@sparkelf/dsh-plus 0.1.0-rc.34 → 0.1.0-rc.36

package/lib/bin.js

@@ -6,6 +6,7 @@ import { createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, rm
 import { dirname, join, posix, resolve, win32 } from "node:path";
 import { homedir } from "node:os";
 import semver from "semver";
+import { parseDocument } from "yaml";
 import { fileURLToPath } from "node:url";
 import { createServer } from "node:net";
 //#region lib/types/registry-versions.js
@@ -306,7 +307,8 @@ function resolveDistributionDirectory(anchor) {
 /** The reviewed bundle order and pins the installed distribution declares. */
 function readDistributionProfile(distributionDirectory) {
 	const manifest = requireRecord(JSON.parse(readFileSync(join(distributionDirectory, "package.json"), "utf8")), "Plus distribution manifest");
-	const profile = requireRecord(requireRecord(manifest.dshPlus, "dshPlus").profile, "dshPlus.profile");
+	const plus = requireRecord(manifest.dshPlus, "dshPlus");
+	const profile = requireRecord(plus.profile, "dshPlus.profile");
 	const rawDependencies = requireRecord(profile.dependencies, "dshPlus.profile.dependencies");
 	const rawAllowBuilds = requireRecord(profile.allowBuilds, "dshPlus.profile.allowBuilds");
 	const dependencies = {};
@@ -319,36 +321,59 @@ function readDistributionProfile(distributionDirectory) {
 		if (typeof allowed !== "boolean") throw new Error("dshPlus.profile.allowBuilds." + name + " must be a boolean");
 		allowBuilds[name] = allowed;
 	}
+	const overrides = {};
+	const rawOverrides = profile.overrides === void 0 ? {} : requireRecord(profile.overrides, "dshPlus.profile.overrides");
+	for (const [name, spec] of Object.entries(rawOverrides)) {
+		if (typeof spec !== "string" || spec === "") throw new Error("dshPlus.profile.overrides." + name + " must be a non-empty string");
+		overrides[name] = spec;
+	}
+	const compatibility = requireRecord(plus.compatibility, "dshPlus.compatibility");
 	return {
 		name: String(manifest.name),
 		bundles: requireStringArray(profile.bundles, "dshPlus.profile.bundles"),
 		dependencies,
 		allowBuilds,
+		overrides,
+		dshRange: String(compatibility.dsh),
 		version: String(manifest.version)
 	};
 }
 /**
-* Point the profile at the consumer's installed packages.
+* Give the profile its own installed tree, built from the distribution's declarations.
 *
-* The launcher resolves a bundle from the profile directory, so a profile with no
-* `node_modules` cannot see packages the consumer installed beside it. One link to
-* the consumer's directory keeps a single installed copy as the only authority.
+* The launcher resolves a bundle from the profile directory, so the profile needs its
+* own `node_modules`. Pointing it at the consumer's tree was cheaper, but it made the
+* profile inherit whatever npm had already installed — including the official packages
+* the distribution's `overrides` exist to replace. npm applies `overrides` only from a
+* project's own root, so a profile without its own tree cannot receive them at all, and
+* a patch delivered that way silently never arrives.
 *
-* npm hoists what it can and nests the rest, so a bundle can sit at the consumer's
-* top level or inside the package that depends on it. The profile reaches the first
-* through one link and the second through the distribution's own `node_modules`, and
-* a bundle found in neither is one the installation does not carry at all.
+* Installing here makes the profile that root: pnpm reads `overrides` from the
+* profile's own `pnpm-workspace.yaml`, which `writeProfileOverrides` writes before this
+* runs. The install is skipped once the tree exists so a start does not pay for it
+* twice; `dsh-plus apply` remains the command that reinstalls after a change.
 *
 * @param paths - resolved standalone paths.
-* @param consumerDirectory - directory whose `node_modules` holds the packages.
+* @param consumerDirectory - directory whose `node_modules` holds the installation.
