@deepseek-ai/dsh-app-boot 0.2.0-rc.2 → 0.2.1-alpha.2

package/README.i18n.yaml

@@ -21,8 +21,8 @@
   en: 2fdfe02f2ed4a258
   zh: d748228ece579c4a
 /deepseek-ai-dsh-app-boot/use-this-package/starting-the-app:
-  en: 1099528bde0e2aee
-  zh: b68772bdb9bb7856
+  en: 4a424cd401556f20
+  zh: 0b34dd18e0db6cea
 /deepseek-ai-dsh-app-boot/use-this-package/profiles:
   en: d50b0fdaf62353dd
   zh: 0fccb6968602e5de
@@ -33,8 +33,8 @@
   en: c4a301652b851ce9
   zh: 784871e19cd9db0a
 /deepseek-ai-dsh-app-boot/use-this-package/reading-plugin-display-metadata:
-  en: 480ad3a4d96112f0
-  zh: 10a92f1013aa5ac4
+  en: a9afb263b03d112c
+  zh: 31f5e797cd953c15
 /deepseek-ai-dsh-app-boot/use-this-package/startup-and-reload-failures:
   en: 09890e218ab49c84
   zh: e3d86597e7fb1adb
@@ -45,17 +45,17 @@
   en: f4a2695cb4c8a570
   zh: 89837235d2f376cf
 /deepseek-ai-dsh-app-boot/understand-the-implementation/design-notes:
-  en: 4ac0c33806b5a5b2
-  zh: cdb56f3adfcb4364
+  en: 25a0d1b46fd66d68
+  zh: 5cd8b4ac382dccdc
 /deepseek-ai-dsh-app-boot/understand-the-implementation/helper-behavior:
   en: f7bc3a8dd4b00bdd
   zh: 30098428aa769ad0
 /deepseek-ai-dsh-app-boot/understand-the-implementation/source-map:
-  en: 25602fd8eb9b2907
-  zh: 870a33dd34a52c32
+  en: 3da01827e3354655
+  zh: 06ccfaed83f65a76
 /deepseek-ai-dsh-app-boot/further-exploration:
-  en: ffd10e94443a10ca
-  zh: cd11495bae751bdd
+  en: 401269cc5ea8593e
+  zh: cd337c356b320565
 /deepseek-ai-dsh-app-boot/model-experience:
   en: 769777f1cb1a9408
   zh: f02b2834179df50d

package/README.md

@@ -40,7 +40,7 @@ installFailLoud('dsh')
 const ctx = await boot('dsh', resolveConfigPath(argv[2], process.env.DSH_SNAPSHOT))
 ```
 
-`installFailLoud` writes one labelled `util.inspect` diagnostic to stderr for an unhandled rejection or an uncaught exception, awaits the surface's release hook under a fixed timeout, and exits 1; control never returns to the failed operation, because only the throw site knows which state is intact, and the event loop runs only until the release settles or times out. With that entry point, startup keeps every plugin that can activate. An enabled failed plugin produces a labelled warning. A failed required entry makes startup dispose the whole app and exit nonzero; required ids absent from a profile and disabled required entries do not affect startup. The global required list covers shared Agent execution, application endpoints, and Web bootstrap/transport: `agent-loop`, `webserver`, `modules`, `connection`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`.
+`installFailLoud` writes one labelled `util.inspect` diagnostic to stderr for an unhandled rejection or an uncaught exception, awaits the surface's release hook under a fixed timeout, and exits 1; control never returns to the failed operation, because only the throw site knows which state is intact, and the event loop runs only until the release settles or times out. With that entry point, startup keeps every plugin that can activate. An enabled failed plugin produces a labelled warning. A failed required entry makes startup dispose the whole app and exit nonzero; required ids absent from a profile and disabled required entries do not affect startup. The global required list covers shared Agent execution, application endpoints, and Web bootstrap/transport: `agent-loop`, `webserver`, `web-runtime`, `modules`, `connection`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`.
 
 <a id="profiles"></a>
 ### Profiles
@@ -82,7 +82,11 @@ The projector preserves native omission behavior by checking literal defaults ag
 
 ### Reading plugin display metadata
 
-Use `readPluginMeta(specifier, parentURL)` or `ctx.pluginPackages.metaOf(specifier, parentURL)` to read installed package display text without importing or activating the plugin. Lookup uses the complete package specifier and the caller's resolution base, respecting Node exports. File paths and file URLs return no metadata without resolving resources. Missing locale fields fall back to the accessible `package.json` at that address; malformed metadata returns an `error` diagnostic. Results retain translations for Client-side language selection. The reader also loads `package.json.icon` as an image data URL, even when locale text is complete; an icon error preserves valid text alongside the diagnostic. See [Plugin display metadata](../../../docs/cookbook/adding-a-package.md#plugin-display-metadata) for the author format.
+`resolvePluginResource(specifier, parentURL)` resolves a plugin module or exported resource to its local filesystem path through the active Node ESM resolver without evaluating it. It throws when the resolver is unavailable or the resource cannot resolve to a local file.
+
+Use `readPluginMeta(specifier, parentURL)` or `ctx.pluginPackages.metaOf(specifier, parentURL)` to read installed package display text without importing or activating the plugin. Lookup uses the complete package specifier and the caller's resolution base, respecting Node exports. File paths and file URLs return no metadata without resolving resources. For a package-root specifier, missing locale fields fall back to the accessible `package.json`; a subpath specifier never reads a `package.json`. Malformed metadata returns an `error` diagnostic. Results retain translations for Client-side language selection. The reader also loads an image data URL, even when locale text is complete: a package root uses its manifest `icon`, or `<package>/icon` when that field is omitted; a subpath uses `<specifier>/icon`. An icon error preserves valid text alongside the diagnostic. See [Plugin display metadata](../../../docs/cookbook/adding-a-package.md#plugin-display-metadata) for the author format.
+
+`ON_DEMAND_BUNDLES` names the public Official packages installed only on request. `OFFICIAL_ON_DEMAND_CATALOG` embeds their package-owned localized metadata and icons for offline discovery; `pnpm gen-official-bundle-catalog` explicitly updates generated content, and `verify-official-bundle-catalog` checks resource completeness and freshness; builds consume the committed catalog without importing provider code. The catalog contains no install target: [Plugin Manager](../plugin-manager/README.md#use-this-package) derives it from the running version and installation and uses the ordinary bundle installer. The [product-use check](../../../scripts/verify-product-use.ts) composes shipped and on-demand selections against Web without executing providers.
 
 <a id="startup-and-reload-failures"></a>
 ### Startup and reload failures
@@ -135,7 +139,7 @@ This section explains how the outcomes above are realized and points at the code
 - **Package metadata.** `ctx.pluginPackages.packageOf` locates the owning package without loading code or requiring an exported `package.json`; a subpath selects its package without validating that file. The installed runtime resolution owns selection even for a miss. Low-level embedders that install the service without one retain native lookup. Display metadata uses the separate entry-aware reader described above.
 - **Two Loader builtins.** `mountRootInclude` registers `cordis:include` and `cordis:group` as Loader builtins: a group row gives one `isolate` realm to a provider and its consumers together, and an agent preset outside this workspace cannot resolve `@deepseek-ai/cordis-plugin-group` by name. Both load through the ambient module pipeline rather than the included tree's own specifier resolution.
 - **Consumer-owned strictness.** Ordinary Loader groups keep successful siblings. App-boot applies the global required-entry policy after initial settlement; agent presets and dynamic multi-entry compositions own and dispose their separate Loader subtree when they require all-or-nothing setup. App-boot reads failed fibers to report their recorded errors and coalesces duplicate Loader rejection notifications through one process checkpoint.
-- **One runtime resolution.** The installation-first and ordered-bundle breadth-first traversal produces the runtime table. Runtime resolution creates no links; runtime resolution entries occupy their package names at `$DSH_HOME/profiles/node_modules`, and every other name sees that directory as an ordinary ancestor. Profile load removes the `.dsh-module-fallback` projections that link-backend releases wrote into a profile; pnpm-installed packages stay. External bare targets selected by package `imports` use the same package order, while Node retains mapping, conditions, and exact target resolution. A complete successor may add package names and update linked-root membership atomically within the existing package-mapping and local-name constraints.
+- **One runtime resolution.** The installation-first and ordered-bundle breadth-first traversal produces the runtime table. Runtime resolution creates no links; runtime resolution entries occupy their package names at `$DSH_HOME/profiles/node_modules`, and every other name sees that directory as an ordinary ancestor. Profile load removes the `.dsh-module-fallback` projections that link-backend releases wrote into a profile; pnpm-installed packages stay. External bare targets selected by package `imports` use the same package order, while Node retains mapping, conditions, and exact target resolution. A complete successor may add package names, remove profile-scoped mappings and profile-local names, and update linked-root membership atomically; retained mappings keep their normalized directory, version, and scope. Installation anchors remain fixed; a profile mapping may change its declarer. [Plugin Manager](../plugin-manager/README.md) publishes successors after package operations ([decision](../../../.agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.md)).
 - **Removing linked interception.** A successor may remove a linked root without restart. Directories outside all remaining roots use native lookup for subsequent requests, which may find a development copy or report a missing package. Existing module references and Node caches stay unchanged. Re-adding the same link name and target is allowed; pointing a previously published name at a different target is rejected even after removal ([generation rules](../../../.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.md#immutable-generations)).
 - **Application-owned profiles.** Application-owned profiles use the same runtime resolution. Links within the active profile directory, including pnpm store links, are not external roots even when the profile is outside the shared profiles tree. Resolution does not modify their `node_modules`; pnpm owns installed packages.
 - **Owned Workers.** Worker build banners import `@deepseek-ai/dsh-app-boot/worker/profile-resolution-bootstrap` before bundled business code. Each Worker installs the structured-cloned runtime resolution in its own isolate. The bootstrap bundle has no static package imports. Source Worker entries retain their self-contained dependency closure, and third-party Workers receive no injection.
@@ -159,7 +163,6 @@ The exports each own one stage of the boot: config resolution and snapshot repla
 | [`src/profile-sanitize.ts`](src/profile-sanitize.ts) | Profile patch backup and recovery bundle activation |
 | [`src/config-schema/`](src/config-schema/) | Profile schema generation, discovery, native projection, and result types |
 | [`src/profile-resolution/`](src/profile-resolution/) | Runtime resolver, package-metadata service, and built Worker bootstrap |
-| — | No runtime invariant companion is published; one interception owns each runtime resolution. |
 
 </details>
 
@@ -177,7 +180,7 @@ Read these pages when the package-level contract is not enough. They move from t
 - [dsh-home-paths](../../util/home-paths/README.md) — the Harness-home resolver (`resolveDshHome`).
 - [Configuration source ownership](../../../.agents/notes/implemented/architecture/2026-08-04-configuration-source-ownership.md) — why a discovered file may not decide bootstrap behavior.
 - [Profile plugin bundles](../../../.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.md) — the profile and bundle composition design.
-- [User-patch HMR tests](../../../.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.md) — ownership of live-patch behavior and native filesystem delivery.
+- [User-patch HMR tests](tests/user-patches.spec.ts) — ownership of live-patch behavior and native filesystem delivery.
 
 -----
 

package/README.zh.md

@@ -40,7 +40,7 @@ installFailLoud('dsh')
 const ctx = await boot('dsh', resolveConfigPath(argv[2], process.env.DSH_SNAPSHOT))
 ```
 
