @param write - terminal output sink; awaited before returning, defaults to stderr.
+* @returns after saving or printing the report and completing terminal writes.
 */
-/* v8 ignore file -- built-bin acceptance exercises this self-executing dispatch. */
-/** This app's version, read from its checked-in package.json. */
-function readVersion() {
-	const manifest = JSON.parse(readFileSync(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8"));
-	return typeof manifest.version === "string" ? manifest.version : "0.0.0";
-}
-const invocation = parseDshArgs(process.argv.slice(2), readVersion());
-switch (invocation.mode) {
-	case "profile": {
-		const { runProfile } = await import("./profile-boot-BnJoK_kl.js");
-		await runProfile({
-			environment: loadLayeredEnv("dsh"),
-			profile: invocation.profile,
-			patchFiles: invocation.patches,
-			args: invocation.args
+async function reportStartupFailure(error, context, write = writeStderr) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const report = "WARNING: Raw diagnostics may contain configuration or credential values from plugin errors. Review before sharing.\n\n" + inspect({
+		timestamp: now,
+		dshVersion: context.version,
+		nodeVersion: process.version,
+		platform: process.platform,
+		arch: process.arch,
+		profile: context.profile,
+		error
+	}, {
+		depth: null,
+		maxArrayLength: null,
+		maxStringLength: null,
+		showHidden: true,
+		customInspect: false,
+		getters: false,
+		colors: false
+	}) + "\n";
+	await write(`${error.message}\n`);
+	const logDir = join(context.home, "logs");
+	const logPath = join(logDir, `startup-${now.replaceAll(":", "-")}-${randomUUID()}.log`);
+	try {
+		await mkdir(logDir, {
+			recursive: true,
+			mode: 448
 		});
-		break;
-	}
-	case "plugin": {
-		const { runPlugin } = await import("./plugin-9h8shc4d.js");
-		process.exit(runPlugin(invocation.profile, invocation.args));
-		break;
-	}
-	case "web-log": {
-		const { runWebLog } = await import("./web-log-DZLBFfre.js");
-		runWebLog({
-			tmp: invocation.tmp,
-			patches: invocation.patches,
-			args: invocation.args
+		await writeFile(logPath, report, {
+			flag: "wx",
+			mode: 384
 		});
-		break;
+	} catch (writeError) {
+		await write(`\ndsh: warning: could not write startup diagnostics: ${String(writeError)}\nFull diagnostics:\n${report}`);
+		return;
 	}
-	case "dump-config": {
-		const { runDumpConfig } = await import("./dump-config-D-jtgwY3.js");
-		runDumpConfig(invocation.profile, invocation.defaultOnly, invocation.patches);
-		break;
+	await write(`\nFull diagnostics: ${logPath}\n`);
+}
+//#endregion
+//#region lib/types/bin.js
+/**
+* Command-line entry for dsh.
+* @module @deepseek-ai/dsh/bin
+*/
+/* v8 ignore file -- built-bin acceptance exercises this self-executing dispatch. */
+/**
+* Run the public dsh command-line interface.
+* @param options - Package runtime and Desktop profile access supplied by the installation.
+* @returns a promise that settles when the selected command mode finishes.
+*/
+async function runCli(options = {}) {
+	const version = getDshRuntimeVersion();
+	const { manageDesktopProfile, ...profileOptions } = options;
+	const invocation = parseDshArgs(process.argv.slice(2), version, manageDesktopProfile);
+	switch (invocation.mode) {
+		case "profile": {
+			const { runProfile } = await import("./profile-boot.js");
+			try {
+				await runProfile({
+					environment: loadLayeredEnv("dsh"),
+					profile: invocation.profile,
+					fromDefaultProfile: invocation.fromDefaultProfile,
+					patchFiles: invocation.patches,
+					args: invocation.args,
+					...profileOptions
+				});
+			} catch (error) {
+				if (!(error instanceof StartupError)) throw error;
+				await reportStartupFailure(error, {
+					home: resolveDshHome(),
+					version,
+					profile: invocation.profile
+				});
+				process.exit(1);
+			}
+			break;
+		}
+		case "plugin": {
+			const { runPlugin } = await import("./plugin-BiveYA7h.js");
+			process.exit(await runPlugin(invocation.profile, invocation.args, options.packageManager));
+			break;
+		}
+		case "web-log": {
+			const { runWebLog } = await import("./web-log-DVrp_oFP.js");
+			runWebLog({
+				tmp: invocation.tmp,
+				patches: invocation.patches,
+				args: invocation.args
+			});
+			break;
+		}
+		case "dump-config": {
+			const { runDumpConfig } = await import("./dump-config-CxNkSYcK.js");
+			runDumpConfig(invocation.profile, invocation.defaultOnly, invocation.patches, invocation.fromDefaultProfile);
+			break;
+		}
+		case "dump-config-schema": {
+			const { runDumpConfigSchema } = await import("./dump-config-schema-D_PxIzpe.js");
+			await runDumpConfigSchema(invocation.profile, invocation.patches, invocation.fromDefaultProfile);
+			break;
+		}
+		default: throw new Error(`dsh: unhandled invocation mode ${JSON.stringify(invocation)}`);
 	}
-	default: throw new Error(`dsh: unhandled invocation mode ${JSON.stringify(invocation)}`);
 }
+if (import.meta.main) await runCli();
 //#endregion
-export {};
+export { runCli };