 */
-function linkConsumerPackages(paths, consumerDirectory) {
-	const target = join(consumerDirectory, "node_modules");
-	if (!existsSync(target)) throw new Error("no node_modules in " + consumerDirectory + "; run npm install there first");
-	mkdirSync(paths.profileDirectory, { recursive: true });
-	const link = join(paths.profileDirectory, "node_modules");
-	if (!existsSync(link)) symlinkSync(target, link, "junction");
-	linkNestedBundles(paths, target);
+function installProfilePackages(paths, consumerDirectory) {
+	if (!existsSync(join(consumerDirectory, "node_modules"))) throw new Error("no node_modules in " + consumerDirectory + "; run npm install there first");
+	const profileModules = join(paths.profileDirectory, "node_modules");
+	if (existsSync(profileModules)) {
+		linkNestedBundles(paths, profileModules);
+		return;
+	}
+	runPnpm(paths.profileDirectory, ["install", "--no-frozen-lockfile"], "pnpm install in the plus profile");
+	linkNestedBundles(paths, profileModules);
+}
+/** Run pnpm in one directory, inheriting its output. */
+function runPnpm(cwd, args, label) {
+	const result = spawnSync(process.platform === "win32" ? "pnpm.cmd" : "pnpm", [...args], {
+		cwd,
+		stdio: "inherit"
+	});
+	if (result.error !== void 0) throw result.error;
+	if (result.status !== 0) throw new Error(label + " failed with exit code " + String(result.status));
 }
 /**
 * Expose the distribution's nested packages at the top level the profile searches.
@@ -405,10 +430,13 @@ function resolvePaths(anchor, env = process.env) {
 * @returns whether this call created the manifest.
 */
 function ensureProfile(paths, consumerDirectory) {
-	linkConsumerPackages(paths, consumerDirectory);
 	const manifestPath = join(paths.profileDirectory, "package.json");
-	if (existsSync(manifestPath)) return false;
 	const distribution = readDistributionProfile(paths.distributionDirectory);
+	if (existsSync(manifestPath)) {
+		writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds);
+		installProfilePackages(paths, consumerDirectory);
+		return false;
+	}
 	mkdirSync(paths.profileDirectory, { recursive: true });
 	const manifest = {
 		name: "dsh-profile-plus",
@@ -416,6 +444,7 @@ function ensureProfile(paths, consumerDirectory) {
 		type: "module",
 		dependencies: {
 			"@sparkelf/dsh-plus": distribution.version,
+			"@deepseek-ai/dsh": distribution.dshRange,
 			...distribution.dependencies
 		},
 		dsh: { profile: {
@@ -424,8 +453,32 @@ function ensureProfile(paths, consumerDirectory) {
 		} }
 	};
 	writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
+	writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds);
+	installProfilePackages(paths, consumerDirectory);
 	return true;
 }
+/**
+* Record the distribution's package substitutions in the profile workspace.
+*
+* pnpm reads \`overrides\` from \`pnpm-workspace.yaml\` since version 10 and ignores the
+* same key in \`package.json\`, so a profile that carried it in the manifest would
+* silently install the official package the override meant to replace.
+*
+* @param profileDirectory - the standalone profile directory.
+* @param overrides - official package name to published replacement spec.
+*/
+function writeProfileOverrides(profileDirectory, overrides, allowBuilds) {
+	const workspacePath = join(profileDirectory, "pnpm-workspace.yaml");
+	const document = parseDocument(existsSync(workspacePath) ? readFileSync(workspacePath, "utf8") : "");
+	const [documentError] = document.errors;
+	if (documentError !== void 0) throw new Error("Plus profile workspace is not valid YAML", { cause: documentError });
+	if (document.get("packages") === void 0) document.set("packages", ["."]);
+	for (const [name, spec] of Object.entries(overrides)) document.setIn(["overrides", name], spec);
+	for (const [name, allowed] of Object.entries(allowBuilds)) document.setIn(["allowBuilds", name], allowed);
+	if (document.get("nodeLinker") === void 0) document.set("nodeLinker", "hoisted");
+	if (document.get("autoInstallPeers") === void 0) document.set("autoInstallPeers", false);
+	writeFileSync(workspacePath, String(document));
+}
 /** Run git in one directory, returning undefined instead of throwing when asked to. */
 function git(root, args, acceptFailure = false) {
 	const result = spawnSync("git", args, {

package/lib/types/standalone-profile.d.ts

@@ -54,24 +54,29 @@ export declare function readDistributionProfile(distributionDirectory: string):
     readonly bundles: readonly string[];
     readonly dependencies: Readonly<Record<string, string>>;
     readonly allowBuilds: Readonly<Record<string, boolean>>;
+    readonly overrides: Readonly<Record<string, string>>;
+    readonly dshRange: string;
     readonly version: string;
 };
 /**
- * Point the profile at the consumer's installed packages.
+ * Give the profile its own installed tree, built from the distribution's declarations.
  *
- * The launcher resolves a bundle from the profile directory, so a profile with no
- * `node_modules` cannot see packages the consumer installed beside it. One link to
- * the consumer's directory keeps a single installed copy as the only authority.
