@deepseek-ai/dsh-app-boot 0.2.1-rc.5 → 0.2.2-alpha.3

package/lib/index.js

@@ -2,65 +2,509 @@ import { createRequire, isBuiltin } from "node:module";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import fs, { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { inspect, parseEnv } from "node:util";
+import { Context, Service } from "@deepseek-ai/cordis";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
 import * as yaml from "js-yaml";
 import { load } from "js-yaml";
-import { Context, Service } from "@deepseek-ai/cordis";
 import Loader, { EntryGroup, EntryTree, ModuleLoader, isJsExpr } from "@deepseek-ai/cordis-plugin-loader";
-import { access, constants, mkdir, readFile, realpath, rename, writeFile } from "node:fs/promises";
+import { access, constants, mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import Group from "@deepseek-ai/cordis-plugin-group";
 import { dshHomePath, resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { createLaunchEnvironmentSnapshot } from "@deepseek-ai/dsh-launch-environment";
+import { INSTALLATION_OWNED_PROFILE_TUPLES, PROFILE_TEMPLATES, RETIRED_BUNDLES } from "@deepseek-ai/dsh-official-bundles";
 import semver, { parse } from "semver";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { getEnvironmentData, setEnvironmentData } from "node:worker_threads";
 import { imports } from "resolve.exports";
-//#region ../../../vendor/include/src/index.ts
-const JsExpr = new yaml.Type("tag:yaml.org,2002:js", {
-	kind: "scalar",
-	resolve: (data) => typeof data === "string",
-	construct: (data) => ({ __jsExpr: data }),
-	predicate: isJsExpr,
-	represent: (data) => data["__jsExpr"]
-});
+//#region lib/types/startup-diagnostics.js
+/** Configuration-free snapshots captured before a failed startup disposes its plugins. */
+function stateName(state) {
+	return {
+		0: "pending",
+		1: "loading",
+		2: "active",
+		3: "failed",
+		4: "disposed",
+		5: "unloading"
+	}[state];
+}
+function pluginState(ctx, entry) {
+	let state;
+	try {
+		state = entry.disabled ? "disabled" : entry.fiber === void 0 ? "failed" : stateName(entry.fiber.state);
+	} catch (_error) {
+		state = "failed";
+	}
+	let version = "unknown";
+	const source = entry.parent.tree.ctx.baseUrl;
+	try {
+		if (source !== void 0) version = ctx.get("pluginPackages")?.packageOf(entry.options.name, source)?.version ?? "unknown";
+	} catch (_error) {}
+	const fiber = entry.fiber;
+	return {
+		id: entry.id,
+		module: entry.options.name,
+		version,
+		state,
+		source: source ?? "unknown",
+		missing: state === "pending" && fiber !== void 0 ? Object.keys(fiber.inject).filter((name) => fiber.ctx.get(name) === void 0) : []
+	};
+}
 /**
-* The entry-list YAML dialect: `!!js` scalars round-trip as expression nodes
-* the Loader evaluates at entry activation. Exported so config tooling
-* (`dsh --dump-config`) parses and prints exactly the dialect this include
-* mounts.
+* Capture Loader state and registered service ownership before teardown.
+* Providers that never registered cannot be inferred from their package names.
+* @param ctx - Live application context with its Loader still mounted.
+* @returns At most 256 plugin rows and 256 missing-service observations, with omission counts.
 */
-const entryListSchema = yaml.JSON_SCHEMA.extend(JsExpr);
-const schema = entryListSchema;
-const writable = {
-	".json": "application/json",
-	".yaml": "application/yaml",
-	".yml": "application/yaml"
-};
-const supported = new Set(Object.keys(writable));
-const WRITE_RETRY_LIMIT = 10;
-const WRITE_RETRY_DELAY_MS = 50;
-function retryableWriteError(error) {
-	const code = error?.code;
-	return code === "EACCES" || code === "EBUSY" || code === "EPERM";
+function captureStartupComposition(ctx) {
+	const rows = [...ctx.loader.entries()].map((entry) => ({
+		entry,
+		state: pluginState(ctx, entry)
+	}));
+	rows.sort((a, b) => Number(a.state.state === "active") - Number(b.state.state === "active"));
+	const services = [];
+	let omittedServices = 0;
+	const store = ctx.reflect.store;
+	for (const { entry, state } of rows) {
+		const fiber = entry.fiber;
+		if (fiber === void 0) continue;
+		for (const service of state.missing) {
+			if (services.length === 256) {
+				omittedServices++;
+				continue;
+			}
+			const scope = fiber.ctx[Context.isolate][service];
+			const providers = [];
+			for (const key of Object.getOwnPropertySymbols(store)) {
+				const impl = store[key];
+				if (impl?.name !== service) continue;
+				providers.push({
+					entry: impl.ctx.fiber.entry?.id ?? "unknown",
+					state: stateName(impl.ctx.fiber.state),
+					visibility: key === scope ? "same-scope" : "other-scope"
+				});
+			}
+			services.push({
+				consumer: state.id,
+				service,
+				providers
+			});
+		}
+	}
+	return {
+		plugins: rows.slice(0, 256).map((row) => row.state),
+		services,
+		omittedPlugins: Math.max(0, rows.length - 256),
+		omittedServices
+	};
+}
+//#endregion
+//#region ../../../vendor/cosmokit/src/misc.ts
+/** Return true when a value is `null` or `undefined`. */
+function isNullable(value) {
+	return value === null || value === void 0;
+}
+/** Omit selected keys from a shallow object copy. */
+function omit(source, keys) {
+	if (!keys) return { ...source };
+	const result = { ...source };
+	for (const key of keys) Reflect.deleteProperty(result, key);
+	return result;
+}
+//#endregion
+//#region ../../../vendor/cosmokit/src/volatile.ts
+/** Shared config references used by schema validators and plugin runtimes. */
+const write = Symbol.for("cosmokit.volatile.write");
+/**
+* Identify references across ESM/CJS copies of the shared library.
+* @param value - a parsed config value.
+* @returns whether the value implements the shared reference protocol.
+*/
+function isVolatile(value) {
+	return typeof value === "object" && value !== null && write in value;
+}
+//#endregion
+//#region ../../../vendor/cosmokit/src/types.ts
+/** Test values using `instanceof` with a `toStringTag` fallback. */
+function is(type, value) {
+	if (arguments.length === 1) return (value) => is(type, value);
+	return type in globalThis && value instanceof globalThis[type] || Object.prototype.toString.call(value).slice(8, -1) === type;
+}
+function isArrayBufferLike(value) {
+	return is("ArrayBuffer", value) || is("SharedArrayBuffer", value);
+}
+function isArrayBufferSource(value) {
+	return isArrayBufferLike(value) || ArrayBuffer.isView(value);
+}
+let Binary;
+(function(_Binary) {
+	_Binary.is = isArrayBufferLike;
+	_Binary.isSource = isArrayBufferSource;
+	function fromSource(source) {
+		if (ArrayBuffer.isView(source)) return source.buffer.slice(source.byteOffset, source.byteOffset + source.byteLength);
+		else return source;
+	}
+	_Binary.fromSource = fromSource;
+	function toBase64(source) {
+		source = fromSource(source);
+		if (typeof Buffer !== "undefined") return Buffer.from(source).toString("base64");
+		let binary = "";
+		const bytes = new Uint8Array(source);
+		for (let i = 0; i < bytes.byteLength; i++) binary += String.fromCharCode(bytes[i]);
+		return btoa(binary);
+	}
+	_Binary.toBase64 = toBase64;
+	function fromBase64(source) {
+		if (typeof Buffer !== "undefined") return fromSource(Buffer.from(source, "base64"));
+		return Uint8Array.from(atob(source), (c) => c.charCodeAt(0));
+	}
+	_Binary.fromBase64 = fromBase64;
+	function toHex(source) {
+		source = fromSource(source);
+		if (typeof Buffer !== "undefined") return Buffer.from(source).toString("hex");
+		return Array.from(new Uint8Array(source), (byte) => byte.toString(16).padStart(2, "0")).join("");
+	}
+	_Binary.toHex = toHex;
+	function fromHex(source) {
+		if (typeof Buffer !== "undefined") return fromSource(Buffer.from(source, "hex"));
+		const hex = source.length % 2 === 0 ? source : source.slice(0, source.length - 1);
+		const buffer = [];
+		for (let i = 0; i < hex.length; i += 2) buffer.push(parseInt(`${hex[i]}${hex[i + 1]}`, 16));
+		return Uint8Array.from(buffer).buffer;
+	}
+	_Binary.fromHex = fromHex;
+})(Binary || (Binary = {}));
+Binary.fromBase64;
+Binary.toBase64;
+Binary.fromHex;
+Binary.toHex;
+/**
+* Compare values recursively, treating two volatile references as equal regardless of value.
+* Strict comparison distinguishes null/undefined, treats opaque objects by identity,
+* compares URLs by normalized href, treats array holes as undefined, and considers distinct cyclic structures unequal.
+* @param a - first value.
+* @param b - second value.
+* @param strict - whether to require strict data equality outside volatile references.
+* @returns whether the values compare equal.
