@sparkelf/dsh-plus 0.1.0-rc.35 → 0.1.0-rc.36

package/lib/bin.js

@@ -307,7 +307,8 @@ function resolveDistributionDirectory(anchor) {
 /** The reviewed bundle order and pins the installed distribution declares. */
 function readDistributionProfile(distributionDirectory) {
 	const manifest = requireRecord(JSON.parse(readFileSync(join(distributionDirectory, "package.json"), "utf8")), "Plus distribution manifest");
-	const profile = requireRecord(requireRecord(manifest.dshPlus, "dshPlus").profile, "dshPlus.profile");
+	const plus = requireRecord(manifest.dshPlus, "dshPlus");
+	const profile = requireRecord(plus.profile, "dshPlus.profile");
 	const rawDependencies = requireRecord(profile.dependencies, "dshPlus.profile.dependencies");
 	const rawAllowBuilds = requireRecord(profile.allowBuilds, "dshPlus.profile.allowBuilds");
 	const dependencies = {};
@@ -326,37 +327,53 @@ function readDistributionProfile(distributionDirectory) {
 		if (typeof spec !== "string" || spec === "") throw new Error("dshPlus.profile.overrides." + name + " must be a non-empty string");
 		overrides[name] = spec;
 	}
+	const compatibility = requireRecord(plus.compatibility, "dshPlus.compatibility");
 	return {
 		name: String(manifest.name),
 		bundles: requireStringArray(profile.bundles, "dshPlus.profile.bundles"),
 		dependencies,
 		allowBuilds,
 		overrides,
+		dshRange: String(compatibility.dsh),
 		version: String(manifest.version)
 	};
 }
 /**
-* Point the profile at the consumer's installed packages.
+* Give the profile its own installed tree, built from the distribution's declarations.
 *
-* The launcher resolves a bundle from the profile directory, so a profile with no
-* `node_modules` cannot see packages the consumer installed beside it. One link to
-* the consumer's directory keeps a single installed copy as the only authority.
+* The launcher resolves a bundle from the profile directory, so the profile needs its
+* own `node_modules`. Pointing it at the consumer's tree was cheaper, but it made the
+* profile inherit whatever npm had already installed — including the official packages
+* the distribution's `overrides` exist to replace. npm applies `overrides` only from a
+* project's own root, so a profile without its own tree cannot receive them at all, and
+* a patch delivered that way silently never arrives.
 *
-* npm hoists what it can and nests the rest, so a bundle can sit at the consumer's
-* top level or inside the package that depends on it. The profile reaches the first
-* through one link and the second through the distribution's own `node_modules`, and
-* a bundle found in neither is one the installation does not carry at all.
+* Installing here makes the profile that root: pnpm reads `overrides` from the
+* profile's own `pnpm-workspace.yaml`, which `writeProfileOverrides` writes before this
+* runs. The install is skipped once the tree exists so a start does not pay for it
+* twice; `dsh-plus apply` remains the command that reinstalls after a change.
 *
 * @param paths - resolved standalone paths.
-* @param consumerDirectory - directory whose `node_modules` holds the packages.
+* @param consumerDirectory - directory whose `node_modules` holds the installation.
 */
-function linkConsumerPackages(paths, consumerDirectory) {
-	const target = join(consumerDirectory, "node_modules");
-	if (!existsSync(target)) throw new Error("no node_modules in " + consumerDirectory + "; run npm install there first");
-	mkdirSync(paths.profileDirectory, { recursive: true });
-	const link = join(paths.profileDirectory, "node_modules");
-	if (!existsSync(link)) symlinkSync(target, link, "junction");
-	linkNestedBundles(paths, target);
+function installProfilePackages(paths, consumerDirectory) {
+	if (!existsSync(join(consumerDirectory, "node_modules"))) throw new Error("no node_modules in " + consumerDirectory + "; run npm install there first");
+	const profileModules = join(paths.profileDirectory, "node_modules");
+	if (existsSync(profileModules)) {
+		linkNestedBundles(paths, profileModules);
+		return;
+	}
+	runPnpm(paths.profileDirectory, ["install", "--no-frozen-lockfile"], "pnpm install in the plus profile");
+	linkNestedBundles(paths, profileModules);
+}
+/** Run pnpm in one directory, inheriting its output. */
+function runPnpm(cwd, args, label) {
+	const result = spawnSync(process.platform === "win32" ? "pnpm.cmd" : "pnpm", [...args], {
+		cwd,
+		stdio: "inherit"
+	});
+	if (result.error !== void 0) throw result.error;
+	if (result.status !== 0) throw new Error(label + " failed with exit code " + String(result.status));
 }
 /**
 * Expose the distribution's nested packages at the top level the profile searches.
@@ -413,10 +430,13 @@ function resolvePaths(anchor, env = process.env) {
 * @returns whether this call created the manifest.
 */
 function ensureProfile(paths, consumerDirectory) {
-	linkConsumerPackages(paths, consumerDirectory);
 	const manifestPath = join(paths.profileDirectory, "package.json");
-	if (existsSync(manifestPath)) return false;
 	const distribution = readDistributionProfile(paths.distributionDirectory);
+	if (existsSync(manifestPath)) {
+		writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds);
+		installProfilePackages(paths, consumerDirectory);
+		return false;
+	}
 	mkdirSync(paths.profileDirectory, { recursive: true });
 	const manifest = {
 		name: "dsh-profile-plus",
@@ -424,6 +444,7 @@ function ensureProfile(paths, consumerDirectory) {
 		type: "module",
 		dependencies: {
 			"@sparkelf/dsh-plus": distribution.version,
+			"@deepseek-ai/dsh": distribution.dshRange,
 			...distribution.dependencies
 		},
 		dsh: { profile: {
@@ -432,7 +453,8 @@ function ensureProfile(paths, consumerDirectory) {
 		} }
 	};
 	writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
-	writeProfileOverrides(paths.profileDirectory, distribution.overrides);
+	writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds);
+	installProfilePackages(paths, consumerDirectory);
 	return true;
 }
 /**
@@ -445,13 +467,14 @@ function ensureProfile(paths, consumerDirectory) {
 * @param profileDirectory - the standalone profile directory.
 * @param overrides - official package name to published replacement spec.
 */
-function writeProfileOverrides(profileDirectory, overrides) {
+function writeProfileOverrides(profileDirectory, overrides, allowBuilds) {
 	const workspacePath = join(profileDirectory, "pnpm-workspace.yaml");
 	const document = parseDocument(existsSync(workspacePath) ? readFileSync(workspacePath, "utf8") : "");
 	const [documentError] = document.errors;
 	if (documentError !== void 0) throw new Error("Plus profile workspace is not valid YAML", { cause: documentError });
 	if (document.get("packages") === void 0) document.set("packages", ["."]);
 	for (const [name, spec] of Object.entries(overrides)) document.setIn(["overrides", name], spec);
+	for (const [name, allowed] of Object.entries(allowBuilds)) document.setIn(["allowBuilds", name], allowed);
 	if (document.get("nodeLinker") === void 0) document.set("nodeLinker", "hoisted");
 	if (document.get("autoInstallPeers") === void 0) document.set("autoInstallPeers", false);
 	writeFileSync(workspacePath, String(document));

