@sparkelf/dsh-plus 0.1.0-rc.33 → 0.1.0-rc.35

package/lib/bin.js

@@ -6,6 +6,7 @@ import { createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, rm
 import { dirname, join, posix, resolve, win32 } from "node:path";
 import { homedir } from "node:os";
 import semver from "semver";
+import { parseDocument } from "yaml";
 import { fileURLToPath } from "node:url";
 import { createServer } from "node:net";
 //#region lib/types/registry-versions.js
@@ -319,11 +320,18 @@ function readDistributionProfile(distributionDirectory) {
 		if (typeof allowed !== "boolean") throw new Error("dshPlus.profile.allowBuilds." + name + " must be a boolean");
 		allowBuilds[name] = allowed;
 	}
+	const overrides = {};
+	const rawOverrides = profile.overrides === void 0 ? {} : requireRecord(profile.overrides, "dshPlus.profile.overrides");
+	for (const [name, spec] of Object.entries(rawOverrides)) {
+		if (typeof spec !== "string" || spec === "") throw new Error("dshPlus.profile.overrides." + name + " must be a non-empty string");
+		overrides[name] = spec;
+	}
 	return {
 		name: String(manifest.name),
 		bundles: requireStringArray(profile.bundles, "dshPlus.profile.bundles"),
 		dependencies,
 		allowBuilds,
+		overrides,
 		version: String(manifest.version)
 	};
 }
@@ -424,8 +432,102 @@ function ensureProfile(paths, consumerDirectory) {
 		} }
 	};
 	writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
+	writeProfileOverrides(paths.profileDirectory, distribution.overrides);
 	return true;
 }
+/**
+* Record the distribution's package substitutions in the profile workspace.
+*
+* pnpm reads \`overrides\` from \`pnpm-workspace.yaml\` since version 10 and ignores the
+* same key in \`package.json\`, so a profile that carried it in the manifest would
+* silently install the official package the override meant to replace.
+*
+* @param profileDirectory - the standalone profile directory.
+* @param overrides - official package name to published replacement spec.
+*/
+function writeProfileOverrides(profileDirectory, overrides) {
+	const workspacePath = join(profileDirectory, "pnpm-workspace.yaml");
+	const document = parseDocument(existsSync(workspacePath) ? readFileSync(workspacePath, "utf8") : "");
+	const [documentError] = document.errors;
+	if (documentError !== void 0) throw new Error("Plus profile workspace is not valid YAML", { cause: documentError });
+	if (document.get("packages") === void 0) document.set("packages", ["."]);
+	for (const [name, spec] of Object.entries(overrides)) document.setIn(["overrides", name], spec);
+	if (document.get("nodeLinker") === void 0) document.set("nodeLinker", "hoisted");
+	if (document.get("autoInstallPeers") === void 0) document.set("autoInstallPeers", false);
+	writeFileSync(workspacePath, String(document));
+}
+/** Run git in one directory, returning undefined instead of throwing when asked to. */
+function git(root, args, acceptFailure = false) {
+	const result = spawnSync("git", args, {
+		cwd: root,
+		encoding: "utf8"
+	});
+	if (result.status === 0) return result.stdout.trim();
+	if (acceptFailure) return void 0;
+	const detail = result.stderr.trim();
+	throw new Error("git " + args.join(" ") + " failed" + (detail === "" ? "" : ": " + detail));
+}
+/**
+* Apply the reviewed npm-target patches to the profile's installed packages.
+*
+* A standalone installation runs no `apply` step: it installs the distribution from
+* the registry, links the consumer's packages, and starts. The npm patches a
+* distribution declares therefore need an owner that does not require an official
+* source checkout — the source half of the apply step needs one, this does not.
+*
+* The work is idempotent: a patch whose reverse already applies is left alone, so a
+* second start neither re-applies nor fails. A reinstall restores the published bytes,
+* which is why this runs on every start rather than once.
+*
+* @param distributionDirectory - the installed `@sparkelf/dsh-plus` directory.
+* @param profileDirectory - the standalone profile directory.
+* @returns the labels of the patches that were applied.
+*/
+function applyProfileNpmPatches(distributionDirectory, profileDirectory) {
+	const names = requireRecord(requireRecord(JSON.parse(readFileSync(join(distributionDirectory, "package.json"), "utf8")), "Plus distribution manifest").dshPlus, "dshPlus").patchPackages;
+	if (!Array.isArray(names)) throw new Error("dshPlus.patchPackages must be an array");
+	const applied = [];
+	for (const value of names) {
+		if (typeof value !== "string" || value === "") throw new Error("dshPlus.patchPackages entries must be non-empty strings");
+		const patchPackage = resolveInstalledPackage(distributionDirectory, value);
+		const variants = requireRecord(patchPackage.manifest.dshPatch, value + " dshPatch").variants;
+		if (!Array.isArray(variants)) throw new Error(value + " dshPatch.variants must be an array");
+		for (const entry of variants) {
+			const variant = requireRecord(entry, value + " variant");
+			const target = requireRecord(variant.target, value + " variant target");
+			if (target.kind !== "npm") continue;
+			const targetName = String(target.name);
+			const patched = resolveInstalledPackage(profileDirectory, targetName);
+			const file = resolve(patchPackage.directory, String(variant.file));
+			if (git(patched.directory, [
+				"apply",
+				"--reverse",
+				"--check",
+				file
+			], true) !== void 0) continue;
+			git(patched.directory, ["apply", file]);
+			applied.push(value + " -> " + targetName);
+		}
+	}
+	return applied;
+}
+/** Resolve one installed package's manifest from a requiring directory. */
+function resolveInstalledPackage(from, packageName) {
+	const requireFrom = createRequire(join(from, "package.json"));
+	let manifestPath;
+	try {
+		manifestPath = requireFrom.resolve(packageName + "/package.json");
+	} catch {
+		throw new Error(packageName + " is not installed under " + from);
+	}
+	const manifest = requireRecord(JSON.parse(readFileSync(manifestPath, "utf8")), packageName + " manifest");
+	return {
+		name: packageName,
+		version: String(manifest.version),
+		directory: dirname(manifestPath),
+		manifest
+	};
+}
 //#endregion
 //#region lib/types/standalone-cli.js
 /**
@@ -529,6 +631,7 @@ async function start(argv) {
 	const paths = resolvePaths(anchor);
 	const created = ensureProfile(paths, installationRoot());
 	console.log(created ? "Created the plus profile at " + paths.profileDirectory : "Using the existing plus profile");
+	for (const label of applyProfileNpmPatches(paths.distributionDirectory, paths.profileDirectory)) console.log("Applied the reviewed patch " + label);
 	const entry = launcherEntry(anchor);
 	if (options.foreground) return runForeground(entry, options.port, options.host, options.open);
 	const existing = readState(paths.home);