+*/
+function deepEqual(a, b, strict) {
+	const ancestors = /* @__PURE__ */ new Set();
+	function compare(a, b) {
+		if (a === b) return true;
+		if (isVolatile(a) || isVolatile(b)) return isVolatile(a) && isVolatile(b);
+		if (!strict && isNullable(a) && isNullable(b)) return true;
+		if (typeof a !== typeof b || typeof a !== "object" || !a || !b) return false;
+		if (ancestors.has(a)) return false;
+		function check(test, then) {
+			return test(a) ? test(b) ? then(a, b) : false : test(b) ? false : void 0;
+		}
+		ancestors.add(a);
+		try {
+			return check(Array.isArray, (a, b) => {
+				if (a.length !== b.length) return false;
+				for (let index = 0; index < a.length; index++) if (!compare(a[index], b[index])) return false;
+				return true;
+			}) ?? check(is("Date"), (a, b) => a.valueOf() === b.valueOf()) ?? check(is("URL"), (a, b) => a.href === b.href) ?? check(is("RegExp"), (a, b) => a.source === b.source && a.flags === b.flags) ?? check(isArrayBufferLike, (a, b) => {
+				if (a.byteLength !== b.byteLength) return false;
+				const viewA = new Uint8Array(a);
+				const viewB = new Uint8Array(b);
+				for (let i = 0; i < viewA.length; i++) if (viewA[i] !== viewB[i]) return false;
+				return true;
+			}) ?? ((!strict || [a, b].every((value) => Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null)) && Object.keys({
+				...a,
+				...b
+			}).every((key) => compare(a[key], b[key])));
+		} finally {
+			ancestors.delete(a);
+		}
+	}
+	return compare(a, b);
+}
+//#endregion
+//#region ../../../vendor/cosmokit/src/time.ts
+let Time;
+(function(_Time) {
+	_Time.millisecond = 1;
+	const second = _Time.second = 1e3;
+	const minute = _Time.minute = second * 60;
+	const hour = _Time.hour = minute * 60;
+	const day = _Time.day = hour * 24;
+	const week = _Time.week = day * 7;
+	let timezoneOffset = (/* @__PURE__ */ new Date()).getTimezoneOffset();
+	function setTimezoneOffset(offset) {
+		timezoneOffset = offset;
+	}
+	_Time.setTimezoneOffset = setTimezoneOffset;
+	function getTimezoneOffset() {
+		return timezoneOffset;
+	}
+	_Time.getTimezoneOffset = getTimezoneOffset;
+	function getDateNumber(date = /* @__PURE__ */ new Date(), offset) {
+		if (typeof date === "number") date = new Date(date);
+		if (offset === void 0) offset = timezoneOffset;
+		return Math.floor((date.valueOf() / minute - offset) / 1440);
+	}
+	_Time.getDateNumber = getDateNumber;
+	function fromDateNumber(value, offset) {
+		const date = new Date(value * day);
+		if (offset === void 0) offset = timezoneOffset;
+		return new Date(+date + offset * minute);
+	}
+	_Time.fromDateNumber = fromDateNumber;
+	const numeric = /\d+(?:\.\d+)?/.source;
+	const timeRegExp = new RegExp(`^${[
+		"w(?:eek(?:s)?)?",
+		"d(?:ay(?:s)?)?",
+		"h(?:our(?:s)?)?",
+		"m(?:in(?:ute)?(?:s)?)?",
+		"s(?:ec(?:ond)?(?:s)?)?"
+	].map((unit) => `(${numeric}${unit})?`).join("")}$`);
+	function parseTime(source) {
+		const capture = timeRegExp.exec(source);
+		if (!capture) return 0;
+		return (parseFloat(capture[1]) * week || 0) + (parseFloat(capture[2]) * day || 0) + (parseFloat(capture[3]) * hour || 0) + (parseFloat(capture[4]) * minute || 0) + (parseFloat(capture[5]) * second || 0);
+	}
+	_Time.parseTime = parseTime;
+	function parseDate(date) {
+		const parsed = parseTime(date);
+		if (parsed) date = Date.now() + parsed;
+		else if (/^\d{1,2}(:\d{1,2}){1,2}$/.test(date)) date = `${(/* @__PURE__ */ new Date()).toLocaleDateString()}-${date}`;
+		else if (/^\d{1,2}-\d{1,2}-\d{1,2}(:\d{1,2}){1,2}$/.test(date)) date = `${(/* @__PURE__ */ new Date()).getFullYear()}-${date}`;
+		return date ? new Date(date) : /* @__PURE__ */ new Date();
+	}
+	_Time.parseDate = parseDate;
+	function format(ms) {
+		const abs = Math.abs(ms);
+		if (abs >= day - hour / 2) return Math.round(ms / day) + "d";
+		else if (abs >= hour - minute / 2) return Math.round(ms / hour) + "h";
+		else if (abs >= minute - second / 2) return Math.round(ms / minute) + "m";
+		else if (abs >= second) return Math.round(ms / second) + "s";
+		return ms + "ms";
+	}
+	_Time.format = format;
+	function toDigits(source, length = 2) {
+		return source.toString().padStart(length, "0");
+	}
+	_Time.toDigits = toDigits;
+	function template(template, time = /* @__PURE__ */ new Date()) {
+		return template.replace("yyyy", time.getFullYear().toString()).replace("yy", time.getFullYear().toString().slice(2)).replace("MM", toDigits(time.getMonth() + 1)).replace("dd", toDigits(time.getDate())).replace("hh", toDigits(time.getHours())).replace("mm", toDigits(time.getMinutes())).replace("ss", toDigits(time.getSeconds())).replace("SSS", toDigits(time.getMilliseconds(), 3));
+	}
+	_Time.template = template;
+})(Time || (Time = {}));
+//#endregion
+//#region ../../../vendor/include/src/journal.ts
+function diffOptions(legacy, options) {
+	const changes = {};
+	for (const key of new Set([...Object.keys(legacy), ...Object.keys(options)])) {
+		if (key === "id") continue;
+		if (deepEqual(legacy[key], options[key])) continue;
+		changes[key] = options[key];
+	}
+	return changes;
+}
+/** Fold a later record into an earlier one for the same entry. */
+function mergeRecords(older, newer) {
+	if (!older) return newer;
+	if (newer.kind === "remove") return older.kind === "upsert" && older.created ? void 0 : newer;
+	if (older.kind === "remove") return {
+		...newer,
+		created: false
+	};
+	const relocated = newer.parent !== void 0;
+	return {
+		kind: "upsert",
+		created: older.created,
+		parent: relocated ? newer.parent : older.parent,
+		position: relocated ? newer.position : older.position,
+		changes: {
+			...older.changes,
+			...newer.changes
+		}
+	};
+}
+function merge(journal, id, record) {
+	const merged = mergeRecords(journal.get(id), record);
+	if (merged) journal.set(id, merged);
+	else journal.delete(id);
+}
+function record$1(journal, change, parent) {
+	const { id, options, legacy } = change;
+	if (!options) return merge(journal, id, { kind: "remove" });
+	const position = change.group.data.indexOf(options);
+	if (!legacy) return merge(journal, id, {
+		kind: "upsert",
+		created: true,
+		parent,
+		position,
+		changes: omit(options, ["id"])
+	});
+	merge(journal, id, {
+		kind: "upsert",
+		created: false,
+		parent: change.from ? parent : void 0,
+		position,
+		changes: diffOptions(legacy, options)
+	});
+}
+/** Index every entry (including nested group members) by id. */
+function flatten(data, parent = null, result = /* @__PURE__ */ new Map()) {
+	data.forEach((options, position) => {
+		if (options.id) result.set(options.id, {
+			parent,
+			position,
+			options,
+			list: data
+		});
+		if (options.group && Array.isArray(options.config)) flatten(options.config, options.id ?? null, result);
+	});
+	return result;
+}
+function applyChanges(options, changes, filter) {
+	for (const [key, value] of Object.entries(changes)) {
+		if (filter && !filter(key)) continue;
+		if (value === void 0) delete options[key];
+		else options[key] = value;
+	}
+}
+function detach(data, id) {
+	const flat = flatten(data).get(id);
+	if (!flat) return;
+	flat.list.splice(flat.list.indexOf(flat.options), 1);
+	return flat.options;
+}
+/**
+* Insert `options` under `parent` (a group id, or `null` for the root) at
+* `position`, clamped to the group's length. Returns false when the parent
+* group does not exist.
+*/
+function place(data, options, parent, position) {
+	let list = data;
+	if (parent !== null) {
+		const group = flatten(data).get(parent);
+		if (!group?.options.group) return false;
+		list = group.options.config ??= [];
+	}
+	list.splice(Math.min(position, list.length), 0, options);
+	return true;
+}
+/**
+* Overlay a journal onto `data` in place. `filter(id, key)` restricts which
+* changes apply; `key` is `null` when asking about the entry as a whole
+* (creation, removal, relocation).
