@sparkelf/dsh-plus 0.1.0-rc.10

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/bundle/plus/README.md
+README.md: 627a5b3d23b642d2c7b92926133435ae82ae2c15
+README.zh.md: 1eaced04cf003ed2ef4485e6dedfcf5cfb4656ca

package/README.md

@@ -0,0 +1,73 @@
+---
+description: "The npm-installable DeepSeek Harness Plus profile composition and explicit official-source materializer."
+kind: "package-bundle"
+---
+
+# @sparkelf/dsh-plus
+
+English | [中文](README.zh.md)
+
+## Summary
+
+This distribution composes official `@deepseek-ai/dsh-base` and `@deepseek-ai/dsh-web-app` with the selected external sidebar, mobile bridge, plugin market, GenUI package, five complete Plus capability packages, and nine independent patch packages. It owns only ordered composition, minimum compatibility metadata, dependency closure, explicit materialization, and the credential-free deployment lock; capability behavior and patch payloads stay in their owning packages.
+
+## Table of Contents
+
+- [Use this package](#use-this-package)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## Use this package
+
+Install and materialize Plus without Desktop or the tray:
+
+```bash
+dsh plugin --profile plus add @sparkelf/dsh-plus
+dsh plugin --profile plus exec dsh-plus apply --dsh-root /path/to/official-dsh
+dsh --profile plus
+```
+
+The explicit apply step requires official revision `cd5ef8148158c3a752a658978873241fdf8e2bbc`, materializes every selected runtime package as a profile-direct dependency, applies all pending source payloads together, configures exact npm patches, removes retired Plus-owned entries, and writes `.dsh-plus/patchset.lock.json` with mode `0600`. It installs `dsh-better-sidebar@0.17.1` at the profile root, explicitly allows only its `node-pty` native build, and links the profile's `@deepseek-ai` scope to the exact official source dependencies. Version conflicts and source mismatches fail before profile installation or source mutation. The package has no install lifecycle script.
+
+Official DSH supplies onboarding, Workspace selection, Session export, Turn folding, and the base image path. The external `@changfenhuang/dsh-genui` bundle owns generated UI, including inline interactive charts emitted by the model as `dsh-ui`. The temporary GenUI streaming EChart patch targets only `0.9.6` and retires after [upstream PR #87](https://github.com/omdsh-dev/dsh-genui/pull/87) ships in npm and the real inline-chart path passes. DataOps and Document Attachments mount only when their endpoint environment variables exist. Agent Teams is excluded because the official packages are private experimental workspaces and shipped profiles disable them.
+
+-----
+
+<a id="model-experience"></a>
+## Model Experience
+
+### Profile composition
+
+#### What the model sees
+
+Nothing directly. `@sparkelf/dsh-plus` registers no tool, prompt section, model-facing Session event, or provider content; each selected capability owns its own model-visible behavior.
+
+#### Token effect
+
+Zero by itself. Token use comes only from the capability and official packages selected by the profile.
+
+#### KV Cache effect
+
+Independent by itself. The profile changes a request prefix only when one of its selected packages contributes or removes model-visible content.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- **Exact source target**: source payloads apply only to the recorded official revision; another source tree fails loudly, and the distribution provides no accepted-fork or fuzzy-apply fallback.
+
+<a id="dev-note"></a>
+### Dev Note
+
+<details>
+<summary>Working context for maintainers, click to expand</summary>
+
+This Dev Note is working context for maintainers; shipped behavior, limits, and rationale live in the sections above, the package code, and the linked Agent Note.
+
+- The [distribution Agent Note](../../../.agents/notes/proposed/architecture/2026-08-29-ranged-plus-patchset-distribution.md) owns package forms, inventory, materialization, and deletion rules; `src/apply.ts` and `cordis.patch.yml` own the executable profile behavior.
+
+</details>

