@deepseek-insight/dsi 0.5.38 → 0.6.0

package/.agents/skills/dsi-plugin-rack/SKILL.md

@@ -0,0 +1,27 @@
+# dsi-plugin-rack
+
+Install and uninstall dsh plugins from the plugins reference (~/.dsi/resources/plugins-reff.md), cached at ~/.dsi/resources/pgr-cache.json. Implements the ADR "The Plugin Rack" (dev/architectural-decission/2026-09/, 2026-09-27).
+
+## Engine
+
+`rack.mjs` — plain Node, JSON on stdout, every payload carries `v: 1`.
+
+```bash
+# build snapshot (reuses existing unless --reload)
+node rack.mjs refresh [--reload] [--reff PATH] [--cache PATH] [--manifest PATH] [--profile P] [--dsh-cmd CMD]
+
+# dsh-delegated install / remove (D3: never hand-edit the profile)
+node rack.mjs apply install 1            # numbers or ids; spec = git+<repo>.git
+node rack.mjs apply remove dsh-rules-paths
+
+node rack.mjs snapshot-status
+```
+
+## Rules (do not violate)
+
+- **dsh is the writer.** Every install/remove goes through `dsh plugin --profile <p> add|remove` — the profile manifest, its lock, and reconcilePlugins are dsh's. Never write ~/.dsh/profiles/* by hand (D3).
+- **The manifest's dependencies are the install authority (D4, amended 2026-09-27).** pnpm records git plugins under the package's OWN scoped name (`@owner/name`), not the reff id — matching is by repo identity (exact id, or the owner/name tail in the dep resolution), and the recorded key is captured as `pkg` and IS the remove target. Bundle entries are a derived hint, never the gate; after dsh reports success the engine re-reads the manifest and DISTRUSTS success it cannot see recorded.
+- **Snapshot-first (D3):** refresh reuses an existing cache; only --reload rebuilds. Never delete the cache to force a rebuild.
+- **Gates surface, never auto-clear (D6):** allowBuilds and version-approval failures relay dsh's own diagnostics verbatim; the operator unlocks, then retries.
+- **Uninstall only what the manifest records AND the reff lists** — hand-added packages (e.g. the OV plugin) are invisible to the rack.
+- Tests MUST use --reff + --cache + --manifest + --dsh-cmd fixture overrides — never the real home directories.

