@deepseek-ai/dsh-plugin-manager 0.2.1-alpha.1 → 0.2.1-alpha.2

package/README.i18n.yaml

@@ -15,8 +15,8 @@
   en: 87679c51aa3693f5
   zh: 11684a48a5806afb
 /deepseek-ai-dsh-plugin-manager/use-this-package:
-  en: 2cbe6e4a68994e2f
-  zh: ba0328f5538d8746
+  en: 4eef24eeb95ebb30
+  zh: 99fb6a7e4e3f759f
 /deepseek-ai-dsh-plugin-manager/use-this-package/version-compatibility-and-exemptions:
   en: 920c0acb3b9feaf3
   zh: ba6e832a256880a7

package/README.md

@@ -43,8 +43,14 @@ A selected bundle that cannot load remains in `listBundles` with an `error`; `en
 
 `listBundles` includes optional display `meta` for each bundle and its declared plugin rows, including disabled bundles. The Client selects a language from these values. The separate `description` field is the bundle's raw `package.json.description`; a metadata diagnostic does not block management. `source` gives a profile dependency as a spec `pnpm add` accepts: a git address or URL as recorded without the user information of an http(s) URL (a query string stays as recorded), a `file:` or `link:` path made absolute against the profile or the home directory for `~`, and a registry range, tag, or alias after the package name, as is any spec of a package installed under another name; a bundle the installation supplies has none, even when the profile also depends on it, because the installation's copy is the one that loads. The `plugin_manager` tool omits UI display metadata from list results.
 
+`listBundles` marks shipped optional bundles and on-demand catalog entries as `official`, independently of package installation. `availability` identifies a readable installation-provided or profile package, or `missing`; on-demand catalog entries exclude undeclared transitive copies. `installed` only records whether the profile declares the dependency. An absent on-demand entry carries embedded localized metadata and a host-derived `installTarget` containing the running DSH version and install spec, without registry access. Profile-declared packages with unreadable files retain their declaration and expose the normal error.
+
 `inspect(spec, options)` reads what a spec names before anything installs: a registry name is asked of the registry through `pnpm view`, run in the profile directory so the same proxy and authentication settings apply as to the install; an absolute path has its `package.json` read; a git address or tarball answers only its form and the `host` it is fetched from. The answer carries the name, version, description, whether the package declares a bundle, and the `registry` that answered, or a `problem`: `invalid-spec`, `already-installed`, `not-found`, `not-a-package`, `not-a-bundle`, `network`, or `unknown`, with the `registries` asked. A caller's `signal` or `inspectTimeoutMs` ends the lookup.
 
+Published installations offer `package@<running DSH version>`. Source Web and development Desktop offer `link:<absolute workspace package directory>` from the running CLI installation, including its development symlink. Package names resolve through workspace manifests; current working directory and prerelease suffixes do not select a checkout. Missing packages, bundle patches, or built entry points produce a diagnostic without registry fallback. Prepare the checkout with `pnpm install` and `pnpm run build`. Linked packages use that checkout’s dependencies and peers; rebuilding and restarting remain necessary after code changes. A registry copy or another checkout’s link can need replacement even when its version matches.
+
+Official on-demand installs and explicit updates call the same `installBundle` operation as other bundles. Registry targets use `saveExact: true`; development targets retain the ordinary `link:` dependency. Updates pass the current `enabled` selection; replacing an existing dependency reports `restart-required`. Turning Off only deselects the layer, and Remove uses the existing removal checks. Installation failure restores the profile manifest and lockfile; activation failure after installation can retain the saved dependency and selection. The existing peer-compatibility check still applies, without an additional Official-only version admission rule.
+
 `installBundle` checks GitHub repositories with `git ls-remote` before starting pnpm, using the profile directory and the installer's Git and proxy configuration. `githubConnectionTimeoutMs` defaults to 5000 ms and limits only this check, not package download or builds. The check disables credential helpers and prompts; only network failures and timeouts stop installation, reporting `failedAt: 'spec-host'` with the existing failure kind and diagnostic log. Authentication, repository lookup and other failures are left to pnpm, including its HTTPS-to-SSH fallback. Cancellation and manager disposal stop the check and its descendants. Registry packages, paths, tarballs and other Git hosts skip this check. A reachable repository can still fail during download or bundle validation.
 
 Registries are asked in turn. The plan starts at `options.registry`, else the configured `registry` (`null` is the one pnpm's own configuration names), and continues through `fallbackRegistries` while a registry is unreachable, times out, or answers that it has no such package or version, which a mirror not yet synced does. A registry outside the configured set is asked alone, so a private registry never falls through to a public one; pnpm's own registry counts as part of the set only while what it names, read through `pnpm config get registry` before each plan, is npm's own registry or one of the fallbacks, and is otherwise asked alone as a private one. A registry pnpm's own configuration already names is asked once. The lookup runs `pnpm view` with `--registry` and without pnpm's own retries, so a dead registry is reported within `inspectTimeoutMs` and the next one is asked; pnpm prints its refusal as JSON on stdout, which is read like stderr. The install keeps pnpm's retry settings. `registries()` answers the configured set and what pnpm names, for a picker. The [registry Agent Note](../../../.agents/notes/implemented/architecture/2026-09-18-plugin-install-registries.md) owns the rationale.
@@ -55,7 +61,7 @@ The browser-safe `@deepseek-ai/dsh-plugin-manager/registry` entry exports `OFFIC
 
 `waitForInstall(requestId)` lets a client recover a lost response by waiting for the active installation, including its non-cancellable application phase. It returns the same outcome as the original call, or `null` if the request is not active. Completed results are not retained; `null` establishes neither success nor cancellation.
 
-When pnpm 11 blocks dependency scripts, the failed installation reports every pending package name in the profile under `pendingBuilds`, including names left by earlier attempts; a failed run restores `package.json` and `pnpm-lock.yaml` but deliberately not `pnpm-workspace.yaml`, where pnpm records them. The Web plugin page offers **Allow these scripts and retry**; the tool can grant permission on the user's behalf through `approvedBuilds` on `install_bundle`, after the user approves those scripts in the conversation. The service validates pending names; it does not verify conversation approval. Approval persists by package name in this profile, permits commands with the host user's permissions, and survives another installation failure. Only currently undecided names can be approved; existing denials and wildcard rules cannot be overridden through this action. Approval rejects YAML anchors or aliases inside `allowBuilds`. Retry preserves the original activation choice.
+When pnpm 11 blocks dependency scripts, the failed installation reports every pending package name in the profile under `pendingBuilds`, including names left by earlier attempts and names the run reported as ignored. pnpm writes those entries into `pnpm-workspace.yaml` only when it can prompt, so the manager records the reported names itself; a failed run restores `package.json` and `pnpm-lock.yaml` but deliberately not `pnpm-workspace.yaml`. The Web plugin page offers **Allow these scripts and retry**; the tool can grant permission on the user's behalf through `approvedBuilds` on `install_bundle`, after the user approves those scripts in the conversation. The service validates pending names; it does not verify conversation approval. Approval persists by package name in this profile, permits commands with the host user's permissions, and survives another installation failure. Only currently undecided names can be approved; existing denials and wildcard rules cannot be overridden through this action. Approval rejects YAML anchors or aliases inside `allowBuilds`. Retry preserves the original activation choice.
 
