@sparkelf/dsh-plus 0.1.0-rc.11 → 0.1.0-rc.13

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/bundle/plus/README.md
-README.md: a48ce3e778e2cf121f9abfe1cb12fbe1a4ec7c9a
-README.zh.md: 0fd4947ad19983bb44fcf69b3c148e3eccb043e4
+README.md: a8ac5367fb3de36c0ee24c27bfc0f7f1cc72c8cc
+README.zh.md: a179074b4bec9ec8f857c6cbe5fa8b9e4bbebde6

package/README.md

@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-This distribution composes official `@deepseek-ai/dsh-base` and `@deepseek-ai/dsh-web-app` with the selected external sidebar, mobile bridge, plugin market, GenUI package, five complete Plus capability packages, and nine independent patch packages. It owns only ordered composition, minimum compatibility metadata, dependency closure, explicit materialization, and the credential-free deployment lock; capability behavior and patch payloads stay in their owning packages.
+This distribution composes official `@deepseek-ai/dsh-base` and `@deepseek-ai/dsh-web-app` with the selected external sidebar, mobile bridge, plugin market, GenUI package, five in-repository Plus capability packages and one externally owned Supervisor package, and fifteen independent patch packages. It owns only ordered composition, minimum compatibility metadata, dependency closure, explicit materialization, and the credential-free deployment lock; capability behavior and patch payloads stay in their owning packages.
 
 ## Table of Contents
 
@@ -31,9 +31,11 @@ dsh plugin --profile plus exec dsh-plus apply --dsh-root /path/to/official-dsh
 dsh --profile plus
 ```
 
-The explicit apply step requires official revision `cd5ef8148158c3a752a658978873241fdf8e2bbc`, materializes every selected runtime package as a profile-direct dependency, applies all pending source payloads together, configures exact npm patches, removes retired Plus-owned entries, and writes `.dsh-plus/patchset.lock.json` with mode `0600`. It installs `dsh-better-sidebar@0.17.1` at the profile root, explicitly allows only its `node-pty` native build, and links the profile's `@deepseek-ai` scope to the exact official dsh CLI dependency tree at `apps/cli/node_modules/@deepseek-ai`. Version conflicts and source mismatches fail before profile installation or source mutation. The package has no install lifecycle script.
+The explicit apply step requires official revision `0a53fb55bea101816fa226bb964ae2bed71c343b`, materializes every selected runtime package as a profile-direct dependency, applies all pending source payloads together, configures exact npm patches, removes retired Plus-owned entries, and writes `.dsh-plus/patchset.lock.json` with mode `0600`. It installs stable `dsh-better-sidebar@0.17.1`, Office preview `0.1.2`, and video preview `0.1.4` at the profile root, applies the exact alpha.2 Settings patch, explicitly allows only the sidebar's `node-pty` native build, and builds the profile's `@deepseek-ai` scope from the exact official dsh CLI dependency tree plus official source workspaces needed by out-of-tree plugin peers. SparkElf-owned external Mobile Bridge `0.2.10` and independently maintained dshmarket `1.38.1` each carry alpha.2 Settings compatibility in their own release, so Plus applies no Mobile Bridge patch. Version conflicts and source mismatches fail before profile installation or source mutation. The package has no install lifecycle script.
 
-Official DSH supplies onboarding, Workspace selection, Session export, Turn folding, and the base image path. The external `@changfenhuang/dsh-genui` bundle owns generated UI, including inline interactive charts emitted by the model as `dsh-ui`. The temporary GenUI streaming EChart patch targets only `0.9.6` and retires after [upstream PR #87](https://github.com/omdsh-dev/dsh-genui/pull/87) ships in npm and the real inline-chart path passes. DataOps and Document Attachments mount only when their endpoint environment variables exist. Agent Teams is excluded because the official packages are private experimental workspaces and shipped profiles disable them.
+Official DSH supplies onboarding, Workspace selection, Session export, Turn folding, and the base image path. Plus builds that source with the official client profile, keeps the attachment chooser directly after the composer command button, adds Better Sidebar previews for Office documents and video, replaces mixed English `Session` wording in the Simplified-Chinese Session export UI, and places the desktop Session-log action immediately before Trajectory search while retaining its Header position on phones. The external `@changfenhuang/dsh-genui` bundle owns generated UI, including inline interactive charts emitted by the model as `dsh-ui`. Two exact `0.9.6` patches keep top-level streaming complete, register the bundled `genui` skill, publish the compact chart signature, and reject invalid chart fields; each retires after its upstream behavior ships and the real DataOps chart path passes without it. The registry-pinned Supervisor from `SparkElf/dsh-plugins-plus` manages an explicitly materialized runtime and restores Sessions interrupted by its own restart; optional Desktop from `SparkElf/dsh-plus-desktop` delegates tray commands to that package. Neither source tree lives in this fork. DataOps and Document Attachments mount only when their endpoint environment variables exist. Agent Teams is excluded because the official packages are private experimental workspaces and shipped profiles disable them.
+
+Plus explicitly selects `browserAuthentication: disabled`: its Web URL is clean and opens without a process-token exchange or browser cookie, while Connection still applies the official Host/Origin trust fence. Every process that can reach an accepted authority can therefore use the complete Host API, including Shell, files, and Sessions. The official `web` profile keeps the upstream `required` default; only the Plus composition opts out.
 
 -----
 

package/README.zh.md

@@ -9,7 +9,7 @@ kind: "package-bundle"
 
 ## 概述
 
-该distribution把official `@deepseek-ai/dsh-base`及`@deepseek-ai/dsh-web-app`与selected external sidebar、mobile bridge、plugin market、GenUI package、五个完整Plus capability packages及九个independent patch packages组合起来。它只持有ordered composition、minimum compatibility metadata、dependency closure、explicit materialization及credential-free deployment lock；capability behavior和patch payloads仍属于各自package。
+该distribution把official `@deepseek-ai/dsh-base`及`@deepseek-ai/dsh-web-app`与selected external sidebar、mobile bridge、plugin market、GenUI package、五个in-repository Plus capability packages及一个externally owned Supervisor package及十五个independent patch packages组合起来。它只持有ordered composition、minimum compatibility metadata、dependency closure、explicit materialization及credential-free deployment lock；capability behavior和patch payloads仍属于各自package。
 
 ## 目录
 
@@ -31,9 +31,11 @@ dsh plugin --profile plus exec dsh-plus apply --dsh-root /path/to/official-dsh
 dsh --profile plus
 ```
 
