@deepseek-ai/dsh-plugin-manager 0.2.0-rc.2 → 0.2.1-alpha.2

package/lib/types/index.js

@@ -42,14 +42,15 @@ import { withFileLock, writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
 import z from '@deepseek-ai/schemastery';
 import { TypertRemoteService, Remote } from '@deepseek-ai/dsh-typert-protocol';
 import { pluginEntryId, readPluginInventory } from '@deepseek-ai/dsh-host-plugin-inventory';
-import { readPluginMeta, readProfileManifest, resolveBundleDir, loadOverlayPatches, composeEntries, reconcileProfilePatches, readProfilePatches, OPTIONAL_BUNDLES, bundlePatchPaths, evaluatePluginCompatibility, readProfileCompatibility, readProfileVersionExemptions, setProfileVersionExemption, PROFILE_COMPATIBILITY_FILENAME, } from '@deepseek-ai/dsh-app-boot';
+import { readPluginMeta, readProfileManifest, resolveBundleDir, loadOverlayPatches, composeEntries, reconcileProfilePatches, readProfilePatches, OPTIONAL_BUNDLES, bundlePatchPaths, evaluatePluginCompatibility, readProfileCompatibility, readProfileVersionExemptions, setProfileVersionExemption, PROFILE_COMPATIBILITY_FILENAME, OFFICIAL_ON_DEMAND_CATALOG, getDshRuntimeVersion, } from '@deepseek-ai/dsh-app-boot';
 import { bundleManifest, readProfileRegistry, registryArguments, runProfilePnpm, saveManifest, viewProfilePackage } from "./operations.js";
 import { classifyInstallFailure } from "./install-failure.js";
-import { InvalidInstallSpecError, parseInstallSpec } from "./install-spec.js";
+import { officialBundleInstallTarget } from "./official-install-target.js";
+import { dependencySpec, InvalidInstallSpecError, parseInstallSpec } from "./install-spec.js";
 import { attributeFailure, normalizeRegistry, NPMMIRROR_REGISTRY, registryPlan } from "./registry.js";
 import { writePluginEnabled } from "./patch.js";
 import { incompatiblePlugin, ManagementFailure } from "./failure.js";
-import { approveBuilds, readPendingBuilds } from "./build-approval.js";
+import { approveBuilds, recordPendingBuilds } from "./build-approval.js";
 import { checkGithubConnection } from "./github-connection.js";
 export { classifyInstallFailure } from "./install-failure.js";
 export { InvalidInstallSpecError, parseInstallSpec } from "./install-spec.js";
@@ -274,49 +275,83 @@ let PluginManager = (() => {
                 return { ...entry, patchId: candidate.id };
             });
         }
-        /** Read the profile's installed bundles, the bundles this dsh installation supplies, and the selected names that are not bundles.
+        /** Read installed, installation-provided, and offline Official catalog bundles, plus selected non-bundle names.
          * A dependency without a bundle patch is listed, as a `not-bundle` problem, only while it is selected.
-         * @returns Package versions, manifest descriptions, rows, optional display metadata, activation selections,
-         * whether the installation offers the bundle, and removal availability.
+         * @returns Package versions, manifest descriptions, the installable spec of profile dependencies, rows, optional
+         * display metadata, activation selections, whether the installation offers the bundle, and removal availability.