 <a id="version-compatibility-and-exemptions"></a>
 ### Version compatibility and exemptions

package/README.zh.md

@@ -43,8 +43,14 @@ kind: "package-reference"
 
 `listBundles` 为各组合包及其声明的插件行提供可选的展示 `meta`，包括已禁用的组合包。Client 从这些值中选择语言。单独的 `description` 字段是该组合包原始的 `package.json.description`；元信息诊断不会阻止管理操作。`source` 以 `pnpm add` 接受的 spec 给出 profile 依赖：git 地址或 URL 按记录给出，但去掉 http(s) URL 的 user information（查询字符串保持原样）；`file:` 或 `link:` 路径按 profile 目录解析为绝对路径，`~` 展开为主目录；注册表版本范围、标签或别名接在包名的 `@` 之后，以别名安装的包的 spec 也是如此。安装提供的组合包没有该字段，即使 profile 也依赖它，因为实际加载的是安装中的副本。`plugin_manager` 工具的列表结果不包含 UI 展示元信息。
 
+`listBundles` 将随附可选组合包和按需目录项标为 `official`，与包的安装状态独立。`availability` 表示可读取的安装随附包、profile 包，或 `missing`；按需目录项不计入未声明的传递依赖副本。`installed` 仅表示 profile 是否声明该依赖。尚未安装的按需条目携带内嵌的本地化元信息，以及 Host 生成、包含当前 DSH 版本与安装 spec 的 `installTarget`，无需访问注册表。profile 已声明但文件不可读的包保留依赖声明，并展示原有错误。
+
 `inspect(spec, options)` 在任何东西安装之前读出 spec 指向什么：注册表包名通过 `pnpm view` 询问注册表，在 profile 目录中运行，因而与安装使用同样的代理与认证设置；绝对路径读取其 `package.json`；git 地址或 tarball 只答复自己的形式和它被拉取的 `host`。答复携带名称、版本、描述、该包是否声明组合包，以及作答的 `registry`，否则给出 `problem`：`invalid-spec`、`already-installed`、`not-found`、`not-a-package`、`not-a-bundle`、`network` 或 `unknown`，并附上问过的 `registries`。调用方的 `signal` 或 `inspectTimeoutMs` 会结束查询。
 
+已发布的安装提供 `package@<当前 DSH 版本>`。源码 Web 与开发 Desktop 提供 `link:<工作区包的绝对目录>`，目录来自当前 CLI 的安装位置，包括其开发符号链接。包名通过工作区清单解析；当前工作目录和预发布版本后缀不用于选择 checkout。包、bundle patch 或已构建入口缺失时报告诊断，不回退到注册表。使用 `pnpm install` 和 `pnpm run build` 准备 checkout。链接包使用该 checkout 的依赖与 peer；代码改变后仍需重新构建并重启。即使版本相同，注册表副本或其他 checkout 的链接也可能需要替换。
+
+官方按需安装与显式更新调用和其他组合包相同的 `installBundle` 操作。注册表目标使用 `saveExact: true`；开发目标保留普通 `link:` 依赖。更新传入当前 `enabled` 选择状态；替换已有依赖会报告 `restart-required`。关闭仅取消选择配置层，移除使用原有移除检查。安装失败恢复 profile 清单和锁文件；安装成功后激活失败可能保留已保存的依赖和选择。原有 peer 兼容性检查继续生效，不增加仅针对官方条目的版本准入规则。
+
 `installBundle` 在启动 pnpm 前通过 `git ls-remote` 检查 GitHub 仓库，使用 profile 目录及安装器的 Git 与代理配置。`githubConnectionTimeoutMs` 默认为 5000 毫秒，只限制这次检查，不限制包下载或构建。检查禁用凭据助手和认证提示；只有网络失败与超时会停止安装，通过现有失败类型与诊断日志返回，并标记 `failedAt: 'spec-host'`。认证、仓库查找及其他失败继续交给 pnpm，包括其 HTTPS 到 SSH 的回退。取消安装或销毁管理器会停止检查及其子进程。注册表包、本地路径、压缩包和其他 Git 主机跳过此检查。仓库可达后，下载或组合包验证仍可能失败。
 
 注册表按顺序询问。计划从 `options.registry` 开始，否则从配置的 `registry`（`null` 即 pnpm 自身配置指定的那个）开始，并在一个注册表不可达、超时或答复没有这个包或版本（尚未同步的镜像会如此）时继续问 `fallbackRegistries`。配置集合之外的注册表只问它自己，因而私有源永远不会落到公共源；pnpm 自身的注册表只在它指向的地址（每次做计划前经 `pnpm config get registry` 读出）是 npm 官方源或某个备选源时才算集合成员，否则视为私有源只问它自己。pnpm 自身配置已经指向的注册表只问一次。查询以 `--registry` 运行 `pnpm view` 且不带 pnpm 自身的重试，所以死掉的注册表会在 `inspectTimeoutMs` 内报告并转问下一个；pnpm 把拒绝以 JSON 打印在 stdout，读法与 stderr 相同。安装保留 pnpm 的重试设置。`registries()` 把配置集合和 pnpm 指向的地址答复给选择器。[注册表 Agent Note](../../../.agents/notes/implemented/architecture/2026-09-18-plugin-install-registries.zh.md) 拥有理由。
@@ -55,7 +61,7 @@ kind: "package-reference"
 
 `waitForInstall(requestId)` 让客户端在响应丢失后等待活动安装的结果，包括不可取消的应用阶段。它返回与原调用相同的结果，请求不在活动中时返回 `null`。已完成的结果不保留；`null` 不表示成功或已取消。
 
-pnpm 11 拦下依赖脚本时，失败的安装在 `pendingBuilds` 里报告 profile 中所有待决定的包名，包括先前尝试留下的；失败的运行会恢复 `package.json` 与 `pnpm-lock.yaml`，但有意不恢复 pnpm 记录这些名字的 `pnpm-workspace.yaml`。Web 插件页提供**允许这些脚本并重试**；工具可以在用户于对话中批准这些脚本后，通过 `install_bundle` 的 `approvedBuilds` 代为授权。服务只校验待决定的名字，不核实对话中的批准。授权按包名保存在当前 profile，允许以宿主用户的权限执行命令，并在再次安装失败后保留。只能批准当前未决定的名字；已有的拒绝与通配规则不能通过此操作覆盖。`allowBuilds` 里出现 YAML 锚点或别名时拒绝授权。重试保留原来的启用选择。
+pnpm 11 拦下依赖脚本时，失败的安装在 `pendingBuilds` 里报告 profile 中所有待决定的包名，包括先前尝试留下的，以及本次运行报告为已忽略的。pnpm 只在能够交互提示时才把这些条目写入 `pnpm-workspace.yaml`，因此由管理器自行记录本次运行报告的包名；失败的运行会恢复 `package.json` 与 `pnpm-lock.yaml`，但有意不恢复 `pnpm-workspace.yaml`。Web 插件页提供**允许这些脚本并重试**；工具可以在用户于对话中批准这些脚本后，通过 `install_bundle` 的 `approvedBuilds` 代为授权。服务只校验待决定的名字，不核实对话中的批准。授权按包名保存在当前 profile，允许以宿主用户的权限执行命令，并在再次安装失败后保留。只能批准当前未决定的名字；已有的拒绝与通配规则不能通过此操作覆盖。`allowBuilds` 里出现 YAML 锚点或别名时拒绝授权。重试保留原来的启用选择。
 