-explicit apply步骤要求official revision `cd5ef8148158c3a752a658978873241fdf8e2bbc`，把每个selected runtime package materialize为profile-direct dependency，一次应用全部pending source payloads，配置exact npm patches，删除retired Plus-owned entries，并以`0600` mode写入`.dsh-plus/patchset.lock.json`。它在profile root安装`dsh-better-sidebar@0.17.1`，只显式允许其`node-pty` native build，并把profile的`@deepseek-ai` scope链接到`apps/cli/node_modules/@deepseek-ai`中的exact official dsh CLI dependency tree。version conflict和source mismatch会在profile installation或source mutation前失败。该package没有install lifecycle script。
+explicit apply步骤要求official revision `0a53fb55bea101816fa226bb964ae2bed71c343b`，把每个selected runtime package materialize为profile-direct dependency，一次应用全部pending source payloads，配置exact npm patches，删除retired Plus-owned entries，并以`0600` mode写入`.dsh-plus/patchset.lock.json`。它在profile root安装stable `dsh-better-sidebar@0.17.1`、Office preview `0.1.2`与video preview `0.1.4`，应用exact alpha.2 Settings patch，只显式允许sidebar的`node-pty` native build，并用exact official dsh CLI dependency tree及out-of-tree plugin peers所需的official source workspaces共同构建profile的`@deepseek-ai` scope。SparkElf自有external Mobile Bridge `0.2.10`与独立维护的dshmarket `1.38.1`各自在自身release中包含alpha.2 Settings compatibility，因此Plus不应用Mobile Bridge patch。version conflict和source mismatch会在profile installation或source mutation前失败。该package没有install lifecycle script。
 
