@deepseek-ai/dsh-plugin-manager 0.2.0-rc.2 → 0.2.1-alpha.2

package/lib/index.js

@@ -1,16 +1,17 @@
 import { randomUUID } from "node:crypto";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, globSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { mkdir, mkdtemp, open, readFile, rm } from "node:fs/promises";
-import { isAbsolute, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import z from "@deepseek-ai/schemastery";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { pluginEntryId, readPluginInventory } from "@deepseek-ai/dsh-host-plugin-inventory";
-import { OPTIONAL_BUNDLES, PROFILE_COMPATIBILITY_FILENAME, bundlePatchPaths, composeEntries, evaluatePluginCompatibility, loadOptionalPatches, loadOverlayPatches, pluginCompatibilityWarning, readPluginMeta, readProfileCompatibility, readProfileManifest, readProfilePatches, readProfileVersionExemptions, reconcileProfilePatches, resolveBundleDir, resolveProfileDir, setProfileVersionExemption } from "@deepseek-ai/dsh-app-boot";
+import { OFFICIAL_ON_DEMAND_CATALOG, OPTIONAL_BUNDLES, PROFILE_COMPATIBILITY_FILENAME, bundlePatchPaths, composeEntries, evaluatePluginCompatibility, getDshRuntimeVersion, loadOptionalPatches, loadOverlayPatches, pluginCompatibilityWarning, readPluginMeta, readProfileCompatibility, readProfileManifest, readProfilePatches, readProfileVersionExemptions, reconcileProfilePatches, resolveBundleDir, resolveProfileDir, setProfileVersionExemption } from "@deepseek-ai/dsh-app-boot";
 import { once } from "node:events";
 import { execa } from "execa";
 import { scrubbedParentEnv } from "@deepseek-ai/dsh-subprocess";
+import { homedir } from "node:os";
 import { isAlias, isMap, isNode, isScalar, isSeq, parseDocument, visit } from "yaml";
 //#region lib/types/install-spec.js
 /**
@@ -115,6 +116,32 @@ function parseInstallSpec(raw) {
 		range
 	};
 }
+/** A recorded dependency value pnpm resolves outside a registry: a protocol other than a registry alias, or an scp-like git address. */
+const NON_REGISTRY_VALUE = /^(?!(?:npm|jsr|workspace|catalog):)[a-z][a-z0-9+.-]*:|^[^@/:\s]+@[^:/\s]+:/i;
+/** The user information of an http(s) URL, up to the last `@` before the path, which holds a password or access token when present. */
+const HTTP_USER_INFO = /^((?:git\+)?https?:\/\/)[^/]*@/i;
+/**
+* The spec `pnpm add` accepts for a dependency the profile manifest records. A git address, URL, or other
+* non-registry protocol is the recorded value without the user information of an http(s) URL, whose query string
+* is kept; a `file:` or `link:` path, which pnpm records relative to the profile or with `~` for the home
+* directory, becomes absolute. A registry range, tag, or alias follows the dependency name after `@`, as does a
+* non-registry value installed under a name other than the package's own.
+* @param name - the dependency name.
+* @param recorded - the value the profile manifest records for it.
+* @param profileDir - the profile directory a relative local path is resolved against.
+* @param packageName - the name the installed package's manifest declares, when it could be read.
+* @returns the installable spec.
