@deepseek-ai/dsh-plugin-manager 0.2.0-rc.1 → 0.2.1-alpha.1

package/README.i18n.yaml

@@ -15,8 +15,8 @@
   en: 87679c51aa3693f5
   zh: 11684a48a5806afb
 /deepseek-ai-dsh-plugin-manager/use-this-package:
-  en: b8d7061ee289b2a0
-  zh: 49aba7df4761fb23
+  en: 2cbe6e4a68994e2f
+  zh: ba0328f5538d8746
 /deepseek-ai-dsh-plugin-manager/use-this-package/version-compatibility-and-exemptions:
   en: 920c0acb3b9feaf3
   zh: ba6e832a256880a7
@@ -24,8 +24,8 @@
   en: d5643a06f300c30a
   zh: 9348b6a7676a2849
 /deepseek-ai-dsh-plugin-manager/understand-the-implementation:
-  en: 1c737c375aeac163
-  zh: 009d7f139a749c79
+  en: 7b54d30e231bb325
+  zh: 08df9441fed9927f
 /deepseek-ai-dsh-plugin-manager/further-exploration:
   en: c6538243d8702a0d
   zh: 04a82d923353c75f
@@ -48,8 +48,8 @@
   en: fde2d9491fe5dd4f
   zh: ef6e6db15c4f19d2
 /deepseek-ai-dsh-plugin-manager/known-limitations-and-deferred-work/failure-behavior:
-  en: 61450cf6e03c2819
-  zh: 4d52f5306825787b
+  en: 4447e4df8d62b274
+  zh: c76443e2edb97b1d
 /deepseek-ai-dsh-plugin-manager/known-limitations-and-deferred-work/dev-note:
   en: e67f633dc6fe7773
   zh: 3bb0c20c93f16f98

package/README.md

@@ -41,7 +41,7 @@ A plugin toggle updates only `disabled` in the last matching override in the pro
 
 A selected bundle that cannot load remains in `listBundles` with an `error`; `enabled` records the saved selection, not successful loading. The plugin page shows the error and allows deselection. A broken bundle cannot be enabled. Management bundles remain protected if their files become unreadable.
 
-`listBundles` includes optional display `meta` for each bundle and its declared plugin rows, including disabled bundles. The Client selects a language from these values. The separate `description` field is the bundle's raw `package.json.description`; a metadata diagnostic does not block management. The `plugin_manager` tool omits UI display metadata from list results.
+`listBundles` includes optional display `meta` for each bundle and its declared plugin rows, including disabled bundles. The Client selects a language from these values. The separate `description` field is the bundle's raw `package.json.description`; a metadata diagnostic does not block management. `source` gives a profile dependency as a spec `pnpm add` accepts: a git address or URL as recorded without the user information of an http(s) URL (a query string stays as recorded), a `file:` or `link:` path made absolute against the profile or the home directory for `~`, and a registry range, tag, or alias after the package name, as is any spec of a package installed under another name; a bundle the installation supplies has none, even when the profile also depends on it, because the installation's copy is the one that loads. The `plugin_manager` tool omits UI display metadata from list results.
 
 `inspect(spec, options)` reads what a spec names before anything installs: a registry name is asked of the registry through `pnpm view`, run in the profile directory so the same proxy and authentication settings apply as to the install; an absolute path has its `package.json` read; a git address or tarball answers only its form and the `host` it is fetched from. The answer carries the name, version, description, whether the package declares a bundle, and the `registry` that answered, or a `problem`: `invalid-spec`, `already-installed`, `not-found`, `not-a-package`, `not-a-bundle`, `network`, or `unknown`, with the `registries` asked. A caller's `signal` or `inspectTimeoutMs` ends the lookup.
 
@@ -51,7 +51,7 @@ Registries are asked in turn. The plan starts at `options.registry`, else the co
 
 The browser-safe `@deepseek-ai/dsh-plugin-manager/registry` entry exports `OFFICIAL_NPM_REGISTRY` and `NPMMIRROR_REGISTRY` for consumers that identify those public registries.
 
-`installBundle` accepts a caller-generated `requestId`, under which `plugin-manager/install-log` streams each pnpm run's output and `plugin-manager/install-state` announces `installing`, `cancelling`, and `applying`; `installing` is announced once per registry asked, with the `attempt`'s registry, position, and the plan's length. The install asks the same plan as the lookup, from `options.registry`, running `pnpm add` with `--registry` and restoring the profile files between attempts; it moves on for the failures another registry can change and stops at any other, and at a failure whose error line names the host a git or tarball spec is fetched from, which no registry stands in for; `failedAt` says which of the two the last failed run could not reach. `cancelInstall(requestId)` stops the run and answers `cancelled` only after the Git check or pnpm exited and the files are back, `too-late` once the bundle is being applied, and `not-running` for any other id; the install call then reports `application: 'cancelled'`. A run that fails, is cancelled, or adds a package without a bundle patch restores `package.json` and `pnpm-lock.yaml` as they were; `packageResult.kind` classifies the last run from its exit and output, `registries` names every registry asked, and `bundle` names the package a finished run added. `listBundles` carries each bundle's one-liner (the package `description`), the rows its patch declares with their live entries, and the built-in rows it overrides; it lists the profile's own bundles, the bundles the installation supplies, and a selected name without a bundle patch as a `not-bundle` problem, while an unselected plain dependency is left out. A bundle the launcher's `OPTIONAL_BUNDLES` names is `optional`: shipped switched off for the person to turn on, never removable, and selected by no shipped template ([rationale](../../../.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md)). Every completed operation emits `plugin-manager/changed`; a patch generation applied outside the manager, by HMR's watcher after a CLI or hand edit, announces nothing, so the page learns of it on its next read.
+`installBundle` accepts a caller-generated `requestId`, under which `plugin-manager/install-log` streams each pnpm run's output and `plugin-manager/install-state` announces `installing`, `cancelling`, and `applying`; `installing` is announced once per registry asked, with the `attempt`'s registry, position, and the plan's length. The install asks the same plan as the lookup, from `options.registry`, running `pnpm add` with `--registry` and restoring the profile files between attempts; it moves on for the failures another registry can change and stops at any other, and at a failure whose error line names the host a git or tarball spec is fetched from, which no registry stands in for; `failedAt` says which of the two the last failed run could not reach. `cancelInstall(requestId)` stops the run and answers `cancelled` only after the Git check or pnpm exited and the files are back, `too-late` once the bundle is being applied, and `not-running` for any other id; the install call then reports `application: 'cancelled'`. A run that fails, is cancelled, or adds a package without a bundle patch restores `package.json` and `pnpm-lock.yaml` as they were; `packageResult.kind` classifies the last run from its exit and output, `registries` names every registry asked, `bundle` names the package a finished run added, and `version` its manifest version, which can differ from the version `inspect` read, for example when pnpm's `minimumReleaseAge` holds back a recent release. `listBundles` carries each bundle's one-liner (the package `description`), the rows its patch declares with their live entries, and the built-in rows it overrides; it lists the profile's own bundles, the bundles the installation supplies, and a selected name without a bundle patch as a `not-bundle` problem, while an unselected plain dependency is left out. A bundle the launcher's `OPTIONAL_BUNDLES` names is `optional`: shipped switched off for the person to turn on, never removable, and selected by no shipped template ([rationale](../../../.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md)). Every completed operation emits `plugin-manager/changed`; a patch generation applied outside the manager, by HMR's watcher after a CLI or hand edit, announces nothing, so the page learns of it on its next read.
 
 `waitForInstall(requestId)` lets a client recover a lost response by waiting for the active installation, including its non-cancellable application phase. It returns the same outcome as the original call, or `null` if the request is not active. Completed results are not retained; `null` establishes neither success nor cancellation.
 