package/README.zh.md

@@ -0,0 +1,73 @@
+---
+description: "可通过npm安装的DeepSeek Harness Plus profile composition及explicit official-source materializer。"
+kind: "package-bundle"
+---
+
+# @sparkelf/dsh-plus
+
+[English](README.md) | 中文
+
+## 概述
+
+该distribution把official `@deepseek-ai/dsh-base`及`@deepseek-ai/dsh-web-app`与selected external sidebar、mobile bridge、plugin market、GenUI package、五个完整Plus capability packages及九个independent patch packages组合起来。它只持有ordered composition、minimum compatibility metadata、dependency closure、explicit materialization及credential-free deployment lock；capability behavior和patch payloads仍属于各自package。
+
+## 目录
+
+- [使用此软件包](#use-this-package)
+- [模型体验](#model-experience)
+- [已知限制和延期工作](#known-limitations-and-deferred-work)
+- [开发备注](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## 使用此软件包
+
+无需Desktop或tray即可安装并materialize Plus：
+
+```bash
+dsh plugin --profile plus add @sparkelf/dsh-plus
+dsh plugin --profile plus exec dsh-plus apply --dsh-root /path/to/official-dsh
+dsh --profile plus
+```
+
+explicit apply步骤要求official revision `cd5ef8148158c3a752a658978873241fdf8e2bbc`，把每个selected runtime package materialize为profile-direct dependency，一次应用全部pending source payloads，配置exact npm patches，删除retired Plus-owned entries，并以`0600` mode写入`.dsh-plus/patchset.lock.json`。它在profile root安装`dsh-better-sidebar@0.17.1`，只显式允许其`node-pty` native build，并把profile的`@deepseek-ai` scope链接到exact official source dependencies。version conflict和source mismatch会在profile installation或source mutation前失败。该package没有install lifecycle script。
+
+Official DSH提供onboarding、Workspace selection、Session export、Turn folding及base image path。External `@changfenhuang/dsh-genui` bundle拥有generated UI，包括模型以`dsh-ui`输出的inline interactive charts。Temporary GenUI streaming EChart patch只target `0.9.6`；[upstream PR #87](https://github.com/omdsh-dev/dsh-genui/pull/87)进入npm且真实inline-chart path通过后退役。DataOps和Document Attachments仅在对应endpoint environment variables存在时mount。Agent Teams被排除，因为official packages属于private experimental workspaces且shipped profiles会禁用它们。
+
+-----
+
+<a id="model-experience"></a>
+## 模型体验
+
+### Profile composition
+
+#### 模型看到什么
+
+没有direct内容。`@sparkelf/dsh-plus`不注册tool、prompt section、model-facing Session event或provider content；每个selected capability持有自己的model-visible behavior。
+
+#### Token 影响
+
+自身为零。Token use只来自profile选择的capability和official packages。
+
+#### KV Cache 影响
+
+自身独立。仅当selected package贡献或移除model-visible content时，该profile才会改变request prefix。
+
+## 已知限制和延期工作
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- **Exact source target**：source payloads只应用于recorded official revision；其他source tree会明确失败，distribution不提供accepted-fork或fuzzy-apply fallback。
+
+<a id="dev-note"></a>
+### 开发备注
+
+<details>
+<summary>维护者工作上下文，点击展开</summary>
+
+该开发备注是maintainer working context；shipped behavior、limits及rationale以以上sections、package code及linked Agent Note为准。
+
+- [Distribution Agent Note](../../../.agents/notes/proposed/architecture/2026-08-29-ranged-plus-patchset-distribution.zh.md)持有package forms、inventory、materialization及deletion rules；`src/apply.ts`和`cordis.patch.yml`持有executable profile behavior。
+
+</details>

package/cordis.patch.yml

@@ -0,0 +1,50 @@
+- id: subagent-model-selection-settings
+  disabled: true
+
+- insert:
+    - id: plus-backup
+      name: '@sparkelf/dsh-plugin-backup'
+
+    - id: plus-dataops
+      name: '@sparkelf/dsh-plugin-dataops'
+      disabled: !!js "!process.env.DSH_DATAOPS_BASE_URL"
+      config:
+        baseUrl: !!js process.env.DSH_DATAOPS_BASE_URL
+        serverName: dataops
+        credentialRef: dataops_access_token
+        targetCredentialRef: dataops_target_ref
+        callbackOrigin: !!js process.env.DSH_DATAOPS_CALLBACK_ORIGIN
+        toolCallTimeoutMs: 60000
+        failOnStartupError: false
+
+    - id: plus-document-parser
+      name: '@sparkelf/dsh-plugin-document-attachments'
+      disabled: !!js "!process.env.DSH_MINERU_ENDPOINT"
+      config:
+        provider: mineru
+        maxDirectMarkdownBytes: 1048576
+        maxRequestBytes: 402653184
+
+    - id: plus-document-parser-mineru
+      name: '@sparkelf/dsh-plugin-document-attachments/mineru'
+      disabled: !!js "!process.env.DSH_MINERU_ENDPOINT"
+      config:
+        endpoint: !!js process.env.DSH_MINERU_ENDPOINT
+        timeoutMs: 120000
+        maxResponseBytes: 67108864
+
+    - id: plus-subagent-settings
+      name: '@sparkelf/dsh-plugin-subagent-settings/startup'
+      config:
+        settingsNamespace: subagent
+        provider: spawn
+        enabled: false
+        maxDepth: 0
+
+    - id: plus-subagent-fork-settings
+      name: '@sparkelf/dsh-plugin-subagent-settings/startup'
+      config:
+        settingsNamespace: subagent-fork
+        provider: fork
+        enabled: false
+        maxDepth: 0