          */
         listBundles() {
             const manifest = readProfileManifest('dsh', this.profile.dir);
             const exemptions = readProfileVersionExemptions(this.profile.dir);
             const selected = manifest.dsh?.profile?.bundles ?? [];
-            const dependencies = Object.keys(manifest.dependencies ?? {});
+            const recorded = manifest.dependencies ?? {};
+            const dependencies = Object.keys(recorded);
             const installation = JSON.parse(readFileSync(this.profile.installAnchor, 'utf8'));
-            const names = [...new Set([...selected, ...dependencies, ...Object.keys(installation.dependencies ?? {})])];
+            const catalog = new Map(OFFICIAL_ON_DEMAND_CATALOG.map(entry => [entry.packageName, entry]));
+            const names = [...new Set([...selected, ...dependencies, ...Object.keys(installation.dependencies ?? {}), ...catalog.keys()])];
             const bundles = [];
+            const runtimeVersion = getDshRuntimeVersion();
             for (const name of names) {
                 const installed = dependencies.includes(name);
                 const optional = OPTIONAL_BUNDLES.includes(name);
-                const removable = installed && !Object.hasOwn(installation.dependencies ?? {}, name);
                 const enabled = selected.includes(name);
+                const shipped = Object.hasOwn(installation.dependencies ?? {}, name);
+                const offered = catalog.get(name);
+                const official = optional || offered !== undefined;
+                let target = {};
+                let targetError;
+                if (offered !== undefined) {
+                    try {
+                        target = { installTarget: officialBundleInstallTarget(name, this.profile.installAnchor, runtimeVersion) };
+                    }
+                    catch (error) {
+                        targetError = managementError(error);
+                    }
+                }
+                const catalogMeta = offered === undefined ? {} : { meta: offered.meta };
+                if (offered !== undefined && !installed && !shipped) {
+                    bundles.push({ name, official, availability: 'missing', ...catalogMeta, ...target, enabled, installed, optional,
+                        removable: enabled, rows: [], overrides: [],
+                        ...targetError !== undefined ? { error: targetError } : enabled ? { error: { code: 'not-bundle' } } : {} });
+                    continue;
+                }
+                // Installation-owned copies remain protected even if a profile also declares their names.
+                const owned = installed && !shipped;
+                const removable = owned || (enabled && !installed && !shipped);
+                const sourceOf = (packageName) => owned ? { source: dependencySpec(name, recorded[name], this.profile.dir, packageName) } : {};
                 const readOnlyReason = this.protectsManager(name) ? 'management-required' : undefined;
+                let availability = 'missing';
+                let version;
                 try {
                     const info = bundleManifest(name, this.profile.dir, this.profile.installAnchor);
+                    availability = shipped ? 'installation' : 'profile';
                     if (info === undefined) {
-                        if (enabled)
-                            bundles.push({ name, enabled, installed, optional, removable: removable && readOnlyReason === undefined,
-                                ...(readOnlyReason === undefined ? {} : { readOnlyReason }), error: { code: 'not-bundle' }, rows: [], overrides: [] });
+                        if (enabled || offered !== undefined)
+                            bundles.push({ name, official, availability, ...catalogMeta, ...target,
+                                ...sourceOf(), enabled, installed, optional, removable: removable && readOnlyReason === undefined,
+                                ...(readOnlyReason === undefined ? {} : { readOnlyReason }), error: targetError ?? { code: 'not-bundle' }, rows: [], overrides: [] });
                         continue;
                     }
+                    version = info.version;
                     const compatibility = evaluatePluginCompatibility(info, exemptions);
                     if (compatibility !== undefined && !compatibility.exempted)
                         throw new ManagementFailure('incompatible-version', [incompatiblePlugin(compatibility)]);
                     const dir = resolveBundleDir('dsh', name, this.profile.installAnchor, this.profile.dir);
-                    const meta = readPluginMeta(info.name ?? name, pathToFileURL(join(dir, 'package.json')).href);
-                    bundles.push({ name, ...(info.version === undefined ? {} : { version: info.version }),
+                    const meta = offered?.meta ?? readPluginMeta(info.name ?? name, pathToFileURL(join(dir, 'package.json')).href);