+*/
+function dependencySpec(name, recorded, profileDir, packageName = name) {
+	const local = /^(file|link):(.*)$/s.exec(recorded);
+	let spec;
+	if (local !== null) {
+		const path = local[2].replace(/^~(?=$|[\\/])/, () => homedir());
+		spec = `${local[1]}:${resolve(profileDir, path)}`;
+	} else if (NON_REGISTRY_VALUE.test(recorded)) spec = recorded.replace(HTTP_USER_INFO, "$1");
+	else return `${name}@${recorded}`;
+	return packageName === name ? spec : `${name}@${spec}`;
+}
 //#endregion
 //#region lib/types/run-tree.js
 /** Waiting for one package run's process tree to disappear before its caller touches the profile. */
@@ -792,6 +819,48 @@ function classifyInstallFailure(facts) {
 	for (const [kind, pattern] of LOG_KINDS) if (pattern.test(facts.log)) return kind;
 	return "unknown";
 }
+//#endregion
+//#region lib/types/official-install-target.js
+/** Select Official bundle packages from the running installation without importing provider code. */
+function manifestAt(file) {
+	return JSON.parse(readFileSync(file, "utf8"));
+}
+/**
+* Offer a source checkout link or an exact published package version. Source installations are
+* identified by the real CLI manifest and its unpacked workspace dependencies, including Desktop's
+* development symlink. An incomplete checkout is an error, never a registry fallback.
+* @param name - Official catalog package name.
+* @param installAnchor - Running application's DSH package.json, possibly reached through a symlink.
+* @param version - Running DSH version used by its release family.
+* @returns An ordinary package-manager spec and its package version.
+* @throws when a source installation lacks its workspace package, bundle patch, or built runtime.
+*/
+function officialBundleInstallTarget(name, installAnchor, version) {
+	const anchor = realpathSync(installAnchor);
+	const installation = manifestAt(anchor);
+	if (!(installation.name === "@deepseek-ai/dsh" && Object.values(installation.dependencies ?? {}).some((value) => value.startsWith("workspace:")))) return {
+		spec: `${name}@${version}`,
+		version
+	};
+	const root = resolve(dirname(anchor), "../..");
+	if (anchor !== join(root, "apps", "cli", "package.json") || !existsSync(join(root, "package.json")) || manifestAt(join(root, "package.json")).name !== "@deepseek-ai/dsh-root") throw new Error(`Official bundle ${name}: source DSH installation ${anchor} requires its complete workspace checkout`);
+	const matches = globSync("packages/*/*/package.json", { cwd: root }).map((file) => ({
+		file: join(root, file),
+		manifest: manifestAt(join(root, file))
+	})).filter((entry) => entry.manifest.name === name);
+	const selected = matches[0];
+	if (matches.length !== 1 || selected === void 0) throw new Error(`Official bundle ${name}: expected one workspace package in ${root}, found ${matches.length}; restore the checkout and run pnpm install`);
+	const { file, manifest } = selected;
+	const directory = realpathSync(dirname(file));
+	if (manifest.version !== version || manifest.private === true || manifest.dsh?.bundle === void 0) throw new Error(`Official bundle ${name}: ${file} must declare a public bundle at DSH version ${version}`);
+	const main = typeof manifest.main === "string" ? resolve(directory, manifest.main) : void 0;
+	if (main === void 0 || !existsSync(main) || !statSync(main).isFile()) throw new Error(`Official bundle ${name}: built runtime is missing in ${directory}; run pnpm install and pnpm run build in ${root}`);
+	for (const patch of bundlePatchPaths(directory, manifest.dsh.bundle)) if (!existsSync(patch) || !statSync(patch).isFile()) throw new Error(`Official bundle ${name}: bundle patch ${patch} is missing; restore the checkout`);
+	return {
+		spec: `link:${directory}`,
+		version
+	};
+}
 /** Public npmmirror URL shared by the fallback configuration and public-registry comparison. */
 const NPMMIRROR_REGISTRY = "https://registry.npmmirror.com/";
 /**
@@ -913,6 +982,10 @@ async function writePluginEnabled(filename, id, name, enabled) {
 //#endregion
 //#region lib/types/build-approval.js
 /** Approve pnpm's pending dependency scripts in the current profile's workspace settings. */
+/** Value pnpm leaves for a build script that still needs a decision. */
+const UNDECIDED_BUILD = "set this to true or false";
+/** Where a non-interactive run names the build scripts it skipped. */
+const IGNORED_BUILDS = /\bIgnored build scripts: (.+)/;
 async function readPolicy(dir) {
 	let text;
 	try {
@@ -929,17 +1002,41 @@ async function readPolicy(dir) {
 	visit(builds ?? null, (_key, node) => {
 		if (isAlias(node) || isNode(node) && "anchor" in node && node.anchor) throw new Error("allowBuilds must not contain YAML anchors or aliases");
 	});
+	const keys = isMap(builds) ? builds.items.flatMap(({ key }) => isScalar(key) && typeof key.value === "string" ? [key.value] : []) : [];
 	return {
 		document,
-		pending: isMap(builds) ? builds.items.flatMap(({ key, value }) => isScalar(key) && typeof key.value === "string" && !/[*?]/.test(key.value) && isScalar(value) && value.value === "set this to true or false" ? [key.value] : []) : []
+		pending: isMap(builds) ? builds.items.flatMap(({ key, value }) => isScalar(key) && typeof key.value === "string" && !/[*?]/.test(key.value) && isScalar(value) && value.value === UNDECIDED_BUILD ? [key.value] : []) : [],
+		keys
 	};
 }
-/** Read package names left undecided by pnpm 11, including after installation cleanup.