-`installFailLoud` 会为未处理 rejection 或未捕获异常向 stderr 写一条带标签的 `util.inspect` 诊断，在固定超时内等待界面的 release 钩子，然后以 1 退出；控制流不会回到失败的操作，因为只有抛出点知道哪些状态仍然完整，事件循环只运行到 release 结束或超时。有了这个入口，启动会保留所有能够激活的插件。启用但失败的插件会产生带标签的警告。required entry 失败时，启动会拆卸整个应用并以非零码退出；profile 中不存在的 required id 和已禁用的 required entry 不影响启动。全局 required list 覆盖共享 Agent 执行、应用 endpoint，以及 Web 启动与传输：`agent-loop`、`webserver`、`modules`、`connection`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。
+`installFailLoud` 会为未处理 rejection 或未捕获异常向 stderr 写一条带标签的 `util.inspect` 诊断，在固定超时内等待界面的 release 钩子，然后以 1 退出；控制流不会回到失败的操作，因为只有抛出点知道哪些状态仍然完整，事件循环只运行到 release 结束或超时。有了这个入口，启动会保留所有能够激活的插件。启用但失败的插件会产生带标签的警告。required entry 失败时，启动会拆卸整个应用并以非零码退出；profile 中不存在的 required id 和已禁用的 required entry 不影响启动。全局 required list 覆盖共享 Agent 执行、应用 endpoint，以及 Web 启动与传输：`agent-loop`、`webserver`、`web-runtime`、`modules`、`connection`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。
 
 <a id="profiles"></a>
 ### Profile
@@ -82,7 +82,11 @@ profile 导入插件前，DSH 会检查其 `peerDependencies` 中对 `@deepseek-
 
 ### 读取插件展示元信息
 
-使用 `readPluginMeta(specifier, parentURL)` 或 `ctx.pluginPackages.metaOf(specifier, parentURL)` 读取已安装包的展示文本，无需导入或激活插件。查询使用完整包标识与调用方的解析基准，并遵循 Node exports。文件路径与文件 URL 不解析资源，直接返回无元信息。缺失的 locale 字段回退到该地址下可访问的 `package.json`；格式错误的元信息返回 `error` 诊断。结果保留翻译，由 Client 选择语言。即使 locale 文本完整，读取器也会将 `package.json.icon` 加载为图片 data URL；图标出错时，保留有效文本并附上诊断。作者格式见[插件展示元信息](../../../docs/cookbook/adding-a-package.zh.md#plugin-display-metadata)。
+`resolvePluginResource(specifier, parentURL)` 通过活动的 Node ESM 解析器将插件模块或导出资源解析为本地文件路径，不执行其代码。解析器不可用或资源无法解析为本地文件时会抛出错误。
+
+使用 `readPluginMeta(specifier, parentURL)` 或 `ctx.pluginPackages.metaOf(specifier, parentURL)` 读取已安装包的展示文本，无需导入或激活插件。查询使用完整包标识与调用方的解析基准，并遵循 Node exports。文件路径与文件 URL 不解析资源，直接返回无元信息。包根标识缺失的 locale 字段回退到可访问的 `package.json`；子路径标识从不读取 `package.json`。格式错误的元信息返回 `error` 诊断。结果保留翻译，由 Client 选择语言。即使 locale 文本完整，读取器也会加载图片 data URL：包根使用清单 `icon`，省略该字段时使用 `<包名>/icon`；子路径使用 `<标识>/icon`。图标出错时，保留有效文本并附上诊断。作者格式见[插件展示元信息](../../../docs/cookbook/adding-a-package.zh.md#plugin-display-metadata)。
+
+`ON_DEMAND_BUNDLES` 列出仅按需安装的官方公开包。`OFFICIAL_ON_DEMAND_CATALOG` 内嵌这些包拥有的本地化元信息和图标，支持离线发现；`pnpm gen-official-bundle-catalog` 显式更新生成内容，`verify-official-bundle-catalog` 检查资源完整性与新鲜度；构建只读取已提交的目录，不导入提供者代码。目录不保存安装目标；[插件管理器](../plugin-manager/README.zh.md#use-this-package)根据当前版本和安装位置确定目标，并使用普通组合包安装器。[产品用途检查](../../../scripts/verify-product-use.ts)将随附和按需选择与 Web 组合，但不执行提供者。
 