+                    bundles.push({ name, official, availability, ...target, ...(version === undefined ? {} : { version }),
                         ...(info.description === undefined || info.description === '' ? {} : { description: info.description }),
                         ...meta === undefined ? {} : { meta },
-                        enabled, installed, optional, removable: removable && readOnlyReason === undefined,
+                        ...sourceOf(info.name), enabled, installed, optional, removable: removable && readOnlyReason === undefined,
                         ...(readOnlyReason === undefined ? {} : { readOnlyReason }),
-                        ...this.declaredRows(name, info) });
+                        ...this.declaredRows(name, info),
+                        ...targetError === undefined ? {} : { error: targetError } });
                 }
                 catch (error) {
-                    if (enabled || installed) {
-                        bundles.push({ name, enabled, installed, optional, removable: removable && readOnlyReason === undefined,
-                            ...(readOnlyReason === undefined ? {} : { readOnlyReason }), error: managementError(error), rows: [], overrides: [] });
+                    if (enabled || installed || optional || offered !== undefined) {
+                        bundles.push({ name, official, availability, ...catalogMeta, ...target, ...(version === undefined ? {} : { version }),
+                            ...sourceOf(), enabled, installed, optional, removable: removable && readOnlyReason === undefined,
+                            ...(readOnlyReason === undefined ? {} : { readOnlyReason }),
+                            error: targetError ?? managementError(error), rows: [], overrides: [] });
                     }
                 }
             }
@@ -456,7 +491,11 @@ let PluginManager = (() => {
         setBundleEnabled(name, enabled) {
             return this.change(result => this.configure(async () => {
                 await this.selectBundle(name, enabled);
+                if (enabled)
+                    await this.refreshPackages();
                 result.warnings = await this.reload(enabled ? this.bundleRows(name).map(row => row.id) : []);
+                if (!enabled && this.ownerContext.get('hmr') !== undefined)
+                    await this.refreshPackages();
             }), { stage: 'enable', target: name, enabled }, 'bundle');
         }
         /**
@@ -467,7 +506,7 @@ let PluginManager = (() => {
          * `package.json` and `pnpm-lock.yaml` as they were; downloaded files can stay.
          * @param spec One package spec, including local paths relative to the invocation directory.
          * @param options Whether to activate the installed bundle (defaults to true), the request id a cancellation names,
-         * the pending build scripts to allow for this profile before pnpm runs, and the registry asked first.
+         * the pending build scripts to allow, whether to save an exact dependency, and the registry asked first.
          * @returns Package-manager diagnostics, the registries asked, and the observed activation outcome.
          */
         installBundle(spec, options) {
@@ -492,6 +531,7 @@ let PluginManager = (() => {
                 const files = await this.readRestoredFiles();
                 const before = readProfileManifest('dsh', this.profile.dir).dependencies ?? {};
                 let name;
+                let version;
                 try {
                     result.registries = [];
                     const connection = checkGithubConnection(parsedForRegistry(spec), this.profile.dir, {
@@ -525,7 +565,7 @@ let PluginManager = (() => {
                             throw new InstallCancelledError();
                         result.registries.push(registry);
                         announce('installing', { registry, index: index + 1, total: plan.length });
-                        run = await this.runPnpm(['add', spec, ...registryArguments(registry)], control.abort.signal, requestId);
+                        run = await this.runPnpm(['add', spec, ...options?.saveExact === true ? ['--save-exact'] : [], ...registryArguments(registry)], control.abort.signal, requestId);
                         result.packageResult = run;
                         if (stopped())
                             throw new InstallCancelledError();
@@ -557,9 +597,9 @@ let PluginManager = (() => {
                     if (succeeded)
                         delete result.failedAt;
                     if (!succeeded) {
-                        // pnpm-workspace.yaml is not restored, so the names pnpm left undecided there can be offered for approval.
+                        // pnpm-workspace.yaml is not restored, so the names it left undecided, or reported as ignored, are offered for approval.