-Official DSH提供onboarding、Workspace selection、Session export、Turn folding及base image path。External `@changfenhuang/dsh-genui` bundle拥有generated UI，包括模型以`dsh-ui`输出的inline interactive charts。Temporary GenUI streaming EChart patch只target `0.9.6`；[upstream PR #87](https://github.com/omdsh-dev/dsh-genui/pull/87)进入npm且真实inline-chart path通过后退役。DataOps和Document Attachments仅在对应endpoint environment variables存在时mount。Agent Teams被排除，因为official packages属于private experimental workspaces且shipped profiles会禁用它们。
+Official DSH提供onboarding、Workspace selection、Session export、Turn folding及base image path。Plus使用official client profile构建该source，把附件选择器保持在输入框指令按钮正右侧，增加Better Sidebar的Office document与video preview，把简体中文会话导出界面中混用的英文`Session`替换为中文，并在桌面端把会话日志操作放到Trajectory搜索框紧邻左侧，同时在手机上保留其Header位置。External `@changfenhuang/dsh-genui` bundle拥有generated UI，包括模型以`dsh-ui`输出的inline interactive charts。两个exact `0.9.6` patch分别保持top-level streaming完整，并注册bundled `genui` skill、发布紧凑chart signature及拒绝非法chart fields；各自upstream behavior发布且真实DataOps chart path在不使用对应patch时通过后退役。来自`SparkElf/dsh-plugins-plus`且由registry精确固定的Supervisor管理显式materialize的runtime并恢复被其自身restart中断的Sessions；来自`SparkElf/dsh-plus-desktop`的可选Desktop把tray commands委托给该package。两个source tree都不在本fork中。DataOps和Document Attachments仅在对应endpoint environment variables存在时mount。Agent Teams被排除，因为official packages属于private experimental workspaces且shipped profiles会禁用它们。
+
+Plus显式选择`browserAuthentication: disabled`：其Web URL保持clean，无需process-token exchange或browser cookie即可打开，同时Connection仍执行official Host/Origin trust fence。因此所有能访问accepted authority的进程都能使用包含Shell、files与Sessions在内的完整Host API。official `web` profile保留upstream `required` default；只有Plus composition选择关闭。
 
 -----
 

package/cordis.patch.yml

@@ -1,6 +1,11 @@
 - id: subagent-model-selection-settings
   disabled: true
 
+- id: connection
+  config:
+    trustedHosts: !!js ctx.webRuntime.trustedHosts
+    browserAuthentication: disabled
+
 - insert:
     - id: plus-backup
       name: '@sparkelf/dsh-plugin-backup'