package/lib/apply.js

@@ -0,0 +1,446 @@
+import { createRequire } from "node:module";
+import { spawnSync } from "node:child_process";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { satisfies, valid, validRange } from "semver";
+import { parseDocument } from "yaml";
+//#region lib/types/apply.js
+/** Materialize the Plus distribution's independent patch packages without Desktop. */
+const FORMAT_VERSION = 1;
+function readJsonObject(path, label) {
+	const parsed = JSON.parse(readFileSync(path, "utf8"));
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(label + " must be a JSON object");
+	return parsed;
+}
+function requireObject(value, label) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(label + " must be an object");
+	return value;
+}
+function requireString(value, label) {
+	if (typeof value !== "string" || value === "") throw new Error(label + " must be a non-empty string");
+	return value;
+}
+function requireRange(value, label) {
+	const range = requireString(value, label);
+	if (validRange(range) === null) throw new Error(label + " is not a semantic-version range: " + range);
+	return range;
+}
+function requireVersion(value, label) {
+	const version = requireString(value, label);
+	if (valid(version) === null) throw new Error(label + " is not a semantic version: " + version);
+	return version;
+}
+function requireStringArray(value, label) {
+	if (!Array.isArray(value) || value.length === 0) throw new Error(label + " must be a non-empty array");
+	const strings = value.map((entry, index) => requireString(entry, label + "[" + String(index) + "]"));
+	if (new Set(strings).size !== strings.length) throw new Error(label + " must not contain duplicates");
+	return strings;
+}
+function resolveInstalledPackage(distributionDirectory, packageName) {
+	const manifestPath = createRequire(resolve(distributionDirectory, "package.json")).resolve(packageName + "/package.json");
+	const manifest = readJsonObject(manifestPath, packageName + " manifest");
+	return {
+		name: packageName,
+		version: requireVersion(manifest.version, packageName + " version"),
+		directory: dirname(manifestPath),
+		manifest
+	};
+}
+function resolvePatchFile(packageDirectory, declared) {
+	const absoluteFile = resolve(packageDirectory, declared);
+	const local = relative(packageDirectory, absoluteFile);
+	if (isAbsolute(local) || local === ".." || local.startsWith("../")) throw new Error("patch file must stay inside its patch package: " + declared);
+	if (!existsSync(absoluteFile)) throw new Error("patch file does not exist: " + absoluteFile);
+	return {
+		relativeFile: local.replaceAll("\\", "/"),
+		absoluteFile
+	};
+}
+function parseVariant(value, index, patchPackage) {
+	const label = patchPackage.name + " dshPatch.variants[" + String(index) + "]";
+	const variant = requireObject(value, label);
+	const target = requireObject(variant.target, label + ".target");
+	const kind = requireString(target.kind, label + ".target.kind");
+	const common = {
+		id: requireString(variant.id, label + ".id"),
+		dsh: requireRange(variant.dsh, label + ".dsh"),
+		file: requireString(variant.file, label + ".file"),
+		patchPackage
+	};
+	if (kind === "npm") return {
+		...common,
+		target: {
+			kind,
+			name: requireString(target.name, label + ".target.name"),
+			range: requireRange(target.range, label + ".target.range")
+		}
+	};
+	if (kind === "dsh-source") return {
+		...common,
+		target: {
+			kind,
+			baseRevision: requireString(target.baseRevision, label + ".target.baseRevision")
+		}
+	};
+	throw new Error("unsupported patch target kind: " + kind);
+}
+function git(root, args, acceptFailure = false) {
+	const result = spawnSync("git", args, {
+		cwd: root,
+		encoding: "utf8"
+	});
+	if (result.status === 0) return result.stdout.trim();
+	if (acceptFailure) return void 0;
+	const detail = result.stderr.trim();
+	throw new Error("git " + args.join(" ") + " failed" + (detail === "" ? "" : ": " + detail));
+}
+function sourcePatchState(root, file) {
+	if (git(root, [
+		"apply",
+		"--check",
+		file
+	], true) !== void 0) return "pending";
+	if (git(root, [
+		"apply",
+		"--reverse",
+		"--check",
+		file
+	], true) !== void 0) return "applied";
+	git(root, [
+		"apply",
+		"--check",
+		file
+	]);
+	throw new Error("unreachable");
+}
+function requireSourceBase(root, baseRevision) {
+	const checkoutRevision = requireString(git(root, ["rev-parse", "HEAD"]), "DSH checkout revision");
+	if (checkoutRevision !== baseRevision) throw new Error("DSH checkout must be exact official base " + baseRevision + ", found " + checkoutRevision);
+	return checkoutRevision;
+}
+function patchPackageVariants(distributionDirectory, names) {
+	const variants = [];
+	for (const name of names) {
+		const patchPackage = resolveInstalledPackage(distributionDirectory, name);
+		const declaration = requireObject(patchPackage.manifest.dshPatch, name + " dshPatch");
+		if (declaration.formatVersion !== FORMAT_VERSION) throw new Error("unsupported dshPatch formatVersion in " + name + ": " + String(declaration.formatVersion));
+		if (!Array.isArray(declaration.variants) || declaration.variants.length === 0) throw new Error(name + " dshPatch.variants must be a non-empty array");
+		for (const [index, value] of declaration.variants.entries()) variants.push(parseVariant(value, index, patchPackage));