@@ -89,9 +89,13 @@ The CLI exposes `dsh plugin --profile <profile> version-exemptions`, `allow-vers
 <details>
 <summary>Implementation internals — click to expand</summary>
 
-The service and `dsh plugin` share the package operations in [operations.ts](src/operations.ts). The launcher supplies the current profile; [DSH HMR](../hmr/README.md) serializes module reloads, file watching and management writes. Each refresh re-reads bundle selection and patch layers, updates the original root Include, and awaits removed plugin resources as well as the remaining Loader tree. CLI and service operations share the profile manifest writer lock to prevent concurrent package and manifest writes. HMR does not acquire that lock. Pnpm runs outside the HMR queue; installation selects the bundle after pnpm succeeds, while removal deselects and unloads the bundle before pnpm runs. A service run whose captured output stays silent for `idleTimeoutMs` is terminated, reports `timedOut` alongside its exit status, is classified `timeout` whatever status the signal left behind, and is not retried on the next registry, which bounds how long one operation can hold the profile lock; the CLI inherits the terminal, captures no output, and stays unbounded for its operator to interrupt. A run completes when its process exits, and the pipes then drain under a bounded grace period, so a descendant that inherited them cannot hold the operation open. A terminated run stops its whole process tree and waits for it, because a lifecycle script outlives the pnpm process that started it (issue #4981). Each operation records the pnpm run it starts in `.plugin-manager/run.json` and removes the record when the run ends. A lock whose holder process exited is taken over by the next writer, but that process's pnpm tree can still be running, so an operation that finds a record waits up to five seconds for the recorded run to stop and otherwise fails with a diagnostic that names the process and the record, without running pnpm. Dependency-only changes do not trigger configuration reloads.
+The service and `dsh plugin` share the package operations in [operations.ts](src/operations.ts). The launcher supplies the current profile; [DSH HMR](../hmr/README.md) serializes module reloads, file watching and management writes. Each configuration refresh re-reads bundle selection and patch layers, updates the original root Include, and awaits removed plugin resources as well as the remaining Loader tree. CLI and service operations share the profile manifest writer lock to prevent concurrent package and manifest writes. HMR does not acquire that lock. Pnpm runs outside the HMR queue; installation selects the bundle after pnpm succeeds, while removal deselects and unloads the bundle before pnpm runs.
 
-Results contain the last attempted stage, target, saved-state change, application status and error codes. Web dictionaries render management text; pnpm and Loader diagnostics remain unmodified. Unrelated pre-existing inactive entries return warnings; new or changed failures and inactive explicit enablement targets fail the operation. A failed or cancelled installation restores the manifest and lockfile it snapshotted before pnpm ran ([rationale](../../../.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.md)); a failed removal retains its partial changes and diagnostics. Installations are tracked by request id until their call settles, so a cancellation names one run and joins its settlement without taking the profile lock. The CLI inherits authentication variables and terminal descriptors; service operations use a scrubbed environment and captured output. No invariant companion is published because the manager reads files and Loader state directly and owns no independent state projection.
+Installing a new package, enabling a bundle, disabling it with HMR after its plugins stop, and a successful removal publish the profile's runtime resolution. Shared dependencies may pass to another bundle's declaration when their normalized directory, version, and scope stay unchanged. Without HMR, a deselected startup bundle still runs: while any such bundle is absent from the saved selection, subsequent package operations retain the entire current table and report `restart-required`. Other new installations and removals of non-running bundles can still publish without HMR; activation waits for restart. Overwriting an installed package publishes nothing and reports `restart-required` ([decision](../../../.agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.md)).
+
+A service run whose captured output stays silent for `idleTimeoutMs` is terminated, reports `timedOut` alongside its exit status, is classified `timeout` whatever status the signal left behind, and is not retried on the next registry, which bounds how long one operation can hold the profile lock; the CLI inherits the terminal, captures no output, and stays unbounded for its operator to interrupt. A run completes when its process exits, and the pipes then drain under a bounded grace period, so a descendant that inherited them cannot hold the operation open. A terminated run stops its whole process tree and waits for it, because a lifecycle script outlives the pnpm process that started it (issue #4981). Each operation records the pnpm run it starts in `.plugin-manager/run.json` and removes the record when the run ends. A lock whose holder process exited is taken over by the next writer, but that process's pnpm tree can still be running, so an operation that finds a record waits up to five seconds for the recorded run to stop and otherwise fails with a diagnostic that names the process and the record, without running pnpm. Dependency-only changes do not trigger configuration reloads.
+
+Results contain the last attempted stage, target, saved-state change, application status and error codes. Web dictionaries render management text; pnpm and Loader diagnostics remain unmodified. Unrelated pre-existing inactive entries return warnings; new or changed failures and inactive explicit enablement targets fail the operation. A failed or cancelled package run, or failed bundle validation, restores the manifest and lockfile snapshotted before pnpm ran ([rationale](../../../.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.md)); later failures retain saved changes as described in [Failure behavior](#failure-behavior). Installations are tracked by request id until their call settles, so a cancellation names one run and joins its settlement without taking the profile lock. The CLI inherits authentication variables and terminal descriptors; service operations use a scrubbed environment and captured output.
 
 </details>
 
@@ -143,9 +147,10 @@ Failures preserve completed steps and report the actual remaining state. Profile
 |---|---|
 | Install: pnpm or bundle validation fails | Restore `package.json` and `pnpm-lock.yaml` as snapshotted before pnpm ran; files pnpm downloaded may remain. Report installation failure. |
 | Enable: saving selection or loading fails | Keep the installed dependency and any saved selection. Report enablement failure; allow repair, disablement or removal. |
+| Resolution publication after a successful package operation fails | Keep completed disk changes and the previous runtime table. Report `application: 'failed'` with the publication diagnostic; pnpm's zero exit code does not mean publication succeeded. |
 | Remove: any step fails | Stop at the failed step. Preserve completed changes, retain remaining dependencies for retry, and report removal failure. Do not re-enable the bundle. |
 
-Installation finishes after pnpm and bundle validation succeed; subsequent enablement failure does not undo installation. Removal proceeds in order: remove the bundle from `dsh.profile.bundles`, unload its runtime contributions, then run `pnpm remove`. A failed step prevents subsequent steps.
+Installation finishes after pnpm and bundle validation succeed; subsequent publication or enablement failure does not undo installation. Removal proceeds in order: remove the bundle from `dsh.profile.bundles`, unload its runtime contributions, run `pnpm remove`, then publish runtime resolution unless a deselected startup bundle still runs without HMR. A failed step prevents subsequent steps; publication failure after removal does not restore deleted packages. A selected name that neither the profile's dependencies nor the installation holds, such as a retired bundle, is also removable; its removal stops after deselection and runs no pnpm.
 
 Restoration rewrites only the two snapshotted files; user-authored patch configuration, application data, diagnostic logs and files pnpm downloaded remain untouched, and the next package operation prunes packages no manifest references.
 

package/README.zh.md

@@ -41,7 +41,7 @@ kind: "package-reference"
 
 已选择但无法加载的组合包仍会出现在 `listBundles` 中，并携带 `error`；`enabled` 表示保存的选择，不代表加载成功。插件页面显示错误并允许取消选择。损坏的组合包无法启用。管理组合包的文件变得不可读后仍受保护。
 
-`listBundles` 为各组合包及其声明的插件行提供可选的展示 `meta`，包括已禁用的组合包。Client 从这些值中选择语言。单独的 `description` 字段是该组合包原始的 `package.json.description`；元信息诊断不会阻止管理操作。`plugin_manager` 工具的列表结果不包含 UI 展示元信息。
+`listBundles` 为各组合包及其声明的插件行提供可选的展示 `meta`，包括已禁用的组合包。Client 从这些值中选择语言。单独的 `description` 字段是该组合包原始的 `package.json.description`；元信息诊断不会阻止管理操作。`source` 以 `pnpm add` 接受的 spec 给出 profile 依赖：git 地址或 URL 按记录给出，但去掉 http(s) URL 的 user information（查询字符串保持原样）；`file:` 或 `link:` 路径按 profile 目录解析为绝对路径，`~` 展开为主目录；注册表版本范围、标签或别名接在包名的 `@` 之后，以别名安装的包的 spec 也是如此。安装提供的组合包没有该字段，即使 profile 也依赖它，因为实际加载的是安装中的副本。`plugin_manager` 工具的列表结果不包含 UI 展示元信息。
 
 `inspect(spec, options)` 在任何东西安装之前读出 spec 指向什么：注册表包名通过 `pnpm view` 询问注册表，在 profile 目录中运行，因而与安装使用同样的代理与认证设置；绝对路径读取其 `package.json`；git 地址或 tarball 只答复自己的形式和它被拉取的 `host`。答复携带名称、版本、描述、该包是否声明组合包，以及作答的 `registry`，否则给出 `problem`：`invalid-spec`、`already-installed`、`not-found`、`not-a-package`、`not-a-bundle`、`network` 或 `unknown`，并附上问过的 `registries`。调用方的 `signal` 或 `inspectTimeoutMs` 会结束查询。
 