 <a id="version-compatibility-and-exemptions"></a>
 ### 版本兼容性与豁免

package/lib/index.js

@@ -1,13 +1,13 @@
 import { randomUUID } from "node:crypto";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, globSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { mkdir, mkdtemp, open, readFile, rm } from "node:fs/promises";
-import { isAbsolute, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import z from "@deepseek-ai/schemastery";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { pluginEntryId, readPluginInventory } from "@deepseek-ai/dsh-host-plugin-inventory";
-import { OPTIONAL_BUNDLES, PROFILE_COMPATIBILITY_FILENAME, bundlePatchPaths, composeEntries, evaluatePluginCompatibility, loadOptionalPatches, loadOverlayPatches, pluginCompatibilityWarning, readPluginMeta, readProfileCompatibility, readProfileManifest, readProfilePatches, readProfileVersionExemptions, reconcileProfilePatches, resolveBundleDir, resolveProfileDir, setProfileVersionExemption } from "@deepseek-ai/dsh-app-boot";
+import { OFFICIAL_ON_DEMAND_CATALOG, OPTIONAL_BUNDLES, PROFILE_COMPATIBILITY_FILENAME, bundlePatchPaths, composeEntries, evaluatePluginCompatibility, getDshRuntimeVersion, loadOptionalPatches, loadOverlayPatches, pluginCompatibilityWarning, readPluginMeta, readProfileCompatibility, readProfileManifest, readProfilePatches, readProfileVersionExemptions, reconcileProfilePatches, resolveBundleDir, resolveProfileDir, setProfileVersionExemption } from "@deepseek-ai/dsh-app-boot";
 import { once } from "node:events";
 import { execa } from "execa";
 import { scrubbedParentEnv } from "@deepseek-ai/dsh-subprocess";
@@ -819,6 +819,48 @@ function classifyInstallFailure(facts) {
 	for (const [kind, pattern] of LOG_KINDS) if (pattern.test(facts.log)) return kind;
 	return "unknown";
 }
+//#endregion
+//#region lib/types/official-install-target.js
+/** Select Official bundle packages from the running installation without importing provider code. */
+function manifestAt(file) {
+	return JSON.parse(readFileSync(file, "utf8"));
+}
+/**
+* Offer a source checkout link or an exact published package version. Source installations are
+* identified by the real CLI manifest and its unpacked workspace dependencies, including Desktop's
+* development symlink. An incomplete checkout is an error, never a registry fallback.
+* @param name - Official catalog package name.
+* @param installAnchor - Running application's DSH package.json, possibly reached through a symlink.
+* @param version - Running DSH version used by its release family.
+* @returns An ordinary package-manager spec and its package version.
+* @throws when a source installation lacks its workspace package, bundle patch, or built runtime.
+*/
+function officialBundleInstallTarget(name, installAnchor, version) {
+	const anchor = realpathSync(installAnchor);
+	const installation = manifestAt(anchor);
+	if (!(installation.name === "@deepseek-ai/dsh" && Object.values(installation.dependencies ?? {}).some((value) => value.startsWith("workspace:")))) return {
+		spec: `${name}@${version}`,
+		version
+	};
+	const root = resolve(dirname(anchor), "../..");
+	if (anchor !== join(root, "apps", "cli", "package.json") || !existsSync(join(root, "package.json")) || manifestAt(join(root, "package.json")).name !== "@deepseek-ai/dsh-root") throw new Error(`Official bundle ${name}: source DSH installation ${anchor} requires its complete workspace checkout`);
+	const matches = globSync("packages/*/*/package.json", { cwd: root }).map((file) => ({
+		file: join(root, file),
+		manifest: manifestAt(join(root, file))
+	})).filter((entry) => entry.manifest.name === name);
+	const selected = matches[0];
+	if (matches.length !== 1 || selected === void 0) throw new Error(`Official bundle ${name}: expected one workspace package in ${root}, found ${matches.length}; restore the checkout and run pnpm install`);
+	const { file, manifest } = selected;
+	const directory = realpathSync(dirname(file));
+	if (manifest.version !== version || manifest.private === true || manifest.dsh?.bundle === void 0) throw new Error(`Official bundle ${name}: ${file} must declare a public bundle at DSH version ${version}`);
+	const main = typeof manifest.main === "string" ? resolve(directory, manifest.main) : void 0;
+	if (main === void 0 || !existsSync(main) || !statSync(main).isFile()) throw new Error(`Official bundle ${name}: built runtime is missing in ${directory}; run pnpm install and pnpm run build in ${root}`);
+	for (const patch of bundlePatchPaths(directory, manifest.dsh.bundle)) if (!existsSync(patch) || !statSync(patch).isFile()) throw new Error(`Official bundle ${name}: bundle patch ${patch} is missing; restore the checkout`);
+	return {
+		spec: `link:${directory}`,
+		version
+	};
+}
 /** Public npmmirror URL shared by the fallback configuration and public-registry comparison. */
 const NPMMIRROR_REGISTRY = "https://registry.npmmirror.com/";
 /**
@@ -940,6 +982,10 @@ async function writePluginEnabled(filename, id, name, enabled) {
 //#endregion
 //#region lib/types/build-approval.js
 /** Approve pnpm's pending dependency scripts in the current profile's workspace settings. */
+/** Value pnpm leaves for a build script that still needs a decision. */
+const UNDECIDED_BUILD = "set this to true or false";
+/** Where a non-interactive run names the build scripts it skipped. */
+const IGNORED_BUILDS = /\bIgnored build scripts: (.+)/;
 async function readPolicy(dir) {
 	let text;
 	try {
@@ -956,17 +1002,41 @@ async function readPolicy(dir) {
 	visit(builds ?? null, (_key, node) => {
 		if (isAlias(node) || isNode(node) && "anchor" in node && node.anchor) throw new Error("allowBuilds must not contain YAML anchors or aliases");
 	});
+	const keys = isMap(builds) ? builds.items.flatMap(({ key }) => isScalar(key) && typeof key.value === "string" ? [key.value] : []) : [];
 	return {
 		document,
-		pending: isMap(builds) ? builds.items.flatMap(({ key, value }) => isScalar(key) && typeof key.value === "string" && !/[*?]/.test(key.value) && isScalar(value) && value.value === "set this to true or false" ? [key.value] : []) : []
+		pending: isMap(builds) ? builds.items.flatMap(({ key, value }) => isScalar(key) && typeof key.value === "string" && !/[*?]/.test(key.value) && isScalar(value) && value.value === UNDECIDED_BUILD ? [key.value] : []) : [],
+		keys
 	};
 }
-/** Read package names left undecided by pnpm 11, including after installation cleanup.
+/**
+* Record the build scripts a failed run reported as ignored, then list every name awaiting a decision.
+*
+* pnpm writes those policy entries itself only when it can prompt, and the
+* manager always runs it non-interactively, so the run's own report is the
+* record that survives.
 * @param dir Current profile directory.
+* @param output Captured output of the failed run.
 * @returns Exact package names awaiting a build decision; wildcard rules are excluded.
 */
-async function readPendingBuilds(dir) {
-	return (await readPolicy(dir)).pending;
+async function recordPendingBuilds(dir, output) {
+	const { document, pending, keys } = await readPolicy(dir);
+	const known = new Set(keys);
+	const added = ignoredBuildNames(output).filter((name) => !known.has(name));
+	if (added.length === 0) return pending;
+	for (const name of added) document.setIn(["allowBuilds", name], UNDECIDED_BUILD);
+	await writeFileAtomic(join(dir, "pnpm-workspace.yaml"), String(document), { mode: 384 });
+	return [...pending, ...added];
+}
+/**
+* Read the package names a pnpm run reported as ignored build scripts.
+* @param output Captured output of the run.
+* @returns Exact names in report order; wildcard patterns are excluded.
+*/
+function ignoredBuildNames(output) {
+	const reported = IGNORED_BUILDS.exec(output)?.[1];
+	if (reported === void 0) return [];
+	return reported.split(",").map((name) => name.trim()).filter((name) => name !== "" && !/[*?]/.test(name));
 }
 /** Persist approval without running scripts; the caller holds the profile manifest lock.
 * @param dir Current profile directory.
@@ -1475,7 +1545,7 @@ let PluginManager = (() => {
 				};
 			});
 		}
-		/** Read the profile's installed bundles, the bundles this dsh installation supplies, and the selected names that are not bundles.