+/**
+* Record the build scripts a failed run reported as ignored, then list every name awaiting a decision.
+*
+* pnpm writes those policy entries itself only when it can prompt, and the
+* manager always runs it non-interactively, so the run's own report is the
+* record that survives.
 * @param dir Current profile directory.
+* @param output Captured output of the failed run.
 * @returns Exact package names awaiting a build decision; wildcard rules are excluded.
 */
-async function readPendingBuilds(dir) {
-	return (await readPolicy(dir)).pending;
+async function recordPendingBuilds(dir, output) {
+	const { document, pending, keys } = await readPolicy(dir);
+	const known = new Set(keys);
+	const added = ignoredBuildNames(output).filter((name) => !known.has(name));
+	if (added.length === 0) return pending;
+	for (const name of added) document.setIn(["allowBuilds", name], UNDECIDED_BUILD);
+	await writeFileAtomic(join(dir, "pnpm-workspace.yaml"), String(document), { mode: 384 });
+	return [...pending, ...added];
+}
+/**
+* Read the package names a pnpm run reported as ignored build scripts.
+* @param output Captured output of the run.
+* @returns Exact names in report order; wildcard patterns are excluded.
+*/
+function ignoredBuildNames(output) {
+	const reported = IGNORED_BUILDS.exec(output)?.[1];
+	if (reported === void 0) return [];
+	return reported.split(",").map((name) => name.trim()).filter((name) => name !== "" && !/[*?]/.test(name));
 }
 /** Persist approval without running scripts; the caller holds the profile manifest lock.
 * @param dir Current profile directory.
@@ -1448,70 +1545,124 @@ let PluginManager = (() => {
 				};
 			});
 		}
-		/** Read the profile's installed bundles, the bundles this dsh installation supplies, and the selected names that are not bundles.
+		/** Read installed, installation-provided, and offline Official catalog bundles, plus selected non-bundle names.
 		* A dependency without a bundle patch is listed, as a `not-bundle` problem, only while it is selected.
-		* @returns Package versions, manifest descriptions, rows, optional display metadata, activation selections,
-		* whether the installation offers the bundle, and removal availability.
+		* @returns Package versions, manifest descriptions, the installable spec of profile dependencies, rows, optional
+		* display metadata, activation selections, whether the installation offers the bundle, and removal availability.