package/lib/apply.js

@@ -1,12 +1,16 @@
 import { createRequire } from "node:module";
 import { spawnSync } from "node:child_process";
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { tmpdir } from "node:os";
 import { satisfies, valid, validRange } from "semver";
 import { parseDocument } from "yaml";
 //#region lib/types/apply.js
 /** Materialize the Plus distribution's independent patch packages without Desktop. */
 const FORMAT_VERSION = 1;
+function isSelectedNpmPatch(patch) {
+	return patch.target.kind === "npm";
+}
 function readJsonObject(path, label) {
 	const parsed = JSON.parse(readFileSync(path, "utf8"));
 	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(label + " must be a JSON object");
@@ -113,6 +117,40 @@ function sourcePatchState(root, file) {
 	]);
 	throw new Error("unreachable");
 }
+/** 在隔离index中按真实顺序预演source patches，避免失败后污染official worktree。 */
+function preflightSourcePatches(root, files) {
+	if (files.length === 0) return;
+	const directory = mkdtempSync(resolve(tmpdir(), "dsh-plus-source-patches-"));
+	const index = resolve(directory, "index");
+	const env = {
+		...process.env,
+		GIT_INDEX_FILE: index
+	};
+	const run = (args) => {
+		const result = spawnSync("git", args, {
+			cwd: root,
+			encoding: "utf8",
+			env
+		});
+		if (result.status === 0) return;
+		const detail = result.stderr.trim();
+		throw new Error("git " + args.join(" ") + " failed" + (detail === "" ? "" : ": " + detail));
+	};
+	try {
+		run(["read-tree", "HEAD"]);
+		for (const file of files) run([
+			"apply",
+			"--cached",
+			"--3way",
+			file
+		]);
+	} finally {
+		rmSync(directory, {
+			recursive: true,
+			force: true
+		});
+	}
+}
 function requireSourceBase(root, baseRevision) {
 	const checkoutRevision = requireString(git(root, ["rev-parse", "HEAD"]), "DSH checkout revision");
 	if (checkoutRevision !== baseRevision) throw new Error("DSH checkout must be exact official base " + baseRevision + ", found " + checkoutRevision);
@@ -160,18 +198,14 @@ function prepareSelection(distributionDirectory, profileDirectory, dshRoot) {
 		groups.set(variant.id, entries);
 	}
 	const sourceStates = /* @__PURE__ */ new Map();
-	for (const variant of [...groups.values()].flat()) {
+	const orderedGroups = [...groups].sort(([left], [right]) => left.localeCompare(right));
+	for (const [, variants] of orderedGroups) for (const variant of variants) {
 		if (variant.target.kind !== "dsh-source" || variant.target.baseRevision !== baseRevision || !satisfies(dshVersion, variant.dsh, { includePrerelease: true })) continue;
 		const file = resolvePatchFile(variant.patchPackage.directory, variant.file);
 		sourceStates.set(file.absoluteFile, sourcePatchState(dshRoot, file.absoluteFile));
 	}
-	const pendingSourceFiles = [...sourceStates].flatMap(([file, state]) => state === "pending" ? [file] : []);
-	if (pendingSourceFiles.length > 0) git(dshRoot, [
-		"apply",
-		"--check",
-		...pendingSourceFiles
-	]);
-	if (writeProfileRequirements(profileDirectory, profileDependencySpecs, allowBuilds)) runPnpm(profileDirectory, ["install"], "pnpm install Plus profile dependencies");
+	preflightSourcePatches(dshRoot, [...sourceStates].flatMap(([file, state]) => state === "pending" ? [file] : []));
+	if (writeProfileRequirements(profileDirectory, profileDependencySpecs, allowBuilds)) runPnpm(profileDirectory, ["install", "--no-frozen-lockfile"], "pnpm install Plus profile dependencies");
 	const profileDependencies = Object.keys(profileDependencySpecs).sort().map((name) => {
 		return {
 			name,
@@ -185,8 +219,8 @@ function prepareSelection(distributionDirectory, profileDirectory, dshRoot) {
 		};
 	}), ...profileDependencies].sort((left, right) => left.name.localeCompare(right.name));
 	const selected = [];
-	for (const id of [...groups.keys()].sort()) {
-		const candidates = (groups.get(id) ?? []).flatMap((variant) => {
+	for (const [id, variants] of orderedGroups) {
+		const candidates = variants.flatMap((variant) => {
 			if (!satisfies(dshVersion, variant.dsh, { includePrerelease: true })) return [];
 			const file = resolvePatchFile(variant.patchPackage.directory, variant.file);
 			if (variant.target.kind === "dsh-source") {
@@ -258,13 +292,14 @@ function prepareSelection(distributionDirectory, profileDirectory, dshRoot) {
 		}
 	};
 }
+/** 保留每个独立payload，并为同一npm目标生成pnpm可消费的唯一组合patch。 */
 function materializePatchFiles(profileDirectory, patches) {
 	const root = resolve(profileDirectory, ".dsh-plus", "patches");
 	rmSync(root, {
 		recursive: true,
 		force: true
 	});
-	return patches.map((patch) => {
+	const stablePatches = patches.map((patch) => {