+		/** Read installed, installation-provided, and offline Official catalog bundles, plus selected non-bundle names.
 		* A dependency without a bundle patch is listed, as a `not-bundle` problem, only while it is selected.
 		* @returns Package versions, manifest descriptions, the installable spec of profile dependencies, rows, optional
 		* display metadata, activation selections, whether the installation offers the bundle, and removal availability.
@@ -1487,45 +1557,86 @@ let PluginManager = (() => {
 			const recorded = manifest.dependencies ?? {};
 			const dependencies = Object.keys(recorded);
 			const installation = JSON.parse(readFileSync(this.profile.installAnchor, "utf8"));
+			const catalog = new Map(OFFICIAL_ON_DEMAND_CATALOG.map((entry) => [entry.packageName, entry]));
 			const names = [...new Set([
 				...selected,
 				...dependencies,
-				...Object.keys(installation.dependencies ?? {})
+				...Object.keys(installation.dependencies ?? {}),
+				...catalog.keys()
 			])];
 			const bundles = [];
+			const runtimeVersion = getDshRuntimeVersion();
 			for (const name of names) {
 				const installed = dependencies.includes(name);
 				const optional = OPTIONAL_BUNDLES.includes(name);
 				const enabled = selected.includes(name);
 				const shipped = Object.hasOwn(installation.dependencies ?? {}, name);
+				const offered = catalog.get(name);
+				const official = optional || offered !== void 0;
+				let target = {};
+				let targetError;
+				if (offered !== void 0) try {
+					target = { installTarget: officialBundleInstallTarget(name, this.profile.installAnchor, runtimeVersion) };
+				} catch (error) {
+					targetError = managementError(error);
+				}
+				const catalogMeta = offered === void 0 ? {} : { meta: offered.meta };
+				if (offered !== void 0 && !installed && !shipped) {
+					bundles.push({
+						name,
+						official,
+						availability: "missing",
+						...catalogMeta,
+						...target,
+						enabled,
+						installed,
+						optional,
+						removable: enabled,
+						rows: [],
+						overrides: [],
+						...targetError !== void 0 ? { error: targetError } : enabled ? { error: { code: "not-bundle" } } : {}
+					});
+					continue;
+				}
 				const owned = installed && !shipped;
 				const removable = owned || enabled && !installed && !shipped;
 				const sourceOf = (packageName) => owned ? { source: dependencySpec(name, recorded[name], this.profile.dir, packageName) } : {};
 				const readOnlyReason = this.protectsManager(name) ? "management-required" : void 0;
+				let availability = "missing";
+				let version;
 				try {
 					const info = bundleManifest(name, this.profile.dir, this.profile.installAnchor);
+					availability = shipped ? "installation" : "profile";
 					if (info === void 0) {
-						if (enabled) bundles.push({
+						if (enabled || offered !== void 0) bundles.push({
 							name,
+							official,
+							availability,
+							...catalogMeta,
+							...target,
 							...sourceOf(),
 							enabled,
 							installed,
 							optional,
 							removable: removable && readOnlyReason === void 0,
 							...readOnlyReason === void 0 ? {} : { readOnlyReason },
-							error: { code: "not-bundle" },
+							error: targetError ?? { code: "not-bundle" },
 							rows: [],
 							overrides: []
 						});
 						continue;
 					}
+					version = info.version;
 					const compatibility = evaluatePluginCompatibility(info, exemptions);
 					if (compatibility !== void 0 && !compatibility.exempted) throw new ManagementFailure("incompatible-version", [incompatiblePlugin(compatibility)]);
 					const dir = resolveBundleDir("dsh", name, this.profile.installAnchor, this.profile.dir);
-					const meta = readPluginMeta(info.name ?? name, pathToFileURL(join(dir, "package.json")).href);
+					const meta = offered?.meta ?? readPluginMeta(info.name ?? name, pathToFileURL(join(dir, "package.json")).href);
 					bundles.push({
 						name,
-						...info.version === void 0 ? {} : { version: info.version },
+						official,
+						availability,
+						...target,
+						...version === void 0 ? {} : { version },
 						...info.description === void 0 || info.description === "" ? {} : { description: info.description },
 						...meta === void 0 ? {} : { meta },
 						...sourceOf(info.name),
@@ -1534,18 +1645,24 @@ let PluginManager = (() => {
 						optional,
 						removable: removable && readOnlyReason === void 0,
 						...readOnlyReason === void 0 ? {} : { readOnlyReason },
-						...this.declaredRows(name, info)
+						...this.declaredRows(name, info),
+						...targetError === void 0 ? {} : { error: targetError }
 					});
 				} catch (error) {
-					if (enabled || installed) bundles.push({
+					if (enabled || installed || optional || offered !== void 0) bundles.push({
 						name,
+						official,
+						availability,
+						...catalogMeta,
+						...target,
+						...version === void 0 ? {} : { version },
 						...sourceOf(),
 						enabled,
 						installed,
 						optional,
 						removable: removable && readOnlyReason === void 0,
 						...readOnlyReason === void 0 ? {} : { readOnlyReason },
-						error: managementError(error),
+						error: targetError ?? managementError(error),
 						rows: [],
 						overrides: []
 					});
@@ -1721,7 +1838,7 @@ let PluginManager = (() => {
 		* `package.json` and `pnpm-lock.yaml` as they were; downloaded files can stay.
 		* @param spec One package spec, including local paths relative to the invocation directory.
 		* @param options Whether to activate the installed bundle (defaults to true), the request id a cancellation names,
-		* the pending build scripts to allow for this profile before pnpm runs, and the registry asked first.
+		* the pending build scripts to allow, whether to save an exact dependency, and the registry asked first.
 		* @returns Package-manager diagnostics, the registries asked, and the observed activation outcome.
 		*/
 		installBundle(spec, options) {
@@ -1786,6 +1903,7 @@ let PluginManager = (() => {
 						run = await this.runPnpm([
 							"add",
 							spec,
+							...options?.saveExact === true ? ["--save-exact"] : [],
 							...registryArguments(registry)
 						], control.abort.signal, requestId);
 						result.packageResult = run;
@@ -1806,7 +1924,7 @@ let PluginManager = (() => {
 					if (succeeded) delete result.failedAt;
 					if (!succeeded) {
 						try {
-							result.pendingBuilds = await readPendingBuilds(this.profile.dir);
+							result.pendingBuilds = await recordPendingBuilds(this.profile.dir, run.output);
 						} catch (error) {
 							this.ownerContext.logger.warn("Could not read pending build approvals after pnpm failed", error);
 						}
@@ -1814,7 +1932,11 @@ let PluginManager = (() => {
 					}
 					const after = readProfileManifest("dsh", this.profile.dir).dependencies ?? {};
 					const installed = Object.keys(after).filter((name) => before[name] !== after[name]);
-					if (installed.length === 0) installed.push(...Object.keys(after).filter((name) => spec === name || spec.startsWith(`${name}@`)));
+					if (installed.length === 0) {
+						const parsed = parsedForRegistry(spec);
+						const localName = parsed.kind === "path" ? readProfileManifest("dsh", parsed.path).name : void 0;
+						installed.push(...Object.keys(after).filter((name) => name === localName || spec === name || spec.startsWith(`${name}@`)));
+					}
 					const target = installed[0];
 					if (installed.length !== 1 || target === void 0) throw new ManagementFailure("ambiguous-install");
 					name = target;
@@ -1924,7 +2046,7 @@ let PluginManager = (() => {
 			const rows = [];
 			const packages = this.ctx.get("pluginPackages");
 			for (const row of flatten(composeEntries([patches.filter((item) => item.insert !== void 0)]))) {
-				if (typeof row.id !== "string" || typeof row.name !== "string") continue;
+				if (typeof row.id !== "string" || typeof row.name !== "string" || row.group === true) continue;
 				const active = live.get(row.id);
 				const entryId = active?.entryId;
 				const base = active?.baseUrl ?? pathToFileURL(join(dir, "package.json")).href;