+	}
+	return variants;
+}
+function prepareSelection(distributionDirectory, profileDirectory, dshRoot) {
+	const distributionManifest = readJsonObject(resolve(distributionDirectory, "package.json"), "Plus distribution manifest");
+	const distributionName = requireString(distributionManifest.name, "Plus distribution name");
+	const distributionVersion = requireVersion(distributionManifest.version, "Plus distribution version");
+	const plus = requireObject(distributionManifest.dshPlus, "Plus distribution dshPlus");
+	if (plus.formatVersion !== FORMAT_VERSION) throw new Error("unsupported dshPlus formatVersion: " + String(plus.formatVersion));
+	const dshRange = requireRange(requireObject(plus.compatibility, "dshPlus.compatibility").dsh, "dshPlus.compatibility.dsh");
+	const baseRevision = requireString(requireObject(plus.sourceBase, "dshPlus.sourceBase").revision, "dshPlus.sourceBase.revision");
+	const profile = requireObject(plus.profile, "dshPlus.profile");
+	const bundles = requireStringArray(profile.bundles, "dshPlus.profile.bundles");
+	const rawProfileDependencySpecs = requireObject(profile.dependencies, "dshPlus.profile.dependencies");
+	const profileDependencySpecs = {};
+	for (const [name, spec] of Object.entries(rawProfileDependencySpecs)) profileDependencySpecs[name] = requireString(spec, "dshPlus.profile.dependencies." + name);
+	const rawAllowBuilds = requireObject(profile.allowBuilds, "dshPlus.profile.allowBuilds");
+	const allowBuilds = {};
+	for (const [name, allowed] of Object.entries(rawAllowBuilds)) {
+		if (typeof allowed !== "boolean") throw new Error("dshPlus.profile.allowBuilds." + name + " must be a boolean");
+		allowBuilds[name] = allowed;
+	}
+	const patchPackageNames = requireStringArray(plus.patchPackages, "dshPlus.patchPackages");
+	const dependencies = requireObject(distributionManifest.dependencies, "Plus distribution dependencies");
+	const dshVersion = requireVersion(readJsonObject(resolve(dshRoot, "package.json"), "DSH source manifest").version, "DSH source version");
+	if (!satisfies(dshVersion, dshRange, { includePrerelease: true })) throw new Error(distributionName + "@" + distributionVersion + " requires DSH " + dshRange + ", found " + dshVersion);
+	const checkoutRevision = requireSourceBase(dshRoot, baseRevision);
+	const groups = /* @__PURE__ */ new Map();
+	for (const variant of patchPackageVariants(distributionDirectory, patchPackageNames)) {
+		const entries = groups.get(variant.id) ?? [];
+		entries.push(variant);
+		groups.set(variant.id, entries);
+	}
+	const sourceStates = /* @__PURE__ */ new Map();
+	for (const variant of [...groups.values()].flat()) {
+		if (variant.target.kind !== "dsh-source" || variant.target.baseRevision !== baseRevision || !satisfies(dshVersion, variant.dsh, { includePrerelease: true })) continue;
+		const file = resolvePatchFile(variant.patchPackage.directory, variant.file);
+		sourceStates.set(file.absoluteFile, sourcePatchState(dshRoot, file.absoluteFile));
+	}
+	const pendingSourceFiles = [...sourceStates].flatMap(([file, state]) => state === "pending" ? [file] : []);
+	if (pendingSourceFiles.length > 0) git(dshRoot, [
+		"apply",
+		"--check",
+		...pendingSourceFiles
+	]);
+	if (writeProfileRequirements(profileDirectory, profileDependencySpecs, allowBuilds)) runPnpm(profileDirectory, ["install"], "pnpm install Plus profile dependencies");
+	const profileDependencies = Object.keys(profileDependencySpecs).sort().map((name) => {
+		return {
+			name,
+			version: resolveInstalledPackage(profileDirectory, name).version
+		};
+	});
+	const runtimePackages = [...Object.keys(dependencies).filter((name) => !patchPackageNames.includes(name)).sort().map((name) => {
+		return {
+			name,
+			version: resolveInstalledPackage(distributionDirectory, name).version
+		};
+	}), ...profileDependencies].sort((left, right) => left.name.localeCompare(right.name));
+	const selected = [];
+	for (const id of [...groups.keys()].sort()) {
+		const candidates = (groups.get(id) ?? []).flatMap((variant) => {
+			if (!satisfies(dshVersion, variant.dsh, { includePrerelease: true })) return [];
+			const file = resolvePatchFile(variant.patchPackage.directory, variant.file);
+			if (variant.target.kind === "dsh-source") {
+				if (variant.target.baseRevision !== baseRevision) return [];
+				return [{
+					id,
+					patchPackage: {
+						name: variant.patchPackage.name,
+						version: variant.patchPackage.version
+					},
+					file: file.relativeFile,
+					absoluteFile: file.absoluteFile,
+					target: {
+						kind: "dsh-source",
+						baseRevision
+					},
+					alreadyApplied: sourceStates.get(file.absoluteFile) === "applied"
+				}];
+			}
+			const targetVersion = resolveInstalledPackage(variant.target.name in profileDependencySpecs ? profileDirectory : distributionDirectory, variant.target.name).version;
+			if (!satisfies(targetVersion, variant.target.range, { includePrerelease: true })) return [];
+			return [{
+				id,
+				patchPackage: {
+					name: variant.patchPackage.name,
+					version: variant.patchPackage.version
+				},
+				file: file.relativeFile,
+				absoluteFile: file.absoluteFile,
+				target: {
+					kind: "npm",
+					name: variant.target.name,
+					version: targetVersion
+				}