package/lib/types/standalone-profile.d.ts

@@ -55,24 +55,28 @@ export declare function readDistributionProfile(distributionDirectory: string):
     readonly dependencies: Readonly<Record<string, string>>;
     readonly allowBuilds: Readonly<Record<string, boolean>>;
     readonly overrides: Readonly<Record<string, string>>;
+    readonly dshRange: string;
     readonly version: string;
 };
 /**
- * Point the profile at the consumer's installed packages.
+ * Give the profile its own installed tree, built from the distribution's declarations.
  *
- * The launcher resolves a bundle from the profile directory, so a profile with no
- * `node_modules` cannot see packages the consumer installed beside it. One link to
- * the consumer's directory keeps a single installed copy as the only authority.
+ * The launcher resolves a bundle from the profile directory, so the profile needs its
+ * own `node_modules`. Pointing it at the consumer's tree was cheaper, but it made the
+ * profile inherit whatever npm had already installed — including the official packages
+ * the distribution's `overrides` exist to replace. npm applies `overrides` only from a
+ * project's own root, so a profile without its own tree cannot receive them at all, and
+ * a patch delivered that way silently never arrives.
  *
- * npm hoists what it can and nests the rest, so a bundle can sit at the consumer's
- * top level or inside the package that depends on it. The profile reaches the first
- * through one link and the second through the distribution's own `node_modules`, and
- * a bundle found in neither is one the installation does not carry at all.
+ * Installing here makes the profile that root: pnpm reads `overrides` from the
+ * profile's own `pnpm-workspace.yaml`, which `writeProfileOverrides` writes before this
+ * runs. The install is skipped once the tree exists so a start does not pay for it
+ * twice; `dsh-plus apply` remains the command that reinstalls after a change.
  *
  * @param paths - resolved standalone paths.
- * @param consumerDirectory - directory whose `node_modules` holds the packages.
+ * @param consumerDirectory - directory whose `node_modules` holds the installation.
  */
-export declare function linkConsumerPackages(paths: StandalonePaths, consumerDirectory: string): void;
+export declare function installProfilePackages(paths: StandalonePaths, consumerDirectory: string): void;
 /** Resolve every path a command needs, without creating anything. */
 export declare function resolvePaths(anchor: string, env?: NodeJS.ProcessEnv): StandalonePaths;
 /**