                         try {
-                            result.pendingBuilds = await readPendingBuilds(this.profile.dir);
+                            result.pendingBuilds = await recordPendingBuilds(this.profile.dir, run.output);
                         }
                         catch (error) {
                             this.ownerContext.logger.warn('Could not read pending build approvals after pnpm failed', error);
@@ -569,8 +609,11 @@ let PluginManager = (() => {
                     const after = readProfileManifest('dsh', this.profile.dir).dependencies ?? {};
                     const installed = Object.keys(after).filter(name => before[name] !== after[name]);
                     // Registry retries can retain the saved range after a partial installation.
-                    if (installed.length === 0)
-                        installed.push(...Object.keys(after).filter(name => spec === name || spec.startsWith(`${name}@`)));
+                    if (installed.length === 0) {
+                        const parsed = parsedForRegistry(spec);
+                        const localName = parsed.kind === 'path' ? readProfileManifest('dsh', parsed.path).name : undefined;
+                        installed.push(...Object.keys(after).filter(name => name === localName || spec === name || spec.startsWith(`${name}@`)));
+                    }
                     const target = installed[0];
                     if (installed.length !== 1 || target === undefined)
                         throw new ManagementFailure('ambiguous-install');
@@ -584,6 +627,7 @@ let PluginManager = (() => {
                         throw new ManagementFailure('incompatible-version', [incompatiblePlugin(compatibility)]);
                     for (const file of bundlePatchPaths(dir, manifest.dsh.bundle))
                         loadOverlayPatches('dsh', file);
+                    version = manifest.version;
                 }
                 catch (error) {
                     // pnpm has exited by now, so the files it rewrote go back as they were.
@@ -593,6 +637,8 @@ let PluginManager = (() => {
                 control.phase = 'applying';
                 announce('applying');
                 result.bundle = name;
+                if (version !== undefined)
+                    result.version = version;
                 result.target = name;
                 result.stage = 'enable';
                 return this.configure(async () => {
@@ -600,6 +646,7 @@ let PluginManager = (() => {
                         await this.selectBundle(name, true);
                     if (Object.hasOwn(before, name))
                         return 'restart-required';
+                    await this.refreshPackages();
                     if (options?.enabled !== false)
                         result.warnings = await this.reload();
                 });
@@ -633,13 +680,14 @@ let PluginManager = (() => {
             await control.result.then(() => undefined, () => undefined);
             return { status: 'cancelled' };
         }
-        /** Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path.
-         * @param name Installed dependency name.
+        /** Unload and remove a profile-owned bundle dependency through dsh plugin's pnpm path; a selected name no
+         * dependency holds is only deselected.
+         * @param name Installed dependency or selected bundle name.
          * @returns Removal diagnostics and the remaining profile state.
          */
         removeBundle(name) {
             return this.change(async (result) => {
-                await this.configure(async () => {
+                const installed = await this.configure(async () => {
                     const bundle = (await this.listBundles()).find(item => item.name === name);
                     if (bundle === undefined || !bundle.removable)
                         throw new ManagementFailure('not-removable');
@@ -657,11 +705,15 @@ let PluginManager = (() => {
                         && contributions.some(row => row.id === entry.options.id && row.name === entry.options.name))) {
                         throw new ManagementFailure('bundle-in-use');
                     }
+                    return bundle.installed;
                 });
+                if (!installed)
+                    return;
                 result.packageResult = await this.runPnpm(['remove', name]);
                 if (result.packageResult.exitCode !== 0 || result.packageResult.timedOut === true) {
                     throw new Error(result.packageResult.output);
                 }
+                await this.configure(() => this.refreshPackages());
             }, { stage: 'remove', target: name }, 'remove');
         }
         /** The rows a bundle's patch inserts and the existing rows it changes; an unreadable patch throws. */
@@ -684,7 +736,8 @@ let PluginManager = (() => {
             const rows = [];
             const packages = this.ctx.get('pluginPackages');
             for (const row of flatten(composeEntries([patches.filter(item => item.insert !== undefined)]))) {
-                if (typeof row.id !== 'string' || typeof row.name !== 'string')
+                // Group rows are containers without a plugin inventory entry; their children carry the switches.