+ * The launcher resolves a bundle from the profile directory, so the profile needs its
+ * own `node_modules`. Pointing it at the consumer's tree was cheaper, but it made the
+ * profile inherit whatever npm had already installed — including the official packages
+ * the distribution's `overrides` exist to replace. npm applies `overrides` only from a
+ * project's own root, so a profile without its own tree cannot receive them at all, and
+ * a patch delivered that way silently never arrives.
  *
- * npm hoists what it can and nests the rest, so a bundle can sit at the consumer's
- * top level or inside the package that depends on it. The profile reaches the first
- * through one link and the second through the distribution's own `node_modules`, and
- * a bundle found in neither is one the installation does not carry at all.
+ * Installing here makes the profile that root: pnpm reads `overrides` from the
+ * profile's own `pnpm-workspace.yaml`, which `writeProfileOverrides` writes before this
+ * runs. The install is skipped once the tree exists so a start does not pay for it
+ * twice; `dsh-plus apply` remains the command that reinstalls after a change.
  *
  * @param paths - resolved standalone paths.
- * @param consumerDirectory - directory whose `node_modules` holds the packages.
+ * @param consumerDirectory - directory whose `node_modules` holds the installation.
  */
-export declare function linkConsumerPackages(paths: StandalonePaths, consumerDirectory: string): void;
+export declare function installProfilePackages(paths: StandalonePaths, consumerDirectory: string): void;
 /** Resolve every path a command needs, without creating anything. */
 export declare function resolvePaths(anchor: string, env?: NodeJS.ProcessEnv): StandalonePaths;
 /**

package/lib/types/standalone-profile.js

@@ -13,6 +13,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, symlinkSync, writeFil
 import { createRequire } from 'node:module';
 import { homedir } from 'node:os';
 import { dirname, join, posix, resolve, win32 } from 'node:path';
+import { parseDocument } from 'yaml';
 /** Profile name a standalone installation owns. */
 export const STANDALONE_PROFILE = 'plus';
 function requireRecord(value, label) {
@@ -105,41 +106,70 @@ export function readDistributionProfile(distributionDirectory) {
             throw new Error('dshPlus.profile.allowBuilds.' + name + ' must be a boolean');
         allowBuilds[name] = allowed;
     }
+    // An override substitutes our republished build for an official package by name: the
+    // built code imports the official specifier, so the installed location has to keep
+    // that name while its contents come from ours.
+    const overrides = {};
+    const rawOverrides = profile.overrides === undefined
+        ? {}
+        : requireRecord(profile.overrides, 'dshPlus.profile.overrides');
+    for (const [name, spec] of Object.entries(rawOverrides)) {
+        if (typeof spec !== 'string' || spec === '')
+            throw new Error('dshPlus.profile.overrides.' + name + ' must be a non-empty string');
+        overrides[name] = spec;
+    }
+    const compatibility = requireRecord(plus.compatibility, 'dshPlus.compatibility');
     return {
         name: String(manifest.name),
         bundles: requireStringArray(profile.bundles, 'dshPlus.profile.bundles'),
         dependencies,
         allowBuilds,
+        overrides,
+        dshRange: String(compatibility.dsh),
         version: String(manifest.version),
     };
 }
 /**
- * Point the profile at the consumer's installed packages.
+ * Give the profile its own installed tree, built from the distribution's declarations.
  *
- * The launcher resolves a bundle from the profile directory, so a profile with no
- * `node_modules` cannot see packages the consumer installed beside it. One link to
- * the consumer's directory keeps a single installed copy as the only authority.
+ * The launcher resolves a bundle from the profile directory, so the profile needs its
+ * own `node_modules`. Pointing it at the consumer's tree was cheaper, but it made the
+ * profile inherit whatever npm had already installed — including the official packages
+ * the distribution's `overrides` exist to replace. npm applies `overrides` only from a
+ * project's own root, so a profile without its own tree cannot receive them at all, and
+ * a patch delivered that way silently never arrives.
  *
- * npm hoists what it can and nests the rest, so a bundle can sit at the consumer's
- * top level or inside the package that depends on it. The profile reaches the first
- * through one link and the second through the distribution's own `node_modules`, and
- * a bundle found in neither is one the installation does not carry at all.
+ * Installing here makes the profile that root: pnpm reads `overrides` from the
+ * profile's own `pnpm-workspace.yaml`, which `writeProfileOverrides` writes before this
+ * runs. The install is skipped once the tree exists so a start does not pay for it
+ * twice; `dsh-plus apply` remains the command that reinstalls after a change.
  *
  * @param paths - resolved standalone paths.
- * @param consumerDirectory - directory whose `node_modules` holds the packages.
+ * @param consumerDirectory - directory whose `node_modules` holds the installation.