+*/
+function applyJournal(data, journal, filter = () => true, warn = () => {}) {
+	for (const [id, record] of journal) {
+		if (!filter(id, null)) continue;
+		if (record.kind === "remove") {
+			detach(data, id);
+			continue;
+		}
+		const flat = flatten(data).get(id);
+		if (!flat) {
+			const options = { id };
+			applyChanges(options, record.changes, (key) => filter(id, key));
+			const parent = record.parent ?? null;
+			if (!place(data, options, parent, record.position)) warn("cannot place entry %C: group %C not found", id, parent);
+			continue;
+		}
+		applyChanges(flat.options, record.changes, (key) => filter(id, key));
+		if (record.parent !== void 0 && flat.parent !== record.parent) {
+			detach(data, id);
+			if (!place(data, flat.options, record.parent, record.position)) {
+				warn("cannot move entry %C: group %C not found", id, record.parent);
+				place(data, flat.options, flat.parent, flat.position);
+			}
+		}
+	}
+	return data;
+}
+/**
+* Three-way reconciliation of a journal against a new file state. The file
+* wins every conflict: conflicting keys are dropped from the journal so that
+* the tree follows the file, and each drop is reported.
+*
+* `fileOwned(id, key)` scopes the check to what the file can actually express
+* (patch-owned keys and patch-inserted entries live elsewhere).
+*/
+function reconcile(journal, base, theirs, fileOwned) {
+	const conflicts = [];
+	for (const [id, record] of journal) {
+		if (!fileOwned(id, null)) continue;
+		const b = base.get(id);
+		const t = theirs.get(id);
+		if (record.kind === "remove") {
+			if (!t) journal.delete(id);
+			else if (!b || !deepEqual(t.options, b.options)) {
+				conflicts.push({
+					id,
+					reason: b ? "modified in file, removed at runtime" : "added in file, removed at runtime"
+				});
+				journal.delete(id);
+			}
+			continue;
+		}
+		if (!t) {
+			if (b) {
+				conflicts.push({
+					id,
+					reason: "removed in file, modified at runtime"
+				});
+				journal.delete(id);
+			}
+			continue;
+		}
+		if (record.created) record.created = false;
+		for (const key of Object.keys(record.changes)) {
+			if (!fileOwned(id, key)) continue;
+			const bv = b?.options[key];
+			const tv = t.options[key];
+			if (deepEqual(bv, tv) || deepEqual(tv, record.changes[key])) continue;
+			conflicts.push({
+				id,
+				reason: `key "${key}" modified both in file and at runtime`
+			});
+			delete record.changes[key];
+		}
+		if (record.parent !== void 0 && b && t.parent !== b.parent && t.parent !== record.parent) {
+			conflicts.push({
+				id,
+				reason: "moved both in file and at runtime"
+			});
+			record.parent = void 0;
+		}
+		const moved = record.parent !== void 0 && record.parent !== t.parent;
+		if (!Object.keys(record.changes).length && !moved) journal.delete(id);
+	}
+	return conflicts;
+}
+//#endregion
+//#region ../../../vendor/include/src/patch.ts
+function randomId(used) {
+	let id;
+	do
+		id = Math.random().toString(16).slice(2, 10);
+	while (used(id));
+	return id;
+}
+/** Give every entry (nested groups included) an id, in place. */
+function ensureIds(entries, used) {
+	for (const entry of entries) {
+		if (!entry.id) entry.id = randomId(used);
+		if (entry.group && Array.isArray(entry.config)) ensureIds(entry.config, used);
+	}
+}
+/** Runtime changes are routed back to an inserted entry by its id, so every insert needs one. */
+function ensureInsertIds(patches, used) {
+	for (const patch of patches ?? []) if (patch.insert) ensureIds(patch.insert, used);
 }
 /**
-* Apply patch lists to an entry list — THE patch semantics of this include,
-* shared by mounting (`applyPatches`) and offline config tooling
-* (`dsh --dump-config`) so a dump can never drift from what boots. The input
-* is never mutated: patching shared entry objects would bake earlier patch
-* values into the cached parse, so repeated application (config hot-reloads)
-* could never revert a removed or changed patch. Inserted entries are indexed
-* as they are added, so a later patch in the same list can target a row an
-* earlier patch inserted. A patch that matches nothing warns and is skipped.
-* @param data - the parsed entry list (JSON-safe plain data).
-* @param patches - the patch list to apply, in order.
-* @param warn - sink for skipped-patch diagnostics (printf-style, `%C` = code).
-* @returns a detached entry list with every applicable patch applied.
+* Overlay `patches` onto a fresh clone of `data`. Inserted entries are cloned
+* too, so the tree owns every object it mounts.
 */
-function applyEntryPatches(data, patches, warn) {
-	if (!patches?.length) return [...data];
+function applyPatches(data, patches, warn) {
 	data = structuredClone(data);
+	if (!patches?.length) return data;
 	const entryMap = /* @__PURE__ */ new Map();
 	const buildMap = (entries) => {
 		for (const entry of entries) {
@@ -72,6 +516,7 @@ function applyEntryPatches(data, patches, warn) {
 	for (const patch of patches) {
 		const { id, insert, name, ...overrides } = patch;
 		if (insert) {
+			const clone = structuredClone(insert);
 			if (id) {
 				const target = entryMap.get(id);
 				if (!target) {
@@ -83,9 +528,9 @@ function applyEntryPatches(data, patches, warn) {
 					continue;
 				}
 				if (!Array.isArray(target.config)) target.config = [];
-				target.config.push(...insert);
-			} else data.push(...insert);
-			buildMap(insert);
+				target.config.push(...clone);
+			} else data.push(...clone);
+			buildMap(clone);
 			continue;
 		}
 		if (!id) {
@@ -108,145 +553,518 @@ function applyEntryPatches(data, patches, warn) {
 	}
 	return data;
 }
-/** Loader entry tree backed by a YAML or JSON file. */
+var PatchIndex = class {
+	patches;
+	keys = /* @__PURE__ */ new Map();
+	inserts = /* @__PURE__ */ new Map();
+	constructor(patches) {
+		this.patches = patches;
+		patches.forEach((patch, index) => {
+			const { id, insert } = patch;
+			if (insert) {
+				const walk = (list, parent) => {
+					for (const options of list) {
+						this.inserts.set(options.id, {
+							type: "insert",
+							index,
+							list,
+							options,
+							parent
+						});
+						if (options.group && Array.isArray(options.config)) walk(options.config, options.id);
+					}
+				};
+				walk(insert, id ?? null);
+				return;
+			}
+			if (!id) return;
+			const keys = this.keys.get(id) ?? /* @__PURE__ */ new Map();
+			for (const key of Object.keys(omit(patch, [
+				"id",
+				"insert",
+				"name"
+			]))) keys.set(key, index);
+			this.keys.set(id, keys);
+		});
+	}
+	/** Owner of the entry as a whole. */
+	entry(id) {
+		if (id === null) return { type: "file" };
+		return this.inserts.get(id) ?? { type: "file" };
+	}
+	/** Owner of one key of an entry. */
+	key(id, key) {
+		const insert = this.inserts.get(id);
+		if (insert) return insert;
+		const index = this.keys.get(id)?.get(key);
+		return index === void 0 ? { type: "file" } : {
+			type: "patch",
+			index
+		};
+	}
+	fileOwned(id, key) {
+		return (key === null ? this.entry(id) : this.key(id, key)).type === "file";
+	}
+};
+/**
+* Route a journal to its owners: file-owned changes are applied to `data`,
+* patch-owned ones to `patches`. Both are mutated in place, so pass clones.
+* Returns whether any patch changed.
+*/
+function routeJournal(journal, data, patches, warn) {
+	const index = new PatchIndex(patches);
+	let patched = false;
+	const insertList = (owner) => owner.options.config ??= [];
+	const placeAt = (options, parent, position) => {
+		const owner = index.entry(parent);
+		if (owner.type === "insert") {
+			const list = insertList(owner);
+			list.splice(Math.min(position, list.length), 0, options);
+			patched = true;
+		} else if (!place(data, options, parent, position)) warn("cannot place entry %C: group %C not found", options.id, parent);
+	};
+	for (const [id, record] of journal) {
+		const owner = index.entry(id);
+		if (record.kind === "remove") {
+			if (owner.type === "insert") {
+				owner.list.splice(owner.list.indexOf(owner.options), 1);
+				patched = true;
+			} else detach(data, id);
+			continue;
+		}
+		const current = owner.type === "insert" ? owner : flatten(data).get(id);
+		if (!current) {
+			const options = { id };
+			applyChanges(options, record.changes);
+			placeAt(options, record.parent ?? null, record.position);
+			continue;
+		}
+		if (record.parent !== void 0 && current.parent !== record.parent) {
+			if (owner.type === "insert") {
+				owner.list.splice(owner.list.indexOf(owner.options), 1);
+				patched = true;
+			} else detach(data, id);
+			applyChanges(current.options, record.changes);
+			placeAt(current.options, record.parent, record.position);
+			continue;
+		}
+		if (owner.type === "insert") {
+			applyChanges(current.options, record.changes);
+			patched = true;
+			continue;
+		}
+		const patchChanges = {};
+		applyChanges(current.options, record.changes, (key) => {
+			const keyOwner = index.key(id, key);
+			if (keyOwner.type !== "patch") return true;
+			(patchChanges[keyOwner.index] ??= {})[key] = record.changes[key];
+			return false;
+		});
+		for (const [i, changes] of Object.entries(patchChanges)) {
+			applyChanges(patches[i], changes);
+			patched = true;
+		}
+	}
+	return patched;
+}
+//#endregion
+//#region ../../../vendor/include/src/index.ts
+const JsExpr = new yaml.Type("tag:yaml.org,2002:js", {
+	kind: "scalar",
+	resolve: (data) => typeof data === "string",
+	construct: (data) => ({ __jsExpr: data }),
+	predicate: isJsExpr,
+	represent: (data) => data["__jsExpr"]
+});
+/** YAML dialect preserving child-owned JavaScript expression nodes. */
+const entryListSchema = yaml.JSON_SCHEMA.extend(JsExpr);
+const schema = entryListSchema;
+const types = {
+	".json": "application/json",
+	".yaml": "application/yaml",
+	".yml": "application/yaml"
+};
+var ConfigFileError = class extends Error {
+	stage;
+	name = "ConfigFileError";
+	constructor(stage, path, cause) {
+		super(`failed to ${stage} config file ${path}`, { cause });
+		this.stage = stage;
+	}
+};
+/** The file changed under us between the pre-check and the rename. */
+var StaleWriteError = class extends Error {
+	name = "StaleWriteError";
+};
+function isENOENT(error) {
+	return error?.code === "ENOENT";
+}
+const RENAME_RETRIES = 10;
+const RENAME_BACKOFF = 20;
+/**
+* On Windows a rename over a file that another process holds open (typically
+* an antivirus scanning what we just wrote) fails with one of these; the lock
+* is normally gone within milliseconds. A bounded retry is cheap enough to
+* apply on every platform.