package/lib/types/standalone-profile.js

@@ -118,42 +118,58 @@ export function readDistributionProfile(distributionDirectory) {
             throw new Error('dshPlus.profile.overrides.' + name + ' must be a non-empty string');
         overrides[name] = spec;
     }
+    const compatibility = requireRecord(plus.compatibility, 'dshPlus.compatibility');
     return {
         name: String(manifest.name),
         bundles: requireStringArray(profile.bundles, 'dshPlus.profile.bundles'),
         dependencies,
         allowBuilds,
         overrides,
+        dshRange: String(compatibility.dsh),
         version: String(manifest.version),
     };
 }
 /**
- * Point the profile at the consumer's installed packages.
+ * Give the profile its own installed tree, built from the distribution's declarations.
  *
- * The launcher resolves a bundle from the profile directory, so a profile with no
- * `node_modules` cannot see packages the consumer installed beside it. One link to
- * the consumer's directory keeps a single installed copy as the only authority.
+ * The launcher resolves a bundle from the profile directory, so the profile needs its
+ * own `node_modules`. Pointing it at the consumer's tree was cheaper, but it made the
+ * profile inherit whatever npm had already installed — including the official packages
+ * the distribution's `overrides` exist to replace. npm applies `overrides` only from a
+ * project's own root, so a profile without its own tree cannot receive them at all, and
+ * a patch delivered that way silently never arrives.
  *
- * npm hoists what it can and nests the rest, so a bundle can sit at the consumer's
- * top level or inside the package that depends on it. The profile reaches the first
- * through one link and the second through the distribution's own `node_modules`, and
- * a bundle found in neither is one the installation does not carry at all.
+ * Installing here makes the profile that root: pnpm reads `overrides` from the
+ * profile's own `pnpm-workspace.yaml`, which `writeProfileOverrides` writes before this
+ * runs. The install is skipped once the tree exists so a start does not pay for it
+ * twice; `dsh-plus apply` remains the command that reinstalls after a change.
  *
  * @param paths - resolved standalone paths.
- * @param consumerDirectory - directory whose `node_modules` holds the packages.
+ * @param consumerDirectory - directory whose `node_modules` holds the installation.
  */
-export function linkConsumerPackages(paths, consumerDirectory) {
-    const target = join(consumerDirectory, 'node_modules');
-    if (!existsSync(target)) {
+export function installProfilePackages(paths, consumerDirectory) {
+    const consumerModules = join(consumerDirectory, 'node_modules');
+    if (!existsSync(consumerModules)) {
         throw new Error('no node_modules in ' + consumerDirectory + '; run npm install there first');
     }
-    mkdirSync(paths.profileDirectory, { recursive: true });
-    const link = join(paths.profileDirectory, 'node_modules');
-    if (!existsSync(link))
-        symlinkSync(target, link, 'junction');
-    // A profile created before the installation changed must still reach what npm nested
-    // afterwards, so this runs on every start rather than only when the profile is new.
-    linkNestedBundles(paths, target);
+    const profileModules = join(paths.profileDirectory, 'node_modules');
+    if (existsSync(profileModules)) {
+        // A profile installed before the distribution declared overrides still needs the
+        // packages it reaches from the consumer tree, which npm nested rather than hoisted.
+        linkNestedBundles(paths, profileModules);
+        return;
+    }
+    runPnpm(paths.profileDirectory, ['install', '--no-frozen-lockfile'], 'pnpm install in the plus profile');
+    linkNestedBundles(paths, profileModules);
+}
+/** Run pnpm in one directory, inheriting its output. */
+function runPnpm(cwd, args, label) {
+    const command = process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm';
+    const result = spawnSync(command, [...args], { cwd, stdio: 'inherit' });
+    if (result.error !== undefined)
+        throw result.error;
+    if (result.status !== 0)
+        throw new Error(label + ' failed with exit code ' + String(result.status));
 }
 /**
  * Expose the distribution's nested packages at the top level the profile searches.
@@ -217,17 +233,30 @@ export function resolvePaths(anchor, env = process.env) {
  * @returns whether this call created the manifest.
  */
 export function ensureProfile(paths, consumerDirectory) {
-    linkConsumerPackages(paths, consumerDirectory);
     const manifestPath = join(paths.profileDirectory, 'package.json');
-    if (existsSync(manifestPath))
-        return false;
     const distribution = readDistributionProfile(paths.distributionDirectory);
+    if (existsSync(manifestPath)) {
+        // The workspace carries decisions the distribution owns — overrides and the build
+        // script allowlist — and a distribution release changes them. Rewriting on every
+        // start is what lets an upgraded installation receive the new values; a profile
+        // written once keeps whatever its own release decided and can never be corrected.
+        writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds);
+        installProfilePackages(paths, consumerDirectory);
+        return false;
+    }
     mkdirSync(paths.profileDirectory, { recursive: true });
     const manifest = {
         name: 'dsh-profile-' + STANDALONE_PROFILE,
         private: true,
         type: 'module',
-        dependencies: { '@sparkelf/dsh-plus': distribution.version, ...distribution.dependencies },
+        dependencies: {
+            '@sparkelf/dsh-plus': distribution.version,
+            // The launcher's own tree supplies every service package the bundles mount. A
+            // profile that lists only the distribution's plugins installs a partial tree and
+            // fails at load with a module the launcher would have carried.
+            '@deepseek-ai/dsh': distribution.dshRange,
+            ...distribution.dependencies,
+        },
         dsh: {
             profile: {
                 bundles: distribution.bundles,
@@ -236,7 +265,9 @@ export function ensureProfile(paths, consumerDirectory) {
         },
     };
     writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
-    writeProfileOverrides(paths.profileDirectory, distribution.overrides);
+    // The overrides must reach the workspace before the install that reads them.
+    writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds);
+    installProfilePackages(paths, consumerDirectory);
     return true;
 }
 /**
@@ -249,7 +280,7 @@ export function ensureProfile(paths, consumerDirectory) {
  * @param profileDirectory - the standalone profile directory.
  * @param overrides - official package name to published replacement spec.
  */
-function writeProfileOverrides(profileDirectory, overrides) {
+function writeProfileOverrides(profileDirectory, overrides, allowBuilds) {
     const workspacePath = join(profileDirectory, 'pnpm-workspace.yaml');
     const document = parseDocument(existsSync(workspacePath) ? readFileSync(workspacePath, 'utf8') : '');
     const [documentError] = document.errors;
@@ -259,6 +290,11 @@ function writeProfileOverrides(profileDirectory, overrides) {
         document.set('packages', ['.']);
     for (const [name, spec] of Object.entries(overrides))
         document.setIn(['overrides', name], spec);
+    // pnpm refuses an install whose packages want to run build scripts until each is
+    // decided, so the distribution's reviewed decisions travel with the install rather
+    // than waiting for an interactive approval no start can offer.
+    for (const [name, allowed] of Object.entries(allowBuilds))
+        document.setIn(['allowBuilds', name], allowed);
     // The profile resolves bundles from this directory, so peers the official tree would
     // supply have to come from what the consumer installed.
     if (document.get('nodeLinker') === undefined)