package/lib/types/standalone-cli.js

@@ -14,7 +14,7 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { newerVersion } from "./registry-versions.js";
 import { DEFAULT_PORT, STOP_GRACE_MILLISECONDS, choosePort, clearState, isRunning, portAvailable, readState, spawnServer, stateDirectory, waitForAuthenticatedUrl, waitForServer, writeState, } from "./standalone-server.js";
-import { STANDALONE_PROFILE, ensureProfile, readDistributionProfile, resolvePaths, } from "./standalone-profile.js";
+import { STANDALONE_PROFILE, applyProfileNpmPatches, ensureProfile, readDistributionProfile, resolvePaths, } from "./standalone-profile.js";
 /** Milliseconds a start waits for the server to answer before reporting failure. */
 const READY_TIMEOUT_MILLISECONDS = 90_000;
 function parseStartOptions(argv) {
@@ -104,6 +104,12 @@ async function start(argv) {
     console.log(created
         ? 'Created the ' + STANDALONE_PROFILE + ' profile at ' + paths.profileDirectory
         : 'Using the existing ' + STANDALONE_PROFILE + ' profile');
+    // The profile symlinks the consumer's packages, so a patch lands on the installed
+    // copy the launcher loads. A reinstall restores the published bytes, which is why
+    // this runs on every start rather than only when the profile was created.
+    for (const label of applyProfileNpmPatches(paths.distributionDirectory, paths.profileDirectory)) {
+        console.log('Applied the reviewed patch ' + label);
+    }
     const entry = launcherEntry(anchor);
     if (options.foreground)
         return runForeground(entry, options.port, options.host, options.open);