@@ -51,7 +51,7 @@ kind: "package-reference"
 
 可在浏览器使用的 `@deepseek-ai/dsh-plugin-manager/registry` 入口导出 `OFFICIAL_NPM_REGISTRY` 和 `NPMMIRROR_REGISTRY`，供消费方识别这两个公共注册表。
 
-`installBundle` 接受调用方生成的 `requestId`，`plugin-manager/install-log` 在其下流式转发每次 pnpm 运行的输出，`plugin-manager/install-state` 通告 `installing`、`cancelling` 与 `applying`；每问一个注册表通告一次 `installing`，`attempt` 带上这次的注册表、序号和计划长度。安装沿用查询的计划，从 `options.registry` 开始，以 `--registry` 运行 `pnpm add`，两次尝试之间恢复 profile 文件；换一个注册表能改变的失败才转问下一个，其他失败即停，错误行点名 git 或 tarball spec 自身拉取主机的失败也停，因为没有注册表能替代那台主机；`failedAt` 说明最后一次失败的运行连不上的是二者中的哪一个。`cancelInstall(requestId)` 停止运行，只在 Git 检查或 pnpm 退出且文件恢复后答复 `cancelled`，组合包已在应用时答复 `too-late`，其他 id 答复 `not-running`；安装调用随后报告 `application: 'cancelled'`。失败、被取消或装入了没有组合包 patch 的包的运行，会把 `package.json` 与 `pnpm-lock.yaml` 恢复原样；`packageResult.kind` 按退出方式与输出对最后一次运行分类，`registries` 列出问过的每个注册表，`bundle` 给出完成的运行新增的包。`listBundles` 携带每个组合包的一句话简介（包的 `description`）、其 patch 声明的行及其存活条目，以及它覆盖的内置行；它列出 profile 自己的组合包、安装提供的组合包，以及被选中却没有组合包 patch 的名字（作为 `not-bundle` 问题），未选中的普通依赖不列出。启动器的 `OPTIONAL_BUNDLES` 点名的组合包是 `optional`：随安装提供、默认关闭、由用户开启，永不可卸载，也不被任何随附模板选中（[理由](../../../.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.zh.md)）。每个完成的操作都会发出 `plugin-manager/changed`；在管理器之外应用的一代 patch（HMR 监视到 CLI 或手工编辑后）不发通知，页面要到下一次读取才知道。
+`installBundle` 接受调用方生成的 `requestId`，`plugin-manager/install-log` 在其下流式转发每次 pnpm 运行的输出，`plugin-manager/install-state` 通告 `installing`、`cancelling` 与 `applying`；每问一个注册表通告一次 `installing`，`attempt` 带上这次的注册表、序号和计划长度。安装沿用查询的计划，从 `options.registry` 开始，以 `--registry` 运行 `pnpm add`，两次尝试之间恢复 profile 文件；换一个注册表能改变的失败才转问下一个，其他失败即停，错误行点名 git 或 tarball spec 自身拉取主机的失败也停，因为没有注册表能替代那台主机；`failedAt` 说明最后一次失败的运行连不上的是二者中的哪一个。`cancelInstall(requestId)` 停止运行，只在 Git 检查或 pnpm 退出且文件恢复后答复 `cancelled`，组合包已在应用时答复 `too-late`，其他 id 答复 `not-running`；安装调用随后报告 `application: 'cancelled'`。失败、被取消或装入了没有组合包 patch 的包的运行，会把 `package.json` 与 `pnpm-lock.yaml` 恢复原样；`packageResult.kind` 按退出方式与输出对最后一次运行分类，`registries` 列出问过的每个注册表，`bundle` 给出完成的运行新增的包，`version` 给出它的清单版本，它可能与 `inspect` 读到的版本不同，例如 pnpm 的 `minimumReleaseAge` 暂缓了最近的发布。`listBundles` 携带每个组合包的一句话简介（包的 `description`）、其 patch 声明的行及其存活条目，以及它覆盖的内置行；它列出 profile 自己的组合包、安装提供的组合包，以及被选中却没有组合包 patch 的名字（作为 `not-bundle` 问题），未选中的普通依赖不列出。启动器的 `OPTIONAL_BUNDLES` 点名的组合包是 `optional`：随安装提供、默认关闭、由用户开启，永不可卸载，也不被任何随附模板选中（[理由](../../../.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.zh.md)）。每个完成的操作都会发出 `plugin-manager/changed`；在管理器之外应用的一代 patch（HMR 监视到 CLI 或手工编辑后）不发通知，页面要到下一次读取才知道。
 
 `waitForInstall(requestId)` 让客户端在响应丢失后等待活动安装的结果，包括不可取消的应用阶段。它返回与原调用相同的结果，请求不在活动中时返回 `null`。已完成的结果不保留；`null` 不表示成功或已取消。
 
@@ -89,9 +89,13 @@ CLI 提供 `dsh plugin --profile <profile> version-exemptions`、`allow-version
 <details>
 <summary>实现细节——点击展开</summary>
 
-服务与 `dsh plugin` 共用 [operations.ts](src/operations.ts) 中的包管理操作。启动器提供当前 profile；[DSH HMR](../hmr/README.zh.md) 串行执行模块重载、文件监听和管理写入。每次刷新重新读取组合包选择与 patch 层，更新原有根 Include，并等待已移除插件释放资源及剩余 Loader 树稳定。CLI 与 service 操作共用 profile manifest 写锁，防止并发包操作和 manifest 写入。HMR 不获取该锁。pnpm 在 HMR 队列之外执行；安装在 pnpm 成功后选入组合包，删除则在执行 pnpm 前取消选入并完成卸载。service 运行若在 `idleTimeoutMs` 内没有任何捕获输出即被终止，与退出状态一并报告 `timedOut`，不论信号留下什么退出状态都归类为 `timeout`，且不再转问下一个注册表，因此单次操作占用 profile 锁的时长有上界；CLI 继承终端、不捕获输出，因此不受此上界约束，由操作者中断。运行以进程退出为完成点，随后只在一个有界的宽限窗口内排空管道，因此继承管道的孙进程无法让操作挂起。被终止的运行会停止整棵进程树并等待其消失，因为生命周期脚本的存活时间超过启动它的 pnpm 进程（issue #4981）。每个操作把它启动的 pnpm 运行记录在 `.plugin-manager/run.json` 中，并在运行结束时删除该记录。持有者进程已退出的锁会被下一个写入方接管，但该进程的 pnpm 进程树可能仍在运行，因此发现记录的操作最多等待五秒让记录中的运行停止，否则不运行 pnpm，并以指明该进程与记录文件的诊断失败。仅依赖字段变化不会触发配置重载。
+服务与 `dsh plugin` 共用 [operations.ts](src/operations.ts) 中的包管理操作。启动器提供当前 profile；[DSH HMR](../hmr/README.zh.md) 串行执行模块重载、文件监听和管理写入。每次配置刷新重新读取组合包选择与 patch 层，更新原有根 Include，并等待已移除插件释放资源及剩余 Loader 树稳定。CLI 与 service 操作共用 profile manifest 写锁，防止并发包操作和 manifest 写入。HMR 不获取该锁。pnpm 在 HMR 队列之外执行；安装在 pnpm 成功后选入组合包，删除则在执行 pnpm 前取消选入并完成卸载。
 