+*/
+function isTransientRenameError(error) {
+	const code = error?.code;
+	return code === "EACCES" || code === "EPERM" || code === "EBUSY";
+}
 var Include = class extends EntryTree {
 	config;
 	static inject = ["loader"];
 	static [EntryGroup.key] = true;
 	filename;
 	type;
-	readonly;
-	content;
-	data;
-	writeTask;
-	pendingWrite;
-	writeQueue = Promise.resolve();
+	/** The last file state we read or wrote. */
+	cache;
+	/** Tree-side changes that have not reached the file yet. */
+	journal = /* @__PURE__ */ new Map();
+	/** Ids we assigned to entries the file leaves anonymous. */
+	anonymous = /* @__PURE__ */ new Map();
+	dirtyRead = false;
+	dirtyWrite = false;
+	_draining;
+	/** Only the latest intended tree is ever applied; older ones are skipped. */
+	_pendingTree;
+	_applyTask;
+	_disposed = false;
+	_seq = 0;
+	persistenceError;
 	constructor(ctx, config) {
 		super(ctx);
 		this.config = config;
 		this.enableLogs = config.enableLogs ?? ctx.fiber.entry?.parent.tree.enableLogs ?? false;
 		this.filename = fileURLToPath(new URL(this.config.path, this.ctx.baseUrl));
 		const ext = extname(this.filename);
-		if (!supported.has(ext)) throw new Error(`extension "${ext}" not supported`);
-		this.type = writable[ext];
-		this.readonly = !this.type;
+		if (!types[ext]) throw new Error(`extension "${ext}" not supported`);
+		this.type = types[ext];
 		this.ctx.baseUrl = new URL(".", pathToFileURL(this.filename)).href;
-		ctx.on("internal/update", (config, _, next) => {
+		ensureInsertIds(config.patches, (id) => !!this.store[id]);
+		ctx.on("internal/update", (config, next) => {
 			if (config.path !== this.config.path) return next();
 			this.config = config;
-			this.root.update(this.applyPatches(this.data, config.patches)).catch((error) => {
-				this.ctx.logger.warn("config update at %C failed", this.filename);
-				this.ctx.logger.warn(error);
-			});
-		});
-	}
-	async checkAccess() {
-		if (!this.type) return;
-		try {
-			await access(this.filename, constants.W_OK);
-		} catch {
-			this.readonly = true;
-		}
-	}
-	async read(forced = false) {
-		const content = await readFile(this.filename, "utf8");
-		if (!forced && this.content === content) return false;
-		let data;
-		if (this.type === "application/yaml") data = yaml.load(content, { schema: entryListSchema });
-		else if (this.type === "application/json") data = JSON.parse(content);
-		else {
-			const module = await import(
-				/* @vite-ignore */
-				this.filename
-);
-			data = module.default || module;
-		}
-		if (!Array.isArray(data)) throw new TypeError(`config file must be a top-level array of entries: ${this.filename}`);
-		this.content = content;
-		this.data = data;
-		await this.checkAccess();
-		return true;
-	}
-	applyPatches(data, patches = this.config.patches) {
-		return applyEntryPatches(data, patches, (message, ...args) => {
-			this.ctx.root.logger?.("loader").warn(message, ...args);
+			ensureInsertIds(config.patches, (id) => !!this.store[id]);
+			this._scheduleApply();
+			return this._applyTask;
 		});
 	}
+	warn = (format, ...args) => {
+		this.ctx.root.logger?.("loader").warn(format, ...args);
+	};
 	async *[Service.init]() {
 		try {
-			await this.read();
+			await this._read();
 		} catch (error) {
-			if (error?.code !== "ENOENT") throw error;
-			if (this.config.initial) {
-				await this._writeFile(this.config.initial);
-				await this.read(true);
-			} else throw new Error(`config file not found: ${this.filename}`);
+			if (!isENOENT(error instanceof ConfigFileError && error.stage === "read" ? error.cause : void 0)) throw error;
+			if (!this.config.initial) throw new Error(`config file not found: ${this.filename}`);
+			const initial = structuredClone(this.config.initial);
+			ensureIds(initial, (id) => !!this.store[id]);
+			await this._writeText(this.dump(initial));
+			await this._read();
 		}
 		yield () => this.stop();
-		await this.root.update(this.applyPatches(this.data));
+		await this._applyTask;
 	}
 	async stop() {
+		this._disposed = true;
+		this._pendingTree = void 0;
+		if (this.journal.size) {
+			this.dirtyWrite = true;
+			this._drain();
+		}
 		try {
-			await this.flushWrite();
+			await this.flush();
 		} finally {
 			this.root.stop();
-			await this.flushWrite();
 		}
 	}
 	/**
-	* Re-read the file and refresh child entries when content changed. An
-	* unreadable or unparsable file logs a warning and keeps the last good
-	* tree: a hot-reload of a live app must never take the process down.
+	* Resolves once every pending read and write has been processed and the
+	* tree reflects the outcome. Retries pending writes and rejects while changes remain unsaved.