package/lib/typert.host.js

@@ -34,6 +34,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_parameter_0$sc
 let _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_parameter_1$schema$value
 const _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_parameter_1$schema = () => (_deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_parameter_1$schema$value ??= z.union([z.undefined(), z.object({
   'enabled': z.boolean().optional(),
+  'saveExact': z.boolean().optional(),
   'requestId': z.intersection(z.string(), z.unknown()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registry': z.union([z.literal(null), z.string()]).optional(),
@@ -80,6 +81,12 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_result$schema
 let _deepseek_ai_dsh_plugin_manager_pluginManager_listBundles_result$schema$value
 const _deepseek_ai_dsh_plugin_manager_pluginManager_listBundles_result$schema = () => (_deepseek_ai_dsh_plugin_manager_pluginManager_listBundles_result$schema$value ??= z.array(z.object({
   'name': z.string(),
+  'official': z.boolean(),
+  'availability': z.union([z.literal("profile"), z.literal("installation"), z.literal("missing")]),
+  'installTarget': z.object({
+  'spec': z.string(),
+  'version': z.string(),
+}).optional(),
   'version': z.string().optional(),
   'meta': z.object({
   'title': z.union([z.string(), z.intersection(z.object({
@@ -419,7 +426,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#PluginInstallCancellation',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_cancelInstall_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":600,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":628,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/inspect',
@@ -456,7 +463,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#PluginSpecInspection',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_inspect_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":350,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":374,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/installBundle',
@@ -492,7 +499,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":473,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":497,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/listBundles',
@@ -507,7 +514,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager#pluginManager/listBundles:result',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_listBundles_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":280,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":282,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/listPlugins',
@@ -522,7 +529,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager#pluginManager/listPlugins:result',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_listPlugins_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":256,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":258,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/listVersionExemptions',
@@ -537,7 +544,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager#pluginManager/listVersionExemptions:result',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_listVersionExemptions_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":232,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":234,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/registries',
@@ -552,7 +559,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#PluginRegistries',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_registries_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":334,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":358,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/removeBundle',
@@ -577,7 +584,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_removeBundle_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":617,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":645,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/setBundleEnabled',
@@ -612,7 +619,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_setBundleEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":452,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":476,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/setPluginEnabled',
@@ -647,7 +654,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_setPluginEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":434,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":458,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/setVersionExemption',
@@ -703,7 +710,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_setVersionExemption_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":245,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":247,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/waitForInstall',
@@ -728,7 +735,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager#pluginManager/waitForInstall:result',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_waitForInstall_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":590,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":618,"column":9},
     },
   ],
   model: {
@@ -766,8 +773,8 @@ export const TYPERT = {
             "kind": "method",
             "name": "listBundles",
             "signature": "@Remote listBundles(): Promise<BundleInfo[]>",
-            "summary": "Read the profile's installed bundles, the bundles this dsh installation supplies, and the selected names that are not bundles.",
-            "jsDoc": "/** Read the profile's installed bundles, the bundles this dsh installation supplies, and the selected names that are not bundles.\n * A dependency without a bundle patch is listed, as a `not-bundle` problem, only while it is selected.\n * @returns Package versions, manifest descriptions, the installable spec of profile dependencies, rows, optional\n * display metadata, activation selections, whether the installation offers the bundle, and removal availability.\n */"
+            "summary": "Read installed, installation-provided, and offline Official catalog bundles, plus selected non-bundle names.",
+            "jsDoc": "/** Read installed, installation-provided, and offline Official catalog bundles, plus selected non-bundle names.\n * A dependency without a bundle patch is listed, as a `not-bundle` problem, only while it is selected.\n * @returns Package versions, manifest descriptions, the installable spec of profile dependencies, rows, optional\n * display metadata, activation selections, whether the installation offers the bundle, and removal availability.\n */"
           },
           {
             "kind": "method",
@@ -802,7 +809,7 @@ export const TYPERT = {
             "name": "installBundle",
             "signature": "@Remote installBundle(spec: string, options?: InstallBundleOptions): Promise<ChangeResult>",
             "summary": "Install a package using the same pnpm implementation as dsh plugin.",
-            "jsDoc": "/**\n * Install a package using the same pnpm implementation as dsh plugin. GitHub\n * repositories get a connection check bounded by githubConnectionTimeoutMs before pnpm starts;\n * only network failures or timeouts stop installation, while pnpm owns authentication and transport fallback. A run\n * that fails, is cancelled, or adds a package without a bundle patch restores\n * `package.json` and `pnpm-lock.yaml` as they were; downloaded files can stay.\n * @param spec One package spec, including local paths relative to the invocation directory.\n * @param options Whether to activate the installed bundle (defaults to true), the request id a cancellation names,\n * the pending build scripts to allow for this profile before pnpm runs, and the registry asked first.\n * @returns Package-manager diagnostics, the registries asked, and the observed activation outcome.\n */"
+            "jsDoc": "/**\n * Install a package using the same pnpm implementation as dsh plugin. GitHub\n * repositories get a connection check bounded by githubConnectionTimeoutMs before pnpm starts;\n * only network failures or timeouts stop installation, while pnpm owns authentication and transport fallback. A run\n * that fails, is cancelled, or adds a package without a bundle patch restores\n * `package.json` and `pnpm-lock.yaml` as they were; downloaded files can stay.\n * @param spec One package spec, including local paths relative to the invocation directory.\n * @param options Whether to activate the installed bundle (defaults to true), the request id a cancellation names,\n * the pending build scripts to allow, whether to save an exact dependency, and the registry asked first.\n * @returns Package-manager diagnostics, the registries asked, and the observed activation outcome.\n */"
           },
           {
             "kind": "method",
@@ -833,7 +840,7 @@ export const TYPERT = {
           },
           {
             "name": "BundleInfo",
-            "declaration": "export interface BundleInfo {\n    name: string;\n    version?: string;\n    meta?: PluginLocalizedMeta;\n    description?: string;\n    enabled: boolean;\n    installed: boolean;\n    source?: string;\n    optional: boolean;\n    removable: boolean;\n    readOnlyReason?: ReadOnlyReason;\n    error?: ManagementError;\n    rows: BundleRowInfo[];\n    overrides: string[];\n}"
+            "declaration": "export interface BundleInfo {\n    name: string;\n    official: boolean;\n    availability: 'installation' | 'profile' | 'missing';\n    installTarget?: { spec: string; version: string; };\n    version?: string;\n    meta?: PluginLocalizedMeta;\n    description?: string;\n    enabled: boolean;\n    installed: boolean;\n    source?: string;\n    optional: boolean;\n    removable: boolean;\n    readOnlyReason?: ReadOnlyReason;\n    error?: ManagementError;\n    rows: BundleRowInfo[];\n    overrides: string[];\n}"
           },
           {
             "name": "BundleRowInfo",
@@ -853,7 +860,7 @@ export const TYPERT = {
           },
           {
             "name": "InstallBundleOptions",
-            "declaration": "export interface InstallBundleOptions {\n    enabled?: boolean;\n    requestId?: PluginInstallRequestId;\n    approvedBuilds?: string[];\n    registry?: Registry;\n}"
+            "declaration": "export interface InstallBundleOptions {\n    enabled?: boolean;\n    saveExact?: boolean;\n    requestId?: PluginInstallRequestId;\n    approvedBuilds?: string[];\n    registry?: Registry;\n}"
           },
           {
             "name": "InstallSpecKind",

package/lib/typert.remote-client.js

@@ -34,6 +34,7 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_parameter_0$sc
 let _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_parameter_1$schema$value
 const _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_parameter_1$schema = () => (_deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_parameter_1$schema$value ??= z.union([z.undefined(), z.object({
   'enabled': z.boolean().optional(),
+  'saveExact': z.boolean().optional(),
   'requestId': z.intersection(z.string(), z.unknown()).optional(),
   'approvedBuilds': z.array(z.string()).optional(),
   'registry': z.union([z.literal(null), z.string()]).optional(),
@@ -80,6 +81,12 @@ const _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_result$schema
 let _deepseek_ai_dsh_plugin_manager_pluginManager_listBundles_result$schema$value
 const _deepseek_ai_dsh_plugin_manager_pluginManager_listBundles_result$schema = () => (_deepseek_ai_dsh_plugin_manager_pluginManager_listBundles_result$schema$value ??= z.array(z.object({
   'name': z.string(),
+  'official': z.boolean(),
+  'availability': z.union([z.literal("profile"), z.literal("installation"), z.literal("missing")]),
+  'installTarget': z.object({
+  'spec': z.string(),
+  'version': z.string(),
+}).optional(),
   'version': z.string().optional(),
   'meta': z.object({
   'title': z.union([z.string(), z.intersection(z.object({
@@ -416,7 +423,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#PluginInstallCancellation',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_cancelInstall_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":600,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":628,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/inspect',
@@ -453,7 +460,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#PluginSpecInspection',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_inspect_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":350,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":374,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/installBundle',
@@ -489,7 +496,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_installBundle_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":473,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":497,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/listBundles',
@@ -504,7 +511,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager#pluginManager/listBundles:result',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_listBundles_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":280,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":282,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/listPlugins',
@@ -519,7 +526,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager#pluginManager/listPlugins:result',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_listPlugins_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":256,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":258,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/listVersionExemptions',
@@ -534,7 +541,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager#pluginManager/listVersionExemptions:result',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_listVersionExemptions_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":232,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":234,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/registries',
@@ -549,7 +556,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#PluginRegistries',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_registries_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":334,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":358,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/removeBundle',
@@ -574,7 +581,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_removeBundle_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":617,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":645,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/setBundleEnabled',
@@ -609,7 +616,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_setBundleEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":452,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":476,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/setPluginEnabled',
@@ -644,7 +651,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_setPluginEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":434,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":458,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/setVersionExemption',
@@ -700,7 +707,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager/types#ChangeResult',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_setVersionExemption_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":245,"column":3},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":247,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-plugin-manager#pluginManager/waitForInstall',
@@ -725,7 +732,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-plugin-manager#pluginManager/waitForInstall:result',
         create: _deepseek_ai_dsh_plugin_manager_pluginManager_waitForInstall_result$schema,
       },
-      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":590,"column":9},
+      sourceLocation: {"file":"packages/boot/plugin-manager/src/index.ts","line":618,"column":9},
     },
   ],
 }

package/lib/types/build-approval.d.ts

@@ -1,8 +1,20 @@
-/** Read package names left undecided by pnpm 11, including after installation cleanup.
+/**
+ * Record the build scripts a failed run reported as ignored, then list every name awaiting a decision.
+ *
+ * pnpm writes those policy entries itself only when it can prompt, and the
+ * manager always runs it non-interactively, so the run's own report is the
+ * record that survives.
  * @param dir Current profile directory.
+ * @param output Captured output of the failed run.
  * @returns Exact package names awaiting a build decision; wildcard rules are excluded.
  */
-export declare function readPendingBuilds(dir: string): Promise<string[]>;
+export declare function recordPendingBuilds(dir: string, output: string): Promise<string[]>;
+/**
+ * Read the package names a pnpm run reported as ignored build scripts.
+ * @param output Captured output of the run.
+ * @returns Exact names in report order; wildcard patterns are excluded.
+ */
+export declare function ignoredBuildNames(output: string): string[];
 /** Persist approval without running scripts; the caller holds the profile manifest lock.
  * @param dir Current profile directory.
  * @param names Explicit package names from the pending build list.