-结果包含最后尝试的阶段、目标、磁盘变化、应用状态和错误码。Web 词典呈现管理文案；pnpm 与 Loader 的诊断保持原样。无关的已有故障作为警告返回；新出现、配置变化后的故障，以及显式启用目标未激活，都会使操作失败。失败或被取消的安装会恢复 pnpm 运行前快照的 manifest 与 lockfile（[理由](../../../.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.zh.md)）；失败的删除保留部分改动和诊断。安装按 request id 跟踪到调用结束，因此取消只针对一次运行，并且不取 profile 锁就能等待它结束。CLI 继承认证环境和终端描述符；service 使用清理后的环境并捕获输出。管理器直接读取文件和 Loader 状态，不维护第二份目标状态注册表，因此不发布单独的运行时不变式伴生入口。
+安装新包、启用组合包、有 HMR 时停用组合包并等插件退出后、以及删除成功后，都会发布 profile 的 runtime resolution。共享依赖的规范化目录、版本和作用域不变时，可以改由另一个组合包声明。没有 HMR 时，已取消选入的启动组合包仍在运行：只要保存的选择列表中缺少任何这样的组合包，后续包操作就保留整张当前表，并报告 `restart-required`。其他新安装和未运行组合包的删除仍可在没有 HMR 时发布；激活等待重启。覆盖已安装的包不发布，并报告 `restart-required`（[决策](../../../.agents/notes/implemented/architecture/2026-09-30-profile-package-refresh-and-manifest-invalidation.zh.md)）。
+
+service 运行若在 `idleTimeoutMs` 内没有任何捕获输出即被终止，与退出状态一并报告 `timedOut`，不论信号留下什么退出状态都归类为 `timeout`，且不再转问下一个注册表，因此单次操作占用 profile 锁的时长有上界；CLI 继承终端、不捕获输出，因此不受此上界约束，由操作者中断。运行以进程退出为完成点，随后只在一个有界的宽限窗口内排空管道，因此继承管道的孙进程无法让操作挂起。被终止的运行会停止整棵进程树并等待其消失，因为生命周期脚本的存活时间超过启动它的 pnpm 进程（issue #4981）。每个操作把它启动的 pnpm 运行记录在 `.plugin-manager/run.json` 中，并在运行结束时删除该记录。持有者进程已退出的锁会被下一个写入方接管，但该进程的 pnpm 进程树可能仍在运行，因此发现记录的操作最多等待五秒让记录中的运行停止，否则不运行 pnpm，并以指明该进程与记录文件的诊断失败。仅依赖字段变化不会触发配置重载。
+
+结果包含最后尝试的阶段、目标、磁盘变化、应用状态和错误码。Web 词典呈现管理文案；pnpm 与 Loader 的诊断保持原样。无关的已有故障作为警告返回；新出现、配置变化后的故障，以及显式启用目标未激活，都会使操作失败。包管理运行失败或被取消，或组合包校验失败时，会恢复 pnpm 运行前快照的 manifest 与 lockfile（[理由](../../../.agents/notes/implemented/architecture/2026-09-15-guided-plugin-installation.zh.md)）；后续失败按[失败行为](#failure-behavior)所述保留已保存的改动。安装按 request id 跟踪到调用结束，因此取消只针对一次运行，并且不取 profile 锁就能等待它结束。CLI 继承认证环境和终端描述符；service 使用清理后的环境并捕获输出。管理器直接读取文件和 Loader 状态，不维护第二份目标状态注册表，因此不发布单独的运行时不变式伴生入口。
 
 </details>
 
@@ -143,9 +147,10 @@ CLI 提供 `dsh plugin --profile <profile> version-exemptions`、`allow-version
 |---|---|
 | 安装：pnpm 执行或组合包校验失败 | 恢复 pnpm 运行前快照的 `package.json` 与 `pnpm-lock.yaml`；pnpm 已下载的文件可能保留。报告安装失败。 |
 | 启用：保存选择项或加载失败 | 保留已安装的依赖和已保存的选择项。报告启用失败，允许修正、停用或卸载。 |
+| 包操作成功后解析表发布失败 | 保留已完成的磁盘改动和上一张运行时表。报告 `application: 'failed'` 及发布诊断；pnpm 的零退出码不代表发布成功。 |
 | 卸载：任一步失败 | 停在失败步骤，保留已完成的改动和待重试删除的依赖，报告卸载失败。不重新启用组合包。 |
 
-pnpm 执行和组合包校验成功即完成安装，后续启用失败不撤销安装。卸载依次执行：从 `dsh.profile.bundles` 移除组合包、卸载运行时贡献、执行 `pnpm remove`。任一步失败都不继续执行后续步骤。
+pnpm 执行和组合包校验成功即完成安装，后续发布或启用失败不撤销安装。卸载依次执行：从 `dsh.profile.bundles` 移除组合包、卸载运行时贡献、执行 `pnpm remove`，然后发布 runtime resolution，除非没有 HMR 且已取消选入的启动组合包仍在运行。任一步失败都不继续执行后续步骤；删除后的发布失败不会恢复已删除的包。 profile 依赖和安装都不持有的已选名称（例如已下线的组合包）同样可卸载；其卸载在取消选择后结束，不运行 pnpm。
 
 恢复只重写这两份快照文件；用户编写的 patch 配置、应用数据、诊断日志以及 pnpm 已下载的文件保持原样，没有 manifest 引用的包由下一次包操作清理。
 