 		*/
 		listBundles() {
 			const manifest = readProfileManifest("dsh", this.profile.dir);
 			const exemptions = readProfileVersionExemptions(this.profile.dir);
 			const selected = manifest.dsh?.profile?.bundles ?? [];
-			const dependencies = Object.keys(manifest.dependencies ?? {});
+			const recorded = manifest.dependencies ?? {};
+			const dependencies = Object.keys(recorded);
 			const installation = JSON.parse(readFileSync(this.profile.installAnchor, "utf8"));
+			const catalog = new Map(OFFICIAL_ON_DEMAND_CATALOG.map((entry) => [entry.packageName, entry]));
 			const names = [...new Set([
 				...selected,
 				...dependencies,
-				...Object.keys(installation.dependencies ?? {})
+				...Object.keys(installation.dependencies ?? {}),
+				...catalog.keys()
 			])];
 			const bundles = [];
+			const runtimeVersion = getDshRuntimeVersion();
 			for (const name of names) {
 				const installed = dependencies.includes(name);
 				const optional = OPTIONAL_BUNDLES.includes(name);
-				const removable = installed && !Object.hasOwn(installation.dependencies ?? {}, name);
 				const enabled = selected.includes(name);
+				const shipped = Object.hasOwn(installation.dependencies ?? {}, name);
+				const offered = catalog.get(name);
+				const official = optional || offered !== void 0;
+				let target = {};
+				let targetError;
+				if (offered !== void 0) try {
+					target = { installTarget: officialBundleInstallTarget(name, this.profile.installAnchor, runtimeVersion) };
+				} catch (error) {
+					targetError = managementError(error);
+				}
+				const catalogMeta = offered === void 0 ? {} : { meta: offered.meta };
+				if (offered !== void 0 && !installed && !shipped) {
+					bundles.push({
+						name,
+						official,
+						availability: "missing",
+						...catalogMeta,
+						...target,
+						enabled,
+						installed,
+						optional,
+						removable: enabled,
+						rows: [],
+						overrides: [],
+						...targetError !== void 0 ? { error: targetError } : enabled ? { error: { code: "not-bundle" } } : {}
+					});
+					continue;
+				}
+				const owned = installed && !shipped;
+				const removable = owned || enabled && !installed && !shipped;
+				const sourceOf = (packageName) => owned ? { source: dependencySpec(name, recorded[name], this.profile.dir, packageName) } : {};
 				const readOnlyReason = this.protectsManager(name) ? "management-required" : void 0;
+				let availability = "missing";
+				let version;
 				try {
 					const info = bundleManifest(name, this.profile.dir, this.profile.installAnchor);
+					availability = shipped ? "installation" : "profile";
 					if (info === void 0) {
-						if (enabled) bundles.push({
+						if (enabled || offered !== void 0) bundles.push({
 							name,
+							official,
+							availability,
+							...catalogMeta,
+							...target,
+							...sourceOf(),
 							enabled,
 							installed,
 							optional,
 							removable: removable && readOnlyReason === void 0,
 							...readOnlyReason === void 0 ? {} : { readOnlyReason },
-							error: { code: "not-bundle" },
+							error: targetError ?? { code: "not-bundle" },
 							rows: [],
 							overrides: []
 						});
 						continue;
 					}
+					version = info.version;
 					const compatibility = evaluatePluginCompatibility(info, exemptions);
 					if (compatibility !== void 0 && !compatibility.exempted) throw new ManagementFailure("incompatible-version", [incompatiblePlugin(compatibility)]);
 					const dir = resolveBundleDir("dsh", name, this.profile.installAnchor, this.profile.dir);
-					const meta = readPluginMeta(info.name ?? name, pathToFileURL(join(dir, "package.json")).href);
+					const meta = offered?.meta ?? readPluginMeta(info.name ?? name, pathToFileURL(join(dir, "package.json")).href);
 					bundles.push({
 						name,
-						...info.version === void 0 ? {} : { version: info.version },
+						official,
+						availability,
+						...target,
+						...version === void 0 ? {} : { version },
 						...info.description === void 0 || info.description === "" ? {} : { description: info.description },
 						...meta === void 0 ? {} : { meta },
+						...sourceOf(info.name),
 						enabled,
 						installed,
 						optional,
 						removable: removable && readOnlyReason === void 0,
 						...readOnlyReason === void 0 ? {} : { readOnlyReason },
-						...this.declaredRows(name, info)
+						...this.declaredRows(name, info),
+						...targetError === void 0 ? {} : { error: targetError }
 					});
 				} catch (error) {
-					if (enabled || installed) bundles.push({
+					if (enabled || installed || optional || offered !== void 0) bundles.push({
 						name,
+						official,
+						availability,
+						...catalogMeta,
+						...target,
+						...version === void 0 ? {} : { version },