 	*/
-	async refresh() {
+	async flush() {
+		if (this.journal.size && !this._draining) {
+			this.dirtyWrite = true;
+			this._drain();
+		}
+		while (this._draining || this._applyTask) {
+			await this._draining;
+			await this._applyTask;
+		}
+		if (this.journal.size) throw this.persistenceError ?? /* @__PURE__ */ new Error(`config file ${this.filename} has ${this.journal.size} unsaved change(s)`);
+		this.persistenceError = void 0;
+	}
+	/** Re-read the file and reconcile the tree with it. */
+	refresh() {
+		this.dirtyRead = true;
+		this._drain();
+		return this.flush();
+	}
+	/** Called synchronously by the loader once a tree-side change is in place. */
+	commit(change) {
+		this.context.emit("loader/config-update");
+		const parent = change.group === this.root ? null : change.group.ctx.fiber.entry.options.id;
+		record$1(this.journal, change, parent);
+		this.dirtyWrite = true;
+		this._drain();
+	}
+	_drain() {
+		if (this._draining) return;
+		this._draining = this._loop().finally(() => {
+			this._draining = void 0;
+		});
+	}
+	async _loop() {
+		while (this.dirtyRead || this.dirtyWrite) {
+			if (this.dirtyRead) {
+				this.dirtyRead = false;
+				try {
+					await this._read();
+				} catch (error) {
+					this.persistenceError = error;
+					this.ctx.logger.warn(error);
+					if (this.dirtyRead) continue;
+					return;
+				}
+			}
+			if (this.dirtyWrite) {
+				this.dirtyWrite = false;
+				try {
+					await this._write();
+				} catch (error) {
+					this.persistenceError = error;
+					this.ctx.logger.error(error);
+				}
+			}
+		}
+	}
+	async _read() {
+		let content;
+		try {
+			content = await readFile(this.filename, "utf8");
+		} catch (error) {
+			throw new ConfigFileError("read", this.filename, error);
+		}
+		if (content === this.cache?.content) return;
+		let data;
 		try {
-			if (!await this.read()) return;
-			await this.root.update(this.applyPatches(this.data));
+			data = this.type === "application/yaml" ? yaml.load(content, { schema }) : JSON.parse(content);
 		} catch (error) {
-			this.ctx.logger.warn("config reload at %C failed; keeping the running tree", this.filename);
-			this.ctx.logger.warn(error);
+			throw new ConfigFileError("parse", this.filename, error);
 		}
+		if (!Array.isArray(data)) throw new ConfigFileError("validate", this.filename, /* @__PURE__ */ new TypeError("config file must be a top-level array"));
+		this._assignIds(data);
+		if (this.cache) {
+			const index = new PatchIndex(this.config.patches ?? []);
+			const conflicts = reconcile(this.journal, flatten(this.cache.data), flatten(data), (id, key) => index.fileOwned(id, key));
+			for (const { id, reason } of conflicts) this.ctx.logger.error("config conflict in %C: entry %C %s; file wins", this.filename, id, reason);
+		}
+		this.cache = {
+			content,
+			data
+		};
+		this._scheduleApply();
+		if (this.journal.size) this.dirtyWrite = true;
 	}
-	async _writeFile(config) {
-		if (this.readonly) throw new Error(`cannot overwrite readonly config`);
-		if (this.type === "application/yaml") this.content = yaml.dump(config, { schema });
-		else if (this.type === "application/json") this.content = JSON.stringify(config, null, 2);
-		await writeFile(this.filename + ".tmp", this.content);
-		for (let retry = 0;; retry++) try {
-			await rename(this.filename + ".tmp", this.filename);
+	async _write() {
+		if (!this.cache || !this.journal.size) return;
+		const current = await readFile(this.filename, "utf8").catch((error) => {
+			if (isENOENT(error)) return void 0;
+			throw error;
+		});
+		if (current === void 0) {
+			this.ctx.logger.warn("config file %C is missing, %d pending change(s) kept in memory", this.filename, this.journal.size);
 			return;
+		}
+		if (current !== this.cache.content) {
+			this.dirtyRead = true;
+			this.dirtyWrite = true;
+			return;
+		}
+		const batch = this.journal;
+		this.journal = /* @__PURE__ */ new Map();
+		const restore = () => {
+			for (const [id, record] of this.journal) merge(batch, id, record);
+			this.journal = batch;
+		};
+		const data = structuredClone(this.cache.data);
+		const patches = structuredClone(this.config.patches ?? []);
+		if (routeJournal(batch, data, patches, this.warn)) {
+			this.config = {
+				...this.config,
+				patches
+			};
+			if (this.ctx.fiber.entry) try {
+				Promise.resolve(this.ctx.fiber.update(this.config)).catch((error) => {
+					this.ctx.logger.error(error);
+				});
+			} catch (error) {
+				this.ctx.logger.error(error);
+			}
+			else this.ctx.logger.warn("patches of %C changed at runtime but cannot be persisted", this.filename);
+		}
+		if (deepEqual(data, this.cache.data)) {
+			this._scheduleApply();
+			return;
+		}
+		const text = this.dump(data);
+		try {
+			await access(this.filename, constants.W_OK);
+		} catch {
+			restore();
+			this.ctx.logger.warn("config file %C is read-only, %d pending change(s) kept in memory", this.filename, this.journal.size);
+			return;
+		}
+		try {
+			await this._writeText(text, this.cache.content);
 		} catch (error) {
-			if (!retryableWriteError(error) || retry >= WRITE_RETRY_LIMIT) throw error;
-			await setTimeout$1((retry + 1) * WRITE_RETRY_DELAY_MS);
+			restore();
+			if (error instanceof StaleWriteError) {
+				this.dirtyRead = true;
+				this.dirtyWrite = true;
+				return;
+			}
+			this.ctx.logger.warn("failed to write config file %C, %d pending change(s) kept in memory", this.filename, this.journal.size);
+			throw error;
 		}
+		this.cache = {
+			content: text,
+			data
+		};
+		this._scheduleApply();
 	}
-	writeFile(config) {
-		clearTimeout(this.writeTask);
-		this.pendingWrite = config;
-		this.writeTask = setTimeout(() => {
-			this.flushWrite();
-		}, 0);
-	}
-	flushWrite() {
-		clearTimeout(this.writeTask);
-		this.writeTask = void 0;
-		const config = this.pendingWrite;
-		this.pendingWrite = void 0;
-		if (config === void 0) return this.writeQueue;
-		const run = this.writeQueue.then(() => this._writeFile(config), () => this._writeFile(config));
-		this.writeQueue = run;
-		run.catch((error) => {
-			this.ctx.root.logger?.("loader").warn("failed to write config file %C", this.filename);
-			this.ctx.root.logger?.("loader").warn(error);
-		});
-		return run;
+	/**
+	* Write through a temp file and a rename, so that no reader ever sees a
+	* truncated file. When `expected` is given, the rename (and every retry of
+	* it) only goes ahead while the file still holds that content.
+	*/
+	async _writeText(text, expected) {
+		const tmp = join(dirname(this.filename), `.${basename(this.filename)}.${process.pid}.${this._seq++}.tmp`);
+		try {
+			await writeFile(tmp, text);
+			for (let attempt = 0;; attempt++) {
+				if (expected !== void 0) {
+					if (await readFile(this.filename, "utf8").catch((error) => {
+						if (isENOENT(error)) return void 0;
+						throw error;
+					}) !== expected) throw new StaleWriteError();
+				}
+				try {
+					await rename(tmp, this.filename);
+					return;
+				} catch (error) {
+					if (attempt >= RENAME_RETRIES || !isTransientRenameError(error)) throw error;
+				}
+				await setTimeout$1(RENAME_BACKOFF * (attempt + 1));
+			}
+		} catch (error) {
+			await rm(tmp, { force: true }).catch(() => {});
+			throw error;
+		}
 	}
-	/** Schedule a write of the current root entry data. */
-	write() {
-		this.context.emit("loader/config-update");
-		return this.writeFile(this.root.data);
+	dump(data) {
+		return this.type === "application/yaml" ? yaml.dump(data, { schema }) : JSON.stringify(data, null, 2);
+	}
+	/**
+	* Entries the file leaves anonymous get an id here, before the loader sees
+	* them. One that looks exactly like an entry we named on the previous read
+	* keeps that id, so editing a neighbor does not restart it; anything else
+	* gets a fresh id. Assigned ids stay in memory until the next write.
+	*/
+	_assignIds(data) {
+		const used = /* @__PURE__ */ new Set();
+		const pending = [];
+		const walk = (entries, parent) => {
+			for (const options of entries) {
+				if (options.id) used.add(options.id);
+				else pending.push({
+					options,
+					parent
+				});
+				if (options.group && Array.isArray(options.config)) walk(options.config, options.id ?? null);
+			}
+		};
+		walk(data, null);
+		const previous = this.anonymous;
+		this.anonymous = /* @__PURE__ */ new Map();
+		for (const { options, parent } of pending) {
+			let id;
+			for (const [candidate, info] of previous) {
+				if (info.parent !== parent || !deepEqual(info.options, options)) continue;
+				id = candidate;
+				previous.delete(candidate);
+				break;
+			}
+			if (!id) do
+				id = Math.random().toString(16).slice(2, 10);
+			while (used.has(id) || this.store[id]);
+			used.add(id);
+			this.anonymous.set(id, {
+				parent,
+				options: structuredClone(options)
+			});
+			const rest = { ...options };
+			for (const key of Object.keys(options)) delete options[key];
+			Object.assign(options, { id }, rest);
+		}
+	}
+	_scheduleApply() {
+		if (this._disposed || !this.cache) return;
+		const tree = applyPatches(this.cache.data, this.config.patches, this.warn);
+		this._pendingTree = applyJournal(tree, this.journal, void 0, this.warn);
+		this._applyTask ??= (async () => {
+			try {
+				while (this._pendingTree) {
+					const tree = this._pendingTree;
+					this._pendingTree = void 0;
+					await this.root.update(tree);
+				}
+			} finally {
+				this._applyTask = void 0;
+			}
+		})();
+	}
+};
+//#endregion
+//#region lib/types/bundle-platform.js
+/** Host operating-system admission for optional bundle layers. */
+const NODE_PLATFORMS = Object.freeze([
+	"aix",
+	"android",
+	"darwin",
+	"freebsd",
+	"haiku",
+	"linux",
+	"openbsd",
+	"sunos",
+	"win32",
+	"cygwin",
+	"netbsd"
+]);
+/** A valid bundle declaration excludes the operating system running DSH. */
+var UnsupportedBundlePlatformError = class extends Error {
+	/**
+	* @param platforms Node platform names supported by the bundle.
+	* @param platform Operating system of the DSH Host.
+	*/
+	constructor(platforms, platform) {
+		super(`Bundle supports Host platforms ${platforms.join(", ")}; the DSH Host is running ${platform}`);
+		this.name = "UnsupportedBundlePlatformError";
 	}
 };
+/**
+* Validate package metadata and reject an unsupported Host before selecting or composing a bundle.
+* @param platforms The optional `dsh.bundle.platforms` field read from package.json.
+* @param platform Operating system of the DSH Host, from Node's `process.platform`.
+* @throws When the declaration is malformed or excludes the Host; omission allows every platform.