+			}];
+		});
+		const [candidate] = candidates;
+		if (candidate === void 0) throw new Error("no compatible patch variant for " + id + " on DSH " + dshVersion);
+		if (candidates.length > 1) throw new Error("multiple compatible patch variants for " + id + " on DSH " + dshVersion);
+		selected.push(candidate);
+	}
+	const lockPatches = selected.map((patch) => {
+		if ("alreadyApplied" in patch) {
+			const { absoluteFile: _absoluteFile, alreadyApplied: _alreadyApplied, ...locked } = patch;
+			return locked;
+		}
+		const { absoluteFile: _absoluteFile, ...locked } = patch;
+		return locked;
+	});
+	return {
+		patches: selected,
+		bundles,
+		runtimePackages,
+		profileDependencies,
+		allowBuilds,
+		lock: {
+			formatVersion: FORMAT_VERSION,
+			distribution: {
+				name: distributionName,
+				version: distributionVersion
+			},
+			dsh: {
+				version: dshVersion,
+				baseRevision,
+				checkoutRevision
+			},
+			runtimePackages,
+			patches: lockPatches
+		}
+	};
+}
+function materializePatchFiles(profileDirectory, patches) {
+	const root = resolve(profileDirectory, ".dsh-plus", "patches");
+	rmSync(root, {
+		recursive: true,
+		force: true
+	});
+	return patches.map((patch) => {
+		const destination = resolve(root, patch.patchPackage.name, patch.patchPackage.version, patch.file);
+		mkdirSync(dirname(destination), { recursive: true });
+		copyFileSync(patch.absoluteFile, destination);
+		return {
+			...patch,
+			absoluteFile: destination
+		};
+	});
+}
+function profilePatchConfiguration(profileDirectory, patches) {
+	const document = parseDocument(readFileSync(resolve(profileDirectory, "pnpm-workspace.yaml"), "utf8"));
+	const [documentError] = document.errors;
+	if (documentError !== void 0) throw new Error("Plus profile workspace is not valid YAML", { cause: documentError });
+	let changed = false;
+	const desiredKeys = new Set(patches.flatMap((patch) => patch.target.kind === "npm" ? [patch.target.name + "@" + patch.target.version] : []));
+	const workspace = requireObject(document.toJS(), "Plus profile workspace");
+	const configured = workspace.patchedDependencies === void 0 ? {} : requireObject(workspace.patchedDependencies, "Plus profile patchedDependencies");
+	for (const [key, value] of Object.entries(configured)) if (typeof value === "string" && value.startsWith(".dsh-plus/patches/") && !desiredKeys.has(key)) {
+		document.deleteIn(["patchedDependencies", key]);
+		changed = true;
+	}
+	for (const patch of patches) {
+		if (patch.target.kind !== "npm") continue;
+		const key = patch.target.name + "@" + patch.target.version;
+		const value = relative(profileDirectory, patch.absoluteFile).replaceAll("\\", "/");
+		const current = document.getIn(["patchedDependencies", key]);
+		if (current !== void 0 && current !== value && (typeof current !== "string" || !current.startsWith(".dsh-plus/patches/"))) throw new Error("profile patchedDependencies." + key + " is already owned by another payload");
+		if (current === value) continue;
+		document.setIn(["patchedDependencies", key], value);
+		changed = true;
+	}
+	return {
+		text: String(document),
+		changed
+	};
+}
+function writeProfileRequirements(profileDirectory, dependencySpecs, allowBuilds) {
+	const manifestPath = resolve(profileDirectory, "package.json");
+	const manifest = readJsonObject(manifestPath, "DSH profile manifest");
+	const dependencies = requireObject(manifest.dependencies, "DSH profile dependencies");
+	let manifestChanged = false;
+	for (const [name, spec] of Object.entries(dependencySpecs)) {
+		const current = dependencies[name];
+		if (current !== void 0 && current !== spec) throw new Error("profile dependency " + name + " is configured as " + JSON.stringify(current) + ", expected " + spec);
+		if (current === void 0) {
+			dependencies[name] = spec;
+			manifestChanged = true;
+		}
+	}
+	const workspacePath = resolve(profileDirectory, "pnpm-workspace.yaml");
+	const document = parseDocument(readFileSync(workspacePath, "utf8"));
+	const [documentError] = document.errors;
+	if (documentError !== void 0) throw new Error("Plus profile workspace is not valid YAML", { cause: documentError });
+	let workspaceChanged = false;
+	for (const [name, allowed] of Object.entries(allowBuilds)) {
+		const current = document.getIn(["allowBuilds", name]);
+		if (current !== void 0 && current !== allowed) throw new Error("profile allowBuilds." + name + " is configured as " + JSON.stringify(current) + ", expected " + String(allowed));
+		if (current === void 0) {
+			document.setIn(["allowBuilds", name], allowed);
+			workspaceChanged = true;
+		}
+	}
+	if (manifestChanged) {
+		manifest.dependencies = dependencies;
+		writeFileSync(manifestPath, JSON.stringify(manifest, void 0, 2) + "\n");
+	}
+	if (workspaceChanged) writeFileSync(workspacePath, String(document));
+	return manifestChanged || workspaceChanged;
+}
+function writeProfileComposition(profileDirectory, bundles, runtimePackages) {
+	const path = resolve(profileDirectory, "package.json");
+	const manifest = readJsonObject(path, "DSH profile manifest");
+	const dependencies = requireObject(manifest.dependencies, "DSH profile dependencies");
+	let changed = false;
+	for (const runtimePackage of runtimePackages) {
+		if (dependencies[runtimePackage.name] === void 0) {