package/lib/types/build-approval.js

@@ -4,6 +4,10 @@ import { join } from 'node:path';
 import { isAlias, isMap, isNode, isScalar, parseDocument, visit } from 'yaml';
 import { ManagementFailure } from "./failure.js";
 import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
+/** Value pnpm leaves for a build script that still needs a decision. */
+const UNDECIDED_BUILD = 'set this to true or false';
+/** Where a non-interactive run names the build scripts it skipped. */
+const IGNORED_BUILDS = /\bIgnored build scripts: (.+)/;
 async function readPolicy(dir) {
     let text;
     try {
@@ -27,16 +31,42 @@ async function readPolicy(dir) {
             throw new Error('allowBuilds must not contain YAML anchors or aliases');
         }
     });
+    const keys = isMap(builds) ? builds.items.flatMap(({ key }) => isScalar(key) && typeof key.value === 'string' ? [key.value] : []) : [];
     const pending = isMap(builds) ? builds.items.flatMap(({ key, value }) => isScalar(key) && typeof key.value === 'string' && !/[*?]/.test(key.value)
-        && isScalar(value) && value.value === 'set this to true or false' ? [key.value] : []) : [];
-    return { document, pending };
+        && isScalar(value) && value.value === UNDECIDED_BUILD ? [key.value] : []) : [];
+    return { document, pending, keys };
 }
-/** Read package names left undecided by pnpm 11, including after installation cleanup.
+/**
+ * Record the build scripts a failed run reported as ignored, then list every name awaiting a decision.
+ *
+ * pnpm writes those policy entries itself only when it can prompt, and the
+ * manager always runs it non-interactively, so the run's own report is the
+ * record that survives.
  * @param dir Current profile directory.
+ * @param output Captured output of the failed run.
  * @returns Exact package names awaiting a build decision; wildcard rules are excluded.
  */
-export async function readPendingBuilds(dir) {
-    return (await readPolicy(dir)).pending;
+export async function recordPendingBuilds(dir, output) {
+    const { document, pending, keys } = await readPolicy(dir);
+    const known = new Set(keys);
+    const added = ignoredBuildNames(output).filter(name => !known.has(name));
+    if (added.length === 0)
+        return pending;
+    for (const name of added)
+        document.setIn(['allowBuilds', name], UNDECIDED_BUILD);
+    await writeFileAtomic(join(dir, 'pnpm-workspace.yaml'), String(document), { mode: 0o600 });
+    return [...pending, ...added];
+}
+/**
+ * Read the package names a pnpm run reported as ignored build scripts.
+ * @param output Captured output of the run.
+ * @returns Exact names in report order; wildcard patterns are excluded.
+ */
+export function ignoredBuildNames(output) {
+    const reported = IGNORED_BUILDS.exec(output)?.[1];
+    if (reported === undefined)
+        return [];
+    return reported.split(',').map(name => name.trim()).filter(name => name !== '' && !/[*?]/.test(name));
 }
 /** Persist approval without running scripts; the caller holds the profile manifest lock.
  * @param dir Current profile directory.

package/lib/types/index.d.ts

@@ -75,7 +75,7 @@ export declare class PluginManager extends TypertRemoteService {
      * @returns Current runtime entries with persistent patch targets.
      */
     listPlugins(): Promise<PluginInfo[]>;
-    /** Read the profile's installed bundles, the bundles this dsh installation supplies, and the selected names that are not bundles.
+    /** Read installed, installation-provided, and offline Official catalog bundles, plus selected non-bundle names.
      * A dependency without a bundle patch is listed, as a `not-bundle` problem, only while it is selected.
      * @returns Package versions, manifest descriptions, the installable spec of profile dependencies, rows, optional
      * display metadata, activation selections, whether the installation offers the bundle, and removal availability.
@@ -112,7 +112,7 @@ export declare class PluginManager extends TypertRemoteService {
      * `package.json` and `pnpm-lock.yaml` as they were; downloaded files can stay.
      * @param spec One package spec, including local paths relative to the invocation directory.
      * @param options Whether to activate the installed bundle (defaults to true), the request id a cancellation names,
-     * the pending build scripts to allow for this profile before pnpm runs, and the registry asked first.
+     * the pending build scripts to allow, whether to save an exact dependency, and the registry asked first.
      * @returns Package-manager diagnostics, the registries asked, and the observed activation outcome.
      */
     installBundle(spec: string, options?: InstallBundleOptions): Promise<ChangeResult>;