package/.agents/skills/dsi-plugin-rack/rack.mjs

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+/**
+ * dsi-plugin-rack — the rack engine (ADR "The Plugin Rack" 2026-09-27, D2–D6).
+ * Plain Node, JSON on stdout, every payload carries v: 1.
+ *
+ *   rack.mjs refresh [--reload] [--reff PATH] [--cache PATH] [--manifest PATH]
+ *                    [--profile P] [--dsh-cmd CMD]
+ *   rack.mjs apply install|remove <n|id>...
+ *   rack.mjs snapshot-status
+ *
+ * Reading is ours (reff parse, snapshot); WRITING is dsh's — apply shells out
+ * to `dsh plugin --profile <p> add|remove` and never hand-edits the profile
+ * manifest (D3). The manifest is provenance's state home (D4): installed =
+ * dependencies[id] AND dsh.profile.bundles includes id. Gates surface, they
+ * never auto-clear (D6).
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const CACHE_VERSION = 1;
+
+function parseArgs(argv) {
+	const out = { command: argv[0], reload: false, reff: null, cache: null, manifest: null, profile: process.env.DSH_PROFILE ?? 'web', dshCmd: null, targets: [] };
+	for (let i = 1; i < argv.length; i++) {
+		const a = argv[i];
+		if (a === '--reload') out.reload = true;
+		else if (a === '--reff') out.reff = argv[++i];
+		else if (a === '--cache') out.cache = argv[++i];
+		else if (a === '--manifest') out.manifest = argv[++i];
+		else if (a === '--profile') out.profile = argv[++i];
+		else if (a === '--dsh-cmd') out.dshCmd = argv[++i];
+		else out.targets.push(a);
+	}
+	return out;
+}
+
+/** plugins-reff.md line grammar: `1. [name](repo-url) - [author](author-url)`
+ *  (author side optional). One line IS one plugin (ADR §2.1). */
+export function parseReff(text) {
+	const plugins = [];
+	const warnings = [];
+	const re = /^\s*\d+\.\s+\[([^\]]+)\]\(([^)\s]+)\)(?:\s+-\s+\[([^\]]+)\]\(([^)\s]+)\))?\s*$/;
+	for (const line of text.split(/\r?\n/)) {
+		if (/^\s*\d+\.\s+\[/.test(line) && !re.test(line)) {
+			warnings.push({ code: 'reff-malformed-line', detail: line.trim() });
+			continue;
+		}
+		const m = line.match(re);
+		if (m) plugins.push({ id: m[1], repo: m[2], author: m[3] ?? null, authorUrl: m[4] ?? null });
+	}
+	if (plugins.length === 0) warnings.push({ code: 'reff-empty', detail: 'no plugin lines found' });
+	return { plugins, warnings };
+}
+
+/** D4 (amended 2026-09-27): the manifest's DEPENDENCIES are the install
+ *  authority. pnpm records a git plugin under the package's REAL name from
+ *  its own package.json (e.g. '@temoa/dsh-rules-paths'), not the reff id -
+ *  so matching goes by the repo's owner/name tail found in the dep's
+ *  resolution (e.g. 'github:Temoa/dsh-rules-paths'), with the exact reff id
+ *  as the fallback. Bundle entries are dsh's own reconcile business and MAY
+ *  lag or be absent for git plugins - they are a derived hint, never the
+ *  install gate. Returns the recorded dep key (the remove target) or null. */
+export function findDepKey(manifest, id, repo) {
+	if (manifest.deps[id] !== undefined) return id;
+	const tail = String(repo || '').replace(/\\.git$/, '').replace(/\/+$/, '').split('/').slice(-2).join('/');
+	if (!tail) return null;
+	for (const [key, value] of Object.entries(manifest.deps)) {
+		if (typeof value === 'string' && value.includes(tail)) return key;
+	}
+	return null;
+}
+
+/**
+ * D4: the profile manifest is the install authority.
+ */
+export function readManifest(path) {
+	if (!existsSync(path)) return { deps: {}, bundles: [], missing: true };
+	const doc = JSON.parse(readFileSync(path, 'utf8'));
+	return {
+		deps: (doc && typeof doc === 'object' && doc.dependencies) || {},
+		bundles: (doc?.dsh?.profile?.bundles) ?? [],
+		missing: false
+	};
+}
+
+export function isInstalled(manifest, id, repo) {
+	return findDepKey(manifest, id, repo) !== null;
+}
+
+export function buildSnapshot({ reffPath, manifestPath, profile }) {
+	const warnings = [];
+	if (!existsSync(reffPath)) warnings.push({ code: 'reff-missing', detail: reffPath });
+	const parsed = existsSync(reffPath) ? parseReff(readFileSync(reffPath, 'utf8')) : { plugins: [], warnings: [] };
+	warnings.push(...parsed.warnings);
+	const manifest = readManifest(manifestPath);
+	if (manifest.missing) warnings.push({ code: 'manifest-missing', detail: manifestPath });
+	return {
+		snapshot: {
+			v: CACHE_VERSION,
+			generatedAt: new Date().toISOString(),
+			profile,
+			plugins: parsed.plugins.map((p, i) => {
+				const depKey = findDepKey(manifest, p.id, p.repo);
+				return {
+					n: String(i + 1),
+					id: p.id,
+					repo: p.repo,
+					author: p.author,
+					...(p.authorUrl ? { authorUrl: p.authorUrl } : {}),
+					installed: depKey !== null,
+					// The recorded dependency name (pnpm's truth) - the remove target.
+					pkg: depKey,
+					bundle: (depKey !== null && manifest.bundles.includes(depKey)) || null
+				};
+			})
+		},
+		warnings
+	};
+}
+
+/** D3: the reff URL becomes the dsh add spec: git+<url>.git (append .git
+ *  only when absent — the operator's line stays the single source). */
+export function toInstallSpec(repo) {
+	return 'git+' + repo + (repo.endsWith('.git') ? '' : '.git');
+}
+
+function resolveDshCommand(flags) {
+	if (flags.dshCmd) return flags.dshCmd;
+	if (process.env.DSH_WEB_CMD) return process.env.DSH_WEB_CMD;
+	return 'npx --yes @deepseek-ai/dsh@latest';
+}
+