+			dependencies[runtimePackage.name] = runtimePackage.version;
+			changed = true;
+			continue;
+		}
+		const installed = resolveInstalledPackage(profileDirectory, runtimePackage.name);
+		if (installed.version !== runtimePackage.version) throw new Error("profile dependency " + runtimePackage.name + " resolves to " + installed.version + ", but the Plus distribution requires " + runtimePackage.version);
+	}
+	const dsh = manifest.dsh === void 0 ? {} : requireObject(manifest.dsh, "DSH profile dsh");
+	const profile = dsh.profile === void 0 ? {} : requireObject(dsh.profile, "DSH profile dsh.profile");
+	if (JSON.stringify(profile.bundles) !== JSON.stringify(bundles)) changed = true;
+	manifest.dependencies = dependencies;
+	manifest.dsh = {
+		...dsh,
+		profile: {
+			...profile,
+			bundles: [...bundles]
+		}
+	};
+	if (changed) writeFileSync(path, JSON.stringify(manifest, void 0, 2) + "\n");
+	return changed;
+}
+function runPnpm(profileDirectory, args, label) {
+	const result = spawnSync("pnpm", args, {
+		cwd: profileDirectory,
+		stdio: "inherit",
+		shell: process.platform === "win32"
+	});
+	if (result.error !== void 0) throw result.error;
+	if (result.status !== 0) throw new Error(label + " failed with exit code " + String(result.status));
+}
+function pendingSourcePatchFiles(patches) {
+	return patches.flatMap((patch) => "alreadyApplied" in patch && !patch.alreadyApplied ? [patch.absoluteFile] : []);
+}
+function applySelectedPatches(profileDirectory, dshRoot, patches, profileChanged) {
+	const stablePatches = materializePatchFiles(profileDirectory, patches);
+	const workspacePath = resolve(profileDirectory, "pnpm-workspace.yaml");
+	const workspace = profilePatchConfiguration(profileDirectory, stablePatches);
+	if (workspace.changed) writeFileSync(workspacePath, workspace.text);
+	if (profileChanged || workspace.changed) runPnpm(profileDirectory, ["install"], "pnpm install in Plus profile");
+	const sourceFiles = pendingSourcePatchFiles(stablePatches);
+	if (sourceFiles.length > 0) git(dshRoot, ["apply", ...sourceFiles]);
+	if (stablePatches.some((patch) => patch.target.kind === "dsh-source")) runPnpm(dshRoot, ["run", "build"], "official DSH build after source patches");
+}
+function linkOfficialPackages(profileDirectory, dshRoot) {
+	const source = resolve(dshRoot, "node_modules", "@deepseek-ai");
+	if (!existsSync(source)) throw new Error("official DSH dependencies are missing under " + source);
+	const destination = resolve(profileDirectory, "node_modules", "@deepseek-ai");
+	rmSync(destination, {
+		recursive: true,
+		force: true
+	});
+	symlinkSync(source, destination, process.platform === "win32" ? "junction" : "dir");
+}
+function writeLock(profileDirectory, lock) {
+	const directory = resolve(profileDirectory, ".dsh-plus");
+	mkdirSync(directory, { recursive: true });
+	const path = resolve(directory, "patchset.lock.json");
+	writeFileSync(path, JSON.stringify(lock, void 0, 2) + "\n", { mode: 384 });
+	chmodSync(path, 384);
+	return path;
+}
+function parseApplyArguments(argv) {
+	if (argv[0] !== "apply") throw new Error("usage: dsh-plus apply --dsh-root <official-dsh-root>");
+	let dshRoot;
+	for (let index = 1; index < argv.length; index += 2) {
+		const key = argv[index];
+		const value = argv[index + 1];
+		if (key !== "--dsh-root" || value === void 0) throw new Error("usage: dsh-plus apply --dsh-root <official-dsh-root>");
+		dshRoot = resolve(value);
+	}
+	if (dshRoot === void 0) throw new Error("usage: dsh-plus apply --dsh-root <official-dsh-root>");
+	return {
+		dshRoot,
+		profileDirectory: process.cwd()
+	};
+}
+/**
+* Apply the installed Plus distribution metadata from a DSH profile directory.
+* @param argv - Explicit `apply --dsh-root <path>` command arguments.
+*/
+function runApply(argv) {
+	const { dshRoot, profileDirectory } = parseApplyArguments(argv);
+	if (requireObject(readJsonObject(resolve(profileDirectory, "package.json"), "DSH profile manifest").dependencies, "DSH profile dependencies")["@sparkelf/dsh-plus"] === void 0) throw new Error("current directory is not a DSH profile with @sparkelf/dsh-plus installed");
+	const selection = prepareSelection(dirname(createRequire(resolve(profileDirectory, "package.json")).resolve("@sparkelf/dsh-plus/package.json")), profileDirectory, dshRoot);
+	const profileChanged = writeProfileComposition(profileDirectory, selection.bundles, selection.runtimePackages);
+	applySelectedPatches(profileDirectory, dshRoot, selection.patches, profileChanged);
+	linkOfficialPackages(profileDirectory, dshRoot);
+	const installedProfileDependencies = requireObject(readJsonObject(resolve(profileDirectory, "package.json"), "DSH profile manifest").dependencies, "DSH profile dependencies");
+	selection.lock.profile = {
+		bundles: selection.bundles.map((name) => {
+			return {
+				name,
+				version: (installedProfileDependencies[name] === void 0 ? resolveInstalledPackage(dshRoot, name) : resolveInstalledPackage(profileDirectory, name)).version
+			};
+		}),
+		dependencies: selection.profileDependencies,
+		allowBuilds: selection.allowBuilds
+	};
+	const lock = writeLock(profileDirectory, selection.lock);
+	process.stdout.write("[dsh-plus] applied " + String(selection.patches.length) + " patches; lock " + lock + "\n");
+}
+//#endregion
+export { runApply };