+*/
+function assertBundlePlatform(platforms, platform) {
+	if (platforms === void 0) return;
+	if (!Array.isArray(platforms) || platforms.length === 0 || !platforms.every((value) => typeof value === "string" && NODE_PLATFORMS.includes(value))) throw new Error("dsh.bundle.platforms must be a nonempty list of Node platform names");
+	if (!platforms.includes(platform)) throw new UnsupportedBundlePlatformError(platforms, platform);
+}
 //#endregion
 //#region lib/types/plugin-compatibility.js
 /** Evaluate plugin dsh requirements (`engines.dsh`, else dsh peers) without importing plugin code. */
@@ -547,49 +1365,6 @@ function resolveProfileDir(name, home = resolveDshHome()) {
 	if (name === "" || name.includes("/") || name.includes("\\") || name === "." || name === ".." || name === "node_modules") throw new Error(`dsh: invalid profile name ${JSON.stringify(name)}`);
 	return join(home, PROFILES_DIR, name);
 }
-/** The shipped profile templates auto-initialized on first use, by name. */
-const PROFILE_TEMPLATES = {
-	acp: { bundles: ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-acp-app"] },
-	web: { bundles: ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-web-app"] },
-	headless: { bundles: ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-headless"] },
-	sdk: { bundles: ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-sdk-app"] },
-	"sdk-minimal": { bundles: ["@deepseek-ai/dsh-sdk-minimal"] }
-};
-/** Installation-owned bundle tuples normalized to the shipped template. */
-const INSTALLATION_OWNED_PROFILE_TUPLES = { headless: [
-	"@deepseek-ai/dsh-base",
-	"@deepseek-ai/dsh-web-app",
-	"@deepseek-ai/dsh-headless"
-] };
-/**
-* Bundles an earlier release shipped and the installation no longer carries;
-* {@link loadProfileDirectory} removes them from the profile's bundle list.
-*/
-const RETIRED_BUNDLES = new Set(["@deepseek-ai/dsh-experimental-schedule-bundle"]);
-/** The bundle list a `dsh plugin` init uses for a name with no shipped template. */
-const DEFAULT_PROFILE_BUNDLES = ["@deepseek-ai/dsh-base"];
-/**
-* The bundles the dsh installation ships for a person to switch on: each a
-* runtime dependency of the installation that declares `dsh.bundle.patch`,
-* an `icon`, and `./locale/*.json` display metadata, selected by no shipped
-* template, and offered switched off by the plugin manager
-* ([rationale](../../../../.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md),
-* [admission](../../../../.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md)).
-*/
-const OPTIONAL_BUNDLES = [
-	"@deepseek-ai/dsh-experimental-session-search",
-	"@deepseek-ai/dsh-experimental-ralph-bundle",
-	"@deepseek-ai/dsh-experimental-terminal-bundle",
-	"@deepseek-ai/dsh-experimental-badge-skill-bundle",
-	"@deepseek-ai/dsh-experimental-session-titles-bundle",
-	"@deepseek-ai/dsh-experimental-agent-team-profile",
-	"@deepseek-ai/dsh-experimental-voice-input-bundle",
-	"@deepseek-ai/dsh-experimental-cot-translation-bundle",
-	"@deepseek-ai/dsh-experimental-auto-review",
-	"@deepseek-ai/dsh-experimental-inspector-profile",
-	"@deepseek-ai/dsh-experimental-plugin-market-bundle",
-	"@deepseek-ai/dsh-experimental-tool-worktree"
-];
 const PROFILE_PATCH_TEMPLATE = `# Your patch layer for this dsh profile, applied after every bundle layer:
 # a top-level YAML array of loader patch entries (id-targeted config
 # overrides, disables, and insert lists; \`!!js\` expressions allowed).
@@ -710,7 +1485,11 @@ function readPackageManifest(anchor) {
 }
 /** Return dependency names that may be imported by a loader-visible plugin. */
 function profileDependencyNames(manifest) {
-	return [...Object.keys(manifest.dependencies ?? {}), ...Object.keys(manifest.peerDependencies ?? {})];
+	return [
+		...Object.keys(manifest.dependencies ?? {}),
+		...Object.keys(manifest.peerDependencies ?? {}),
+		...Object.keys(manifest.optionalDependencies ?? {})
+	];
 }
 /** Resolve the installation packages that the runtime resolver supplies to every profile. */
 function collectInstallationScopePackages(installAnchor, skippedBundles) {
@@ -1004,7 +1783,8 @@ function resolveBundleDir(binName, packageName, installAnchor, profileDir) {
 * the shared Harness home. This is used by application-owned profiles whose
 * package project and lifecycle belong to that application.
 * Retired bundles are removed from the stored bundle list first, rewriting the
-* manifest when it listed one. Unreadable bundles, and bundles whose own dsh requirements the profile does not exempt, are skipped
+* manifest when it listed one. Unreadable bundles, unsupported Host platforms, and bundles whose own dsh requirements
+* the profile does not exempt are skipped
 * without changing the manifest and listed in `skippedBundles`; nothing is printed.
 * @param binName - the diagnostic prefix on thrown errors.
 * @param dir - absolute profile package directory.
@@ -1022,6 +1802,7 @@ function loadProfileDirectory(binName, dir, installAnchor, options = {}) {
 		const bundleManifest = readProfileManifest(binName, packageDir);
 		const bundle = bundleManifest.dsh?.bundle;
 		if (bundle === void 0) throw new Error(`${binName}: profile bundle ${JSON.stringify(packageName)} declares no dsh.bundle in its package.json`);
+		assertBundlePlatform(bundle.platforms, process.platform);
 		const issue = evaluatePluginCompatibility(bundleManifest, exemptions);
 		if (issue !== void 0 && !issue.exempted) throw new Error(pluginCompatibilityWarning(issue));
 		const patchPaths = bundlePatchPaths(packageDir, bundle);
@@ -1051,8 +1832,8 @@ function loadProfileDirectory(binName, dir, installAnchor, options = {}) {
 }
 /**
 * Load a profile: resolve every `dsh.profile.bundles` entry to its patch
-* layer and parse the profile's own patch file. Unreadable or incompatible bundles
-* are skipped and listed in `skippedBundles`; profile manifest and user patch errors still throw.
+* layer and parse the profile's own patch file. Unreadable bundles, unsupported Host platforms,
+* and incompatible bundles are skipped and listed in `skippedBundles`; profile manifest and user patch errors still throw.
 * @param binName - the diagnostic prefix on thrown errors.
 * @param name - the profile name.
 * @param installAnchor - absolute path of the dsh app's package.json (first resolution anchor).
@@ -1082,7 +1863,7 @@ function loadProfile(binName, name, installAnchor, home = resolveDshHome(), opti
 * @returns the composed entry list.
 */
 function composeEntries(layers, warn = () => {}) {
-	return applyEntryPatches([], structuredClone(layers.flat()), (message, ...args) => {
+	return applyPatches([], structuredClone(layers.flat()), (message, ...args) => {
 		let index = 0;
 		warn(message.replace(/%C/g, () => JSON.stringify(args[index++])));
 	});
@@ -1205,6 +1986,8 @@ function writeProfileBundles(profileDir, manifest, bundles) {
 * template entries retain their order and duplicates. New bundle dependencies activate automatically.
 * @param options - location, inventory captured before pnpm, and whether explicitly disabled bundles remain disabled.
 * @returns updated inventory and newly added ordinary dependencies for caller-owned warnings.
+* @throws If a new selection has invalid platform metadata or excludes the Host. Installed dependencies
+* remain; no bundle selection changes are written.