package/lib/index.js

@@ -11,6 +11,7 @@ import { OPTIONAL_BUNDLES, PROFILE_COMPATIBILITY_FILENAME, bundlePatchPaths, com
 import { once } from "node:events";
 import { execa } from "execa";
 import { scrubbedParentEnv } from "@deepseek-ai/dsh-subprocess";
+import { homedir } from "node:os";
 import { isAlias, isMap, isNode, isScalar, isSeq, parseDocument, visit } from "yaml";
 //#region lib/types/install-spec.js
 /**
@@ -115,6 +116,32 @@ function parseInstallSpec(raw) {
 		range
 	};
 }
+/** A recorded dependency value pnpm resolves outside a registry: a protocol other than a registry alias, or an scp-like git address. */
+const NON_REGISTRY_VALUE = /^(?!(?:npm|jsr|workspace|catalog):)[a-z][a-z0-9+.-]*:|^[^@/:\s]+@[^:/\s]+:/i;
+/** The user information of an http(s) URL, up to the last `@` before the path, which holds a password or access token when present. */
+const HTTP_USER_INFO = /^((?:git\+)?https?:\/\/)[^/]*@/i;
+/**
+* The spec `pnpm add` accepts for a dependency the profile manifest records. A git address, URL, or other
+* non-registry protocol is the recorded value without the user information of an http(s) URL, whose query string
+* is kept; a `file:` or `link:` path, which pnpm records relative to the profile or with `~` for the home
+* directory, becomes absolute. A registry range, tag, or alias follows the dependency name after `@`, as does a
+* non-registry value installed under a name other than the package's own.
+* @param name - the dependency name.
+* @param recorded - the value the profile manifest records for it.
+* @param profileDir - the profile directory a relative local path is resolved against.
+* @param packageName - the name the installed package's manifest declares, when it could be read.
+* @returns the installable spec.
+*/
+function dependencySpec(name, recorded, profileDir, packageName = name) {
+	const local = /^(file|link):(.*)$/s.exec(recorded);
+	let spec;
+	if (local !== null) {
+		const path = local[2].replace(/^~(?=$|[\\/])/, () => homedir());
+		spec = `${local[1]}:${resolve(profileDir, path)}`;
+	} else if (NON_REGISTRY_VALUE.test(recorded)) spec = recorded.replace(HTTP_USER_INFO, "$1");
+	else return `${name}@${recorded}`;
+	return packageName === name ? spec : `${name}@${spec}`;
+}
 //#endregion
 //#region lib/types/run-tree.js
 /** Waiting for one package run's process tree to disappear before its caller touches the profile. */
@@ -1450,14 +1477,15 @@ let PluginManager = (() => {
 		}
 		/** Read the profile's installed bundles, the bundles this dsh installation supplies, and the selected names that are not bundles.
 		* A dependency without a bundle patch is listed, as a `not-bundle` problem, only while it is selected.
-		* @returns Package versions, manifest descriptions, rows, optional display metadata, activation selections,
-		* whether the installation offers the bundle, and removal availability.
+		* @returns Package versions, manifest descriptions, the installable spec of profile dependencies, rows, optional
+		* display metadata, activation selections, whether the installation offers the bundle, and removal availability.
 		*/
 		listBundles() {
 			const manifest = readProfileManifest("dsh", this.profile.dir);
 			const exemptions = readProfileVersionExemptions(this.profile.dir);
 			const selected = manifest.dsh?.profile?.bundles ?? [];
-			const dependencies = Object.keys(manifest.dependencies ?? {});
+			const recorded = manifest.dependencies ?? {};
+			const dependencies = Object.keys(recorded);
 			const installation = JSON.parse(readFileSync(this.profile.installAnchor, "utf8"));
 			const names = [...new Set([
 				...selected,
@@ -1468,14 +1496,18 @@ let PluginManager = (() => {
 			for (const name of names) {
 				const installed = dependencies.includes(name);
 				const optional = OPTIONAL_BUNDLES.includes(name);
-				const removable = installed && !Object.hasOwn(installation.dependencies ?? {}, name);
 				const enabled = selected.includes(name);
+				const shipped = Object.hasOwn(installation.dependencies ?? {}, name);
+				const owned = installed && !shipped;
+				const removable = owned || enabled && !installed && !shipped;
+				const sourceOf = (packageName) => owned ? { source: dependencySpec(name, recorded[name], this.profile.dir, packageName) } : {};
 				const readOnlyReason = this.protectsManager(name) ? "management-required" : void 0;
 				try {
 					const info = bundleManifest(name, this.profile.dir, this.profile.installAnchor);
 					if (info === void 0) {
 						if (enabled) bundles.push({
 							name,
+							...sourceOf(),
 							enabled,
 							installed,
 							optional,
@@ -1496,6 +1528,7 @@ let PluginManager = (() => {
 						...info.version === void 0 ? {} : { version: info.version },
 						...info.description === void 0 || info.description === "" ? {} : { description: info.description },
 						...meta === void 0 ? {} : { meta },
+						...sourceOf(info.name),
 						enabled,
 						installed,
 						optional,
@@ -1506,6 +1539,7 @@ let PluginManager = (() => {
 				} catch (error) {
 					if (enabled || installed) bundles.push({
 						name,
+						...sourceOf(),
 						enabled,
 						installed,
 						optional,
@@ -1670,7 +1704,9 @@ let PluginManager = (() => {
 		setBundleEnabled(name, enabled) {
 			return this.change((result) => this.configure(async () => {
 				await this.selectBundle(name, enabled);
+				if (enabled) await this.refreshPackages();
 				result.warnings = await this.reload(enabled ? this.bundleRows(name).map((row) => row.id) : []);
+				if (!enabled && this.ownerContext.get("hmr") !== void 0) await this.refreshPackages();
 			}), {
 				stage: "enable",
 				target: name,
@@ -1714,6 +1750,7 @@ let PluginManager = (() => {
 				const files = await this.readRestoredFiles();
 				const before = readProfileManifest("dsh", this.profile.dir).dependencies ?? {};
 				let name;
+				let version;
 				try {
 					result.registries = [];
 					const connection = checkGithubConnection(parsedForRegistry(spec), this.profile.dir, {
@@ -1787,6 +1824,7 @@ let PluginManager = (() => {
 					const compatibility = evaluatePluginCompatibility(manifest, readProfileVersionExemptions(this.profile.dir));
 					if (compatibility !== void 0 && !compatibility.exempted) throw new ManagementFailure("incompatible-version", [incompatiblePlugin(compatibility)]);
 					for (const file of bundlePatchPaths(dir, manifest.dsh.bundle)) loadOverlayPatches("dsh", file);
+					version = manifest.version;
 				} catch (error) {
 					await this.restoreFiles(files);
 					throw error;
@@ -1794,11 +1832,13 @@ let PluginManager = (() => {
 				control.phase = "applying";
 				announce("applying");
 				result.bundle = name;
+				if (version !== void 0) result.version = version;
 				result.target = name;
 				result.stage = "enable";
 				return this.configure(async () => {
 					if (options?.enabled !== false) await this.selectBundle(name, true);
 					if (Object.hasOwn(before, name)) return "restart-required";
+					await this.refreshPackages();
 					if (options?.enabled !== false) result.warnings = await this.reload();
 				});
 			}, {
@@ -1837,13 +1877,14 @@ let PluginManager = (() => {
 			await control.result.then(() => void 0, () => void 0);
 			return { status: "cancelled" };
 		}
-		/** Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path.
-		* @param name Installed dependency name.
+		/** Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path; a selected name no
+		* dependency holds is only deselected.
+		* @param name Installed dependency or selected bundle name.
 		* @returns Removal diagnostics and the remaining profile state.
 		*/
 		removeBundle(name) {
 			return this.change(async (result) => {
-				await this.configure(async () => {
+				if (!await this.configure(async () => {
 					const bundle = (await this.listBundles()).find((item) => item.name === name);
 					if (bundle === void 0 || !bundle.removable) throw new ManagementFailure("not-removable");
 					if (this.ownerContext.get("hmr") === void 0 && (this.profile.startedBundles.includes(name) || bundle.error === void 0 && this.bundleRows(name).some((row) => [...this.ctx.loader.entries()].some((entry) => entry.options.id === row.id && entry.fiber !== void 0)))) throw new ManagementFailure("stop-profile");
@@ -1853,9 +1894,11 @@ let PluginManager = (() => {
 						result.warnings = await this.reload();
 					}
 					if ([...this.ctx.loader.entries()].some((entry) => entry.fiber?.uid != null && contributions.some((row) => row.id === entry.options.id && row.name === entry.options.name))) throw new ManagementFailure("bundle-in-use");
-				});
+					return bundle.installed;
+				})) return;
 				result.packageResult = await this.runPnpm(["remove", name]);
 				if (result.packageResult.exitCode !== 0 || result.packageResult.timedOut === true) throw new Error(result.packageResult.output);
+				await this.configure(() => this.refreshPackages());
 			}, {
 				stage: "remove",
 				target: name
@@ -2028,6 +2071,13 @@ let PluginManager = (() => {
 			};
 			return hmr === void 0 ? apply() : hmr.runExclusive(apply);
 		}
+		async refreshPackages() {
+			if (this.ownerContext.get("hmr") === void 0) {
+				const selected = readProfileManifest("dsh", this.profile.dir).dsh?.profile?.bundles ?? [];
+				if (this.profile.startedBundles.some((name) => !selected.includes(name))) return;
+			}
+			await this.ownerContext.get("pluginPackages")?.refresh();
+		}
 		async reload(requiredIds = []) {
 			if (this.ownerContext.get("hmr") === void 0) return [];
 			return reconcileProfilePatches(this.ownerContext.root, readProfilePatches("dsh", this.profile), "dsh", requiredIds);