 <a id="startup-and-reload-failures"></a>
 ### 启动与重载失败
@@ -135,7 +139,7 @@ Loader 结算后，app-boot 在仅 optional 条目未激活时输出警告。如
 - **包元数据。** `ctx.pluginPackages.packageOf` 定位所属包，不加载代码，也不要求导出 `package.json`；子路径选择其所属包，不校验该文件。安装 runtime resolution 后，即使查询未命中也以其选包规则为准。仅安装服务而不提供 runtime resolution 的底层嵌入方保留原生查询。展示元数据使用上文另述的入口感知读取器。
 - **两个 Loader builtin。** `mountRootInclude` 把 `cordis:include` 与 `cordis:group` 注册为 Loader builtin：group 行能把一个提供方与它的消费方放进同一个 `isolate` realm，而位于本工作区之外的 agent preset 无法按名称解析 `@deepseek-ai/cordis-plugin-group`。两者都通过宿主的模块管线加载，而非被包含树自身的说明符解析。
 - **由 consumer 持有严格语义。** 普通 Loader group 保留成功 sibling。App-boot 在首次结算后应用全局 required-entry policy；agent preset 与动态多 entry 组合在需要 all-or-nothing setup 时，持有并拆卸各自的独立 Loader 子树。App-boot 读取 failed fiber 来报告已记录的错误，并在一个进程检查点内合并 Loader 重复的 rejection 通知。
-- **唯一 runtime resolution。** 安装优先、有序 bundle 逐根 breadth-first 遍历生成运行时表。runtime 解析不创建链接；runtime resolution 条目占据 `$DSH_HOME/profiles/node_modules` 上各自的包名位置，其余包名把该目录当作普通祖先。profile 加载时删除 Link 后端发布版写进 profile 的 `.dsh-module-fallback` 投影；pnpm 安装的包保留。package `imports` 选中的外部 bare target 使用相同的选包顺序，映射、conditions 和精确 target 解析仍由 Node 负责。完整后继 runtime resolution 可以在既有包映射和本地包名约束内原子增加 package name、更新 linked root 集合。
+- **唯一 runtime resolution。** 安装优先、有序 bundle 逐根 breadth-first 遍历生成运行时表。runtime 解析不创建链接；runtime resolution 条目占据 `$DSH_HOME/profiles/node_modules` 上各自的包名位置，其余包名把该目录当作普通祖先。profile 加载时删除 Link 后端发布版写进 profile 的 `.dsh-module-fallback` 投影；pnpm 安装的包保留。package `imports` 选中的外部 bare target 使用相同的选包顺序，映射、conditions 和精确 target 解析仍由 Node 负责。完整后继 runtime resolution 可以原子地增加 package name、移除 profile 范围的映射和 profile 本地包名、更新 linked root 集合；保留映射的规范化目录、版本和作用域不变。安装范围的锚点不变；profile 映射可以更换声明来源。[插件管理器](../plugin-manager/README.zh.md)在包操作之后发布后继代（[决策](../../../.agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.zh.md)）。
 - **移除链接拦截。** 后继 generation 可以移除 linked root，无需重启。目录不再被任何剩余 root 覆盖时，后续请求使用原生查询，可能找到开发副本，也可能报告缺包。已有模块引用和 Node 缓存保持不变。同名、同目标可以重新加入；曾发布的名称改指向不同目标时，即使中间移除过也会被拒绝（[generation 规则](../../../.agents/notes/implemented/architecture/2026-09-09-profile-resolution-generations.zh.md#immutable-generations)）。
 - **应用自有 profile。** 应用自有 profile 使用相同的 runtime resolution。目标位于当前 profile 目录内的链接（包括 pnpm store 链接）不算外部 root，即使 profile 位于共享 profiles 树外。解析过程不修改其 `node_modules`；已安装包由 pnpm 管理。
 - **自有 Worker。** Worker 构建 banner 会在业务 bundle 前导入 `@deepseek-ai/dsh-app-boot/worker/profile-resolution-bootstrap`。每个 Worker 在自己的 isolate 中安装结构化克隆的 runtime resolution。bootstrap bundle 不静态导入任何包。源码 Worker 入口保留自包含依赖，第三方 Worker 不接受注入。
@@ -159,7 +163,6 @@ Loader 结算后，app-boot 在仅 optional 条目未激活时输出警告。如
 | [`src/profile-sanitize.ts`](src/profile-sanitize.ts) | profile patch 备份与恢复 bundle 启用状态 |
 | [`src/config-schema/`](src/config-schema/) | Profile schema 生成、发现、原生投影与结果类型 |
 | [`src/profile-resolution/`](src/profile-resolution/) | 运行时 resolver、package metadata 服务与构建后 Worker bootstrap |
-| — | 不发布运行时不变式伴生入口；每个 runtime resolution 只有一个拦截所有。 |
 
 </details>
 
@@ -177,7 +180,7 @@ Loader 结算后，app-boot 在仅 optional 条目未激活时输出警告。如
 - [dsh-home-paths](../../util/home-paths/README.zh.md)——harness home 解析器（`resolveDshHome`）。
 - [配置来源归属](../../../.agents/notes/implemented/architecture/2026-08-04-configuration-source-ownership.zh.md)——被发现的文件为何不得决定 bootstrap 行为。
 - [Profile 插件组合包](../../../.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.zh.md)——profile 与组合包组合设计。
-- [用户 patch HMR 测试](../../../.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.zh.md)——实时 patch 行为与原生文件系统投递的验证归属。
+- [用户 patch HMR 测试](tests/user-patches.spec.ts)——实时 patch 行为与原生文件系统投递的验证归属。
 