+						...sourceOf(),
 						enabled,
 						installed,
 						optional,
 						removable: removable && readOnlyReason === void 0,
 						...readOnlyReason === void 0 ? {} : { readOnlyReason },
-						error: managementError(error),
+						error: targetError ?? managementError(error),
 						rows: [],
 						overrides: []
 					});
@@ -1670,7 +1821,9 @@ let PluginManager = (() => {
 		setBundleEnabled(name, enabled) {
 			return this.change((result) => this.configure(async () => {
 				await this.selectBundle(name, enabled);
+				if (enabled) await this.refreshPackages();
 				result.warnings = await this.reload(enabled ? this.bundleRows(name).map((row) => row.id) : []);
+				if (!enabled && this.ownerContext.get("hmr") !== void 0) await this.refreshPackages();
 			}), {
 				stage: "enable",
 				target: name,
@@ -1685,7 +1838,7 @@ let PluginManager = (() => {
 		* `package.json` and `pnpm-lock.yaml` as they were; downloaded files can stay.
 		* @param spec One package spec, including local paths relative to the invocation directory.
 		* @param options Whether to activate the installed bundle (defaults to true), the request id a cancellation names,
-		* the pending build scripts to allow for this profile before pnpm runs, and the registry asked first.
+		* the pending build scripts to allow, whether to save an exact dependency, and the registry asked first.
 		* @returns Package-manager diagnostics, the registries asked, and the observed activation outcome.
 		*/
 		installBundle(spec, options) {
@@ -1714,6 +1867,7 @@ let PluginManager = (() => {
 				const files = await this.readRestoredFiles();
 				const before = readProfileManifest("dsh", this.profile.dir).dependencies ?? {};
 				let name;
+				let version;
 				try {
 					result.registries = [];
 					const connection = checkGithubConnection(parsedForRegistry(spec), this.profile.dir, {
@@ -1749,6 +1903,7 @@ let PluginManager = (() => {
 						run = await this.runPnpm([
 							"add",
 							spec,
+							...options?.saveExact === true ? ["--save-exact"] : [],
 							...registryArguments(registry)
 						], control.abort.signal, requestId);
 						result.packageResult = run;
@@ -1769,7 +1924,7 @@ let PluginManager = (() => {
 					if (succeeded) delete result.failedAt;
 					if (!succeeded) {
 						try {
-							result.pendingBuilds = await readPendingBuilds(this.profile.dir);
+							result.pendingBuilds = await recordPendingBuilds(this.profile.dir, run.output);
 						} catch (error) {
 							this.ownerContext.logger.warn("Could not read pending build approvals after pnpm failed", error);
 						}
@@ -1777,7 +1932,11 @@ let PluginManager = (() => {
 					}
 					const after = readProfileManifest("dsh", this.profile.dir).dependencies ?? {};
 					const installed = Object.keys(after).filter((name) => before[name] !== after[name]);
-					if (installed.length === 0) installed.push(...Object.keys(after).filter((name) => spec === name || spec.startsWith(`${name}@`)));
+					if (installed.length === 0) {
+						const parsed = parsedForRegistry(spec);
+						const localName = parsed.kind === "path" ? readProfileManifest("dsh", parsed.path).name : void 0;
+						installed.push(...Object.keys(after).filter((name) => name === localName || spec === name || spec.startsWith(`${name}@`)));
+					}
 					const target = installed[0];
 					if (installed.length !== 1 || target === void 0) throw new ManagementFailure("ambiguous-install");
 					name = target;
@@ -1787,6 +1946,7 @@ let PluginManager = (() => {
 					const compatibility = evaluatePluginCompatibility(manifest, readProfileVersionExemptions(this.profile.dir));
 					if (compatibility !== void 0 && !compatibility.exempted) throw new ManagementFailure("incompatible-version", [incompatiblePlugin(compatibility)]);
 					for (const file of bundlePatchPaths(dir, manifest.dsh.bundle)) loadOverlayPatches("dsh", file);
+					version = manifest.version;
 				} catch (error) {
 					await this.restoreFiles(files);
 					throw error;
@@ -1794,11 +1954,13 @@ let PluginManager = (() => {
 				control.phase = "applying";
 				announce("applying");
 				result.bundle = name;
+				if (version !== void 0) result.version = version;
 				result.target = name;
 				result.stage = "enable";
 				return this.configure(async () => {
 					if (options?.enabled !== false) await this.selectBundle(name, true);
 					if (Object.hasOwn(before, name)) return "restart-required";
+					await this.refreshPackages();
 					if (options?.enabled !== false) result.warnings = await this.reload();
 				});
 			}, {
@@ -1837,13 +1999,14 @@ let PluginManager = (() => {
 			await control.result.then(() => void 0, () => void 0);
 			return { status: "cancelled" };
 		}
-		/** Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path.