 		const destination = resolve(root, patch.patchPackage.name, patch.patchPackage.version, patch.file);
 		mkdirSync(dirname(destination), { recursive: true });
 		copyFileSync(patch.absoluteFile, destination);
@@ -273,23 +308,49 @@ function materializePatchFiles(profileDirectory, patches) {
 			absoluteFile: destination
 		};
 	});
+	const npmGroups = /* @__PURE__ */ new Map();
+	for (const patch of stablePatches) {
+		if (!isSelectedNpmPatch(patch)) continue;
+		const key = patch.target.name + "@" + patch.target.version;
+		const group = npmGroups.get(key);
+		if (group === void 0) npmGroups.set(key, [patch]);
+		else group.push(patch);
+	}
+	const npmPatchFiles = /* @__PURE__ */ new Map();
+	for (const [key, group] of npmGroups) {
+		const first = group[0];
+		if (group.length === 1) {
+			npmPatchFiles.set(key, first.absoluteFile);
+			continue;
+		}
+		const members = group.map((patch) => encodeURIComponent(patch.id + "@" + patch.patchPackage.version)).join("+");
+		const destination = resolve(root, "combined", encodeURIComponent(key), members + ".patch");
+		mkdirSync(dirname(destination), { recursive: true });
+		writeFileSync(destination, group.map((patch) => {
+			const content = readFileSync(patch.absoluteFile, "utf8");
+			return content.endsWith("\n") ? content : content + "\n";
+		}).join(""));
+		npmPatchFiles.set(key, destination);
+	}
+	return {
+		patches: stablePatches,
+		npmPatchFiles
+	};
 }
-function profilePatchConfiguration(profileDirectory, patches) {
+function profilePatchConfiguration(profileDirectory, npmPatchFiles) {
 	const document = parseDocument(readFileSync(resolve(profileDirectory, "pnpm-workspace.yaml"), "utf8"));
 	const [documentError] = document.errors;
 	if (documentError !== void 0) throw new Error("Plus profile workspace is not valid YAML", { cause: documentError });
 	let changed = false;
-	const desiredKeys = new Set(patches.flatMap((patch) => patch.target.kind === "npm" ? [patch.target.name + "@" + patch.target.version] : []));
+	const desiredKeys = new Set(npmPatchFiles.keys());
 	const workspace = requireObject(document.toJS(), "Plus profile workspace");
 	const configured = workspace.patchedDependencies === void 0 ? {} : requireObject(workspace.patchedDependencies, "Plus profile patchedDependencies");
 	for (const [key, value] of Object.entries(configured)) if (typeof value === "string" && value.startsWith(".dsh-plus/patches/") && !desiredKeys.has(key)) {
 		document.deleteIn(["patchedDependencies", key]);
 		changed = true;
 	}
-	for (const patch of patches) {
-		if (patch.target.kind !== "npm") continue;
-		const key = patch.target.name + "@" + patch.target.version;
-		const value = relative(profileDirectory, patch.absoluteFile).replaceAll("\\", "/");
+	for (const [key, file] of npmPatchFiles) {
+		const value = relative(profileDirectory, file).replaceAll("\\", "/");
 		const current = document.getIn(["patchedDependencies", key]);
 		if (current !== void 0 && current !== value && (typeof current !== "string" || !current.startsWith(".dsh-plus/patches/"))) throw new Error("profile patchedDependencies." + key + " is already owned by another payload");
 		if (current === value) continue;
@@ -375,27 +436,92 @@ function pendingSourcePatchFiles(patches) {
 	return patches.flatMap((patch) => "alreadyApplied" in patch && !patch.alreadyApplied ? [patch.absoluteFile] : []);
 }
 function applySelectedPatches(profileDirectory, dshRoot, patches, profileChanged) {
-	const stablePatches = materializePatchFiles(profileDirectory, patches);
+	const materialized = materializePatchFiles(profileDirectory, patches);
 	const workspacePath = resolve(profileDirectory, "pnpm-workspace.yaml");
-	const workspace = profilePatchConfiguration(profileDirectory, stablePatches);
+	const workspace = profilePatchConfiguration(profileDirectory, materialized.npmPatchFiles);
 	if (workspace.changed) writeFileSync(workspacePath, workspace.text);
-	if (profileChanged || workspace.changed) runPnpm(profileDirectory, ["install"], "pnpm install in Plus profile");
-	const sourceFiles = pendingSourcePatchFiles(stablePatches);
-	if (sourceFiles.length > 0) git(dshRoot, ["apply", ...sourceFiles]);
-	if (stablePatches.some((patch) => patch.target.kind === "dsh-source")) runPnpm(dshRoot, ["run", "build"], "official DSH build after source patches");
+	if (profileChanged || workspace.changed) runPnpm(profileDirectory, ["install", "--no-frozen-lockfile"], "pnpm install in Plus profile");
+	const sourceFiles = pendingSourcePatchFiles(materialized.patches);
+	if (sourceFiles.length > 0) git(dshRoot, ["update-index", "--refresh"], true);