 -----
 

package/lib/index.js

@@ -1,6 +1,6 @@
 import { createRequire, isBuiltin } from "node:module";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import fs, { existsSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import fs, { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { inspect, parseEnv } from "node:util";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
 import * as yaml from "js-yaml";
@@ -441,7 +441,7 @@ async function setProfileVersionExemption(profileDir, packageVersion, runtimeVer
 }
 //#endregion
 //#region lib/types/profile-resolution/legacy-links.js
-/** Package directory canonicalization through the active runtime carrier's filesystem. */
+/** Package directory and resource canonicalization through the active runtime carrier's filesystem. */
 /**
 * Return whether the process reads application modules from pkg's virtual filesystem.
 * @returns whether pkg owns the module filesystem.
@@ -457,6 +457,15 @@ function isPackagedExecutable() {
 function realModuleDirectory(path) {
 	return isPackagedExecutable() ? realpathSync(path) : realpathSync.native(path);
 }
+/** Canonicalize a module resource, preserving physical file aliases.
+* SEA archive files are symlink-free and support stat and reads, while their containing directories support realpath.
+* @param path Existing module resource path.
+* @returns Canonical resource path under the active carrier's filesystem.
+* @throws When the resource or its directory cannot be inspected or resolved.
+*/
+function realModuleFile(path) {
+	return !isPackagedExecutable() || lstatSync(path).isSymbolicLink() ? realpathSync(path) : join(realModuleDirectory(dirname(path)), basename(path));
+}
 //#endregion
 //#region lib/types/profile.js
 /**
@@ -539,6 +548,11 @@ const INSTALLATION_OWNED_PROFILE_TUPLES = { headless: [
 	"@deepseek-ai/dsh-web-app",
 	"@deepseek-ai/dsh-headless"
 ] };
+/**
+* Bundles an earlier release shipped and the installation no longer carries;
+* {@link loadProfileDirectory} removes them from the profile's bundle list.
+*/
+const RETIRED_BUNDLES = new Set(["@deepseek-ai/dsh-experimental-schedule-bundle"]);
 /** The bundle list a `dsh plugin` init uses for a name with no shipped template. */
 const DEFAULT_PROFILE_BUNDLES = ["@deepseek-ai/dsh-base"];
 /**
@@ -550,10 +564,17 @@ const DEFAULT_PROFILE_BUNDLES = ["@deepseek-ai/dsh-base"];
 * [admission](../../../../.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md)).
 */
 const OPTIONAL_BUNDLES = [
+	"@deepseek-ai/dsh-experimental-session-search",
+	"@deepseek-ai/dsh-experimental-ralph-bundle",
+	"@deepseek-ai/dsh-experimental-terminal-bundle",
+	"@deepseek-ai/dsh-experimental-badge-skill-bundle",
+	"@deepseek-ai/dsh-experimental-session-titles-bundle",
 	"@deepseek-ai/dsh-experimental-agent-team-profile",
 	"@deepseek-ai/dsh-experimental-voice-input-bundle",
+	"@deepseek-ai/dsh-experimental-cot-translation-bundle",
 	"@deepseek-ai/dsh-experimental-auto-review",
-	"@deepseek-ai/dsh-experimental-schedule-bundle"
+	"@deepseek-ai/dsh-experimental-inspector-profile",
+	"@deepseek-ai/dsh-experimental-tool-worktree"
 ];
 const PROFILE_PATCH_TEMPLATE = `# Your patch layer for this dsh profile, applied after every bundle layer:
 # a top-level YAML array of loader patch entries (id-targeted config
@@ -738,7 +759,11 @@ async function createRuntimeResolution(options) {
 	const localPackageNames = profile === void 0 ? [] : installedProfilePackageNames(profile, manifest);
 	const profilePackages = profile === void 0 ? /* @__PURE__ */ new Map() : collectProfileScopePackages(profile, packageNames, profileDeclarers, profileVersions);
 	const linkedRoots = profile === void 0 ? [] : linkedProfileRoots(profile, profilesDir);
-	return await Promise.resolve(Object.freeze({
+	return await Promise.resolve(new ProfileRuntimeResolution({
+		installAnchor,
+		profileDir: profile?.dir,
+		home
+	}, {
 		profilesDir,
 		profileDir: profile?.dir,
 		localPackageNames: Object.freeze(localPackageNames),
@@ -758,6 +783,45 @@ async function createRuntimeResolution(options) {
 		}))])
 	}));
 }
+/**
+* A runtime resolution that remembers the inputs it was computed from. Worker environment data carries only its
+* fields; the inputs stay private to the thread that computed it.
+*/
+var ProfileRuntimeResolution = class {
+	profilesDir;
+	profileDir;
+	localPackageNames;
+	entries;
+	linkedRoots;
+	#source;
+	/**
+	* @param source - inputs of {@link createRuntimeResolution}, reused by {@link computeLatestResolution}.
+	* @param table - the computed package table.
+	*/
+	constructor(source, table) {
+		this.#source = source;
+		this.profilesDir = table.profilesDir;
+		this.profileDir = table.profileDir;
+		this.localPackageNames = table.localPackageNames;
+		this.entries = table.entries;
+		this.linkedRoots = table.linkedRoots;
+		Object.freeze(this);
+	}
+	/**
+	* Compute the latest generation from the same installation, profile directory, and Harness home, rereading the
+	* profile's manifest, bundle selection, and installed packages from disk, without retaining synthetic layers.
+	* With no profile directory, only installation packages are recomputed. This instance is unchanged.
+	* @returns a new resolution for the latest generation.
+	*/
+	computeLatestResolution() {
+		const { installAnchor, home, profileDir } = this.#source;
+		return createRuntimeResolution({
+			installAnchor,
+			home,
+			...profileDir === void 0 ? {} : { profile: loadProfileDirectory("dsh", profileDir, installAnchor) }
+		});
+	}
+};
 /** Synthetic profiles used by direct callers may have no on-disk manifest. */
 function readOptionalProfileManifest(profile) {
 	if (profile === void 0) return void 0;
@@ -848,6 +912,19 @@ function writeProfileManifest(dir, manifest) {
 function sameBundles(left, right) {
 	return left.length === right.length && left.every((value, index) => value === right[index]);
 }
+/** Return `manifest` with `dsh.profile.bundles` replaced, preserving all other fields. */
+function withBundles(manifest, bundles) {
+	return {
+		...manifest,
+		dsh: {
+			...manifest.dsh,
+			profile: {
+				...manifest.dsh?.profile,
+				bundles: [...bundles]
+			}
+		}
+	};
+}
 /**
 * Normalize an exact installation-owned bundle tuple to its shipped template,
 * preserving all other manifest fields. Other bundle lists remain untouched.
@@ -858,16 +935,19 @@ function normalizeShippedProfile(name, dir, manifest) {
 	const bundles = manifest.dsh?.profile?.bundles;
 	if (template === void 0 || bundles === void 0) return manifest;
 	if (!(installationOwned !== void 0 && sameBundles(bundles, installationOwned))) return manifest;
-	const normalized = {
-		...manifest,
-		dsh: {
-			...manifest.dsh,
-			profile: {
-				...manifest.dsh?.profile,
-				bundles: [...template.bundles]
-			}
-		}
-	};
+	const normalized = withBundles(manifest, template.bundles);
+	writeProfileManifest(dir, normalized);
+	return normalized;
+}
+/**
+* Remove {@link RETIRED_BUNDLES} from a profile's bundle list, writing the
+* manifest back only when it listed one.
+*/
+function dropRetiredBundles(dir, manifest) {
+	const bundles = manifest.dsh?.profile?.bundles ?? [];
+	const kept = bundles.filter((bundle) => !RETIRED_BUNDLES.has(bundle));
+	if (kept.length === bundles.length) return manifest;
+	const normalized = withBundles(manifest, kept);
 	writeProfileManifest(dir, normalized);
 	return normalized;
 }
@@ -909,7 +989,8 @@ function resolveBundleDir(binName, packageName, installAnchor, profileDir) {
 * Load an already initialized profile directory without resolving it through
 * the shared Harness home. This is used by application-owned profiles whose
 * package project and lifecycle belong to that application.
-* Unreadable bundles, and bundles whose own dsh peers the profile does not exempt, are skipped
+* Retired bundles are removed from the stored bundle list first, rewriting the
+* manifest when it listed one. Unreadable bundles, and bundles whose own dsh peers the profile does not exempt, are skipped
 * without changing the manifest and listed in `skippedBundles`; nothing is printed.
 * @param binName - the diagnostic prefix on thrown errors.
 * @param dir - absolute profile package directory.
@@ -918,7 +999,7 @@ function resolveBundleDir(binName, packageName, installAnchor, profileDir) {
 * @returns the successfully loaded bundle layers and optional user patch layer.
 */
 function loadProfileDirectory(binName, dir, installAnchor, options = {}) {
-	const bundles = readProfileManifest(binName, dir).dsh?.profile?.bundles ?? [];
+	const bundles = dropRetiredBundles(dir, readProfileManifest(binName, dir)).dsh?.profile?.bundles ?? [];
 	const layers = [];
 	const skippedBundles = [];