package/lib/{dump-config-D-jtgwY3.js → dump-config-CWs_HdOc.js}

@@ -1,7 +1,7 @@
-import { i as prepareProfile, n as PROFILE_ROOT_FILENAME, r as homePatchPath } from "./profile-boot-DG5t9aNs.js";
-import { existsSync } from "node:fs";
+import { a as prepareProfile, n as PROFILE_ROOT_FILENAME, r as homePatchPath } from "./profile-boot-C14i-8IN.js";
 import { loadOptionalPatches, loadOverlayPatches, renderConfigDump } from "@deepseek-ai/dsh-app-boot";
 import { join, resolve } from "node:path";
+import { existsSync } from "node:fs";
 //#region lib/types/dump-config.js
 /**
 * Config-dump entry for `dsh --profile <name> --dump-config`: compose the
@@ -19,9 +19,21 @@ const NAME = "dsh";
 * (the recovery diagnostic for a broken `cordis.patch.yml`, which is then
 * never parsed).
 * @param patches - `--patch` overlay paths, in argv order.
+* @param fromDefaultProfile - shipped template that replaces the profile before loading it.
 */
-function runDumpConfig(profile, defaultOnly, patches) {
-	const loaded = prepareProfile(profile, !defaultOnly);
+function runDumpConfig(profile, defaultOnly, patches, fromDefaultProfile) {
+	const loaded = prepareProfile(profile, !defaultOnly, fromDefaultProfile);
+	const layers = collectConfigDumpLayers(loaded, defaultOnly, patches);
+	process.stdout.write(renderConfigDump(NAME, join(loaded.dir, PROFILE_ROOT_FILENAME), layers));
+}
+/**
+* Read dump layers in bundle, profile, home, then argv order without composing them.
+* @param loaded - prepared profile and parsed bundle and profile patches.
+* @param defaultOnly - omit profile, home, and argv layers without reading their files.
+* @param patches - overlay paths relative to the invoking directory, in argv order.
+* @returns the labeled layers shared by YAML and schema dumps.
+*/
+function collectConfigDumpLayers(loaded, defaultOnly, patches) {
 	const layers = loaded.layers.map((layer) => ({
 		label: layer.packageName,
 		patches: layer.patches
@@ -45,8 +57,8 @@ function runDumpConfig(profile, defaultOnly, patches) {
 			});
 		}
 	}
-	process.stdout.write(renderConfigDump(NAME, join(loaded.dir, PROFILE_ROOT_FILENAME), layers));
+	return layers;
 }
 /* v8 ignore stop */
 //#endregion
-export { runDumpConfig };
+export { runDumpConfig as n, collectConfigDumpLayers as t };

package/lib/dump-config-CxNkSYcK.js

@@ -0,0 +1,2 @@
+import { n as runDumpConfig } from "./dump-config-CWs_HdOc.js";
+export { runDumpConfig };