package/lib/types/index.js

@@ -42,14 +42,15 @@ import { withFileLock, writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
 import z from '@deepseek-ai/schemastery';
 import { TypertRemoteService, Remote } from '@deepseek-ai/dsh-typert-protocol';
 import { pluginEntryId, readPluginInventory } from '@deepseek-ai/dsh-host-plugin-inventory';
-import { readPluginMeta, readProfileManifest, resolveBundleDir, loadOverlayPatches, composeEntries, reconcileProfilePatches, readProfilePatches, OPTIONAL_BUNDLES, bundlePatchPaths, evaluatePluginCompatibility, readProfileCompatibility, readProfileVersionExemptions, setProfileVersionExemption, PROFILE_COMPATIBILITY_FILENAME, } from '@deepseek-ai/dsh-app-boot';
+import { readPluginMeta, readProfileManifest, resolveBundleDir, loadOverlayPatches, composeEntries, reconcileProfilePatches, readProfilePatches, OPTIONAL_BUNDLES, bundlePatchPaths, evaluatePluginCompatibility, readProfileCompatibility, readProfileVersionExemptions, setProfileVersionExemption, PROFILE_COMPATIBILITY_FILENAME, OFFICIAL_ON_DEMAND_CATALOG, getDshRuntimeVersion, } from '@deepseek-ai/dsh-app-boot';
 import { bundleManifest, readProfileRegistry, registryArguments, runProfilePnpm, saveManifest, viewProfilePackage } from "./operations.js";
 import { classifyInstallFailure } from "./install-failure.js";
+import { officialBundleInstallTarget } from "./official-install-target.js";
 import { dependencySpec, InvalidInstallSpecError, parseInstallSpec } from "./install-spec.js";
 import { attributeFailure, normalizeRegistry, NPMMIRROR_REGISTRY, registryPlan } from "./registry.js";
 import { writePluginEnabled } from "./patch.js";
 import { incompatiblePlugin, ManagementFailure } from "./failure.js";
-import { approveBuilds, readPendingBuilds } from "./build-approval.js";
+import { approveBuilds, recordPendingBuilds } from "./build-approval.js";
 import { checkGithubConnection } from "./github-connection.js";
 export { classifyInstallFailure } from "./install-failure.js";
 export { InvalidInstallSpecError, parseInstallSpec } from "./install-spec.js";
@@ -274,7 +275,7 @@ let PluginManager = (() => {
                 return { ...entry, patchId: candidate.id };
             });
         }
-        /** Read the profile's installed bundles, the bundles this dsh installation supplies, and the selected names that are not bundles.
+        /** Read installed, installation-provided, and offline Official catalog bundles, plus selected non-bundle names.
          * A dependency without a bundle patch is listed, as a `not-bundle` problem, only while it is selected.
          * @returns Package versions, manifest descriptions, the installable spec of profile dependencies, rows, optional
          * display metadata, activation selections, whether the installation offers the bundle, and removal availability.
@@ -286,45 +287,71 @@ let PluginManager = (() => {
             const recorded = manifest.dependencies ?? {};
             const dependencies = Object.keys(recorded);
             const installation = JSON.parse(readFileSync(this.profile.installAnchor, 'utf8'));
-            const names = [...new Set([...selected, ...dependencies, ...Object.keys(installation.dependencies ?? {})])];
+            const catalog = new Map(OFFICIAL_ON_DEMAND_CATALOG.map(entry => [entry.packageName, entry]));
+            const names = [...new Set([...selected, ...dependencies, ...Object.keys(installation.dependencies ?? {}), ...catalog.keys()])];
             const bundles = [];
+            const runtimeVersion = getDshRuntimeVersion();
             for (const name of names) {
                 const installed = dependencies.includes(name);
                 const optional = OPTIONAL_BUNDLES.includes(name);
                 const enabled = selected.includes(name);
                 const shipped = Object.hasOwn(installation.dependencies ?? {}, name);
-                // Bundle resolution reads the installation first, so a profile dependency the installation manifest also names,
-                // like one it forbids removing, is not the loaded copy.
+                const offered = catalog.get(name);
+                const official = optional || offered !== undefined;
+                let target = {};
+                let targetError;
+                if (offered !== undefined) {
+                    try {
+                        target = { installTarget: officialBundleInstallTarget(name, this.profile.installAnchor, runtimeVersion) };
+                    }
+                    catch (error) {
+                        targetError = managementError(error);
+                    }
+                }
+                const catalogMeta = offered === undefined ? {} : { meta: offered.meta };
+                if (offered !== undefined && !installed && !shipped) {
+                    bundles.push({ name, official, availability: 'missing', ...catalogMeta, ...target, enabled, installed, optional,
+                        removable: enabled, rows: [], overrides: [],
+                        ...targetError !== undefined ? { error: targetError } : enabled ? { error: { code: 'not-bundle' } } : {} });
+                    continue;
+                }
+                // Installation-owned copies remain protected even if a profile also declares their names.
                 const owned = installed && !shipped;
-                // A selection neither the profile nor the installation holds, such as a retired bundle, is removed by deselecting it.
                 const removable = owned || (enabled && !installed && !shipped);
                 const sourceOf = (packageName) => owned ? { source: dependencySpec(name, recorded[name], this.profile.dir, packageName) } : {};
                 const readOnlyReason = this.protectsManager(name) ? 'management-required' : undefined;
+                let availability = 'missing';
+                let version;
                 try {
                     const info = bundleManifest(name, this.profile.dir, this.profile.installAnchor);
+                    availability = shipped ? 'installation' : 'profile';
                     if (info === undefined) {
-                        if (enabled)
-                            bundles.push({ name, ...sourceOf(), enabled, installed, optional,
-                                removable: removable && readOnlyReason === undefined,
-                                ...(readOnlyReason === undefined ? {} : { readOnlyReason }), error: { code: 'not-bundle' }, rows: [], overrides: [] });
+                        if (enabled || offered !== undefined)
+                            bundles.push({ name, official, availability, ...catalogMeta, ...target,
+                                ...sourceOf(), enabled, installed, optional, removable: removable && readOnlyReason === undefined,
+                                ...(readOnlyReason === undefined ? {} : { readOnlyReason }), error: targetError ?? { code: 'not-bundle' }, rows: [], overrides: [] });
                         continue;
                     }
+                    version = info.version;
                     const compatibility = evaluatePluginCompatibility(info, exemptions);
                     if (compatibility !== undefined && !compatibility.exempted)
                         throw new ManagementFailure('incompatible-version', [incompatiblePlugin(compatibility)]);
                     const dir = resolveBundleDir('dsh', name, this.profile.installAnchor, this.profile.dir);
-                    const meta = readPluginMeta(info.name ?? name, pathToFileURL(join(dir, 'package.json')).href);
-                    bundles.push({ name, ...(info.version === undefined ? {} : { version: info.version }),
+                    const meta = offered?.meta ?? readPluginMeta(info.name ?? name, pathToFileURL(join(dir, 'package.json')).href);
+                    bundles.push({ name, official, availability, ...target, ...(version === undefined ? {} : { version }),
                         ...(info.description === undefined || info.description === '' ? {} : { description: info.description }),
                         ...meta === undefined ? {} : { meta },
                         ...sourceOf(info.name), enabled, installed, optional, removable: removable && readOnlyReason === undefined,
                         ...(readOnlyReason === undefined ? {} : { readOnlyReason }),
-                        ...this.declaredRows(name, info) });
+                        ...this.declaredRows(name, info),
+                        ...targetError === undefined ? {} : { error: targetError } });
                 }
                 catch (error) {
-                    if (enabled || installed) {
-                        bundles.push({ name, ...sourceOf(), enabled, installed, optional, removable: removable && readOnlyReason === undefined,
-                            ...(readOnlyReason === undefined ? {} : { readOnlyReason }), error: managementError(error), rows: [], overrides: [] });
+                    if (enabled || installed || optional || offered !== undefined) {
+                        bundles.push({ name, official, availability, ...catalogMeta, ...target, ...(version === undefined ? {} : { version }),
+                            ...sourceOf(), enabled, installed, optional, removable: removable && readOnlyReason === undefined,
+                            ...(readOnlyReason === undefined ? {} : { readOnlyReason }),
+                            error: targetError ?? managementError(error), rows: [], overrides: [] });
                     }
                 }
             }
@@ -479,7 +506,7 @@ let PluginManager = (() => {
          * `package.json` and `pnpm-lock.yaml` as they were; downloaded files can stay.
          * @param spec One package spec, including local paths relative to the invocation directory.
          * @param options Whether to activate the installed bundle (defaults to true), the request id a cancellation names,
-         * the pending build scripts to allow for this profile before pnpm runs, and the registry asked first.
+         * the pending build scripts to allow, whether to save an exact dependency, and the registry asked first.
          * @returns Package-manager diagnostics, the registries asked, and the observed activation outcome.
          */
         installBundle(spec, options) {
@@ -538,7 +565,7 @@ let PluginManager = (() => {
                             throw new InstallCancelledError();
                         result.registries.push(registry);
                         announce('installing', { registry, index: index + 1, total: plan.length });
-                        run = await this.runPnpm(['add', spec, ...registryArguments(registry)], control.abort.signal, requestId);
+                        run = await this.runPnpm(['add', spec, ...options?.saveExact === true ? ['--save-exact'] : [], ...registryArguments(registry)], control.abort.signal, requestId);
                         result.packageResult = run;
                         if (stopped())
                             throw new InstallCancelledError();
@@ -570,9 +597,9 @@ let PluginManager = (() => {
                     if (succeeded)
                         delete result.failedAt;
                     if (!succeeded) {
-                        // pnpm-workspace.yaml is not restored, so the names pnpm left undecided there can be offered for approval.
+                        // pnpm-workspace.yaml is not restored, so the names it left undecided, or reported as ignored, are offered for approval.
                         try {
-                            result.pendingBuilds = await readPendingBuilds(this.profile.dir);
+                            result.pendingBuilds = await recordPendingBuilds(this.profile.dir, run.output);
                         }
                         catch (error) {
                             this.ownerContext.logger.warn('Could not read pending build approvals after pnpm failed', error);
@@ -582,8 +609,11 @@ let PluginManager = (() => {
                     const after = readProfileManifest('dsh', this.profile.dir).dependencies ?? {};
                     const installed = Object.keys(after).filter(name => before[name] !== after[name]);
                     // Registry retries can retain the saved range after a partial installation.
-                    if (installed.length === 0)
-                        installed.push(...Object.keys(after).filter(name => spec === name || spec.startsWith(`${name}@`)));
+                    if (installed.length === 0) {
+                        const parsed = parsedForRegistry(spec);
+                        const localName = parsed.kind === 'path' ? readProfileManifest('dsh', parsed.path).name : undefined;
+                        installed.push(...Object.keys(after).filter(name => name === localName || spec === name || spec.startsWith(`${name}@`)));
+                    }
                     const target = installed[0];
                     if (installed.length !== 1 || target === undefined)
                         throw new ManagementFailure('ambiguous-install');
@@ -706,7 +736,8 @@ let PluginManager = (() => {
             const rows = [];
             const packages = this.ctx.get('pluginPackages');
             for (const row of flatten(composeEntries([patches.filter(item => item.insert !== undefined)]))) {
-                if (typeof row.id !== 'string' || typeof row.name !== 'string')
+                // Group rows are containers without a plugin inventory entry; their children carry the switches.
+                if (typeof row.id !== 'string' || typeof row.name !== 'string' || row.group === true)
                     continue;
                 const active = live.get(row.id);
                 const entryId = active?.entryId;

package/lib/types/official-install-target.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Offer a source checkout link or an exact published package version. Source installations are
+ * identified by the real CLI manifest and its unpacked workspace dependencies, including Desktop's
+ * development symlink. An incomplete checkout is an error, never a registry fallback.
+ * @param name - Official catalog package name.
+ * @param installAnchor - Running application's DSH package.json, possibly reached through a symlink.
+ * @param version - Running DSH version used by its release family.
+ * @returns An ordinary package-manager spec and its package version.
+ * @throws when a source installation lacks its workspace package, bundle patch, or built runtime.
+ */
+export declare function officialBundleInstallTarget(name: string, installAnchor: string, version: string): {
+    spec: string;
+    version: string;
+};
+//# sourceMappingURL=official-install-target.d.ts.map