+                if (typeof row.id !== 'string' || typeof row.name !== 'string' || row.group === true)
                     continue;
                 const active = live.get(row.id);
                 const entryId = active?.entryId;
@@ -806,6 +859,15 @@ let PluginManager = (() => {
             const apply = () => { this.abort.signal.throwIfAborted(); return operation(); };
             return hmr === undefined ? apply() : hmr.runExclusive(apply);
         }
+        async refreshPackages() {
+            if (this.ownerContext.get('hmr') === undefined) {
+                const selected = readProfileManifest('dsh', this.profile.dir).dsh?.profile?.bundles ?? [];
+                // Deselected startup bundles still run without HMR and need the existing package table.
+                if (this.profile.startedBundles.some(name => !selected.includes(name)))
+                    return;
+            }
+            await this.ownerContext.get('pluginPackages')?.refresh();
+        }
         async reload(requiredIds = []) {
             if (this.ownerContext.get('hmr') === undefined)
                 return [];

package/lib/types/install-spec.d.ts

@@ -47,4 +47,17 @@ export declare class InvalidInstallSpecError extends Error {
  * registry would refuse, or a URL that is neither a git host nor a tarball.
  */
 export declare function parseInstallSpec(raw: string): ParsedInstallSpec;
+/**
+ * The spec `pnpm add` accepts for a dependency the profile manifest records. A git address, URL, or other
+ * non-registry protocol is the recorded value without the user information of an http(s) URL, whose query string
+ * is kept; a `file:` or `link:` path, which pnpm records relative to the profile or with `~` for the home
+ * directory, becomes absolute. A registry range, tag, or alias follows the dependency name after `@`, as does a
+ * non-registry value installed under a name other than the package's own.
+ * @param name - the dependency name.
+ * @param recorded - the value the profile manifest records for it.
+ * @param profileDir - the profile directory a relative local path is resolved against.
+ * @param packageName - the name the installed package's manifest declares, when it could be read.
+ * @returns the installable spec.
+ */
+export declare function dependencySpec(name: string, recorded: string, profileDir: string, packageName?: string): string;
 //# sourceMappingURL=install-spec.d.ts.map

package/lib/types/install-spec.js

@@ -3,7 +3,8 @@
  * takes, and for a registry name whether it is one the registry can accept.
  * @module @deepseek-ai/dsh-plugin-manager/install-spec
  */
-import { isAbsolute } from 'node:path';
+import { homedir } from 'node:os';
+import { isAbsolute, resolve } from 'node:path';
 /** The forms pnpm resolves through a git host: a host shorthand, a git URL, or a hosted repository URL. */
 const GIT_SHORTHAND = /^(?:github|gitlab|bitbucket|gist):/i;
 const GIT_URL = /^git(?:\+[a-z]+)?:\/\/|^git@[^:]+:/i;
@@ -84,4 +85,35 @@ export function parseInstallSpec(raw) {
         throw invalid(spec, 'a version after @ must not be empty');
     return range === undefined ? { kind: 'registry', spec, name } : { kind: 'registry', spec, name, range };
 }
+/** A recorded dependency value pnpm resolves outside a registry: a protocol other than a registry alias, or an scp-like git address. */
+const NON_REGISTRY_VALUE = /^(?!(?:npm|jsr|workspace|catalog):)[a-z][a-z0-9+.-]*:|^[^@/:\s]+@[^:/\s]+:/i;
+/** The user information of an http(s) URL, up to the last `@` before the path, which holds a password or access token when present. */
+const HTTP_USER_INFO = /^((?:git\+)?https?:\/\/)[^/]*@/i;
+/**
+ * The spec `pnpm add` accepts for a dependency the profile manifest records. A git address, URL, or other
+ * non-registry protocol is the recorded value without the user information of an http(s) URL, whose query string
+ * is kept; a `file:` or `link:` path, which pnpm records relative to the profile or with `~` for the home
+ * directory, becomes absolute. A registry range, tag, or alias follows the dependency name after `@`, as does a
+ * non-registry value installed under a name other than the package's own.