+/** D3/D6: run dsh, relay its own diagnostics verbatim on failure. */
+export function runDsh(flags, action, spec) {
+	const cmd = resolveDshCommand(flags) + ' plugin --profile ' + flags.profile + ' ' + action + ' ' + spec;
+	const r = spawnSync('/bin/sh', ['-c', cmd], { encoding: 'utf8' });
+	if (r.error) return { ok: false, error: String(r.error.message ?? r.error) };
+	if (r.status !== 0) {
+		const tail = ((r.stderr ?? '') + (r.stdout ?? '')).trim();
+		return { ok: false, error: 'dsh plugin ' + action + ' failed (exit ' + (r.status ?? 1) + ')' + (tail ? ': ' + tail.slice(-800) : '') };
+	}
+	return { ok: true };
+}
+
+function loadSnapshot(cachePath) {
+	const snap = JSON.parse(readFileSync(cachePath, 'utf8'));
+	if (snap.v !== CACHE_VERSION) throw new Error('rack cache wire version mismatch: v=' + snap.v);
+	return snap;
+}
+
+function main() {
+	const args = parseArgs(process.argv.slice(2));
+	const reffPath = resolve(args.reff ?? join(homedir(), '.dsi/resources/plugins-reff.md'));
+	const cachePath = resolve(args.cache ?? join(homedir(), '.dsi/resources/pgr-cache.json'));
+	const manifestPath = resolve(args.manifest ?? join(homedir(), '.dsh/profiles', args.profile, 'package.json'));
+
+	if (args.command === 'snapshot-status') {
+		console.log(JSON.stringify({ v: CACHE_VERSION, ok: true, present: existsSync(cachePath), path: cachePath }));
+		return;
+	}
+
+	if (args.command === 'refresh') {
+		if (!args.reload && existsSync(cachePath)) {
+			console.log(JSON.stringify({ v: CACHE_VERSION, ok: true, reused: true, snapshot: loadSnapshot(cachePath) }));
+			return;
+		}
+		const { snapshot, warnings } = buildSnapshot({ reffPath, manifestPath, profile: args.profile });
+		mkdirSync(dirname(cachePath), { recursive: true });
+		writeFileSync(cachePath, JSON.stringify(snapshot, null, 2));
+		console.log(JSON.stringify({ v: CACHE_VERSION, ok: true, snapshot, ...(warnings.length ? { errors: warnings.map((w) => w.code + ': ' + w.detail) } : {}) }));
+		return;
+	}
+
+	if (args.command === 'apply') {
+		const action = args.targets.shift();
+		const targets = args.targets;
+		if (action !== 'install' && action !== 'remove') return fail(['apply needs install|remove and at least one target']);
+		if (targets.length === 0) return fail(['apply ' + action + ' needs at least one target']);
+		if (!existsSync(cachePath)) return fail(['snapshot missing, run refresh first: ' + cachePath]);
+		const snap = loadSnapshot(cachePath);
+		const results = [];
+		for (const t of targets) {
+			const plugin = snap.plugins.find((p) => p.n === t || p.id === t);
+			if (!plugin) { results.push({ n: t, ok: false, error: 'not on the rack: ' + t }); continue; }
+			if (action === 'install') {
+				if (plugin.installed) { results.push({ n: plugin.n, id: plugin.id, ok: true, already: true }); continue; }
+				const r = runDsh(args, 'add', toInstallSpec(plugin.repo));
+				if (!r.ok) { results.push({ n: plugin.n, id: plugin.id, ok: false, error: r.error }); continue; }
+				const manifest = readManifest(manifestPath);
+				const depKey = findDepKey(manifest, plugin.id, plugin.repo);
+				if (!depKey) {
+					results.push({ n: plugin.n, id: plugin.id, ok: false, error: 'dsh reported success but the manifest does not record a dependency matching ' + plugin.repo + ' (D4 authority)' });
+					continue;
+				}
+				plugin.installed = true;
+				plugin.pkg = depKey;
+				plugin.bundle = manifest.bundles.includes(depKey) || null;
+				results.push({ n: plugin.n, id: plugin.id, pkg: depKey, ok: true });
+			} else {
+				if (!plugin.installed) { results.push({ n: plugin.n, id: plugin.id, ok: false, error: 'not installed: ' + plugin.id }); continue; }
+				// Remove targets the RECORDED dependency name (pnpm's truth),
+				// falling back to the reff id for caches written before D4's
+				// amendment - then refresh heals the manifest reconciliation.
+				const manifestNow = readManifest(manifestPath);
+				const depKey = findDepKey(manifestNow, plugin.pkg ?? plugin.id, plugin.repo) ?? plugin.pkg ?? plugin.id;
+				const r = runDsh(args, 'remove', depKey);
+				if (!r.ok) { results.push({ n: plugin.n, id: plugin.id, ok: false, error: r.error }); continue; }
+				const manifest = readManifest(manifestPath);
+				if (findDepKey(manifest, plugin.id, plugin.repo) !== null) {
+					results.push({ n: plugin.n, id: plugin.id, ok: false, error: 'dsh reported success but the manifest still records ' + plugin.id + ' (D4 authority)' });
+					continue;
+				}
+				plugin.installed = false;
+				plugin.bundle = null;
+				plugin.pkg = null;
+				results.push({ n: plugin.n, id: plugin.id, ok: true });
+			}
+		}
+		// Flip flags ONLY after every dsh call so a mid-apply failure never
+		// leaves the cache half-written (shelf apply precedent).
+		if (results.some((x) => x.ok && !x.already)) writeFileSync(cachePath, JSON.stringify(snap, null, 2));
+		const failed = results.filter((x) => !x.ok);
+		console.log(JSON.stringify({ v: CACHE_VERSION, ok: failed.length === 0, results, ...(failed.length ? { errors: failed.map((f) => f.id + ': ' + f.error) } : {}) }));
+		return;
+	}
+
+	fail(['unknown command: ' + args.command + ' (use refresh | apply | snapshot-status)']);
+}
+
+function fail(errors) {
+	console.log(JSON.stringify({ v: CACHE_VERSION, ok: false, errors }));
+	process.exit(1);
+}
+
+main();