 	const exemptions = bundles.length === 0 ? {} : readProfileVersionExemptions(dir);
@@ -1362,10 +1443,10 @@ var ResolutionRouter = class {
 		if (successor.profilesDir !== this.current.profilesDir || successor.profileDir !== this.current.profileDir) throw new Error("profile resolution: a successor cannot change its profile scope");
 		for (const [name, current] of this.current.entries) {
 			const next = entries.get(name);
-			if (next === void 0 || !sameResolution(current.packageDir, next.packageDir) || !sameResolution(current.declarer, next.declarer) || current.version !== next.version || current.scope !== next.scope) throw new Error(`profile resolution: replacing ${JSON.stringify(name)} requires a process restart`);
+			if (next === void 0 && current.scope === "profile") continue;
+			if (next === void 0 || !sameResolution(current.packageDir, next.packageDir) || current.scope === "installation" && !sameResolution(current.declarer, next.declarer) || current.version !== next.version || current.scope !== next.scope) throw new Error(`profile resolution: replacing ${JSON.stringify(name)} requires a process restart`);
 		}
 		const localPackageNames = new Set(successor.localPackageNames);
-		for (const name of this.current.localPackageNames) if (!localPackageNames.has(name)) throw new Error(`profile resolution: removing local package ${JSON.stringify(name)} requires a process restart`);
 		for (const name of localPackageNames) if (!this.current.localPackageNames.has(name) && this.current.entries.has(name)) throw new Error(`profile resolution: overriding ${JSON.stringify(name)} locally requires a process restart`);
 		for (const root of successor.linkedRoots) {
 			const previous = this.linkedTargets.get(root.name);
@@ -1857,26 +1938,44 @@ const ICON_MEDIA_TYPES = new Map([
 	[".jpeg", "image/jpeg"],
 	[".webp", "image/webp"]
 ]);
-function iconOf(value, manifestPath) {
-	const icon = textOf(value, `${manifestPath}: icon`);
-	if (icon === void 0) return void 0;
-	if (isAbsolute(icon) || win32.isAbsolute(icon) || /^[A-Za-z][A-Za-z\d+.-]*:/u.test(icon)) throw new Error(`${manifestPath}: icon must be a relative file path`);
-	const mediaType = ICON_MEDIA_TYPES.get(extname(icon).toLowerCase());
-	if (mediaType === void 0) throw new Error(`${manifestPath}: icon must be SVG, PNG, JPEG, or WebP`);
-	const directory = realpathSync(dirname(manifestPath));
-	const file = realpathSync(resolve(directory, icon));
-	const local = relative(directory, file);
-	if (local === ".." || local.startsWith(`..${sep}`) || isAbsolute(local)) throw new Error(`${manifestPath}: icon must remain inside its manifest directory`);
+function iconOf(specifier, packageName, parentURL, manifestPath, value) {
+	const icon = manifestPath === void 0 ? void 0 : textOf(value, `${manifestPath}: icon`);
+	let target;
+	let label;
+	if (manifestPath !== void 0 && icon !== void 0) {
+		if (isAbsolute(icon) || win32.isAbsolute(icon) || /^[A-Za-z][A-Za-z\d+.-]*:/u.test(icon)) throw new Error(`${manifestPath}: icon must be a relative file path`);
+		label = manifestPath;
+		const root = realpathSync(dirname(manifestPath));
+		target = resolve(root, icon);
+		const local = relative(root, realModuleFile(target));
+		if (local === ".." || local.startsWith(`..${sep}`) || isAbsolute(local)) throw new Error(`${label}: icon must remain inside its manifest directory`);
+	} else {
+		const exported = optionalResourcePath(`${specifier}/icon`, parentURL);
+		if (exported === void 0) return void 0;
+		target = label = exported;
+		assertPackageOwned(realModuleFile(target), packageName);
+	}
+	const mediaType = ICON_MEDIA_TYPES.get(extname(target).toLowerCase());
+	if (mediaType === void 0) throw new Error(`${label}: icon must be SVG, PNG, JPEG, or WebP`);
+	const file = realModuleFile(target);
 	const stat = statSync(file);
-	if (!stat.isFile()) throw new Error(`${manifestPath}: icon must be a regular file`);
-	if (stat.size > MAX_ICON_BYTES) throw new Error(`${manifestPath}: icon exceeds 256 KiB`);
+	if (!stat.isFile()) throw new Error(`${label}: icon must be a regular file`);
+	if (stat.size > MAX_ICON_BYTES) throw new Error(`${label}: icon exceeds 256 KiB`);
 	const bytes = readFileSync(file);
-	if (bytes.length > MAX_ICON_BYTES) throw new Error(`${manifestPath}: icon exceeds 256 KiB`);
+	if (bytes.length > MAX_ICON_BYTES) throw new Error(`${label}: icon exceeds 256 KiB`);
 	return `data:${mediaType};base64,${bytes.toString("base64")}`;
 }
+/** Require an ancestor of the real file whose package.json names the owning package. */
+function assertPackageOwned(file, name) {
+	for (let directory = dirname(file);; directory = dirname(directory)) {
+		const manifest = join(directory, "package.json");
+		if (existsSync(manifest) && readObject(manifest).name === name) return;
+		if (dirname(directory) === directory) throw new Error(`${file}: icon must remain inside its package directory`);
+	}
+}
 /**
 * Resolve a plugin resource through the active Node ESM resolver without evaluating it.
-* @param specifier - complete resource module specifier, including its locale filename.
+* @param specifier - plugin module or exported resource specifier.
 * @param parentURL - owning module-resolution base.
 * @returns the local filesystem path selected by Node and the active profile.
 * @throws when the resolver is unavailable or the resource cannot resolve to a local file.
@@ -1954,24 +2053,29 @@ function localizedText(field, dictionaries, fallback, finalFallback) {
 	};
 }
 /**
-* Read localized display text and the icon declared in a plugin's exported package.json.
-* Icons are manifest-relative SVG, PNG, JPEG, or WebP files of at most 256 KiB,
-* contained in the manifest directory after realpath resolution. Icon failures retain display text.
+* Read plugin locale JSON display text and icon without evaluating JavaScript entries.
+* Only a package-root specifier reads its exported package.json: `name`/`description` fill missing
+* locale fields, and a declared `icon` takes priority over the `<specifier>/icon` resource.
+* A subpath specifier never reads package.json; its icon comes only from `<specifier>/icon`.
+* Manifest icons remain inside their declaring directory; exported icons remain inside their
+* owning package after realpath resolution. Both accept SVG, PNG, JPEG, or WebP up to 256 KiB.
+* Icon failures retain display text without falling back.
 * Non-package specifiers are skipped without invoking the resource resolver.
 * Language files share the directory containing the resolved English resource;
 * each file is resolved through the complete plugin specifier before reading.
-* Missing fields use the same address's package.json name/description. Translation
-* maps retain an English fallback, ultimately the full module specifier for titles and empty for descriptions.
+* Translation maps retain an English fallback, ultimately the full module specifier
+* for titles and empty for descriptions.
 * @param specifier - configured plugin module name, including any package subpath.
 * @param parentURL - owning Loader tree's module-resolution base.
-* @returns display fields and any icon diagnostic, or undefined for non-package specifiers or absent metadata.
+* @returns display fields and any resource diagnostic, or undefined for non-package specifiers or absent metadata.
 */
 function readPluginMeta(specifier, parentURL) {
-	if (barePackageName(specifier) === void 0) return void 0;
+	const packageName = barePackageName(specifier);
+	if (packageName === void 0) return void 0;
 	try {
 		const englishPath = optionalResourcePath(`${specifier}/locale/en.json`, parentURL);
 		const dictionaries = englishPath === void 0 ? /* @__PURE__ */ new Map() : dictionariesOf(englishPath, specifier, parentURL);
-		const manifestPath = optionalResourcePath(`${specifier}/package.json`, parentURL);
+		const manifestPath = packageName === specifier ? optionalResourcePath(`${specifier}/package.json`, parentURL) : void 0;
 		const manifest = manifestPath === void 0 ? void 0 : readObject(manifestPath);
 		const title = localizedText("title", dictionaries, fallbackText(manifest?.name), specifier);
 		const description = localizedText("description", dictionaries, fallbackText(manifest?.description), "");
@@ -1981,7 +2085,7 @@ function readPluginMeta(specifier, parentURL) {
 		};
 		let icon;
 		try {
-			icon = manifestPath === void 0 ? void 0 : iconOf(manifest?.icon, manifestPath);
+			icon = iconOf(specifier, packageName, parentURL, manifestPath, manifest?.icon);
 		} catch (error) {
 			return {
 				...text,
@@ -2153,6 +2257,42 @@ function prepareProfilePatches(ctx, patches, parentURL, binName = "dsh") {
 	return rows.length === 0 ? [] : [{ insert: rows }];
 }
 //#endregion
+//#region lib/types/official-bundle-packages.js