package/lib/bin.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { runApply } from "./apply.js";
+//#region lib/types/bin.js
+try {
+	runApply(process.argv.slice(2));
+} catch (error) {
+	console.error(error instanceof Error ? error.stack : error);
+	process.exitCode = 1;
+}
+//#endregion
+export {};

package/lib/index.js

@@ -0,0 +1 @@
+export {};

package/lib/invariant.js

@@ -0,0 +1,19 @@
+//#region lib/types/invariant.js
+/**
+* Package-owned invariant companion for `@sparkelf/dsh-plus`.
+* @module @sparkelf/dsh-plus/invariant
+*/
+const PACKAGE_NAME = "@sparkelf/dsh-plus";
+/** Cordis companion plugin name. */
+const name = "plus-bundle-invariant";
+/** Service required before the companion can register. */
+const inject = ["invariants"];
+const install = () => {};
+/**
+* Register this package's invariant companion.
+* @param ctx - Cordis context carrying the invariant service.
+* @returns the installed registration's disposer after setup succeeds.
+*/
+const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//#endregion
+export { apply, inject, name };

package/lib/types/apply.d.ts

@@ -0,0 +1,7 @@
+/** Materialize the Plus distribution's independent patch packages without Desktop. */
+/**
+ * Apply the installed Plus distribution metadata from a DSH profile directory.
+ * @param argv - Explicit `apply --dsh-root <path>` command arguments.
+ */
+export declare function runApply(argv: readonly string[]): void;
+//# sourceMappingURL=apply.d.ts.map

package/lib/types/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/lib/types/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @sparkelf/dsh-plus carries the Plus Web profile composition, ranged
+ * compatibility declarations, and independent patch-package references. The
+ * profile composer resolves its Cordis patch through the package manifest; the
+ * root module exposes no runtime API, while the explicit CLI lives at ./apply.
+ * @module @sparkelf/dsh-plus
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/lib/types/invariant.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Package-owned invariant companion for `@sparkelf/dsh-plus`.
+ * @module @sparkelf/dsh-plus/invariant
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Cordis companion plugin name. */
+export declare const name = "plus-bundle-invariant";
+/** Service required before the companion can register. */
+export declare const inject: string[];
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/package.json