package/README.md

@@ -6,12 +6,36 @@
 
 > A `Prompt Input` with **Slash-command(/)**, **Macros(!)** and **Auto-complete(?)**. Prompt-manager you can search it and to manage macros & autocomplete; user-prompts worth keeping is one-click-away tobe reuse.
 
-Slash commands are available to execute various operations:
+## Slash commands are available to execute various operations:
 - `/dsi-terminal` — Open a terminal session
 - `/dsi-prompts` — Open prompt manager
+- `/dsi-plugins` — Open plugin manager
 - `/dsi-skills` — Open skill manager
-  
-Included skills for:
+
+### Autocomplete (`?`)
+
+Type `?` followed by a few letters, for example `?deploy`, and a small list appears showing the prompts you have saved before, best match first. Choosing one puts its text into the input, so you can read it and change a detail before sending. It keeps you from typing the same long prompts over and over, and from trying to remember where you saved them.
+
+### Macros (`!`)
+
+`!` works the same way, but choosing a prompt runs it right away instead of filling the input. Save the prompts you use every day as macros, and routines like a code review or a session summary become a single short line. Use `?` when you want to look first, and `!` when you already know what you want.
+
+### Prompt Manager (`/dsi-prompts`)
+The prompt manager is where your saved prompts live, so the `?` and `!` tricks above always have something to find. Search across everything you have kept, open a prompt to tweak its wording, flag the ones you use daily as macros, and send a keeper straight back into the input with one click. A prompt you were proud of today becomes a shortcut tomorrow.
+
+### Plugin Manager (`/dsi-plugins`)
+Plugins add whole features to DSI — the plugin manager shows what is on the rack. A simple install tab lists what you can add, uninstall lists what is already on, and each row shows the plugin's state so you always know what is running. You never touch a config file to add or remove one.
+
+### Skill Manager (`/dsi-skills`)
+Skills are the instructions your agents can follow, and this panel is their shelf. Browse what is installed group by group, tick the ones you want gone, and anything you remove can come back later. If a skill stopped being useful, it is two clicks away from being off the shelf.
+
+### Terminal (`/dsi-terminal`)
+One terminal is rarely enough when agents are working, so this one opens several, each in its own tab. Open a tab per task, keep a long build running in the background, and your tabs survive a page refresh — come back and they are still there. When a session has ended, the tab tells you instead of leaving you to guess.
+
+### Workspace explorer
+The workspace explorer is DSI's window into the folder your agents are working in. Click the workspace chip at the top of a conversation — or a file name in one of the assistant's replies — and the panel opens with that file ready. A directory tree shows the whole project, every opened file keeps its own tab so several can sit side by side, and files your agents have changed are marked in the tree, so the work is visible at a glance. One click turns any tab into a before-and-after diff when you want to see exactly what was edited.
+
+## Included skills for:
 - Coding agents: `/dsi-adr`, `/dsi-spec`, `/dsi-task`
 - Integration helper for [OpenViking](https://openviking.ai/): `/dsi-ov-setup` 
 