+/** Package admission shared by offline catalog generation and release ordering. */
+/** Public DSH release members available through the ordinary on-demand bundle installer. */
+const ON_DEMAND_BUNDLES = ["@deepseek-ai/dsh-subagent-claude-code", "@deepseek-ai/dsh-subagent-codex"];
+//#endregion
+//#region lib/types/official-bundles.generated.js
+/** Generated offline Official bundle metadata. Run pnpm gen-official-bundle-catalog; do not edit. */
+/** Official on-demand entries, independent of installed packages and registry availability. */
+const OFFICIAL_ON_DEMAND_CATALOG = [{
+	packageName: "@deepseek-ai/dsh-subagent-claude-code",
+	meta: {
+		title: {
+			"en": "Claude Code subagent",
+			"zh": "Claude Code 子智能体"
+		},
+		description: {
+			"en": "Delegate one task to Claude Code using its native authentication and settings.",
+			"zh": "使用 Claude Code 原生认证和设置委派单个任务。"
+		},
+		icon: "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMzYiIGhlaWdodD0iMzYiIHZpZXdCb3g9IjAgMCAzNiAzNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48cmVjdCB4PSIxNC45ODkzIiB5PSIxNS4xODc3IiB3aWR0aD0iMTIuMjM2NSIgaGVpZ2h0PSIxMi4yMzY1IiByeD0iMiIgZmlsbD0idXJsKCNkc2hfcGx1Z2luX2FydF9SMGEpIiBmaWxsLW9wYWNpdHk9IjAuOCI+PC9yZWN0PjxyZWN0IHg9IjguODcxMDkiIHk9IjkuMDY5NyIgd2lkdGg9IjEyLjIzNjUiIGhlaWdodD0iMTIuMjM2NSIgcng9IjIiIGZpbGw9InVybCgjZHNoX3BsdWdpbl9hcnRfUjBiKSIgZmlsbC1vcGFjaXR5PSIwLjgiPjwvcmVjdD48ZGVmcz48bGluZWFyR3JhZGllbnQgaWQ9ImRzaF9wbHVnaW5fYXJ0X1IwYSIgeDE9IjIxLjEwNzUiIHkxPSIxNS4xODc3IiB4Mj0iMjEuMTA3NSIgeTI9IjI3LjQyNDMiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBzdG9wLWNvbG9yPSIjNDVFN0E0Ij48L3N0b3A+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjMDU5MDlEIj48L3N0b3A+PC9saW5lYXJHcmFkaWVudD48bGluZWFyR3JhZGllbnQgaWQ9ImRzaF9wbHVnaW5fYXJ0X1IwYiIgeDE9IjE0Ljk4OTQiIHkxPSI5LjA2OTciIHgyPSIxNC45ODk0IiB5Mj0iMjEuMzA2MyIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPjxzdG9wIHN0b3AtY29sb3I9IiM2OUI5RkYiPjwvc3RvcD48c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiMzMjRERTIiPjwvc3RvcD48L2xpbmVhckdyYWRpZW50PjwvZGVmcz48L3N2Zz4K"
+	}
+}, {
+	packageName: "@deepseek-ai/dsh-subagent-codex",
+	meta: {
+		title: {
+			"en": "Codex subagent",
+			"zh": "Codex 子智能体"
+		},
+		description: {
+			"en": "Delegate one task to Codex using its native authentication and settings.",
+			"zh": "使用 Codex 原生认证和设置委派单个任务。"
+		},
+		icon: "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMzYiIGhlaWdodD0iMzYiIHZpZXdCb3g9IjAgMCAzNiAzNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48cmVjdCB4PSIxNC45ODkzIiB5PSIxNS4xODc3IiB3aWR0aD0iMTIuMjM2NSIgaGVpZ2h0PSIxMi4yMzY1IiByeD0iMiIgZmlsbD0idXJsKCNkc2hfcGx1Z2luX2FydF9SMGEpIiBmaWxsLW9wYWNpdHk9IjAuOCI+PC9yZWN0PjxyZWN0IHg9IjguODcxMDkiIHk9IjkuMDY5NyIgd2lkdGg9IjEyLjIzNjUiIGhlaWdodD0iMTIuMjM2NSIgcng9IjIiIGZpbGw9InVybCgjZHNoX3BsdWdpbl9hcnRfUjBiKSIgZmlsbC1vcGFjaXR5PSIwLjgiPjwvcmVjdD48ZGVmcz48bGluZWFyR3JhZGllbnQgaWQ9ImRzaF9wbHVnaW5fYXJ0X1IwYSIgeDE9IjIxLjEwNzUiIHkxPSIxNS4xODc3IiB4Mj0iMjEuMTA3NSIgeTI9IjI3LjQyNDMiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBzdG9wLWNvbG9yPSIjNDVFN0E0Ij48L3N0b3A+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjMDU5MDlEIj48L3N0b3A+PC9saW5lYXJHcmFkaWVudD48bGluZWFyR3JhZGllbnQgaWQ9ImRzaF9wbHVnaW5fYXJ0X1IwYiIgeDE9IjE0Ljk4OTQiIHkxPSI5LjA2OTciIHgyPSIxNC45ODk0IiB5Mj0iMjEuMzA2MyIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPjxzdG9wIHN0b3AtY29sb3I9IiM2OUI5RkYiPjwvc3RvcD48c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiMzMjRERTIiPjwvc3RvcD48L2xpbmVhckdyYWRpZW50PjwvZGVmcz48L3N2Zz4K"
+	}
+}];
+//#endregion
 //#region lib/types/config-schema/native.js
 /** Identity checks at the plugin-export and lazy-builder boundaries. */
 /**
@@ -3209,9 +3349,11 @@ var PluginPackages = class extends Service {
 	packages = /* @__PURE__ */ new Map();
 	interception;
 	disposeWorkerResolution;
+	current;
 	constructor(ctx, config = {}) {
 		super(ctx, "pluginPackages");
 		if (config.resolution === void 0) return;
+		this.current = config.resolution;
 		const interception = installRuntimeInterception(config.resolution);
 		this.disposeWorkerResolution = registerWorkerResolution(config.resolution);
 		this.interception = interception;
@@ -3222,17 +3364,30 @@ var PluginPackages = class extends Service {
 	}
 	/**
 	* Publish a complete successor generation for this process and subsequently created Workers.
-	* Linked roots may be removed without unloading modules or clearing Node caches.
+	* Profile mappings and local package names may be removed after their plugins stop; linked roots may also be removed.
+	* Retained profile mappings may change their declarer, but not their normalized directory, version, or scope;
+	* installation mappings must remain unchanged. Publication does not unload modules or clear Node caches.
 	* @param successor - fully constructed generation accepted by {@link RuntimeInterception.replace}.
 	*/
 	replace(successor) {
 		if (this.interception === void 0) throw new Error("plugin-packages: runtime resolution is not installed");
 		this.interception.replace(successor);
+		this.current = successor;
 		this.packages = /* @__PURE__ */ new Map();
 		this.disposeWorkerResolution?.();
 		this.disposeWorkerResolution = registerWorkerResolution(successor);
 	}
 	/**
+	* Publish the latest generation computed by the installed resolution through {@link replace}. Package contents
+	* and loaded modules are not reloaded.
+	* @throws when no resolution is installed, it is plain data rather than a {@link ProfileRuntimeResolution},
+	* reading the latest files fails, or the successor is rejected. A computed resolution without a profile can refresh.
+	*/
+	async refresh() {
+		if (!(this.current instanceof ProfileRuntimeResolution)) throw new Error("plugin-packages: the installed runtime resolution cannot be recomputed");
+		this.replace(await this.current.computeLatestResolution());
+	}
+	/**
 	* Locate the package named by a specifier without requiring a package export.
 	* @param specifier - module specifier whose package owns the requested module.
 	* @param parentURL - URL whose Node lookup order applies.
@@ -3836,6 +3991,7 @@ const FIBER_DISPOSED = 4;
 const requiredStartupEntryIds = new Set([
 	"agent-loop",
 	"webserver",
+	"web-runtime",
 	"modules",
 	"connection",
 	"headless-runner",
@@ -4134,4 +4290,4 @@ function addHarnessSourceSection(ctx, sourceRoot) {
 	});
 }
 //#endregion
-export { DEFAULT_PROFILE_BUNDLES, FAIL_LOUD_RELEASE_TIMEOUT_MS, HARNESS_SOURCE_SECTION, LOADER_EXPRESSION_SCHEMA, OPTIONAL_BUNDLES, PROFILES_DIR, PROFILE_COMPATIBILITY_FILENAME, PROFILE_PATCH_FILENAME, PROFILE_TEMPLATES, PluginPackages, StartupError, addHarnessSourceSection, auditStartupEntries, boot, bundlePatchFiles, bundlePatchPaths, composeEntries, createConfigProjector, createRuntimeResolution, evaluatePluginCompatibility, generateConfigSchema, getDshRuntimeVersion, initProfile, installFailLoud, isNativeConfigSchema, loadEnv, loadLayeredEnv, loadOptionalPatches, loadOverlayPatches, loadProfile, loadProfileDirectory, mountRootInclude, pluginCompatibilityWarning, prepareProfileEntries, prepareProfilePatches, readPluginMeta, readProfileCompatibility, readProfileManifest, readProfilePatches, readProfilePlugins, readProfileVersionExemptions, reconcileProfilePatches, reconcileProfilePlugins, removeLinkProjections, renderConfigDump, reportSkippedBundles, resolveBundleDir, resolveConfigPath, resolveProfileDir, resolveTelemetryPatch, sanitizeProfile, setProfileVersionExemption, writeProfileBundles, writeProfileManifest };
+export { DEFAULT_PROFILE_BUNDLES, FAIL_LOUD_RELEASE_TIMEOUT_MS, HARNESS_SOURCE_SECTION, LOADER_EXPRESSION_SCHEMA, OFFICIAL_ON_DEMAND_CATALOG, ON_DEMAND_BUNDLES, OPTIONAL_BUNDLES, PROFILES_DIR, PROFILE_COMPATIBILITY_FILENAME, PROFILE_PATCH_FILENAME, PROFILE_TEMPLATES, PluginPackages, ProfileRuntimeResolution, StartupError, addHarnessSourceSection, auditStartupEntries, boot, bundlePatchFiles, bundlePatchPaths, composeEntries, createConfigProjector, createRuntimeResolution, evaluatePluginCompatibility, generateConfigSchema, getDshRuntimeVersion, initProfile, installFailLoud, isNativeConfigSchema, loadEnv, loadLayeredEnv, loadOptionalPatches, loadOverlayPatches, loadProfile, loadProfileDirectory, mountRootInclude, pluginCompatibilityWarning, prepareProfileEntries, prepareProfilePatches, readPluginMeta, readProfileCompatibility, readProfileManifest, readProfilePatches, readProfilePlugins, readProfileVersionExemptions, reconcileProfilePatches, reconcileProfilePlugins, removeLinkProjections, renderConfigDump, reportSkippedBundles, resolveBundleDir, resolveConfigPath, resolvePluginResource, resolveProfileDir, resolveTelemetryPatch, sanitizeProfile, setProfileVersionExemption, writeProfileBundles, writeProfileManifest };