+	for (const file of sourceFiles) git(dshRoot, [
+		"apply",
+		"--3way",
+		file
+	]);
+	if (materialized.patches.some((patch) => patch.target.kind === "dsh-source")) runPnpm(dshRoot, ["run", "build:official"], "official DSH build after source patches");
 }
 function officialPackageRoot(dshRoot) {
 	return resolve(dshRoot, "apps", "cli");
 }
-function linkOfficialPackages(profileDirectory, dshRoot) {
-	const source = resolve(officialPackageRoot(dshRoot), "node_modules", "@deepseek-ai");
-	if (!existsSync(source)) throw new Error("official DSH dependencies are missing under " + source);
+/**
+* Parse pnpm's workspace roster into exact official package directories.
+* @param dshRoot - exact official DSH checkout root.
+* @param stdout - JSON emitted by `pnpm -r list --json --depth -1`.
+* @returns sorted official package names and directories inside the checkout.
+*/
+function parseOfficialWorkspacePackages(dshRoot, stdout) {
+	const parsed = JSON.parse(stdout);
+	if (!Array.isArray(parsed)) throw new Error("pnpm workspace package list must be an array");
+	const packages = /* @__PURE__ */ new Map();
+	for (const [index, value] of parsed.entries()) {
+		if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("pnpm workspace package list[" + String(index) + "] must be an object");
+		const entry = value;
+		if (typeof entry.name !== "string" || !entry.name.startsWith("@deepseek-ai/")) continue;
+		const localName = entry.name.slice(13);
+		if (localName === "" || localName.includes("/")) throw new Error("unsupported official workspace package name: " + entry.name);
+		if (typeof entry.path !== "string" || entry.path === "") throw new Error("pnpm workspace package " + entry.name + " has no path");
+		const directory = resolve(dshRoot, entry.path);
+		const local = relative(dshRoot, directory);
+		if (isAbsolute(local) || local === ".." || local.startsWith("../")) throw new Error("official workspace package escapes DSH root: " + entry.name);
+		const previous = packages.get(entry.name);
+		if (previous !== void 0 && previous !== directory) throw new Error("duplicate official workspace package: " + entry.name);
+		packages.set(entry.name, directory);
+	}
+	return [...packages].sort(([left], [right]) => left.localeCompare(right)).map(([name, directory]) => ({
+		name,
+		directory
+	}));
+}
+function listOfficialWorkspacePackages(dshRoot) {
+	const result = spawnSync("pnpm", [
+		"-r",
+		"list",
+		"--json",
+		"--depth",
+		"-1"
+	], {
+		cwd: dshRoot,
+		encoding: "utf8",
+		shell: process.platform === "win32"
+	});
+	if (result.error !== void 0) throw result.error;
+	if (result.status !== 0) throw new Error("pnpm list official DSH workspace packages failed with exit code " + String(result.status));
+	return parseOfficialWorkspacePackages(dshRoot, result.stdout);
+}
+/**
+* Build the profile's official scope from the CLI closure plus source workspaces.
+* @param profileDirectory - materialized Plus profile root.
+* @param cliScope - official packages already installed under the DSH CLI.
+* @param workspacePackages - additional official source workspaces required by external peers.
+*/
+function materializeOfficialPackageScope(profileDirectory, cliScope, workspacePackages) {
+	if (!existsSync(cliScope)) throw new Error("official DSH dependencies are missing under " + cliScope);
 	const destination = resolve(profileDirectory, "node_modules", "@deepseek-ai");
 	rmSync(destination, {
 		recursive: true,
 		force: true
 	});
-	symlinkSync(source, destination, process.platform === "win32" ? "junction" : "dir");
+	mkdirSync(destination, { recursive: true });
+	const linkType = process.platform === "win32" ? "junction" : "dir";
+	for (const name of readdirSync(cliScope).sort()) symlinkSync(resolve(cliScope, name), resolve(destination, name), linkType);
+	for (const entry of workspacePackages) {
+		const target = resolve(destination, entry.name.slice(13));
+		if (existsSync(target)) continue;
+		symlinkSync(entry.directory, target, linkType);
+	}
+}
+function linkOfficialPackages(profileDirectory, dshRoot) {
+	materializeOfficialPackageScope(profileDirectory, resolve(officialPackageRoot(dshRoot), "node_modules", "@deepseek-ai"), listOfficialWorkspacePackages(dshRoot));
 }
 function writeLock(profileDirectory, lock) {
 	const directory = resolve(profileDirectory, ".dsh-plus");
@@ -446,4 +572,4 @@ function runApply(argv) {
 	process.stdout.write("[dsh-plus] applied " + String(selection.patches.length) + " patches; lock " + lock + "\n");
 }
 //#endregion
-export { runApply };
+export { materializeOfficialPackageScope, parseOfficialWorkspacePackages, runApply };