package/lib/types/standalone-profile.d.ts

@@ -54,6 +54,7 @@ export declare function readDistributionProfile(distributionDirectory: string):
     readonly bundles: readonly string[];
     readonly dependencies: Readonly<Record<string, string>>;
     readonly allowBuilds: Readonly<Record<string, boolean>>;
+    readonly overrides: Readonly<Record<string, string>>;
     readonly version: string;
 };
 /**
@@ -91,4 +92,21 @@ export declare function resolvePaths(anchor: string, env?: NodeJS.ProcessEnv): S
  * @returns whether this call created the manifest.
  */
 export declare function ensureProfile(paths: StandalonePaths, consumerDirectory: string): boolean;
+/**
+ * Apply the reviewed npm-target patches to the profile's installed packages.
+ *
+ * A standalone installation runs no `apply` step: it installs the distribution from
+ * the registry, links the consumer's packages, and starts. The npm patches a
+ * distribution declares therefore need an owner that does not require an official
+ * source checkout — the source half of the apply step needs one, this does not.
+ *
+ * The work is idempotent: a patch whose reverse already applies is left alone, so a
+ * second start neither re-applies nor fails. A reinstall restores the published bytes,
+ * which is why this runs on every start rather than once.
+ *
+ * @param distributionDirectory - the installed `@sparkelf/dsh-plus` directory.
+ * @param profileDirectory - the standalone profile directory.
+ * @returns the labels of the patches that were applied.
+ */
+export declare function applyProfileNpmPatches(distributionDirectory: string, profileDirectory: string): string[];
 //# sourceMappingURL=standalone-profile.d.ts.map