@@ -0,0 +1,117 @@
+{
+  "bin": {
+    "dsh-plus": "lib/bin.js"
+  },
+  "dependencies": {
+    "@changfenhuang/dsh-genui": ">=0.9.6",
+    "@sparkelf/dsh-mobile-bridge": ">=0.2.8",
+    "@sparkelf/dsh-patch-better-sidebar-app-frame": ">=0.1.0-rc.10",
+    "@sparkelf/dsh-patch-document-attachments": ">=0.1.0-rc.10",
+    "@sparkelf/dsh-patch-genui-streaming-echart": ">=0.1.0-rc.10",
+    "@sparkelf/dsh-patch-mobile-bridge-serialized-actions": ">=0.1.0-rc.10",
+    "@sparkelf/dsh-patch-mobile-web-layout": ">=0.1.0-rc.10",
+    "@sparkelf/dsh-patch-responses-reasoning-status": ">=0.1.0-rc.10",
+    "@sparkelf/dsh-patch-subagent-settings-presets": ">=0.1.0-rc.10",
+    "@sparkelf/dsh-patch-web-base-path": ">=0.1.0-rc.10",
+    "@sparkelf/dsh-patch-workspace-storage-restore": ">=0.1.0-rc.10",
+    "@sparkelf/dsh-plugin-backup": ">=0.1.0-rc.10",
+    "@sparkelf/dsh-plugin-dataops": ">=0.1.0-rc.10",
+    "@sparkelf/dsh-plugin-document-attachments": ">=0.1.0-rc.10",
+    "@sparkelf/dsh-plugin-mcp-credentials": ">=0.1.0-rc.10",
+    "@sparkelf/dsh-plugin-subagent-settings": ">=0.1.0-rc.10",
+    "dshmarket": ">=1.29.2",
+    "semver": ">=7.7.3",
+    "yaml": ">=2.9.0"
+  },
+  "description": "DeepSeek Harness Plus official-base Web distribution profile and ranged compatibility patchset",
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-invariants": "^0.1.2-alpha.1",
+    "@types/semver": ">=7.7.1",
+    "dsh-better-sidebar": "0.17.1"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "dshPlus": {
+    "compatibility": {
+      "dsh": ">=0.1.2-alpha.1"
+    },
+    "formatVersion": 1,
+    "patchPackages": [
+      "@sparkelf/dsh-patch-better-sidebar-app-frame",
+      "@sparkelf/dsh-patch-genui-streaming-echart",
+      "@sparkelf/dsh-patch-mobile-bridge-serialized-actions",
+      "@sparkelf/dsh-patch-workspace-storage-restore",
+      "@sparkelf/dsh-patch-subagent-settings-presets",
+      "@sparkelf/dsh-patch-document-attachments",
+      "@sparkelf/dsh-patch-responses-reasoning-status",
+      "@sparkelf/dsh-patch-mobile-web-layout",
+      "@sparkelf/dsh-patch-web-base-path"
+    ],
+    "profile": {
+      "allowBuilds": {
+        "node-pty": true
+      },
+      "bundles": [
+        "@deepseek-ai/dsh-base",
+        "@deepseek-ai/dsh-web-app",
+        "dsh-better-sidebar",
+        "@sparkelf/dsh-mobile-bridge",
+        "dshmarket",
+        "@changfenhuang/dsh-genui",
+        "@sparkelf/dsh-plus"
+      ],
+      "dependencies": {
+        "dsh-better-sidebar": "0.17.1"
+      }
+    },
+    "sourceBase": {
+      "revision": "cd5ef8148158c3a752a658978873241fdf8e2bbc"
+    }
+  },
+  "exports": {
+    ".": {
+      "default": "./lib/index.js",
+      "types": "./lib/types/index.d.ts"
+    },
+    "./apply": {
+      "default": "./lib/apply.js",
+      "types": "./lib/types/apply.d.ts"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./invariant": {
+      "default": "./lib/invariant.js",
+      "types": "./lib/types/invariant.d.ts"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/bin.js",
+    "cordis.patch.yml",
+    "lib/apply.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "main": "lib/index.js",
+  "name": "@sparkelf/dsh-plus",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": ">=4.0.1",
+    "@deepseek-ai/dsh-invariants": ">=0.1.2-alpha.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "directory": "packages/bundle/plus",
+    "type": "git",
+    "url": "git+https://github.com/SparkElf/deepseek-harness-plus.git"
+  },
+  "type": "module",
+  "types": "lib/types/index.d.ts",
+  "version": "0.1.0-rc.10"
+}