package/lib/types/apply.d.ts

@@ -1,4 +1,23 @@
 /** Materialize the Plus distribution's independent patch packages without Desktop. */
+/** One official workspace package available as a profile peer dependency. */
+export interface OfficialWorkspacePackage {
+    name: string;
+    directory: string;
+}
+/**
+ * Parse pnpm's workspace roster into exact official package directories.
+ * @param dshRoot - exact official DSH checkout root.
+ * @param stdout - JSON emitted by `pnpm -r list --json --depth -1`.
+ * @returns sorted official package names and directories inside the checkout.
+ */
+export declare function parseOfficialWorkspacePackages(dshRoot: string, stdout: string): OfficialWorkspacePackage[];
+/**
+ * Build the profile's official scope from the CLI closure plus source workspaces.
+ * @param profileDirectory - materialized Plus profile root.
+ * @param cliScope - official packages already installed under the DSH CLI.
+ * @param workspacePackages - additional official source workspaces required by external peers.
+ */
+export declare function materializeOfficialPackageScope(profileDirectory: string, cliScope: string, workspacePackages: readonly OfficialWorkspacePackage[]): void;
 /**
  * Apply the installed Plus distribution metadata from a DSH profile directory.
  * @param argv - Explicit `apply --dsh-root <path>` command arguments.