+ * @param name - the dependency name.
+ * @param recorded - the value the profile manifest records for it.
+ * @param profileDir - the profile directory a relative local path is resolved against.
+ * @param packageName - the name the installed package's manifest declares, when it could be read.
+ * @returns the installable spec.
+ */
+export function dependencySpec(name, recorded, profileDir, packageName = name) {
+    const local = /^(file|link):(.*)$/s.exec(recorded);
+    let spec;
+    if (local !== null) {
+        const path = local[2].replace(/^~(?=$|[\\/])/, () => homedir());
+        spec = `${local[1]}:${resolve(profileDir, path)}`;
+    }
+    else if (NON_REGISTRY_VALUE.test(recorded)) {
+        spec = recorded.replace(HTTP_USER_INFO, '$1');
+    }
+    else {
+        return `${name}@${recorded}`;
+    }
+    return packageName === name ? spec : `${name}@${spec}`;
+}
 //# sourceMappingURL=install-spec.js.map

package/lib/types/official-install-target.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Offer a source checkout link or an exact published package version. Source installations are
+ * identified by the real CLI manifest and its unpacked workspace dependencies, including Desktop's
+ * development symlink. An incomplete checkout is an error, never a registry fallback.
+ * @param name - Official catalog package name.
+ * @param installAnchor - Running application's DSH package.json, possibly reached through a symlink.
+ * @param version - Running DSH version used by its release family.
+ * @returns An ordinary package-manager spec and its package version.
+ * @throws when a source installation lacks its workspace package, bundle patch, or built runtime.
+ */
+export declare function officialBundleInstallTarget(name: string, installAnchor: string, version: string): {
+    spec: string;
+    version: string;
+};
+//# sourceMappingURL=official-install-target.d.ts.map

package/lib/types/official-install-target.js

@@ -0,0 +1,54 @@
+/** Select Official bundle packages from the running installation without importing provider code. */
+import { existsSync, globSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { bundlePatchPaths } from '@deepseek-ai/dsh-app-boot';
+function manifestAt(file) {
+    return JSON.parse(readFileSync(file, 'utf8'));
+}
+/**
+ * Offer a source checkout link or an exact published package version. Source installations are
+ * identified by the real CLI manifest and its unpacked workspace dependencies, including Desktop's
+ * development symlink. An incomplete checkout is an error, never a registry fallback.
+ * @param name - Official catalog package name.
+ * @param installAnchor - Running application's DSH package.json, possibly reached through a symlink.
+ * @param version - Running DSH version used by its release family.
+ * @returns An ordinary package-manager spec and its package version.
+ * @throws when a source installation lacks its workspace package, bundle patch, or built runtime.