  */
-export function linkConsumerPackages(paths, consumerDirectory) {
-    const target = join(consumerDirectory, 'node_modules');
-    if (!existsSync(target)) {
+export function installProfilePackages(paths, consumerDirectory) {
+    const consumerModules = join(consumerDirectory, 'node_modules');
+    if (!existsSync(consumerModules)) {
         throw new Error('no node_modules in ' + consumerDirectory + '; run npm install there first');
     }
-    mkdirSync(paths.profileDirectory, { recursive: true });
-    const link = join(paths.profileDirectory, 'node_modules');
-    if (!existsSync(link))
-        symlinkSync(target, link, 'junction');
-    // A profile created before the installation changed must still reach what npm nested
-    // afterwards, so this runs on every start rather than only when the profile is new.
-    linkNestedBundles(paths, target);
+    const profileModules = join(paths.profileDirectory, 'node_modules');
+    if (existsSync(profileModules)) {
+        // A profile installed before the distribution declared overrides still needs the
+        // packages it reaches from the consumer tree, which npm nested rather than hoisted.
+        linkNestedBundles(paths, profileModules);
+        return;
+    }
+    runPnpm(paths.profileDirectory, ['install', '--no-frozen-lockfile'], 'pnpm install in the plus profile');
+    linkNestedBundles(paths, profileModules);
+}
+/** Run pnpm in one directory, inheriting its output. */
+function runPnpm(cwd, args, label) {
+    const command = process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm';
+    const result = spawnSync(command, [...args], { cwd, stdio: 'inherit' });
+    if (result.error !== undefined)
+        throw result.error;
+    if (result.status !== 0)
+        throw new Error(label + ' failed with exit code ' + String(result.status));
 }
 /**
  * Expose the distribution's nested packages at the top level the profile searches.
@@ -203,17 +233,30 @@ export function resolvePaths(anchor, env = process.env) {
  * @returns whether this call created the manifest.
  */
 export function ensureProfile(paths, consumerDirectory) {
-    linkConsumerPackages(paths, consumerDirectory);
     const manifestPath = join(paths.profileDirectory, 'package.json');
-    if (existsSync(manifestPath))
-        return false;
     const distribution = readDistributionProfile(paths.distributionDirectory);
+    if (existsSync(manifestPath)) {
+        // The workspace carries decisions the distribution owns — overrides and the build
+        // script allowlist — and a distribution release changes them. Rewriting on every
+        // start is what lets an upgraded installation receive the new values; a profile
+        // written once keeps whatever its own release decided and can never be corrected.
+        writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds);
+        installProfilePackages(paths, consumerDirectory);
+        return false;
+    }
     mkdirSync(paths.profileDirectory, { recursive: true });
     const manifest = {
         name: 'dsh-profile-' + STANDALONE_PROFILE,
         private: true,
         type: 'module',
-        dependencies: { '@sparkelf/dsh-plus': distribution.version, ...distribution.dependencies },
+        dependencies: {
+            '@sparkelf/dsh-plus': distribution.version,
+            // The launcher's own tree supplies every service package the bundles mount. A
+            // profile that lists only the distribution's plugins installs a partial tree and
+            // fails at load with a module the launcher would have carried.
+            '@deepseek-ai/dsh': distribution.dshRange,
+            ...distribution.dependencies,
+        },
         dsh: {
             profile: {
                 bundles: distribution.bundles,
@@ -222,8 +265,44 @@ export function ensureProfile(paths, consumerDirectory) {
         },
     };
     writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
+    // The overrides must reach the workspace before the install that reads them.
+    writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds);
+    installProfilePackages(paths, consumerDirectory);
     return true;
 }
+/**
+ * Record the distribution's package substitutions in the profile workspace.
+ *
+ * pnpm reads \`overrides\` from \`pnpm-workspace.yaml\` since version 10 and ignores the
+ * same key in \`package.json\`, so a profile that carried it in the manifest would
+ * silently install the official package the override meant to replace.
+ *
+ * @param profileDirectory - the standalone profile directory.
+ * @param overrides - official package name to published replacement spec.
+ */
+function writeProfileOverrides(profileDirectory, overrides, allowBuilds) {
+    const workspacePath = join(profileDirectory, 'pnpm-workspace.yaml');
+    const document = parseDocument(existsSync(workspacePath) ? readFileSync(workspacePath, 'utf8') : '');
+    const [documentError] = document.errors;
+    if (documentError !== undefined)
+        throw new Error('Plus profile workspace is not valid YAML', { cause: documentError });
+    if (document.get('packages') === undefined)
+        document.set('packages', ['.']);
+    for (const [name, spec] of Object.entries(overrides))
+        document.setIn(['overrides', name], spec);
+    // pnpm refuses an install whose packages want to run build scripts until each is
+    // decided, so the distribution's reviewed decisions travel with the install rather
+    // than waiting for an interactive approval no start can offer.