package/lib/typert.host.js

@@ -71,6 +71,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_result$schema
 })).optional(),
 }).optional(),
   'bundle': z.string().optional(),
+  'version': z.string().optional(),
   'pendingBuilds': z.array(z.string()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registries': z.array(z.union([z.literal(null), z.string()])).optional(),
@@ -93,6 +94,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_listBundles_result$schema =
   'description': z.string().optional(),
   'enabled': z.boolean(),
   'installed': z.boolean(),
+  'source': z.string().optional(),
   'optional': z.boolean(),
   'removable': z.boolean(),
   'readOnlyReason': z.union([z.literal("management-required"), z.literal("unaddressable")]).optional(),
@@ -207,6 +209,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_removeBundle_result$schema =
 })).optional(),
 }).optional(),
   'bundle': z.string().optional(),
+  'version': z.string().optional(),
   'pendingBuilds': z.array(z.string()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registries': z.array(z.union([z.literal(null), z.string()])).optional(),
@@ -249,6 +252,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_setBundleEnabled_result$sche
 })).optional(),
 }).optional(),
   'bundle': z.string().optional(),
+  'version': z.string().optional(),
   'pendingBuilds': z.array(z.string()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registries': z.array(z.union([z.literal(null), z.string()])).optional(),
@@ -291,6 +295,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_setPluginEnabled_result$sche
 })).optional(),
 }).optional(),
   'bundle': z.string().optional(),
+  'version': z.string().optional(),
   'pendingBuilds': z.array(z.string()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registries': z.array(z.union([z.literal(null), z.string()])).optional(),
@@ -337,6 +342,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_setVersionExemption_result$s
 })).optional(),
 }).optional(),
   'bundle': z.string().optional(),
+  'version': z.string().optional(),
   'pendingBuilds': z.array(z.string()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registries': z.array(z.union([z.literal(null), z.string()])).optional(),
@@ -377,6 +383,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_waitForInstall_result$schema
 })).optional(),
 }).optional(),
   'bundle': z.string().optional(),
+  'version': z.string().optional(),
   'pendingBuilds': z.array(z.string()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registries': z.array(z.union([z.literal(null), z.string()])).optional(),
@@ -412,7 +419,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#PluginInstallCancellation',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_cancelInstall_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":585,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":600,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/inspect',
@@ -449,7 +456,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#PluginSpecInspection',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_inspect_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":341,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":350,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/installBundle',
@@ -485,7 +492,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":462,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":473,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/listBundles',
@@ -545,7 +552,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#PluginRegistries',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_registries_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":325,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":334,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/removeBundle',
@@ -570,7 +577,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_removeBundle_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":601,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":617,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/setBundleEnabled',
@@ -605,7 +612,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_setBundleEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":443,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":452,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/setPluginEnabled',
@@ -640,7 +647,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_setPluginEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":425,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":434,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/setVersionExemption',
@@ -721,7 +728,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager#pluginManager/waitForInstall:result',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_waitForInstall_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":575,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":590,"column":9},
     },
   ],
   model: {
@@ -760,7 +767,7 @@ export const TYPERT = {
             "name": "listBundles",
             "signature": "@Remote listBundles(): Promise<BundleInfo[]>",
             "summary": "Read the profile's installed bundles, the bundles this dsh installation supplies, and the selected names that are not bundles.",
-            "jsDoc": "/** Read the profile's installed bundles, the bundles this dsh installation supplies, and the selected names that are not bundles.\n * A dependency without a bundle patch is listed, as a `not-bundle` problem, only while it is selected.\n * @returns Package versions, manifest descriptions, rows, optional display metadata, activation selections,\n * whether the installation offers the bundle, and removal availability.\n */"
+            "jsDoc": "/** Read the profile's installed bundles, the bundles this dsh installation supplies, and the selected names that are not bundles.\n * A dependency without a bundle patch is listed, as a `not-bundle` problem, only while it is selected.\n * @returns Package versions, manifest descriptions, the installable spec of profile dependencies, rows, optional\n * display metadata, activation selections, whether the installation offers the bundle, and removal availability.\n */"
           },
           {
             "kind": "method",
@@ -815,8 +822,8 @@ export const TYPERT = {
             "kind": "method",
             "name": "removeBundle",
             "signature": "@Remote removeBundle(name: string): Promise<ChangeResult>",
-            "summary": "Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path.",
-            "jsDoc": "/** Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path.\n * @param name Installed dependency name.\n * @returns Removal diagnostics and the remaining profile state.\n */"
+            "summary": "Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path; a selected name no dependency holds is only deselected.",
+            "jsDoc": "/** Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path; a selected name no\n * dependency holds is only deselected.\n * @param name Installed dependency or selected bundle name.\n * @returns Removal diagnostics and the remaining profile state.\n */"
           }
         ],
         "types": [
@@ -826,7 +833,7 @@ export const TYPERT = {
           },
           {
             "name": "BundleInfo",
-            "declaration": "export interface BundleInfo {\n    name: string;\n    version?: string;\n    meta?: PluginLocalizedMeta;\n    description?: string;\n    enabled: boolean;\n    installed: boolean;\n    optional: boolean;\n    removable: boolean;\n    readOnlyReason?: ReadOnlyReason;\n    error?: ManagementError;\n    rows: BundleRowInfo[];\n    overrides: string[];\n}"
+            "declaration": "export interface BundleInfo {\n    name: string;\n    version?: string;\n    meta?: PluginLocalizedMeta;\n    description?: string;\n    enabled: boolean;\n    installed: boolean;\n    source?: string;\n    optional: boolean;\n    removable: boolean;\n    readOnlyReason?: ReadOnlyReason;\n    error?: ManagementError;\n    rows: BundleRowInfo[];\n    overrides: string[];\n}"
           },
           {
             "name": "BundleRowInfo",
@@ -834,7 +841,7 @@ export const TYPERT = {
           },
           {
             "name": "ChangeResult",
-            "declaration": "export interface ChangeResult {\n    changed: boolean;\n    application: 'applied' | 'restart-required' | 'overridden' | 'failed' | 'cancelled';\n    stage: 'install' | 'enable' | 'remove';\n    target: string;\n    enabled?: boolean;\n    error?: ManagementError;\n    warnings?: string[];\n    packageResult?: PackageResult;\n    bundle?: string;\n    pendingBuilds?: string[];\n    approvedBuilds?: string[];\n    registries?: Registry[];\n    failedAt?: 'registry' | 'spec-host';\n}"
+            "declaration": "export interface ChangeResult {\n    changed: boolean;\n    application: 'applied' | 'restart-required' | 'overridden' | 'failed' | 'cancelled';\n    stage: 'install' | 'enable' | 'remove';\n    target: string;\n    enabled?: boolean;\n    error?: ManagementError;\n    warnings?: string[];\n    packageResult?: PackageResult;\n    bundle?: string;\n    version?: string;\n    pendingBuilds?: string[];\n    approvedBuilds?: string[];\n    registries?: Registry[];\n    failedAt?: 'registry' | 'spec-host';\n}"
           },
           {
             "name": "IncompatiblePlugin",

package/lib/typert.remote-client.js

@@ -71,6 +71,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_result$schema
 })).optional(),
 }).optional(),
   'bundle': z.string().optional(),
+  'version': z.string().optional(),
   'pendingBuilds': z.array(z.string()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registries': z.array(z.union([z.literal(null), z.string()])).optional(),
@@ -93,6 +94,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_listBundles_result$schema =
   'description': z.string().optional(),
   'enabled': z.boolean(),
   'installed': z.boolean(),
+  'source': z.string().optional(),
   'optional': z.boolean(),
   'removable': z.boolean(),
   'readOnlyReason': z.union([z.literal("management-required"), z.literal("unaddressable")]).optional(),
@@ -207,6 +209,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_removeBundle_result$schema =
 })).optional(),
 }).optional(),
   'bundle': z.string().optional(),
+  'version': z.string().optional(),
   'pendingBuilds': z.array(z.string()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registries': z.array(z.union([z.literal(null), z.string()])).optional(),
@@ -249,6 +252,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_setBundleEnabled_result$sche
 })).optional(),
 }).optional(),
   'bundle': z.string().optional(),
+  'version': z.string().optional(),
   'pendingBuilds': z.array(z.string()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registries': z.array(z.union([z.literal(null), z.string()])).optional(),
@@ -291,6 +295,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_setPluginEnabled_result$sche
 })).optional(),
 }).optional(),
   'bundle': z.string().optional(),
+  'version': z.string().optional(),
   'pendingBuilds': z.array(z.string()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registries': z.array(z.union([z.literal(null), z.string()])).optional(),
@@ -337,6 +342,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_setVersionExemption_result$s
 })).optional(),
 }).optional(),
   'bundle': z.string().optional(),
+  'version': z.string().optional(),
   'pendingBuilds': z.array(z.string()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registries': z.array(z.union([z.literal(null), z.string()])).optional(),
@@ -377,6 +383,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_waitForInstall_result$schema
 })).optional(),
 }).optional(),
   'bundle': z.string().optional(),
+  'version': z.string().optional(),
   'pendingBuilds': z.array(z.string()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registries': z.array(z.union([z.literal(null), z.string()])).optional(),
@@ -409,7 +416,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#PluginInstallCancellation',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_cancelInstall_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":585,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":600,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/inspect',
@@ -446,7 +453,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#PluginSpecInspection',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_inspect_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":341,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":350,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/installBundle',
@@ -482,7 +489,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":462,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":473,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/listBundles',
@@ -542,7 +549,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#PluginRegistries',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_registries_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":325,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":334,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/removeBundle',
@@ -567,7 +574,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_removeBundle_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":601,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":617,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/setBundleEnabled',
@@ -602,7 +609,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_setBundleEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":443,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":452,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/setPluginEnabled',
@@ -637,7 +644,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_setPluginEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":425,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":434,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/setVersionExemption',
@@ -718,7 +725,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager#pluginManager/waitForInstall:result',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_waitForInstall_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":575,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":590,"column":9},
     },
   ],
 }

package/lib/types/index.d.ts

@@ -77,8 +77,8 @@ export declare class PluginManager extends TypertRemoteService {
     listPlugins(): Promise<PluginInfo[]>;
     /** Read the profile's installed bundles, the bundles this dsh installation supplies, and the selected names that are not bundles.
      * A dependency without a bundle patch is listed, as a `not-bundle` problem, only while it is selected.
-     * @returns Package versions, manifest descriptions, rows, optional display metadata, activation selections,
-     * whether the installation offers the bundle, and removal availability.
+     * @returns Package versions, manifest descriptions, the installable spec of profile dependencies, rows, optional
+     * display metadata, activation selections, whether the installation offers the bundle, and removal availability.
      */
     listBundles(): Promise<BundleInfo[]>;
     /** Read the registries this manager asks: the configured first one, its fallbacks in order, and what pnpm's own configuration names.
@@ -128,8 +128,9 @@ export declare class PluginManager extends TypertRemoteService {
      * applied, `not-running` for any other id.
      */
     cancelInstall(requestId: PluginInstallRequestId): Promise<PluginInstallCancellation>;
-    /** Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path.
-     * @param name Installed dependency name.
+    /** Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path; a selected name no
+     * dependency holds is only deselected.
+     * @param name Installed dependency or selected bundle name.
      * @returns Removal diagnostics and the remaining profile state.
      */
     removeBundle(name: string): Promise<ChangeResult>;
@@ -145,6 +146,7 @@ export declare class PluginManager extends TypertRemoteService {
     private bundleRows;
     private protectsManager;
     private configure;
+    private refreshPackages;
     private reload;
     private change;
     private diskState;