+ */
+export function officialBundleInstallTarget(name, installAnchor, version) {
+    const anchor = realpathSync(installAnchor);
+    const installation = manifestAt(anchor);
+    const source = installation.name === '@deepseek-ai/dsh'
+        && Object.values(installation.dependencies ?? {}).some(value => value.startsWith('workspace:'));
+    if (!source)
+        return { spec: `${name}@${version}`, version };
+    const root = resolve(dirname(anchor), '../..');
+    if (anchor !== join(root, 'apps', 'cli', 'package.json')
+        || !existsSync(join(root, 'package.json'))
+        || manifestAt(join(root, 'package.json')).name !== '@deepseek-ai/dsh-root') {
+        throw new Error(`Official bundle ${name}: source DSH installation ${anchor} requires its complete workspace checkout`);
+    }
+    const matches = globSync('packages/*/*/package.json', { cwd: root })
+        .map(file => ({ file: join(root, file), manifest: manifestAt(join(root, file)) }))
+        .filter(entry => entry.manifest.name === name);
+    const selected = matches[0];
+    if (matches.length !== 1 || selected === undefined) {
+        throw new Error(`Official bundle ${name}: expected one workspace package in ${root}, found ${matches.length}; restore the checkout and run pnpm install`);
+    }
+    const { file, manifest } = selected;
+    const directory = realpathSync(dirname(file));
+    if (manifest.version !== version || manifest.private === true || manifest.dsh?.bundle === undefined) {
+        throw new Error(`Official bundle ${name}: ${file} must declare a public bundle at DSH version ${version}`);
+    }
+    const main = typeof manifest.main === 'string' ? resolve(directory, manifest.main) : undefined;
+    if (main === undefined || !existsSync(main) || !statSync(main).isFile()) {
+        throw new Error(`Official bundle ${name}: built runtime is missing in ${directory}; run pnpm install and pnpm run build in ${root}`);
+    }
+    for (const patch of bundlePatchPaths(directory, manifest.dsh.bundle)) {
+        if (!existsSync(patch) || !statSync(patch).isFile()) {
+            throw new Error(`Official bundle ${name}: bundle patch ${patch} is missing; restore the checkout`);
+        }
+    }
+    return { spec: `link:${directory}`, version };
+}
+//# sourceMappingURL=official-install-target.js.map

package/lib/types/tools.js

@@ -14,7 +14,7 @@ export function apply(ctx) {
         description: 'List plugins or bundles in the current profile, enable or disable them, install a bundle, or remove an installed bundle. Every action requires danger-full-access permission or approval for this call. Approval does not change the session permission mode. Changes affect every session in this profile. List first to obtain exact identifiers. Package installation can execute allowed build scripts. Live profiles apply changes immediately; startup profiles require restart. Incompatible DSH peer dependencies block installation and activation. Version exemptions risk crashes and data loss: warn the user and obtain explicit permission for the exact plugin and runtime versions before granting one.',
         parameters: {
             action: { type: 'string', required: true, enum: ['list_plugins', 'list_bundles', 'set_plugin', 'set_bundle', 'install_bundle', 'remove_bundle', 'list_version_exemptions', 'set_version_exemption'], description: 'Management operation.' },
-            target: { type: 'string', description: 'Plugin entry id, bundle package name, or installation spec, according to action.' },
+            target: { type: 'string', description: 'Plugin entry id, bundle package name, or installation spec, according to action. For an Official catalog entry, pass list_bundles installTarget.spec to install_bundle.' },
             enabled: { type: 'boolean', description: 'Required for set operations; defaults to true for installation. For set_version_exemption, true grants and false revokes.' },
             runtimeVersion: { type: 'string', description: 'For set_version_exemption: exact DSH version from list_version_exemptions. Target must be the manifest package-name@version, not an alias or version range.' },
             acceptRisk: { type: 'boolean', description: 'For granting an exemption: true only after warning the user about possible crashes and data loss and receiving explicit permission for this exact plugin/runtime pair. General installation permission is not enough.' },

package/lib/types/types.d.ts

@@ -40,9 +40,18 @@ export interface BundleRowInfo {
     /** The Loader entry carrying this row, when exactly one live entry has its id. */
     entryId?: PluginEntryId;
 }
-/** One installed or installation-provided bundle. */
+/** One shipped, profile-installed, or discoverable on-demand bundle. */
 export interface BundleInfo {
     name: string;
+    /** Project-maintained shipped optional bundle or on-demand catalog entry, independent of installation and selection. */
+    official: boolean;
+    /** Readable package location; on-demand catalog entries exclude undeclared transitive copies, and declared files may be missing. */
+    availability: 'installation' | 'profile' | 'missing';
+    /** Exact released Host version or same-checkout development link offered for an on-demand catalog entry. */
+    installTarget?: {
+        spec: string;
+        version: string;
+    };
     version?: string;
     /** Local display text with available translations or literal fallbacks, or a metadata diagnostic. */
     meta?: PluginLocalizedMeta;
@@ -50,8 +59,13 @@ export interface BundleInfo {
     description?: string;
     /** Selected in the profile manifest; a load error means its layer was skipped. */
     enabled: boolean;
-    /** Whether the profile's own dependencies hold the package; false for a bundle the dsh installation supplies. */
+    /** Whether the profile declares this dependency; availability separately reports whether its files can be read. */
     installed: boolean;
+    /**
+     * Present for a profile dependency the installation does not also supply: the spec `pnpm add` accepts, with local
+     * paths made absolute and the user information of an http(s) URL removed.