package/bin/dsi.mjs

@@ -28,6 +28,7 @@ import { fileURLToPath } from 'node:url';
 import { parse, stringify } from 'yaml';
 
 import { mirrorSkills } from './lib/mirror-skills.mjs';
+import { dshLauncherCmd, parsePluginArgs } from './lib/plugin-chain.mjs';
 
 // Layman-facing help: wrapped near 76 columns, continuation lines indented,
 // the recommended one-liner first. --zai is optional on purpose — no GLM
@@ -61,6 +62,10 @@ const USAGE = [
 	'      --ov    install the OpenViking memory plugin into the active dsh',
 	'              profile (dsh plugin ... add). Client only — the memory',
 	'              server itself is set up separately (dsi-ov-setup skill)',
+	'      --plugin <add|remove> <pkg> [--profile <p>]',
+	'              run the dsh plugin command, then bounce the floor:',
+	'              killOrphans + token re-sync + re-serve (The Plugin Rack',
+	'              ADR D5). --plugin-restart is the bounce alone.',
 	'',
 	'  Ports: `dsi dsh --sync` serves the DSI page on 5174 and opens your',
 	'  browser there. With --dev the Vite dev server takes 5175 instead',
@@ -80,7 +85,11 @@ const USAGE = [
 	'                   install the OpenViking memory plugin into the active',
 	'                   dsh profile (idempotent; alone, without --sync)',
 	'      dsi dsh --sync-kills',
-	'                   kill orphaned dsh/dsi processes left by an earlier run'
+	'                   kill orphaned dsh/dsi processes left by an earlier run',
+	'      dsi dsh --plugin add git+https://github.com/Temoa/dsh-rules-paths.git',
+	'                   install via dsh plugin, then restart the pair (The',
+	'                   Plugin Rack ADR D5); --plugin-restart bounces alone',
+	'      dsi dsh --plugin remove <pkg>'
 ].join('\n');
 