package/lib/dump-config-schema-D_PxIzpe.js

@@ -0,0 +1,41 @@
+import { a as prepareProfile, t as INSTALL_ANCHOR } from "./profile-boot-C14i-8IN.js";
+import { t as collectConfigDumpLayers } from "./dump-config-CWs_HdOc.js";
+import { generateConfigSchema } from "@deepseek-ai/dsh-app-boot";
+//#region lib/types/dump-config-schema.js
+/**
+* Schema-dump entry: inspect the composed profile without applying its plugins.
+* Imports and lazy schema builders execute trusted module code.
+* @module @deepseek-ai/dsh/dump-config-schema
+*/
+/* v8 ignore file -- built-bin acceptance drives schema collection and output. */
+const NAME = "dsh";
+/**
+* Print one JSON Schema document; incomplete collection or projection sets exitCode to 1.
+* Profile initialization writes match the YAML dump. Plugin imports may execute
+* top-level code, but collection never applies plugins or evaluates `!!js`.
+* During schema generation, ordinary stdout writes are redirected to stderr.
+* @param profile - the profile name.
+* @param patches - overlay paths, in argv order.
+* @param fromDefaultProfile - shipped template that replaces the profile before loading it.
+* @returns after collection and output, with diagnostics also written to stderr.
+*/
+async function runDumpConfigSchema(profile, patches, fromDefaultProfile) {
+	const loaded = prepareProfile(profile, true, fromDefaultProfile);
+	const layers = collectConfigDumpLayers(loaded, false, patches);
+	const stdoutWrite = process.stdout.write;
+	let dump;
+	process.stdout.write = process.stderr.write.bind(process.stderr);
+	try {
+		dump = await generateConfigSchema(loaded, layers.map((layer) => layer.patches), INSTALL_ANCHOR);
+	} finally {
+		process.stdout.write = stdoutWrite;
+	}
+	process.stdout.write(`${JSON.stringify(dump, null, 2)}\n`);
+	for (const diagnostic of dump["x-cordis"].diagnostics) {
+		const location = diagnostic.path === void 0 ? "" : ` [${diagnostic.path}]`;
+		process.stderr.write(`${NAME}: ${diagnostic.level}:${location} ${diagnostic.message}\n`);
+	}
+	if (!dump["x-cordis"].complete) process.exitCode = 1;
+}
+//#endregion
+export { runDumpConfigSchema };