+     */
+    source?: string;
     /**
      * Whether the installation ships the bundle for the person to switch on: named by the launcher's `OPTIONAL_BUNDLES`,
      * held by the installation's dependencies, selected by no shipped template, and never removable.
@@ -104,6 +118,8 @@ export interface ChangeResult {
     packageResult?: PackageResult;
     /** The bundle an installation added, once pnpm and the bundle check accepted it. */
     bundle?: string;
+    /** The installed bundle's manifest version, when declared; pnpm's `minimumReleaseAge` can make it older than the newest release. */
+    version?: string;
     /** Exact package names awaiting explicit script approval in the profile's pnpm settings, read after a failed run. */
     pendingBuilds?: string[];
     /** Package script permissions saved before this installation attempt. */
@@ -121,6 +137,8 @@ export type PluginInstallRequestId = Branded<'PluginInstallRequestId'>;
 /** Bundle installation defaults to activation; callers that offer cancellation supply their request id. */
 export interface InstallBundleOptions {
     enabled?: boolean;
+    /** Save the resolved dependency version without a range; applies to any bundle installation. */
+    saveExact?: boolean;
     requestId?: PluginInstallRequestId;
     /** Explicitly allow these pending packages' scripts for this profile, then install; a name no longer pending refuses the call. */
     approvedBuilds?: string[];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-plugin-manager",
   "description": "Current-profile plugin and bundle management shared by dsh CLI, Web and agent tools",
-  "version": "0.2.0-rc.2",
+  "version": "0.2.1-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -56,26 +56,26 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "execa": "^10.0.0",
+    "@deepseek-ai/dsh-app-boot": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-atomic-write": "0.2.1-alpha.2",
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.1",
+    "execa": "^10.0.1",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@deepseek-ai/dsh-app-boot": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-atomic-write": "0.2.0-rc.2",
-    "@deepseek-ai/schemastery": "~3.18.4",
-    "@deepseek-ai/dsh-util-values": "0.2.0-rc.2"
+    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.2"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.4",
-    "@deepseek-ai/cordis-plugin-loader": "~1.0.5",
-    "@deepseek-ai/dsh-host-plugin-inventory": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-tools": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-brand": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-hmr": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-user-approval": "0.2.0-rc.2"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1",
+    "@deepseek-ai/dsh-host-plugin-inventory": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-tools": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-hmr": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-alpha.2"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-hmr": {
@@ -86,22 +86,23 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-package-manifest": "0.2.0-rc.2",
-    "@deepseek-ai/cordis-plugin-loader": "~1.0.5",
-    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-tools": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-hmr": "0.2.0-rc.2",
-    "@deepseek-ai/cordis-plugin-timer": "~1.1.6",
-    "@deepseek-ai/cordis": "~4.0.4",
-    "@deepseek-ai/dsh-brand": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session-projection": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-user-approval": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-agent": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-plugin-inventory": "0.2.0-rc.2"
+    "chokidar": "^4.0.3",
+    "@deepseek-ai/dsh-package-manifest": "0.2.1-alpha.2",
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1",
+    "@deepseek-ai/dsh-host-plugin-inventory": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-tools": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-hmr": "0.2.1-alpha.2",
+    "@deepseek-ai/cordis-plugin-timer": "~1.1.7-alpha.1",
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-alpha.2"
   }
 }