package/lib/types/standalone-profile.js

@@ -8,10 +8,12 @@
  * the launcher mounts exactly the bundles the profile names and nothing expands a
  * bundle's own list.
  */
+import { spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readdirSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { homedir } from 'node:os';
 import { dirname, join, posix, resolve, win32 } from 'node:path';
+import { parseDocument } from 'yaml';
 /** Profile name a standalone installation owns. */
 export const STANDALONE_PROFILE = 'plus';
 function requireRecord(value, label) {
@@ -104,11 +106,24 @@ export function readDistributionProfile(distributionDirectory) {
             throw new Error('dshPlus.profile.allowBuilds.' + name + ' must be a boolean');
         allowBuilds[name] = allowed;
     }
+    // An override substitutes our republished build for an official package by name: the
+    // built code imports the official specifier, so the installed location has to keep
+    // that name while its contents come from ours.
+    const overrides = {};
+    const rawOverrides = profile.overrides === undefined
+        ? {}
+        : requireRecord(profile.overrides, 'dshPlus.profile.overrides');
+    for (const [name, spec] of Object.entries(rawOverrides)) {
+        if (typeof spec !== 'string' || spec === '')
+            throw new Error('dshPlus.profile.overrides.' + name + ' must be a non-empty string');
+        overrides[name] = spec;
+    }
     return {
         name: String(manifest.name),
         bundles: requireStringArray(profile.bundles, 'dshPlus.profile.bundles'),
         dependencies,
         allowBuilds,
+        overrides,
         version: String(manifest.version),
     };
 }
@@ -221,6 +236,107 @@ export function ensureProfile(paths, consumerDirectory) {
         },
     };
     writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
+    writeProfileOverrides(paths.profileDirectory, distribution.overrides);
     return true;
 }
+/**
+ * Record the distribution's package substitutions in the profile workspace.
+ *
+ * pnpm reads \`overrides\` from \`pnpm-workspace.yaml\` since version 10 and ignores the
+ * same key in \`package.json\`, so a profile that carried it in the manifest would
+ * silently install the official package the override meant to replace.
+ *
+ * @param profileDirectory - the standalone profile directory.
+ * @param overrides - official package name to published replacement spec.
+ */
+function writeProfileOverrides(profileDirectory, overrides) {
+    const workspacePath = join(profileDirectory, 'pnpm-workspace.yaml');
+    const document = parseDocument(existsSync(workspacePath) ? readFileSync(workspacePath, 'utf8') : '');
+    const [documentError] = document.errors;
+    if (documentError !== undefined)
+        throw new Error('Plus profile workspace is not valid YAML', { cause: documentError });
+    if (document.get('packages') === undefined)
+        document.set('packages', ['.']);
+    for (const [name, spec] of Object.entries(overrides))
+        document.setIn(['overrides', name], spec);
+    // The profile resolves bundles from this directory, so peers the official tree would
+    // supply have to come from what the consumer installed.
+    if (document.get('nodeLinker') === undefined)
+        document.set('nodeLinker', 'hoisted');
+    if (document.get('autoInstallPeers') === undefined)
+        document.set('autoInstallPeers', false);
+    writeFileSync(workspacePath, String(document));
+}
+/** Run git in one directory, returning undefined instead of throwing when asked to. */
+function git(root, args, acceptFailure = false) {
+    const result = spawnSync('git', args, { cwd: root, encoding: 'utf8' });
+    if (result.status === 0)
+        return result.stdout.trim();
+    if (acceptFailure)
+        return undefined;
+    const detail = result.stderr.trim();
+    throw new Error('git ' + args.join(' ') + ' failed' + (detail === '' ? '' : ': ' + detail));
+}
+/**
+ * Apply the reviewed npm-target patches to the profile's installed packages.
+ *
+ * A standalone installation runs no `apply` step: it installs the distribution from
+ * the registry, links the consumer's packages, and starts. The npm patches a
+ * distribution declares therefore need an owner that does not require an official
+ * source checkout — the source half of the apply step needs one, this does not.
+ *
+ * The work is idempotent: a patch whose reverse already applies is left alone, so a
+ * second start neither re-applies nor fails. A reinstall restores the published bytes,
+ * which is why this runs on every start rather than once.
+ *
+ * @param distributionDirectory - the installed `@sparkelf/dsh-plus` directory.
+ * @param profileDirectory - the standalone profile directory.
+ * @returns the labels of the patches that were applied.
+ */
+export function applyProfileNpmPatches(distributionDirectory, profileDirectory) {
+    const manifest = requireRecord(JSON.parse(readFileSync(join(distributionDirectory, 'package.json'), 'utf8')), 'Plus distribution manifest');
+    const plus = requireRecord(manifest.dshPlus, 'dshPlus');
+    const names = plus.patchPackages;
+    if (!Array.isArray(names))
+        throw new Error('dshPlus.patchPackages must be an array');
+    const applied = [];
+    for (const value of names) {
+        if (typeof value !== 'string' || value === '')
+            throw new Error('dshPlus.patchPackages entries must be non-empty strings');
+        const patchPackage = resolveInstalledPackage(distributionDirectory, value);
+        const declaration = requireRecord(patchPackage.manifest.dshPatch, value + ' dshPatch');
+        const variants = declaration.variants;
+        if (!Array.isArray(variants))
+            throw new Error(value + ' dshPatch.variants must be an array');
+        for (const entry of variants) {
+            const variant = requireRecord(entry, value + ' variant');
+            const target = requireRecord(variant.target, value + ' variant target');
+            // Only npm targets reach an installed package; a source target needs the
+            // official checkout, which a standalone installation does not have.
+            if (target.kind !== 'npm')
+                continue;
+            const targetName = String(target.name);
+            const patched = resolveInstalledPackage(profileDirectory, targetName);
+            const file = resolve(patchPackage.directory, String(variant.file));
+            if (git(patched.directory, ['apply', '--reverse', '--check', file], true) !== undefined)
+                continue;
+            git(patched.directory, ['apply', file]);
+            applied.push(value + ' -> ' + targetName);
+        }
+    }
+    return applied;
+}
+/** Resolve one installed package's manifest from a requiring directory. */
+function resolveInstalledPackage(from, packageName) {
+    const requireFrom = createRequire(join(from, 'package.json'));
+    let manifestPath;
+    try {
+        manifestPath = requireFrom.resolve(packageName + '/package.json');
+    }
+    catch {
+        throw new Error(packageName + ' is not installed under ' + from);
+    }
+    const manifest = requireRecord(JSON.parse(readFileSync(manifestPath, 'utf8')), packageName + ' manifest');
+    return { name: packageName, version: String(manifest.version), directory: dirname(manifestPath), manifest };
+}
 //# sourceMappingURL=standalone-profile.js.map