package/lib/plugin-BiveYA7h.js

@@ -0,0 +1,101 @@
+import { t as INSTALL_ANCHOR } from "./profile-boot-C14i-8IN.js";
+import { DEFAULT_PROFILE_BUNDLES, PROFILE_TEMPLATES, initProfile, readProfileCompatibility, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
+import { mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { runPluginCommand, runProfilePnpm, setProfileVersionExemption } from "@deepseek-ai/dsh-plugin-manager/operations";
+import { withFileLock } from "@deepseek-ai/dsh-atomic-write";
+//#region lib/types/plugin.js
+/** Profile package management and explicit, exact-version compatibility approvals. */
+function requireDesktopProfile(dir) {
+	if (!existsSync(join(dir, "package.json"))) throw new Error("Open DeepSeek Harness Desktop once to initialize its profile, then fully quit it before running dsh plugin --profile desktop.");
+}
+/** Parse only DSH-owned commands; all other arguments remain pnpm's responsibility. */
+async function versionCommand(profile, args) {
+	const [command, ...rest] = args;
+	if (command !== "allow-version" && command !== "revoke-version" && command !== "version-exemptions") return void 0;
+	try {
+		let packageVersion;
+		let runtimeVersion;
+		let acceptRisk = false;
+		const argumentsIterator = rest.values();
+		for (const argument of argumentsIterator) if (argument === "--accept-risk" && command === "allow-version" && !acceptRisk) acceptRisk = true;
+		else if (argument === "--dsh-version" && runtimeVersion === void 0) runtimeVersion = argumentsIterator.next().value;
+		else if (argument.startsWith("--dsh-version=") && runtimeVersion === void 0) runtimeVersion = argument.slice(14);
+		else if (!argument.startsWith("-") && packageVersion === void 0) packageVersion = argument;
+		else throw new Error(`unexpected argument ${JSON.stringify(argument)}`);
+		if (command === "version-exemptions" && rest.length > 0) throw new Error("usage: dsh plugin version-exemptions");
+		let request;
+		if (command !== "version-exemptions") {
+			if (packageVersion === void 0 || runtimeVersion === void 0) throw new Error(`usage: dsh plugin ${command} <package@version> --dsh-version <exact>${command === "allow-version" ? " --accept-risk" : ""}`);
+			request = {
+				packageVersion,
+				runtimeVersion
+			};
+		}
+		if (command === "allow-version") process.stderr.write("dsh: warning: allowing incompatible plugin versions can break the application or corrupt data. Approval applies only to the exact package and DSH versions.\n");
+		const dir = resolveProfileDir(profile);
+		if (profile !== "desktop") await mkdir(dir, { recursive: true });
+		await withFileLock(join(dir, "package.json"), async () => {
+			if (profile === "desktop") requireDesktopProfile(dir);
+			else if (!existsSync(join(dir, "package.json"))) initProfile(dir, PROFILE_TEMPLATES[profile]?.bundles ?? DEFAULT_PROFILE_BUNDLES);
+			if (request === void 0) {
+				const { exemptions, warnings } = readProfileCompatibility(dir);
+				for (const warning of warnings) process.stderr.write(`dsh: warning: ${warning}\n`);
+				process.stdout.write(JSON.stringify(exemptions, void 0, 2) + "\n");
+			} else {
+				await setProfileVersionExemption(dir, request.packageVersion, request.runtimeVersion, command === "allow-version", acceptRisk);
+				process.stdout.write(`dsh: ${command === "allow-version" ? "allowed" : "revoked"} ${request.packageVersion} for DSH ${request.runtimeVersion}\n`);
+			}
+		}, { waitMs: 12e4 });
+		return 0;
+	} catch (error) {
+		process.stderr.write(`dsh: ${String(error)}\n`);
+		return 1;
+	}
+}
+/** Run package management for a profile.
+* @param profile Profile name; Desktop's reserved profile must already be initialized by the application.
+* @param args DSH exemption command or pnpm arguments relative to the invoking directory.
+* @param packageManager Installation-owned executable and environment for pnpm operations.
+* @returns Zero on success; nonzero on invalid approval or package-manager failure.
+*/
+async function runPlugin(profile, args, packageManager) {
+	if (profile === "desktop") try {
+		requireDesktopProfile(resolveProfileDir(profile));
+	} catch (error) {
+		process.stderr.write(`dsh: ${String(error)}\n`);
+		return 1;
+	}
+	const versionResult = await versionCommand(profile, args);
+	if (versionResult !== void 0) return versionResult;
+	const dir = resolveProfileDir(profile);
+	if (existsSync(join(dir, "package.json"))) for (const warning of readProfileCompatibility(dir).warnings) process.stderr.write(`dsh: warning: ${warning}\n`);
+	const context = {
+		profile,
+		dir,
+		installAnchor: INSTALL_ANCHOR,
+		cwd: process.cwd()
+	};
+	const options = {
+		...packageManager,
+		execution: "cli",
+		outputBytes: 16384,
+		lockWaitMs: 12e4,
+		lookupTimeoutMs: 12e4,
+		onOutput: (text, stream) => {
+			process[stream].write(text);
+		}
+	};
+	const result = profile === "desktop" ? await withFileLock(join(dir, "package.json"), async () => {
+		requireDesktopProfile(dir);
+		return runProfilePnpm(context, args, options);
+	}, { waitMs: 12e4 }) : await runPluginCommand(context, args, options);
+	if (result.exitCode === 127) process.stderr.write("dsh: pnpm was not found; install pnpm and make it available on PATH.\n");
+	for (const { name, version, runtimeVersion } of result.incompatible ?? []) process.stderr.write(`dsh: to accept the risk, run: dsh plugin --profile ${profile} allow-version ${name}@${version} --dsh-version ${runtimeVersion} --accept-risk\n`);
+	if (result.exitCode !== 0) process.stderr.write(`dsh: plugin command failed; diagnostics: ${result.logPath}\n`);
+	if (result.exitCode !== 0 && args.some((argument) => /^git\+|^github:|\.git(?:#|$)/.test(argument))) process.stderr.write(`dsh: git-hosted plugins build on install via their prepare script, which pnpm blocks until allowed — add the exact key pnpm printed above under allowBuilds in ${join(resolveProfileDir(profile), "pnpm-workspace.yaml")}, then re-run\n`);
+	return result.exitCode;
+}
+//#endregion
+export { runPlugin };