 */
 function reconcileProfilePlugins(options) {
 	const after = readProfilePlugins(options);
@@ -1214,7 +1997,10 @@ function reconcileProfilePlugins(options) {
 	const disabled = new Set(options.preserveDisabled ? options.before.dependencies.filter((dependency) => dependency.bundle && !dependency.enabled).map((dependency) => dependency.name) : []);
 	const previous = after.manifest.dsh?.profile?.bundles ?? [];
 	const bundles = previous.filter((name) => !(beforeNames.has(name) || afterNames.has(name)) || bundleNames.has(name));
-	for (const dependency of after.dependencies) if (dependency.bundle && !disabled.has(dependency.name) && !bundles.includes(dependency.name)) bundles.push(dependency.name);
+	for (const dependency of after.dependencies) if (dependency.bundle && !disabled.has(dependency.name) && !bundles.includes(dependency.name)) {
+		assertBundlePlatform(bundleManifest(options, dependency.name)?.dsh?.bundle?.platforms, process.platform);
+		bundles.push(dependency.name);
+	}
 	return {
 		plugins: {
 			manifest: bundles.length !== previous.length || bundles.some((name, index) => name !== previous[index]) ? writeProfileBundles(options.profileDir, after.manifest, bundles) : after.manifest,
@@ -1785,7 +2571,7 @@ function internalModules() {
 	const esmResolve = addon.requireBuiltin("internal/modules/esm/resolve");
 	const esm = esmModule.getOrInitializeCascadedLoader();
 	const modern = "getOrCreateModuleJob" in esm;
-	/* v8 ignore start -- the supported Node 22/24/26 matrix validates each available Internal interface */
+	/* v8 ignore start -- the supported Node 24/26 matrix validates each available Internal interface */
 	if (typeof esm.resolveSync !== "function" || typeof Reflect.get(esm, modern ? "getOrCreateModuleJob" : "getModuleJobForImport") !== "function" || !modern && typeof Reflect.get(esm, "resolve") !== "function" || typeof cjsModule.Module._resolveFilename !== "function" || typeof cjsHelpers.getCjsConditions !== "function" || typeof esmUtils.getDefaultConditions !== "function" || typeof esmResolve.defaultResolve !== "function") throw new Error("profile resolution: unsupported Node module loader");
 	/* v8 ignore stop */
 	return {
@@ -1861,7 +2647,7 @@ function installRuntimeInterception(resolution) {
 				let expected;
 				try {
 					expected = adapted(target.specifier, target.parentURL, attributes);
-					/* v8 ignore next -- Node 24+ resolves synchronously; the Node 22 matrix covers its Promise result */
+					/* v8 ignore next -- the current loader resolves synchronously; the private interface also permits Promise results */
 					if (expected instanceof Promise) expected = expected.catch(restoreImporter);
 				} catch (error) {
 					return restoreImporter(error);
@@ -1890,7 +2676,7 @@ function installRuntimeInterception(resolution) {
 				} catch (error) {
 					return restoreImporter(error);
 				}
-				/* v8 ignore next -- Node 24+ resolves synchronously; the Node 22 matrix covers its Promise result */
+				/* v8 ignore next -- the current loader resolves synchronously; the private interface also permits Promise results */
 				if (result instanceof Promise) return result.catch(restoreImporter);
 				if (cacheable) state.esm = result;
 				return result;
@@ -1912,12 +2698,12 @@ function installRuntimeInterception(resolution) {
 		};
 		return (request, parent, attributes) => {
 			const result = adapted(request, parent, attributes);
-			/* v8 ignore next -- Node 24+ resolves synchronously; the Node 22 matrix covers its Promise result */
+			/* v8 ignore next -- the current loader resolves synchronously; the private interface also permits Promise results */
 			return result instanceof Promise ? result.then((resolved) => relocate(resolved, parent)) : relocate(result, parent);
 		};
 	};
 	let restoreEsm;
-	/* v8 ignore else -- CI coverage runs Node 24 v2; the Node 22 matrix exercises the v1 adapter */
+	/* v8 ignore else -- CI coverage runs Node 24 v2; the Node 24.0 matrix exercises the v1 adapter */
 	if (modern) {
 		const loader = esm;
 		const original = Reflect.get(loader, "resolveSync");
@@ -2376,7 +3162,7 @@ function preflight(ctx, entries, parentURL, report) {
 				data = config.initial;
 			}
 			if (!Array.isArray(data)) return void 0;
-			return check(applyEntryPatches(data, config.patches, patchWarning(ctx)), pathToFileURL(filename).href) ? `its included file ${filename} reaches an incompatible plugin, and that file is never rewritten` : void 0;
+			return check(applyPatches(data, config.patches, patchWarning(ctx)), pathToFileURL(filename).href) ? `its included file ${filename} reaches an incompatible plugin, and that file is never rewritten` : void 0;
 		} finally {
 			includes.delete(filename);
 		}
@@ -2397,46 +3183,10 @@ function preflight(ctx, entries, parentURL, report) {
 */
 function prepareProfilePatches(ctx, patches, parentURL, binName = "dsh") {
 	if (ctx.get("profileContext") === void 0) return patches;
-	const rows = prepareProfileEntries(ctx, applyEntryPatches([], patches, patchWarning(ctx)), parentURL, binName);
+	const rows = prepareProfileEntries(ctx, applyPatches([], patches, patchWarning(ctx)), parentURL, binName);
 	return rows.length === 0 ? [] : [{ insert: rows }];
 }
 //#endregion
-//#region lib/types/official-bundle-packages.js
-/** Package admission shared by offline catalog generation and release ordering. */
-/** Public DSH release members available through the ordinary on-demand bundle installer. */
-const ON_DEMAND_BUNDLES = ["@deepseek-ai/dsh-subagent-claude-code", "@deepseek-ai/dsh-subagent-codex"];
-//#endregion
-//#region lib/types/official-bundles.generated.js
-/** Generated offline Official bundle metadata. Run pnpm gen-official-bundle-catalog; do not edit. */
-/** Official on-demand entries, independent of installed packages and registry availability. */
-const OFFICIAL_ON_DEMAND_CATALOG = [{
-	packageName: "@deepseek-ai/dsh-subagent-claude-code",
-	meta: {
-		title: {
-			"en": "Claude Code subagent",
-			"zh": "Claude Code 子智能体"
-		},
-		description: {
-			"en": "Delegate one task to Claude Code using its native authentication and settings.",
-			"zh": "使用 Claude Code 原生认证和设置委派单个任务。"
-		},
-		icon: "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMzYiIGhlaWdodD0iMzYiIHZpZXdCb3g9IjAgMCAzNiAzNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48cmVjdCB4PSIxNC45ODkzIiB5PSIxNS4xODc3IiB3aWR0aD0iMTIuMjM2NSIgaGVpZ2h0PSIxMi4yMzY1IiByeD0iMiIgZmlsbD0idXJsKCNkc2hfcGx1Z2luX2FydF9SMGEpIiBmaWxsLW9wYWNpdHk9IjAuOCI+PC9yZWN0PjxyZWN0IHg9IjguODcxMDkiIHk9IjkuMDY5NyIgd2lkdGg9IjEyLjIzNjUiIGhlaWdodD0iMTIuMjM2NSIgcng9IjIiIGZpbGw9InVybCgjZHNoX3BsdWdpbl9hcnRfUjBiKSIgZmlsbC1vcGFjaXR5PSIwLjgiPjwvcmVjdD48ZGVmcz48bGluZWFyR3JhZGllbnQgaWQ9ImRzaF9wbHVnaW5fYXJ0X1IwYSIgeDE9IjIxLjEwNzUiIHkxPSIxNS4xODc3IiB4Mj0iMjEuMTA3NSIgeTI9IjI3LjQyNDMiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBzdG9wLWNvbG9yPSIjNDVFN0E0Ij48L3N0b3A+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjMDU5MDlEIj48L3N0b3A+PC9saW5lYXJHcmFkaWVudD48bGluZWFyR3JhZGllbnQgaWQ9ImRzaF9wbHVnaW5fYXJ0X1IwYiIgeDE9IjE0Ljk4OTQiIHkxPSI5LjA2OTciIHgyPSIxNC45ODk0IiB5Mj0iMjEuMzA2MyIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPjxzdG9wIHN0b3AtY29sb3I9IiM2OUI5RkYiPjwvc3RvcD48c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiMzMjRERTIiPjwvc3RvcD48L2xpbmVhckdyYWRpZW50PjwvZGVmcz48L3N2Zz4K"
-	}
-}, {
-	packageName: "@deepseek-ai/dsh-subagent-codex",
-	meta: {
-		title: {
-			"en": "Codex subagent",
-			"zh": "Codex 子智能体"
-		},
-		description: {
-			"en": "Delegate one task to Codex using its native authentication and settings.",
-			"zh": "使用 Codex 原生认证和设置委派单个任务。"
-		},
-		icon: "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMzYiIGhlaWdodD0iMzYiIHZpZXdCb3g9IjAgMCAzNiAzNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj48cmVjdCB4PSIxNC45ODkzIiB5PSIxNS4xODc3IiB3aWR0aD0iMTIuMjM2NSIgaGVpZ2h0PSIxMi4yMzY1IiByeD0iMiIgZmlsbD0idXJsKCNkc2hfcGx1Z2luX2FydF9SMGEpIiBmaWxsLW9wYWNpdHk9IjAuOCI+PC9yZWN0PjxyZWN0IHg9IjguODcxMDkiIHk9IjkuMDY5NyIgd2lkdGg9IjEyLjIzNjUiIGhlaWdodD0iMTIuMjM2NSIgcng9IjIiIGZpbGw9InVybCgjZHNoX3BsdWdpbl9hcnRfUjBiKSIgZmlsbC1vcGFjaXR5PSIwLjgiPjwvcmVjdD48ZGVmcz48bGluZWFyR3JhZGllbnQgaWQ9ImRzaF9wbHVnaW5fYXJ0X1IwYSIgeDE9IjIxLjEwNzUiIHkxPSIxNS4xODc3IiB4Mj0iMjEuMTA3NSIgeTI9IjI3LjQyNDMiIGdyYWRpZW50VW5pdHM9InVzZXJTcGFjZU9uVXNlIj48c3RvcCBzdG9wLWNvbG9yPSIjNDVFN0E0Ij48L3N0b3A+PHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjMDU5MDlEIj48L3N0b3A+PC9saW5lYXJHcmFkaWVudD48bGluZWFyR3JhZGllbnQgaWQ9ImRzaF9wbHVnaW5fYXJ0X1IwYiIgeDE9IjE0Ljk4OTQiIHkxPSI5LjA2OTciIHgyPSIxNC45ODk0IiB5Mj0iMjEuMzA2MyIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPjxzdG9wIHN0b3AtY29sb3I9IiM2OUI5RkYiPjwvc3RvcD48c3RvcCBvZmZzZXQ9IjEiIHN0b3AtY29sb3I9IiMzMjRERTIiPjwvc3RvcD48L2xpbmVhckdyYWRpZW50PjwvZGVmcz48L3N2Zz4K"