 const command = process.argv[2];
@@ -187,6 +196,38 @@ if (command === 'dsh') {
 			rest.filter((arg) => arg !== '--zai' && arg !== '--dev' && arg !== '--ov'),
 			withDev
 		);
+	} else if (flag === '--plugin' || flag === '--plugin-restart') {
+		// The Plugin Rack ADR (2026-09-27, D3/D5): the dsh CLI is the writer,
+		// dsi owns the bounce. Install/remove delegates to the launcher rule
+		// (DSH_WEB_CMD override, else the pinned npx dsh), fails loud, and
+		// ONLY a successful apply reaches the restart chain: killOrphans,
+		// then the synced pair (dsh web + token re-sync + DSI re-serve).
+		const parsed = parsePluginArgs(process.argv.slice(3), {
+			envProfile: process.env.DSH_PROFILE ?? 'web'
+		});
+		if (parsed === null) {
+			console.error(`dsi dsh: unknown flag "${flag}"`);
+			console.error(USAGE);
+			process.exit(64);
+		}
+		if ('error' in parsed) {
+			console.error('dsi dsh: ' + parsed.error);
+			process.exit(64);
+		}
+		if (parsed.action !== 'restart') {
+			const cmd = dshLauncherCmd(parsed.profile, parsed.action, parsed.pkg, dshWebVersion());
+			console.log(`dsi dsh: plugin ${parsed.action} into the ${parsed.profile} profile (${cmd})`);
+			const result = spawnSync('/bin/sh', ['-c', cmd], { stdio: 'inherit' });
+			if (result.error !== undefined) throw result.error;
+			const code = result.status ?? 1;
+			if (code !== 0) {
+				console.error(`dsi dsh: plugin ${parsed.action} failed (exit ${code}) — nothing bounced; fix the cause above, then re-run`);
+				process.exit(code);
+			}
+		}
+		console.log('dsi dsh: bouncing the floor (orphan sweep + synced pair re-run)');
+		killOrphans();
+		runSyncedPair([]);
 	} else if (flag === '--sync-kills') {
 		killOrphans();
 		process.exit(0);

package/bin/lib/plugin-chain.mjs

@@ -0,0 +1,62 @@
+/**
+ * plugin-chain — the testable half of 'dsi dsh --plugin' (The Plugin Rack
+ * ADR 2026-09-27, D3/D5): argument validation and the dsh launcher rule
+ * (DSH_WEB_CMD override, else the pinned published dsh via npx — the same
+ * rule runOvPlugin established). The impure half (spawnSync, killOrphans,
+ * runSyncedPair) stays in dsi.mjs; this module never touches a process.
+ */
+
+/**
+ * Parse 'dsi dsh --plugin <add|remove> <pkg> [--profile <p>]' arguments.
+ *
+ * @param {string[]} argv
+ * @param {{ envProfile?: string }} [options]
+ * @returns {null | { error: string } | { action: 'add' | 'remove' | 'restart', pkg: string, profile: string }}
+ *   null = argv is not a --plugin invocation (the caller falls through to
+ *   its own unknown-flag error); { error } = a --plugin invocation with a
+ *   bad shape (usage exit 64).
+ */
+export function parsePluginArgs(argv, options = {}) {
+	const envProfile = options.envProfile ?? 'web';
+	const [flag] = argv;
+	if (flag !== '--plugin' && flag !== '--plugin-restart') return null;
+	const rest = argv.slice(1);
+	if (flag === '--plugin-restart') {
+		if (rest.length !== 0) return { error: 'usage: dsi dsh --plugin-restart' };
+		return { action: 'restart', pkg: '', profile: envProfile };
+	}
+	const [action, pkg, ...tail] = rest;
+	if (action !== 'add' && action !== 'remove') {
+		return { error: 'usage: dsi dsh --plugin <add|remove> <pkg> [--profile <p>]' };
+	}
+	if (!pkg || pkg.startsWith('-')) {
+		return { error: 'usage: dsi dsh --plugin <add|remove> <pkg> [--profile <p>]' };
+	}
+	let profile = envProfile;
+	for (let i = 0; i < tail.length; i++) {
+		if (tail[i] === '--profile') {
+			const value = tail[i + 1];
+			if (!value || value.startsWith('-')) return { error: 'usage: --profile needs a profile name' };
+			profile = value;
+			i++;
+		} else {
+			return { error: 'unexpected argument: ' + tail[i] };
+		}
+	}
+	return { action, pkg, profile };
+}
+
+/**
+ * The dsh launcher rule (runOvPlugin's, generalized): DSH_WEB_CMD override,
+ * else the pinned published dsh via npx. The webVersion pin comes from the
+ * caller (dsi.mjs owns package.json reads).
+ *
+ * @param {string} profile
+ * @param {'add' | 'remove'} action
+ * @param {string} pkg
+ * @param {string} webVersion
+ */
+export function dshLauncherCmd(profile, action, pkg, webVersion) {
+	const base = process.env.DSH_WEB_CMD || 'npx --yes @deepseek-ai/dsh@' + (webVersion || 'latest');
+	return base + ' plugin --profile ' + profile + ' ' + action + ' ' + pkg;
+}