package/package.json

@@ -98,6 +98,28 @@
         "dsh-better-sidebar": "0.19.1",
         "dsh-sql-workbench": "0.5.1",
         "dsh-video-preview": "0.1.4"
+      },
+      "overrides": {
+        "@deepseek-ai/dsh-agent-presets": "npm:@sparkelf/dsh-agent-presets@0.1.5-rc.2",
+        "@deepseek-ai/dsh-api-gateway": "npm:@sparkelf/dsh-api-gateway@0.1.5-rc.2",
+        "@deepseek-ai/dsh-api-session-controller": "npm:@sparkelf/dsh-api-session-controller@0.1.5-rc.2",
+        "@deepseek-ai/dsh-client-connection": "npm:@sparkelf/dsh-client-connection@0.1.5-rc.2",
+        "@deepseek-ai/dsh-client-ui-agent-preset": "npm:@sparkelf/dsh-client-ui-agent-preset@0.1.5-rc.2",
+        "@deepseek-ai/dsh-client-ui-conversation": "npm:@sparkelf/dsh-client-ui-conversation@0.1.5-rc.2",
+        "@deepseek-ai/dsh-client-ui-deliverables": "npm:@sparkelf/dsh-client-ui-deliverables@0.1.5-rc.2",
+        "@deepseek-ai/dsh-client-ui-layout": "npm:@sparkelf/dsh-client-ui-layout@0.1.5-rc.2",
+        "@deepseek-ai/dsh-client-ui-model-selection": "npm:@sparkelf/dsh-client-ui-model-selection@0.1.5-rc.2",
+        "@deepseek-ai/dsh-client-ui-primitives": "npm:@sparkelf/dsh-client-ui-primitives@0.1.5-rc.2",
+        "@deepseek-ai/dsh-client-ui-settings-models": "npm:@sparkelf/dsh-client-ui-settings-models@0.1.5-rc.2",
+        "@deepseek-ai/dsh-client-ui-trajectory": "npm:@sparkelf/dsh-client-ui-trajectory@0.1.5-rc.2",
+        "@deepseek-ai/dsh-host-frontend-static": "npm:@sparkelf/dsh-host-frontend-static@0.1.5-rc.2",
+        "@deepseek-ai/dsh-host-webserver": "npm:@sparkelf/dsh-host-webserver@0.1.5-rc.2",
+        "@deepseek-ai/dsh-llm-pi-ai": "npm:@sparkelf/dsh-llm-pi-ai@0.1.5-rc.2",
+        "@deepseek-ai/dsh-session-log-export": "npm:@sparkelf/dsh-session-log-export@0.1.5-rc.2",
+        "@deepseek-ai/dsh-tools": "npm:@sparkelf/dsh-tools@0.1.5-rc.2",
+        "@deepseek-ai/dsh-web-app": "npm:@sparkelf/dsh-web-app@0.1.5-rc.2",
+        "@deepseek-ai/dsh-web-frontend": "npm:@sparkelf/dsh-web-frontend@0.1.5-rc.2",
+        "@deepseek-ai/dsh-workspace": "npm:@sparkelf/dsh-workspace@0.1.5-rc.2"
       }
     },
     "sourceBase": {
@@ -140,5 +162,5 @@
   },
   "type": "module",
   "types": "lib/types/index.d.ts",
-  "version": "0.1.0-rc.33"
+  "version": "0.1.0-rc.35"
 }