-		* @param name Installed dependency name.
+		/** Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path; a selected name no
+		* dependency holds is only deselected.
+		* @param name Installed dependency or selected bundle name.
 		* @returns Removal diagnostics and the remaining profile state.
 		*/
 		removeBundle(name) {
 			return this.change(async (result) => {
-				await this.configure(async () => {
+				if (!await this.configure(async () => {
 					const bundle = (await this.listBundles()).find((item) => item.name === name);
 					if (bundle === void 0 || !bundle.removable) throw new ManagementFailure("not-removable");
 					if (this.ownerContext.get("hmr") === void 0 && (this.profile.startedBundles.includes(name) || bundle.error === void 0 && this.bundleRows(name).some((row) => [...this.ctx.loader.entries()].some((entry) => entry.options.id === row.id && entry.fiber !== void 0)))) throw new ManagementFailure("stop-profile");
@@ -1853,9 +2016,11 @@ let PluginManager = (() => {
 						result.warnings = await this.reload();
 					}
 					if ([...this.ctx.loader.entries()].some((entry) => entry.fiber?.uid != null && contributions.some((row) => row.id === entry.options.id && row.name === entry.options.name))) throw new ManagementFailure("bundle-in-use");
-				});
+					return bundle.installed;
+				})) return;
 				result.packageResult = await this.runPnpm(["remove", name]);
 				if (result.packageResult.exitCode !== 0 || result.packageResult.timedOut === true) throw new Error(result.packageResult.output);
+				await this.configure(() => this.refreshPackages());
 			}, {
 				stage: "remove",
 				target: name
@@ -1881,7 +2046,7 @@ let PluginManager = (() => {
 			const rows = [];
 			const packages = this.ctx.get("pluginPackages");
 			for (const row of flatten(composeEntries([patches.filter((item) => item.insert !== void 0)]))) {
-				if (typeof row.id !== "string" || typeof row.name !== "string") continue;
+				if (typeof row.id !== "string" || typeof row.name !== "string" || row.group === true) continue;
 				const active = live.get(row.id);
 				const entryId = active?.entryId;
 				const base = active?.baseUrl ?? pathToFileURL(join(dir, "package.json")).href;
@@ -2028,6 +2193,13 @@ let PluginManager = (() => {
 			};
 			return hmr === void 0 ? apply() : hmr.runExclusive(apply);
 		}
+		async refreshPackages() {
+			if (this.ownerContext.get("hmr") === void 0) {
+				const selected = readProfileManifest("dsh", this.profile.dir).dsh?.profile?.bundles ?? [];
+				if (this.profile.startedBundles.some((name) => !selected.includes(name))) return;
+			}
+			await this.ownerContext.get("pluginPackages")?.refresh();
+		}
 		async reload(requiredIds = []) {
 			if (this.ownerContext.get("hmr") === void 0) return [];
 			return reconcileProfilePatches(this.ownerContext.root, readProfilePatches("dsh", this.profile), "dsh", requiredIds);