package/lib/types/index.js

@@ -45,7 +45,7 @@ import { pluginEntryId, readPluginInventory } from '@deepseek-ai/dsh-host-plugin
 import { readPluginMeta, readProfileManifest, resolveBundleDir, loadOverlayPatches, composeEntries, reconcileProfilePatches, readProfilePatches, OPTIONAL_BUNDLES, bundlePatchPaths, evaluatePluginCompatibility, readProfileCompatibility, readProfileVersionExemptions, setProfileVersionExemption, PROFILE_COMPATIBILITY_FILENAME, } from '@deepseek-ai/dsh-app-boot';
 import { bundleManifest, readProfileRegistry, registryArguments, runProfilePnpm, saveManifest, viewProfilePackage } from "./operations.js";
 import { classifyInstallFailure } from "./install-failure.js";
-import { InvalidInstallSpecError, parseInstallSpec } from "./install-spec.js";
+import { dependencySpec, InvalidInstallSpecError, parseInstallSpec } from "./install-spec.js";
 import { attributeFailure, normalizeRegistry, NPMMIRROR_REGISTRY, registryPlan } from "./registry.js";
 import { writePluginEnabled } from "./patch.js";
 import { incompatiblePlugin, ManagementFailure } from "./failure.js";
@@ -276,28 +276,36 @@ let PluginManager = (() => {
         }
         /** Read the profile's installed bundles, the bundles this dsh installation supplies, and the selected names that are not bundles.
          * A dependency without a bundle patch is listed, as a `not-bundle` problem, only while it is selected.
-         * @returns Package versions, manifest descriptions, rows, optional display metadata, activation selections,
-         * whether the installation offers the bundle, and removal availability.
+         * @returns Package versions, manifest descriptions, the installable spec of profile dependencies, rows, optional
+         * display metadata, activation selections, whether the installation offers the bundle, and removal availability.
          */
         listBundles() {
             const manifest = readProfileManifest('dsh', this.profile.dir);
             const exemptions = readProfileVersionExemptions(this.profile.dir);
             const selected = manifest.dsh?.profile?.bundles ?? [];
-            const dependencies = Object.keys(manifest.dependencies ?? {});
+            const recorded = manifest.dependencies ?? {};
+            const dependencies = Object.keys(recorded);
             const installation = JSON.parse(readFileSync(this.profile.installAnchor, 'utf8'));
             const names = [...new Set([...selected, ...dependencies, ...Object.keys(installation.dependencies ?? {})])];
             const bundles = [];
             for (const name of names) {
                 const installed = dependencies.includes(name);
                 const optional = OPTIONAL_BUNDLES.includes(name);
-                const removable = installed && !Object.hasOwn(installation.dependencies ?? {}, name);
                 const enabled = selected.includes(name);
+                const shipped = Object.hasOwn(installation.dependencies ?? {}, name);
+                // Bundle resolution reads the installation first, so a profile dependency the installation manifest also names,
+                // like one it forbids removing, is not the loaded copy.
+                const owned = installed && !shipped;
+                // A selection neither the profile nor the installation holds, such as a retired bundle, is removed by deselecting it.
+                const removable = owned || (enabled && !installed && !shipped);
+                const sourceOf = (packageName) => owned ? { source: dependencySpec(name, recorded[name], this.profile.dir, packageName) } : {};
                 const readOnlyReason = this.protectsManager(name) ? 'management-required' : undefined;
                 try {
                     const info = bundleManifest(name, this.profile.dir, this.profile.installAnchor);
                     if (info === undefined) {
                         if (enabled)
-                            bundles.push({ name, enabled, installed, optional, removable: removable && readOnlyReason === undefined,
+                            bundles.push({ name, ...sourceOf(), enabled, installed, optional,
+                                removable: removable && readOnlyReason === undefined,
                                 ...(readOnlyReason === undefined ? {} : { readOnlyReason }), error: { code: 'not-bundle' }, rows: [], overrides: [] });
                         continue;
                     }
@@ -309,13 +317,13 @@ let PluginManager = (() => {
                     bundles.push({ name, ...(info.version === undefined ? {} : { version: info.version }),
                         ...(info.description === undefined || info.description === '' ? {} : { description: info.description }),
                         ...meta === undefined ? {} : { meta },
-                        enabled, installed, optional, removable: removable && readOnlyReason === undefined,
+                        ...sourceOf(info.name), enabled, installed, optional, removable: removable && readOnlyReason === undefined,
                         ...(readOnlyReason === undefined ? {} : { readOnlyReason }),
                         ...this.declaredRows(name, info) });
                 }
                 catch (error) {
                     if (enabled || installed) {
-                        bundles.push({ name, enabled, installed, optional, removable: removable && readOnlyReason === undefined,
+                        bundles.push({ name, ...sourceOf(), enabled, installed, optional, removable: removable && readOnlyReason === undefined,
                             ...(readOnlyReason === undefined ? {} : { readOnlyReason }), error: managementError(error), rows: [], overrides: [] });
                     }
                 }
@@ -456,7 +464,11 @@ let PluginManager = (() => {
         setBundleEnabled(name, enabled) {
             return this.change(result => this.configure(async () => {
                 await this.selectBundle(name, enabled);
+                if (enabled)
+                    await this.refreshPackages();
                 result.warnings = await this.reload(enabled ? this.bundleRows(name).map(row => row.id) : []);
+                if (!enabled && this.ownerContext.get('hmr') !== undefined)
+                    await this.refreshPackages();
             }), { stage: 'enable', target: name, enabled }, 'bundle');
         }
         /**
@@ -492,6 +504,7 @@ let PluginManager = (() => {
                 const files = await this.readRestoredFiles();
                 const before = readProfileManifest('dsh', this.profile.dir).dependencies ?? {};
                 let name;
+                let version;
                 try {
                     result.registries = [];
                     const connection = checkGithubConnection(parsedForRegistry(spec), this.profile.dir, {
@@ -584,6 +597,7 @@ let PluginManager = (() => {
                         throw new ManagementFailure('incompatible-version', [incompatiblePlugin(compatibility)]);
                     for (const file of bundlePatchPaths(dir, manifest.dsh.bundle))
                         loadOverlayPatches('dsh', file);
+                    version = manifest.version;
                 }
                 catch (error) {
                     // pnpm has exited by now, so the files it rewrote go back as they were.
@@ -593,6 +607,8 @@ let PluginManager = (() => {
                 control.phase = 'applying';
                 announce('applying');
                 result.bundle = name;
+                if (version !== undefined)
+                    result.version = version;
                 result.target = name;
                 result.stage = 'enable';
                 return this.configure(async () => {
@@ -600,6 +616,7 @@ let PluginManager = (() => {
                         await this.selectBundle(name, true);
                     if (Object.hasOwn(before, name))
                         return 'restart-required';
+                    await this.refreshPackages();
                     if (options?.enabled !== false)
                         result.warnings = await this.reload();
                 });
@@ -633,13 +650,14 @@ let PluginManager = (() => {
             await control.result.then(() => undefined, () => undefined);
             return { status: 'cancelled' };
         }
-        /** Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path.
-         * @param name Installed dependency name.
+        /** Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path; a selected name no
+         * dependency holds is only deselected.
+         * @param name Installed dependency or selected bundle name.
          * @returns Removal diagnostics and the remaining profile state.
          */
         removeBundle(name) {
             return this.change(async (result) => {
-                await this.configure(async () => {
+                const installed = await this.configure(async () => {
                     const bundle = (await this.listBundles()).find(item => item.name === name);
                     if (bundle === undefined || !bundle.removable)
                         throw new ManagementFailure('not-removable');
@@ -657,11 +675,15 @@ let PluginManager = (() => {
                         && contributions.some(row => row.id === entry.options.id && row.name === entry.options.name))) {
                         throw new ManagementFailure('bundle-in-use');
                     }
+                    return bundle.installed;
                 });
+                if (!installed)
+                    return;
                 result.packageResult = await this.runPnpm(['remove', name]);
                 if (result.packageResult.exitCode !== 0 || result.packageResult.timedOut === true) {
                     throw new Error(result.packageResult.output);
                 }
+                await this.configure(() => this.refreshPackages());
             }, { stage: 'remove', target: name }, 'remove');
         }
         /** The rows a bundle's patch inserts and the existing rows it changes; an unreadable patch throws. */
@@ -806,6 +828,15 @@ let PluginManager = (() => {
             const apply = () => { this.abort.signal.throwIfAborted(); return operation(); };
             return hmr === undefined ? apply() : hmr.runExclusive(apply);
         }
+        async refreshPackages() {
+            if (this.ownerContext.get('hmr') === undefined) {
+                const selected = readProfileManifest('dsh', this.profile.dir).dsh?.profile?.bundles ?? [];
+                // Deselected startup bundles still run without HMR and need the existing package table.
+                if (this.profile.startedBundles.some(name => !selected.includes(name)))
+                    return;
+            }
+            await this.ownerContext.get('pluginPackages')?.refresh();
+        }
         async reload(requiredIds = []) {
             if (this.ownerContext.get('hmr') === undefined)
                 return [];