package/package.json

@@ -3,32 +3,42 @@
     "dsh-plus": "lib/bin.js"
   },
   "dependencies": {
-    "@changfenhuang/dsh-genui": ">=0.9.6",
-    "@sparkelf/dsh-mobile-bridge": ">=0.2.8",
-    "@sparkelf/dsh-patch-better-sidebar-app-frame": ">=0.1.0-rc.11",
-    "@sparkelf/dsh-patch-document-attachments": ">=0.1.0-rc.11",
-    "@sparkelf/dsh-patch-genui-streaming-echart": ">=0.1.0-rc.11",
-    "@sparkelf/dsh-patch-mobile-bridge-serialized-actions": ">=0.1.0-rc.11",
-    "@sparkelf/dsh-patch-mobile-web-layout": ">=0.1.0-rc.11",
-    "@sparkelf/dsh-patch-responses-reasoning-status": ">=0.1.0-rc.11",
-    "@sparkelf/dsh-patch-subagent-settings-presets": ">=0.1.0-rc.11",
-    "@sparkelf/dsh-patch-web-base-path": ">=0.1.0-rc.11",
-    "@sparkelf/dsh-patch-workspace-storage-restore": ">=0.1.0-rc.11",
-    "@sparkelf/dsh-plugin-backup": ">=0.1.0-rc.11",
-    "@sparkelf/dsh-plugin-dataops": ">=0.1.0-rc.11",
-    "@sparkelf/dsh-plugin-document-attachments": ">=0.1.0-rc.11",
-    "@sparkelf/dsh-plugin-mcp-credentials": ">=0.1.0-rc.11",
-    "@sparkelf/dsh-plugin-subagent-settings": ">=0.1.0-rc.11",
-    "dshmarket": ">=1.29.2",
+    "@sparkelf/dsh-mobile-bridge": ">=0.2.10",
+    "@sparkelf/dsh-patch-better-sidebar-alpha2-settings": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-better-sidebar-app-frame": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-browser-auth-mode": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-document-attachments": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-genui-skill-chart-contract": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-genui-streaming-echart": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-legacy-code-preset": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-mobile-web-layout": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-ptc-mcp-schema-types": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-responses-reasoning-status": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-session-export-chinese": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-session-log-trajectory-toolbar": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-subagent-settings-presets": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-univer-office-alpha2": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-web-base-path": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-patch-workspace-storage-restore": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-plugin-backup": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-plugin-dataops": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-plugin-document-attachments": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-plugin-mcp-credentials": ">=0.1.0-rc.13",
+    "@sparkelf/dsh-plugin-subagent-settings": ">=0.1.0-rc.13",
+    "dshmarket": ">=1.38.1",
     "semver": ">=7.7.3",
     "yaml": ">=2.9.0"
   },
   "description": "DeepSeek Harness Plus official-base Web distribution profile and ranged compatibility patchset",
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-invariants": "^0.1.2-alpha.1",
+    "@changfenhuang/dsh-genui": "0.9.6",
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-invariants": "^0.1.2-alpha.2",
+    "@huanlin/dsh-plugin-better-sidebar-plugin-office": "0.1.2",
     "@types/semver": ">=7.7.1",
-    "dsh-better-sidebar": "0.17.1"
+    "dsh-better-sidebar": "0.17.1",
+    "dsh-univer-office": "0.2.12",
+    "dsh-video-preview": "0.1.4"
   },
   "dsh": {
     "bundle": {
@@ -37,39 +47,56 @@
   },
   "dshPlus": {
     "compatibility": {
-      "dsh": ">=0.1.2-alpha.1"
+      "dsh": ">=0.1.2-alpha.2"
     },
     "formatVersion": 1,
     "patchPackages": [
       "@sparkelf/dsh-patch-better-sidebar-app-frame",
+      "@sparkelf/dsh-patch-better-sidebar-alpha2-settings",
+      "@sparkelf/dsh-patch-univer-office-alpha2",
       "@sparkelf/dsh-patch-genui-streaming-echart",
-      "@sparkelf/dsh-patch-mobile-bridge-serialized-actions",
+      "@sparkelf/dsh-patch-genui-skill-chart-contract",
+      "@sparkelf/dsh-patch-browser-auth-mode",
       "@sparkelf/dsh-patch-workspace-storage-restore",
       "@sparkelf/dsh-patch-subagent-settings-presets",
       "@sparkelf/dsh-patch-document-attachments",
+      "@sparkelf/dsh-patch-legacy-code-preset",
+      "@sparkelf/dsh-patch-session-export-chinese",
+      "@sparkelf/dsh-patch-session-log-trajectory-toolbar",
       "@sparkelf/dsh-patch-responses-reasoning-status",
+      "@sparkelf/dsh-patch-ptc-mcp-schema-types",
       "@sparkelf/dsh-patch-mobile-web-layout",
       "@sparkelf/dsh-patch-web-base-path"
     ],
     "profile": {
       "allowBuilds": {
-        "node-pty": true
+        "node-pty": true,
+        "protobufjs": false
       },
       "bundles": [
         "@deepseek-ai/dsh-base",
         "@deepseek-ai/dsh-web-app",
         "dsh-better-sidebar",
+        "@huanlin/dsh-plugin-better-sidebar-plugin-office",
+        "dsh-video-preview",
+        "dsh-univer-office",
         "@sparkelf/dsh-mobile-bridge",
         "dshmarket",
         "@changfenhuang/dsh-genui",
+        "@sparkelf/dsh-plugin-supervisor",
         "@sparkelf/dsh-plus"
       ],
       "dependencies": {
-        "dsh-better-sidebar": "0.17.1"
+        "@changfenhuang/dsh-genui": "0.9.6",
+        "@huanlin/dsh-plugin-better-sidebar-plugin-office": "0.1.2",
+        "@sparkelf/dsh-plugin-supervisor": "0.1.1",
+        "dsh-better-sidebar": "0.17.1",
+        "dsh-univer-office": "0.2.12",
+        "dsh-video-preview": "0.1.4"
       }
     },
     "sourceBase": {
-      "revision": "cd5ef8148158c3a752a658978873241fdf8e2bbc"
+      "revision": "0a53fb55bea101816fa226bb964ae2bed71c343b"
     }
   },
   "exports": {
@@ -101,7 +128,7 @@
   "name": "@sparkelf/dsh-plus",
   "peerDependencies": {
     "@deepseek-ai/cordis": ">=4.0.1",
-    "@deepseek-ai/dsh-invariants": ">=0.1.2-alpha.1"
+    "@deepseek-ai/dsh-invariants": ">=0.1.2-alpha.2"
   },
   "publishConfig": {
     "access": "public"
@@ -113,5 +140,5 @@
   },
   "type": "module",
   "types": "lib/types/index.d.ts",
-  "version": "0.1.0-rc.11"
+  "version": "0.1.0-rc.13"
 }