package/lib/types/index.d.ts

@@ -15,7 +15,8 @@ export { sanitizeProfile } from './profile-sanitize.ts';
 export { getDshRuntimeVersion, evaluatePluginCompatibility, pluginCompatibilityWarning, type PluginCompatibility } from './plugin-compatibility.ts';
 export { PROFILE_COMPATIBILITY_FILENAME, readProfileCompatibility, readProfileVersionExemptions, setProfileVersionExemption, type ProfileCompatibility, } from './profile-compatibility.ts';
 export { prepareProfileEntries, prepareProfilePatches } from './compatibility-preflight.ts';
-export { readPluginMeta } from './package-meta.ts';
+export { readPluginMeta, resolvePluginResource } from './package-meta.ts';
+export { ON_DEMAND_BUNDLES, OFFICIAL_ON_DEMAND_CATALOG, type OfficialBundleCatalogEntry } from './official-bundles.ts';
 export { generateConfigSchema, type ConfigSchemaDump, type NativeConfigSchema } from './config-schema/index.ts';
 export { createConfigProjector, LOADER_EXPRESSION_SCHEMA, type ConfigProjection } from './config-schema/projector.ts';
 export { isNativeConfigSchema } from './config-schema/native.ts';
@@ -34,7 +35,7 @@ declare module '@deepseek-ai/cordis' {
         'app-boot/config-reload'(): void;
     }
 }
-export { composeEntries, createRuntimeResolution, DEFAULT_PROFILE_BUNDLES, OPTIONAL_BUNDLES, bundlePatchFiles, bundlePatchPaths, initProfile, removeLinkProjections, loadProfile, loadProfileDirectory, PROFILE_PATCH_FILENAME, PROFILE_TEMPLATES, PROFILES_DIR, readProfileManifest, reportSkippedBundles, resolveBundleDir, resolveProfileDir, writeProfileManifest, type Profile, type ProfileLayer, type SkippedBundle, type ProfileManifest, type LinkedRoot, type RuntimeResolutionOptions, type RuntimeResolutionEntry, type RuntimeResolution, type ProfileTemplate, } from './profile.ts';
+export { composeEntries, createRuntimeResolution, ProfileRuntimeResolution, DEFAULT_PROFILE_BUNDLES, OPTIONAL_BUNDLES, bundlePatchFiles, bundlePatchPaths, initProfile, removeLinkProjections, loadProfile, loadProfileDirectory, PROFILE_PATCH_FILENAME, PROFILE_TEMPLATES, PROFILES_DIR, readProfileManifest, reportSkippedBundles, resolveBundleDir, resolveProfileDir, writeProfileManifest, type Profile, type ProfileLayer, type SkippedBundle, type ProfileManifest, type LinkedRoot, type RuntimeResolutionOptions, type RuntimeResolutionEntry, type RuntimeResolution, type ProfileTemplate, } from './profile.ts';
 export { PluginPackages, type PluginPackage, type PluginPackagesConfig, } from './profile-resolution/service.ts';
 /**
  * Resolve the config to boot. Replay swaps a `cordis.yml` basename for

package/lib/types/official-bundle-packages.d.ts

@@ -0,0 +1,4 @@
+/** Package admission shared by offline catalog generation and release ordering. */
+/** Public DSH release members available through the ordinary on-demand bundle installer. */
+export declare const ON_DEMAND_BUNDLES: readonly string[];
+//# sourceMappingURL=official-bundle-packages.d.ts.map

package/lib/types/official-bundles.d.ts

@@ -0,0 +1,12 @@
+/** Official bundles offered without installing their provider runtimes in the DSH distribution. */
+import type { PluginLocalizedMeta } from '@deepseek-ai/dsh-package-manifest';
+export { ON_DEMAND_BUNDLES } from './official-bundle-packages.ts';
+/** Offline discovery metadata; installation state and the requested version belong to the running host. */
+export interface OfficialBundleCatalogEntry {
+    /** Exact npm package name accepted by the existing bundle installer. */
+    readonly packageName: string;
+    /** Package-owned localized text and a self-contained icon, embedded without provider code. */
+    readonly meta: Required<Pick<PluginLocalizedMeta, 'title' | 'description' | 'icon'>>;
+}
+export { OFFICIAL_ON_DEMAND_CATALOG } from './official-bundles.generated.ts';
+//# sourceMappingURL=official-bundles.d.ts.map

package/lib/types/official-bundles.generated.d.ts

@@ -0,0 +1,5 @@
+/** Generated offline Official bundle metadata. Run pnpm gen-official-bundle-catalog; do not edit. */
+import type { OfficialBundleCatalogEntry } from './official-bundles.ts';
+/** Official on-demand entries, independent of installed packages and registry availability. */
+export declare const OFFICIAL_ON_DEMAND_CATALOG: readonly OfficialBundleCatalogEntry[];
+//# sourceMappingURL=official-bundles.generated.d.ts.map

package/lib/types/package-meta.d.ts

@@ -2,24 +2,28 @@
 import type { PluginLocalizedMeta } from '@deepseek-ai/dsh-package-manifest';
 /**
  * Resolve a plugin resource through the active Node ESM resolver without evaluating it.
- * @param specifier - complete resource module specifier, including its locale filename.
+ * @param specifier - plugin module or exported resource specifier.
  * @param parentURL - owning module-resolution base.
  * @returns the local filesystem path selected by Node and the active profile.
  * @throws when the resolver is unavailable or the resource cannot resolve to a local file.
  */
 export declare function resolvePluginResource(specifier: string, parentURL: string): string;
 /**
- * Read localized display text and the icon declared in a plugin's exported package.json.
- * Icons are manifest-relative SVG, PNG, JPEG, or WebP files of at most 256 KiB,
- * contained in the manifest directory after realpath resolution. Icon failures retain display text.
+ * Read plugin locale JSON display text and icon without evaluating JavaScript entries.
+ * Only a package-root specifier reads its exported package.json: `name`/`description` fill missing
+ * locale fields, and a declared `icon` takes priority over the `<specifier>/icon` resource.
+ * A subpath specifier never reads package.json; its icon comes only from `<specifier>/icon`.
+ * Manifest icons remain inside their declaring directory; exported icons remain inside their
+ * owning package after realpath resolution. Both accept SVG, PNG, JPEG, or WebP up to 256 KiB.
+ * Icon failures retain display text without falling back.
  * Non-package specifiers are skipped without invoking the resource resolver.
  * Language files share the directory containing the resolved English resource;
  * each file is resolved through the complete plugin specifier before reading.
- * Missing fields use the same address's package.json name/description. Translation
- * maps retain an English fallback, ultimately the full module specifier for titles and empty for descriptions.
+ * Translation maps retain an English fallback, ultimately the full module specifier
+ * for titles and empty for descriptions.
  * @param specifier - configured plugin module name, including any package subpath.
  * @param parentURL - owning Loader tree's module-resolution base.
- * @returns display fields and any icon diagnostic, or undefined for non-package specifiers or absent metadata.
+ * @returns display fields and any resource diagnostic, or undefined for non-package specifiers or absent metadata.
  */
 export declare function readPluginMeta(specifier: string, parentURL: string): PluginLocalizedMeta | undefined;
 //# sourceMappingURL=package-meta.d.ts.map

package/lib/types/profile-resolution/legacy-links.d.ts

@@ -1,8 +1,15 @@
-/** Package directory canonicalization through the active runtime carrier's filesystem. */
+/** Package directory and resource canonicalization through the active runtime carrier's filesystem. */
 /**
  * Resolve a directory through the active carrier's filesystem implementation.
  * @param path - directory path to canonicalize.
  * @returns the canonical directory path.
  */
 export declare function realModuleDirectory(path: string): string;
+/** Canonicalize a module resource, preserving physical file aliases.
+ * SEA archive files are symlink-free and support stat and reads, while their containing directories support realpath.
+ * @param path Existing module resource path.
+ * @returns Canonical resource path under the active carrier's filesystem.
+ * @throws When the resource or its directory cannot be inspected or resolved.
+ */
+export declare function realModuleFile(path: string): string;
 //# sourceMappingURL=legacy-links.d.ts.map

package/lib/types/profile-resolution/resolver.d.ts

@@ -11,11 +11,14 @@ export interface RuntimeInterception {
      */
     packageDir(specifier: string, parentURL: string): string | undefined;
     /**
-     * Atomically publish a complete successor and fresh caches. Linked roots may be added or removed.
-     * Removed roots stop intercepting uncovered directories; existing modules and Node caches remain intact.
-     * @param successor - fully constructed generation retaining existing package mappings and local names.
-     * @throws when the profile scope or existing mappings change, local names are removed or override
-     * existing mappings, or a previously published link name selects a different real directory.
+     * Atomically publish a complete successor and fresh caches. Profile-scoped mappings, local names, and linked
+     * roots may be removed; removed roots stop intercepting uncovered directories. Existing modules and Node caches
+     * remain intact, so callers remove a package only after its plugins stop.
+     * A retained profile mapping may change its declarer if its normalized directory, version, and scope stay unchanged.
+     * @param successor - fully constructed generation retaining the installation mappings.
+     * @throws when the profile scope, a retained directory, version, scope, or installation declarer changes;
+     * an installation mapping is removed; a new local name overrides an existing mapping; or a previously published
+     * link name selects a different real directory.
      */
     replace(successor: RuntimeResolution): void;
     /** Restore the native resolver methods. Interceptions dispose in reverse order. */