package/lib/types/official-install-target.js

@@ -0,0 +1,54 @@
+/** Select Official bundle packages from the running installation without importing provider code. */
+import { existsSync, globSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { bundlePatchPaths } from '@deepseek-ai/dsh-app-boot';
+function manifestAt(file) {
+    return JSON.parse(readFileSync(file, 'utf8'));
+}
+/**
+ * Offer a source checkout link or an exact published package version. Source installations are
+ * identified by the real CLI manifest and its unpacked workspace dependencies, including Desktop's
+ * development symlink. An incomplete checkout is an error, never a registry fallback.
+ * @param name - Official catalog package name.
+ * @param installAnchor - Running application's DSH package.json, possibly reached through a symlink.
+ * @param version - Running DSH version used by its release family.
+ * @returns An ordinary package-manager spec and its package version.
+ * @throws when a source installation lacks its workspace package, bundle patch, or built runtime.
+ */
+export function officialBundleInstallTarget(name, installAnchor, version) {
+    const anchor = realpathSync(installAnchor);
+    const installation = manifestAt(anchor);
+    const source = installation.name === '@deepseek-ai/dsh'
+        && Object.values(installation.dependencies ?? {}).some(value => value.startsWith('workspace:'));
+    if (!source)
+        return { spec: `${name}@${version}`, version };
+    const root = resolve(dirname(anchor), '../..');
+    if (anchor !== join(root, 'apps', 'cli', 'package.json')
+        || !existsSync(join(root, 'package.json'))
+        || manifestAt(join(root, 'package.json')).name !== '@deepseek-ai/dsh-root') {
+        throw new Error(`Official bundle ${name}: source DSH installation ${anchor} requires its complete workspace checkout`);
+    }
+    const matches = globSync('packages/*/*/package.json', { cwd: root })
+        .map(file => ({ file: join(root, file), manifest: manifestAt(join(root, file)) }))
+        .filter(entry => entry.manifest.name === name);
+    const selected = matches[0];
+    if (matches.length !== 1 || selected === undefined) {
+        throw new Error(`Official bundle ${name}: expected one workspace package in ${root}, found ${matches.length}; restore the checkout and run pnpm install`);
+    }
+    const { file, manifest } = selected;
+    const directory = realpathSync(dirname(file));
+    if (manifest.version !== version || manifest.private === true || manifest.dsh?.bundle === undefined) {
+        throw new Error(`Official bundle ${name}: ${file} must declare a public bundle at DSH version ${version}`);
+    }
+    const main = typeof manifest.main === 'string' ? resolve(directory, manifest.main) : undefined;
+    if (main === undefined || !existsSync(main) || !statSync(main).isFile()) {
+        throw new Error(`Official bundle ${name}: built runtime is missing in ${directory}; run pnpm install and pnpm run build in ${root}`);
+    }
+    for (const patch of bundlePatchPaths(directory, manifest.dsh.bundle)) {
+        if (!existsSync(patch) || !statSync(patch).isFile()) {
+            throw new Error(`Official bundle ${name}: bundle patch ${patch} is missing; restore the checkout`);
+        }
+    }
+    return { spec: `link:${directory}`, version };
+}
+//# sourceMappingURL=official-install-target.js.map

package/lib/types/tools.js

@@ -14,7 +14,7 @@ export function apply(ctx) {
         description: 'List plugins or bundles in the current profile, enable or disable them, install a bundle, or remove an installed bundle. Every action requires danger-full-access permission or approval for this call. Approval does not change the session permission mode. Changes affect every session in this profile. List first to obtain exact identifiers. Package installation can execute allowed build scripts. Live profiles apply changes immediately; startup profiles require restart. Incompatible DSH peer dependencies block installation and activation. Version exemptions risk crashes and data loss: warn the user and obtain explicit permission for the exact plugin and runtime versions before granting one.',
         parameters: {
             action: { type: 'string', required: true, enum: ['list_plugins', 'list_bundles', 'set_plugin', 'set_bundle', 'install_bundle', 'remove_bundle', 'list_version_exemptions', 'set_version_exemption'], description: 'Management operation.' },
-            target: { type: 'string', description: 'Plugin entry id, bundle package name, or installation spec, according to action.' },
+            target: { type: 'string', description: 'Plugin entry id, bundle package name, or installation spec, according to action. For an Official catalog entry, pass list_bundles installTarget.spec to install_bundle.' },
             enabled: { type: 'boolean', description: 'Required for set operations; defaults to true for installation. For set_version_exemption, true grants and false revokes.' },
             runtimeVersion: { type: 'string', description: 'For set_version_exemption: exact DSH version from list_version_exemptions. Target must be the manifest package-name@version, not an alias or version range.' },
             acceptRisk: { type: 'boolean', description: 'For granting an exemption: true only after warning the user about possible crashes and data loss and receiving explicit permission for this exact plugin/runtime pair. General installation permission is not enough.' },

package/lib/types/types.d.ts

@@ -40,9 +40,18 @@ export interface BundleRowInfo {
     /** The Loader entry carrying this row, when exactly one live entry has its id. */
     entryId?: PluginEntryId;
 }
-/** One installed or installation-provided bundle. */
+/** One shipped, profile-installed, or discoverable on-demand bundle. */
 export interface BundleInfo {
     name: string;
+    /** Project-maintained shipped optional bundle or on-demand catalog entry, independent of installation and selection. */
+    official: boolean;
+    /** Readable package location; on-demand catalog entries exclude undeclared transitive copies, and declared files may be missing. */
+    availability: 'installation' | 'profile' | 'missing';
+    /** Exact released Host version or same-checkout development link offered for an on-demand catalog entry. */
+    installTarget?: {
+        spec: string;
+        version: string;
+    };
     version?: string;
     /** Local display text with available translations or literal fallbacks, or a metadata diagnostic. */
     meta?: PluginLocalizedMeta;
@@ -50,7 +59,7 @@ export interface BundleInfo {
     description?: string;
     /** Selected in the profile manifest; a load error means its layer was skipped. */
     enabled: boolean;
-    /** Whether the profile's own dependencies hold the package; false for a bundle the dsh installation supplies. */
+    /** Whether the profile declares this dependency; availability separately reports whether its files can be read. */
     installed: boolean;
     /**
      * Present for a profile dependency the installation does not also supply: the spec `pnpm add` accepts, with local
@@ -128,6 +137,8 @@ export type PluginInstallRequestId = Branded<'PluginInstallRequestId'>;
 /** Bundle installation defaults to activation; callers that offer cancellation supply their request id. */
 export interface InstallBundleOptions {
     enabled?: boolean;
+    /** Save the resolved dependency version without a range; applies to any bundle installation. */
+    saveExact?: boolean;
     requestId?: PluginInstallRequestId;
     /** Explicitly allow these pending packages' scripts for this profile, then install; a name no longer pending refuses the call. */
     approvedBuilds?: string[];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-plugin-manager",
   "description": "Current-profile plugin and bundle management shared by dsh CLI, Web and agent tools",
-  "version": "0.2.1-alpha.1",
+  "version": "0.2.1-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -56,26 +56,26 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "execa": "^10.0.0",
+    "@deepseek-ai/dsh-app-boot": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-atomic-write": "0.2.1-alpha.2",
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.1",
+    "execa": "^10.0.1",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@deepseek-ai/dsh-app-boot": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-atomic-write": "0.2.1-alpha.1",
-    "@deepseek-ai/schemastery": "~3.18.5-alpha.1",
-    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.1"
+    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.2"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "~4.0.5-alpha.1",
     "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1",
-    "@deepseek-ai/dsh-host-plugin-inventory": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-tools": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-hmr": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-brand": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-user-approval": "0.2.1-alpha.1"
+    "@deepseek-ai/dsh-host-plugin-inventory": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-tools": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-hmr": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-alpha.2"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-hmr": {
@@ -87,22 +87,22 @@
   },
   "devDependencies": {
     "chokidar": "^4.0.3",
-    "@deepseek-ai/dsh-package-manifest": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-package-manifest": "0.2.1-alpha.2",
     "@deepseek-ai/cordis": "~4.0.5-alpha.1",
     "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1",
-    "@deepseek-ai/dsh-host-plugin-inventory": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-tools": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-hmr": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-host-plugin-inventory": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-tools": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-hmr": "0.2.1-alpha.2",
     "@deepseek-ai/cordis-plugin-timer": "~1.1.7-alpha.1",
-    "@deepseek-ai/dsh-brand": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-agent": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-user-approval": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.1"
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-alpha.2"
   }
 }