+    for (const [name, allowed] of Object.entries(allowBuilds))
+        document.setIn(['allowBuilds', name], allowed);
+    // The profile resolves bundles from this directory, so peers the official tree would
+    // supply have to come from what the consumer installed.
+    if (document.get('nodeLinker') === undefined)
+        document.set('nodeLinker', 'hoisted');
+    if (document.get('autoInstallPeers') === undefined)
+        document.set('autoInstallPeers', false);
+    writeFileSync(workspacePath, String(document));
+}
 /** Run git in one directory, returning undefined instead of throwing when asked to. */
 function git(root, args, acceptFailure = false) {
     const result = spawnSync('git', args, { cwd: root, encoding: 'utf8' });

package/package.json

@@ -58,12 +58,16 @@
     ],
     "profile": {
       "allowBuilds": {
-        "@officecli/officecli": true,
-        "cpu-features": false,
-        "node-pty": true,
-        "oracledb": true,
-        "protobufjs": false,
-        "ssh2": true
+        "@deepseek-ai/dsh-subprocess-local@0.1.5-rc.2": true,
+        "@google/genai@1.52.0": false,
+        "@officecli/officecli@1.0.147": true,
+        "cpu-features@0.0.10": false,
+        "koffi@3.3.0": true,
+        "node-pty@1.1.0": true,
+        "node-pty@1.2.0-beta.15": true,
+        "oracledb@7.0.1": true,
+        "protobufjs@7.6.6": false,
+        "ssh2@1.17.0": true
       },
       "bundles": [
         "@deepseek-ai/dsh-base",
@@ -98,6 +102,28 @@
         "dsh-better-sidebar": "0.19.1",
         "dsh-sql-workbench": "0.5.1",
         "dsh-video-preview": "0.1.4"
+      },
+      "overrides": {
+        "@deepseek-ai/dsh-agent-presets": "npm:@sparkelf/dsh-agent-presets@0.1.5-rc.6",
+        "@deepseek-ai/dsh-api-gateway": "npm:@sparkelf/dsh-api-gateway@0.1.5-rc.6",
+        "@deepseek-ai/dsh-api-session-controller": "npm:@sparkelf/dsh-api-session-controller@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-connection": "npm:@sparkelf/dsh-client-connection@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-agent-preset": "npm:@sparkelf/dsh-client-ui-agent-preset@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-conversation": "npm:@sparkelf/dsh-client-ui-conversation@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-deliverables": "npm:@sparkelf/dsh-client-ui-deliverables@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-layout": "npm:@sparkelf/dsh-client-ui-layout@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-model-selection": "npm:@sparkelf/dsh-client-ui-model-selection@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-primitives": "npm:@sparkelf/dsh-client-ui-primitives@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-settings-models": "npm:@sparkelf/dsh-client-ui-settings-models@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-trajectory": "npm:@sparkelf/dsh-client-ui-trajectory@0.1.5-rc.6",
+        "@deepseek-ai/dsh-host-frontend-static": "npm:@sparkelf/dsh-host-frontend-static@0.1.5-rc.6",
+        "@deepseek-ai/dsh-host-webserver": "npm:@sparkelf/dsh-host-webserver@0.1.5-rc.6",
+        "@deepseek-ai/dsh-llm-pi-ai": "npm:@sparkelf/dsh-llm-pi-ai@0.1.5-rc.6",
+        "@deepseek-ai/dsh-session-log-export": "npm:@sparkelf/dsh-session-log-export@0.1.5-rc.6",
+        "@deepseek-ai/dsh-tools": "npm:@sparkelf/dsh-tools@0.1.5-rc.6",
+        "@deepseek-ai/dsh-web-app": "npm:@sparkelf/dsh-web-app@0.1.5-rc.6",
+        "@deepseek-ai/dsh-web-frontend": "npm:@sparkelf/dsh-web-frontend@0.1.5-rc.6",
+        "@deepseek-ai/dsh-workspace": "npm:@sparkelf/dsh-workspace@0.1.5-rc.6"
       }
     },
     "sourceBase": {
@@ -140,5 +166,5 @@
   },
   "type": "module",
   "types": "lib/types/index.d.ts",
-  "version": "0.1.0-rc.34"
+  "version": "0.1.0-rc.36"
 }