package/lib/types/profile-resolution/service.d.ts

@@ -1,7 +1,7 @@
 /** Package metadata resolved through one runtime interception. */
 import { Service, type Context } from '@deepseek-ai/cordis';
 import type { PluginLocalizedMeta } from '@deepseek-ai/dsh-package-manifest';
-import type { RuntimeResolution } from '../profile.ts';
+import { type RuntimeResolution } from '../profile.ts';
 declare module '@deepseek-ai/cordis' {
     interface Context {
         /** Deterministic package lookup for configured plugin specifiers. */
@@ -31,13 +31,23 @@ export declare class PluginPackages extends Service {
     private packages;
     private readonly interception;
     private disposeWorkerResolution;
+    private current;
     constructor(ctx: Context, config?: PluginPackagesConfig);
     /**
      * Publish a complete successor generation for this process and subsequently created Workers.
-     * Linked roots may be removed without unloading modules or clearing Node caches.
+     * Profile mappings and local package names may be removed after their plugins stop; linked roots may also be removed.
+     * Retained profile mappings may change their declarer, but not their normalized directory, version, or scope;
+     * installation mappings must remain unchanged. Publication does not unload modules or clear Node caches.
      * @param successor - fully constructed generation accepted by {@link RuntimeInterception.replace}.
      */
     replace(successor: RuntimeResolution): void;
+    /**
+     * Publish the latest generation computed by the installed resolution through {@link replace}. Package contents
+     * and loaded modules are not reloaded.
+     * @throws when no resolution is installed, it is plain data rather than a {@link ProfileRuntimeResolution},
+     * reading the latest files fails, or the successor is rejected. A computed resolution without a profile can refresh.
+     */
+    refresh(): Promise<void>;
     /**
      * Locate the package named by a specifier without requiring a package export.
      * @param specifier - module specifier whose package owns the requested module.

package/lib/types/profile.d.ts

@@ -175,7 +175,37 @@ export interface RuntimeResolutionOptions {
  * @param options - installation anchor, optional loaded profile, and Harness home.
  * @returns the complete immutable runtime resolution.
  */
-export declare function createRuntimeResolution(options: RuntimeResolutionOptions): Promise<RuntimeResolution>;
+export declare function createRuntimeResolution(options: RuntimeResolutionOptions): Promise<ProfileRuntimeResolution>;
+/** Inputs a {@link ProfileRuntimeResolution} reuses to compute its successor. */
+interface ResolutionSource {
+    installAnchor: string;
+    home: string;
+    profileDir: string | undefined;
+}
+/**
+ * A runtime resolution that remembers the inputs it was computed from. Worker environment data carries only its
+ * fields; the inputs stay private to the thread that computed it.
+ */
+export declare class ProfileRuntimeResolution implements RuntimeResolution {
+    #private;
+    readonly profilesDir: string;
+    readonly profileDir: string | undefined;
+    readonly localPackageNames: readonly string[];
+    readonly entries: readonly RuntimeResolutionEntry[];
+    readonly linkedRoots: readonly LinkedRoot[];
+    /**
+     * @param source - inputs of {@link createRuntimeResolution}, reused by {@link computeLatestResolution}.
+     * @param table - the computed package table.
+     */
+    constructor(source: ResolutionSource, table: RuntimeResolution);
+    /**
+     * Compute the latest generation from the same installation, profile directory, and Harness home, rereading the
+     * profile's manifest, bundle selection, and installed packages from disk, without retaining synthetic layers.
+     * With no profile directory, only installation packages are recomputed. This instance is unchanged.
+     * @returns a new resolution for the latest generation.
+     */
+    computeLatestResolution(): Promise<ProfileRuntimeResolution>;
+}
 /**
  * Read a profile's manifest.
  * @param binName - the diagnostic prefix on the thrown error.
@@ -206,7 +236,8 @@ export declare function resolveBundleDir(binName: string, packageName: string, i
  * Load an already initialized profile directory without resolving it through
  * the shared Harness home. This is used by application-owned profiles whose
  * package project and lifecycle belong to that application.
- * Unreadable bundles, and bundles whose own dsh peers the profile does not exempt, are skipped
+ * Retired bundles are removed from the stored bundle list first, rewriting the
+ * manifest when it listed one. Unreadable bundles, and bundles whose own dsh peers the profile does not exempt, are skipped
  * without changing the manifest and listed in `skippedBundles`; nothing is printed.
  * @param binName - the diagnostic prefix on thrown errors.
  * @param dir - absolute profile package directory.
@@ -242,4 +273,5 @@ export declare function loadProfile(binName: string, name: string, installAnchor
  * @returns the composed entry list.
  */
 export declare function composeEntries(layers: readonly PatchOptions[][], warn?: (message: string) => void): EntryOptions[];
+export {};
 //# sourceMappingURL=profile.d.ts.map

package/lib/worker/profile-resolution-bootstrap.js

@@ -249,10 +249,10 @@ var ResolutionRouter = class {
 		if (successor.profilesDir !== this.current.profilesDir || successor.profileDir !== this.current.profileDir) throw new Error("profile resolution: a successor cannot change its profile scope");
 		for (const [name, current] of this.current.entries) {
 			const next = entries.get(name);
-			if (next === void 0 || !sameResolution(current.packageDir, next.packageDir) || !sameResolution(current.declarer, next.declarer) || current.version !== next.version || current.scope !== next.scope) throw new Error(`profile resolution: replacing ${JSON.stringify(name)} requires a process restart`);
+			if (next === void 0 && current.scope === "profile") continue;
+			if (next === void 0 || !sameResolution(current.packageDir, next.packageDir) || current.scope === "installation" && !sameResolution(current.declarer, next.declarer) || current.version !== next.version || current.scope !== next.scope) throw new Error(`profile resolution: replacing ${JSON.stringify(name)} requires a process restart`);
 		}
 		const localPackageNames = new Set(successor.localPackageNames);
-		for (const name of this.current.localPackageNames) if (!localPackageNames.has(name)) throw new Error(`profile resolution: removing local package ${JSON.stringify(name)} requires a process restart`);
 		for (const name of localPackageNames) if (!this.current.localPackageNames.has(name) && this.current.entries.has(name)) throw new Error(`profile resolution: overriding ${JSON.stringify(name)} locally requires a process restart`);
 		for (const root of successor.linkedRoots) {
 			const previous = this.linkedTargets.get(root.name);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-app-boot",
   "description": "Shared boot glue for the app bins: .env loading, fail-loud Loader guards, snapshot-aware config resolution, and the Loader boot sequence",
-  "version": "0.2.0-rc.2",
+  "version": "0.2.1-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -32,35 +32,35 @@
   ],
   "license": "MIT",
   "dependencies": {
+    "@deepseek-ai/dsh-atomic-write": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-package-manifest": "0.2.1-alpha.2",
     "@eslint-community/regexpp": "^4.12.2",
     "ajv": "^8.20.0",
-    "js-yaml": "^4.2.0",
-    "node-addon-require-builtin": "^0.1.6",
+    "js-yaml": "^4.3.2",
+    "node-addon-require-builtin": "^0.1.9",
     "resolve.exports": "^2.0.3",
-    "semver": "^7.8.5",
-    "@deepseek-ai/dsh-package-manifest": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-atomic-write": "0.2.0-rc.2"
+    "semver": "^7.8.5"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis-plugin-group": "~1.0.4",
-    "@deepseek-ai/cordis-plugin-include": "~1.0.9",
-    "@deepseek-ai/cordis-plugin-loader": "~1.0.5",
-    "@deepseek-ai/dsh-launch-environment": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-home-paths": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "0.2.0-rc.2",
-    "@deepseek-ai/cordis": "~4.0.4"
+    "@deepseek-ai/cordis-plugin-group": "~1.0.5-alpha.1",
+    "@deepseek-ai/cordis-plugin-include": "~1.0.10-alpha.1",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1",
+    "@deepseek-ai/dsh-launch-environment": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-home-paths": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.2",
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1"
   },
   "devDependencies": {
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.1",
+    "@deepseek-ai/cordis-plugin-group": "~1.0.5-alpha.1",
+    "@deepseek-ai/cordis-plugin-include": "~1.0.10-alpha.1",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1",
+    "@deepseek-ai/cordis-plugin-timer": "~1.1.7-alpha.1",
+    "@deepseek-ai/dsh-launch-environment": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-home-paths": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.2",
     "@types/js-yaml": "^4.0.9",
     "@types/semver": "^7.8.0",
-    "@deepseek-ai/schemastery": "~3.18.4",
-    "@deepseek-ai/cordis-plugin-group": "~1.0.4",
-    "@deepseek-ai/cordis-plugin-include": "~1.0.9",
-    "@deepseek-ai/cordis-plugin-loader": "~1.0.5",
-    "@deepseek-ai/dsh-launch-environment": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-home-paths": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "0.2.0-rc.2",
-    "@deepseek-ai/cordis": "~4.0.4",
-    "@deepseek-ai/cordis-plugin-timer": "~1.1.6"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1"
   }
 }