package/lib/types/install-spec.d.ts

@@ -47,4 +47,17 @@ export declare class InvalidInstallSpecError extends Error {
  * registry would refuse, or a URL that is neither a git host nor a tarball.
  */
 export declare function parseInstallSpec(raw: string): ParsedInstallSpec;
+/**
+ * The spec `pnpm add` accepts for a dependency the profile manifest records. A git address, URL, or other
+ * non-registry protocol is the recorded value without the user information of an http(s) URL, whose query string
+ * is kept; a `file:` or `link:` path, which pnpm records relative to the profile or with `~` for the home
+ * directory, becomes absolute. A registry range, tag, or alias follows the dependency name after `@`, as does a
+ * non-registry value installed under a name other than the package's own.
+ * @param name - the dependency name.
+ * @param recorded - the value the profile manifest records for it.
+ * @param profileDir - the profile directory a relative local path is resolved against.
+ * @param packageName - the name the installed package's manifest declares, when it could be read.
+ * @returns the installable spec.
+ */
+export declare function dependencySpec(name: string, recorded: string, profileDir: string, packageName?: string): string;
 //# sourceMappingURL=install-spec.d.ts.map

package/lib/types/install-spec.js

@@ -3,7 +3,8 @@
  * takes, and for a registry name whether it is one the registry can accept.
  * @module @deepseek-ai/dsh-plugin-manager/install-spec
  */
-import { isAbsolute } from 'node:path';
+import { homedir } from 'node:os';
+import { isAbsolute, resolve } from 'node:path';
 /** The forms pnpm resolves through a git host: a host shorthand, a git URL, or a hosted repository URL. */
 const GIT_SHORTHAND = /^(?:github|gitlab|bitbucket|gist):/i;
 const GIT_URL = /^git(?:\+[a-z]+)?:\/\/|^git@[^:]+:/i;
@@ -84,4 +85,35 @@ export function parseInstallSpec(raw) {
         throw invalid(spec, 'a version after @ must not be empty');
     return range === undefined ? { kind: 'registry', spec, name } : { kind: 'registry', spec, name, range };
 }
+/** A recorded dependency value pnpm resolves outside a registry: a protocol other than a registry alias, or an scp-like git address. */
+const NON_REGISTRY_VALUE = /^(?!(?:npm|jsr|workspace|catalog):)[a-z][a-z0-9+.-]*:|^[^@/:\s]+@[^:/\s]+:/i;
+/** The user information of an http(s) URL, up to the last `@` before the path, which holds a password or access token when present. */
+const HTTP_USER_INFO = /^((?:git\+)?https?:\/\/)[^/]*@/i;
+/**
+ * The spec `pnpm add` accepts for a dependency the profile manifest records. A git address, URL, or other
+ * non-registry protocol is the recorded value without the user information of an http(s) URL, whose query string
+ * is kept; a `file:` or `link:` path, which pnpm records relative to the profile or with `~` for the home
+ * directory, becomes absolute. A registry range, tag, or alias follows the dependency name after `@`, as does a
+ * non-registry value installed under a name other than the package's own.
+ * @param name - the dependency name.
+ * @param recorded - the value the profile manifest records for it.
+ * @param profileDir - the profile directory a relative local path is resolved against.
+ * @param packageName - the name the installed package's manifest declares, when it could be read.
+ * @returns the installable spec.
+ */
+export function dependencySpec(name, recorded, profileDir, packageName = name) {
+    const local = /^(file|link):(.*)$/s.exec(recorded);
+    let spec;
+    if (local !== null) {
+        const path = local[2].replace(/^~(?=$|[\\/])/, () => homedir());
+        spec = `${local[1]}:${resolve(profileDir, path)}`;
+    }
+    else if (NON_REGISTRY_VALUE.test(recorded)) {
+        spec = recorded.replace(HTTP_USER_INFO, '$1');
+    }
+    else {
+        return `${name}@${recorded}`;
+    }
+    return packageName === name ? spec : `${name}@${spec}`;
+}
 //# sourceMappingURL=install-spec.js.map

package/lib/types/types.d.ts

@@ -52,6 +52,11 @@ export interface BundleInfo {
     enabled: boolean;
     /** Whether the profile's own dependencies hold the package; false for a bundle the dsh installation supplies. */
     installed: boolean;
+    /**
+     * Present for a profile dependency the installation does not also supply: the spec `pnpm add` accepts, with local
+     * paths made absolute and the user information of an http(s) URL removed.
+     */
+    source?: string;
     /**
      * Whether the installation ships the bundle for the person to switch on: named by the launcher's `OPTIONAL_BUNDLES`,
      * held by the installation's dependencies, selected by no shipped template, and never removable.
@@ -104,6 +109,8 @@ export interface ChangeResult {
     packageResult?: PackageResult;
     /** The bundle an installation added, once pnpm and the bundle check accepted it. */
     bundle?: string;
+    /** The installed bundle's manifest version, when declared; pnpm's `minimumReleaseAge` can make it older than the newest release. */
+    version?: string;
     /** Exact package names awaiting explicit script approval in the profile's pnpm settings, read after a failed run. */
     pendingBuilds?: string[];
     /** Package script permissions saved before this installation attempt. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-plugin-manager",
   "description": "Current-profile plugin and bundle management shared by dsh CLI, Web and agent tools",
-  "version": "0.2.0-rc.1",
+  "version": "0.2.1-alpha.1",
   "publishConfig": {
     "access": "public"
   },
@@ -59,23 +59,23 @@
     "execa": "^10.0.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@deepseek-ai/dsh-app-boot": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-atomic-write": "0.2.0-rc.1",
-    "@deepseek-ai/schemastery": "~3.18.4",
-    "@deepseek-ai/dsh-util-values": "0.2.0-rc.1"
+    "@deepseek-ai/dsh-app-boot": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-atomic-write": "0.2.1-alpha.1",
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.1",
+    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.1"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.4",
-    "@deepseek-ai/cordis-plugin-loader": "~1.0.5",
-    "@deepseek-ai/dsh-host-plugin-inventory": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-tools": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-hmr": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-brand": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-user-approval": "0.2.0-rc.1"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1",
+    "@deepseek-ai/dsh-host-plugin-inventory": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-tools": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-hmr": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-alpha.1"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-hmr": {
@@ -86,22 +86,23 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-package-manifest": "0.2.0-rc.1",
-    "@deepseek-ai/cordis": "~4.0.4",
-    "@deepseek-ai/cordis-plugin-loader": "~1.0.5",
-    "@deepseek-ai/dsh-host-plugin-inventory": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-tools": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-system-prompt": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-hmr": "0.2.0-rc.1",
-    "@deepseek-ai/cordis-plugin-timer": "~1.1.6",
-    "@deepseek-ai/dsh-brand": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-agent": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-session": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-session-projection": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-user-approval": "0.2.0-rc.1"
+    "chokidar": "^4.0.3",
+    "@deepseek-ai/dsh-package-manifest": "0.2.1-alpha.1",
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1",
+    "@deepseek-ai/dsh-host-plugin-inventory": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-tools": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-hmr": "0.2.1-alpha.1",
+    "@deepseek-ai/cordis-plugin-timer": "~1.1.7-alpha.1",
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.1"
   }
 }