-	}
-}];
-//#endregion
 //#region lib/types/config-schema/native.js
 /** Identity checks at the plugin-export and lazy-builder boundaries. */
 /**
@@ -3359,7 +4109,7 @@ async function collectConfigSchemas(profile, entries, resolution, diagnostics =
 			const rows = entryList(source);
 			let children;
 			try {
-				children = applyEntryPatches(rows, patches, warn(path));
+				children = applyPatches(rows, patches, warn(path));
 			} catch (error) {
 				throw new Error(`include patches could not be composed for ${filename}; child declarations are unavailable`, { cause: error });
 			}
@@ -3807,10 +4557,7 @@ async function recompose(ctx, patches, binName, options, withResolution) {
 			options: JSON.stringify(failure.entry.options),
 			diagnostic: failure.entry.fiber?.uid ? reloadDiagnostic(failure) : void 0
 		}));
-		const previousFibers = [...ctx.loader.entries()].flatMap((row) => row.fiber === void 0 ? [] : [{
-			fiber: row.fiber,
-			failed: row.fiber.state === FIBER_FAILED || row.fiber.state === FIBER_DISPOSED
-		}]);
+		const previousFibers = [...ctx.loader.entries()].flatMap((row) => row.fiber === void 0 ? [] : [row.fiber]);
 		const { patches: previous = [], ...includeConfig } = entry.options.config;
 		const current = withResolution ? ctx.get("pluginPackages")?.resolution : void 0;
 		const successor = current instanceof ProfileRuntimeResolution ? await current.computeLatestResolution() : void 0;
@@ -3849,15 +4596,16 @@ async function recompose(ctx, patches, binName, options, withResolution) {
 		const prepared = prepareProfilePatches(ctx, patches, parentURL, binName);
 		applying = true;
 		const retried = [...new Set([...running, ...withResolution ? [...ctx.loader.entries()].filter(importFailed) : []])];
+		const priorData = new Map(retried.map((row) => [row, row.parent.data]));
 		try {
 			await entry.update({ config: {
 				...includeConfig,
 				patches: prepared
 			} });
 		} finally {
-			await resume(ctx, retried);
+			await resume(ctx, retried.filter((row) => row.parent.data === priorData.get(row)));
 		}
-		const results = await Promise.allSettled(previousFibers.map(({ fiber }) => fiber.await()));
+		await Promise.allSettled(previousFibers.map((fiber) => fiber.await()));
 		await ctx.loader.await();
 		const failures = await inactiveEntries(ctx);
 		const introduced = failures.filter((failure) => {
@@ -3867,7 +4615,6 @@ async function recompose(ctx, patches, binName, options, withResolution) {
 			return !previousFailures.some((previous) => sameFailure(previous, failure));
 		});
 		if (introduced.length > 0) throw new Error(activationDiagnostic(binName, introduced, false).trimEnd());
-		for (const [index, result] of results.entries()) if (result.status === "rejected" && !previousFibers[index]?.failed) throw result.reason;
 		ctx.emit("app-boot/config-reload");
 		return { warnings: failures.map(reloadDiagnostic) };
 	} finally {
@@ -3897,7 +4644,7 @@ function rowIds(patches) {
 			if ((row.group === true || row.name === "cordis:group") && Array.isArray(row.config)) visit(row.config);
 		}
 	};
-	visit(applyEntryPatches([], patches, () => {}));
+	visit(applyPatches([], patches, () => {}));
 	return ids;
 }
 /** Publish a generation unless it maps exactly what is published, which would only drop the package caches. */
@@ -4052,7 +4799,7 @@ function renderConfigDump(binName, absoluteConfigPath, layers, warn = (line) =>
 	const baseLabel = basename(absoluteConfigPath);
 	const base = parsed;
 	const snapshot = (count, warnings) => {
-		return applyEntryPatches(base, structuredClone(layers.slice(0, count).flatMap((layer) => layer.patches)), (message, ...args) => {
+		return applyPatches(base, structuredClone(layers.slice(0, count).flatMap((layer) => layer.patches)), (message, ...args) => {
 			let index = 0;
 			warnings.push(message.replace(/%C/g, () => JSON.stringify(args[index++])));
 		});
@@ -4269,6 +5016,8 @@ const FIBER_DISPOSED = 4;
 */
 const requiredStartupEntryIds = new Set([
 	"agent-loop",
+	"tool-executor-native",
+	"tool-executor-ptc",
 	"webserver",
 	"web-runtime",
 	"modules",
@@ -4298,6 +5047,8 @@ function formatActivationError(error, stacks = true) {
 /** Startup audit failure with non-enumerable metadata and original failures as its cause. */
 var StartupError = class extends Error {
 	entries;
+	/** Plugin states captured before disposal, excluding configuration values. */
+	composition;
 	/** Root configuration and startup logs, attached by boot after disposal. */
 	startup;
 	/**
@@ -4310,7 +5061,8 @@ var StartupError = class extends Error {
 		this.entries = entries;
 		Object.defineProperties(this, {
 			entries: { enumerable: false },
-			startup: { enumerable: false }
+			startup: { enumerable: false },
+			composition: { enumerable: false }
 		});
 	}
 };
@@ -4524,14 +5276,6 @@ async function boot(binName, absoluteConfigPath, patches, prepare, bareModuleBas
 	try {
 		ctx.baseUrl = pathToFileURL(dirname(absoluteConfigPath)).href + "/";
 		ctx.provide("dshHomePath", dshHomePath);
-		ctx.on("internal/update", (_config, _noSave, next) => {
-			Promise.resolve(next()).catch((error) => {
-				ctx.logger.error(error);
-			});
-		}, {
-			global: true,
-			prepend: true
-		});
 		await ctx.plugin(Loader);
 		await prepare?.(ctx);
 		stage = "plugin tree failed to load";
@@ -4541,6 +5285,11 @@ async function boot(binName, absoluteConfigPath, patches, prepare, bareModuleBas
 		await auditStartupEntries(ctx, binName);
 		return ctx;
 	} catch (cause) {
+		if (cause instanceof StartupError) try {
+			cause.composition = captureStartupComposition(ctx);
+		} catch (error) {
+			ctx.logger.warn("Startup composition diagnostic unavailable", error);
+		}
 		await ctx.fiber.dispose();
 		if (cause instanceof StartupError) {
 			cause.startup = {
@@ -4563,4 +5312,4 @@ async function boot(binName, absoluteConfigPath, patches, prepare, bareModuleBas
 	}
 }
 //#endregion
-export { DEFAULT_PROFILE_BUNDLES, FAIL_LOUD_RELEASE_TIMEOUT_MS, LOADER_EXPRESSION_SCHEMA, OFFICIAL_ON_DEMAND_CATALOG, ON_DEMAND_BUNDLES, OPTIONAL_BUNDLES, PROFILES_DIR, PROFILE_COMPATIBILITY_FILENAME, PROFILE_PATCH_FILENAME, PROFILE_TEMPLATES, PluginPackages, ProfileRuntimeResolution, ResolutionRestartRequired, StartupError, auditStartupEntries, boot, bundlePatchFiles, bundlePatchPaths, composeEntries, createConfigProjector, createRuntimeResolution, evaluatePluginCompatibility, generateConfigSchema, getDshRuntimeVersion, initProfile, installFailLoud, isNativeConfigSchema, loadEnv, loadLayeredEnv, loadOptionalPatches, loadOverlayPatches, loadProfile, loadProfileDirectory, mountRootInclude, pluginCompatibilityWarning, prepareProfileEntries, prepareProfilePatches, readBundlePatches, readPluginMeta, readProfileCompatibility, readProfileManifest, readProfilePatches, readProfilePlugins, readProfileVersionExemptions, recomposeProfile, reconcileProfilePatches, reconcileProfilePlugins, removeLinkProjections, renderConfigDump, reportSkippedBundles, resolveBundleDir, resolveConfigPath, resolvePluginResource, resolveProfileDir, resolveTelemetryPatch, sanitizeProfile, setProfileVersionExemption, writeProfileBundles, writeProfileManifest };
+export { FAIL_LOUD_RELEASE_TIMEOUT_MS, LOADER_EXPRESSION_SCHEMA, PROFILES_DIR, PROFILE_COMPATIBILITY_FILENAME, PROFILE_PATCH_FILENAME, PluginPackages, ProfileRuntimeResolution, ResolutionRestartRequired, StartupError, UnsupportedBundlePlatformError, assertBundlePlatform, auditStartupEntries, boot, bundlePatchFiles, bundlePatchPaths, composeEntries, createConfigProjector, createRuntimeResolution, evaluatePluginCompatibility, generateConfigSchema, getDshRuntimeVersion, initProfile, installFailLoud, isNativeConfigSchema, loadEnv, loadLayeredEnv, loadOptionalPatches, loadOverlayPatches, loadProfile, loadProfileDirectory, mountRootInclude, pluginCompatibilityWarning, prepareProfileEntries, prepareProfilePatches, readBundlePatches, readPluginMeta, readProfileCompatibility, readProfileManifest, readProfilePatches, readProfilePlugins, readProfileVersionExemptions, recomposeProfile, reconcileProfilePatches, reconcileProfilePlugins, removeLinkProjections, renderConfigDump, reportSkippedBundles, resolveBundleDir, resolveConfigPath, resolvePluginResource, resolveProfileDir, resolveTelemetryPatch, sanitizeProfile, setProfileVersionExemption, validatePluginVersionExemption, writeProfileBundles, writeProfileManifest };