package/package.json

@@ -58,12 +58,16 @@
     ],
     "profile": {
       "allowBuilds": {
-        "@officecli/officecli": true,
-        "cpu-features": false,
-        "node-pty": true,
-        "oracledb": true,
-        "protobufjs": false,
-        "ssh2": true
+        "@deepseek-ai/dsh-subprocess-local@0.1.5-rc.2": true,
+        "@google/genai@1.52.0": false,
+        "@officecli/officecli@1.0.147": true,
+        "cpu-features@0.0.10": false,
+        "koffi@3.3.0": true,
+        "node-pty@1.1.0": true,
+        "node-pty@1.2.0-beta.15": true,
+        "oracledb@7.0.1": true,
+        "protobufjs@7.6.6": false,
+        "ssh2@1.17.0": true
       },
       "bundles": [
         "@deepseek-ai/dsh-base",
@@ -100,26 +104,26 @@
         "dsh-video-preview": "0.1.4"
       },
       "overrides": {
-        "@deepseek-ai/dsh-agent-presets": "npm:@sparkelf/dsh-agent-presets@0.1.5-rc.2",
-        "@deepseek-ai/dsh-api-gateway": "npm:@sparkelf/dsh-api-gateway@0.1.5-rc.2",
-        "@deepseek-ai/dsh-api-session-controller": "npm:@sparkelf/dsh-api-session-controller@0.1.5-rc.2",
-        "@deepseek-ai/dsh-client-connection": "npm:@sparkelf/dsh-client-connection@0.1.5-rc.2",
-        "@deepseek-ai/dsh-client-ui-agent-preset": "npm:@sparkelf/dsh-client-ui-agent-preset@0.1.5-rc.2",
-        "@deepseek-ai/dsh-client-ui-conversation": "npm:@sparkelf/dsh-client-ui-conversation@0.1.5-rc.2",
-        "@deepseek-ai/dsh-client-ui-deliverables": "npm:@sparkelf/dsh-client-ui-deliverables@0.1.5-rc.2",
-        "@deepseek-ai/dsh-client-ui-layout": "npm:@sparkelf/dsh-client-ui-layout@0.1.5-rc.2",
-        "@deepseek-ai/dsh-client-ui-model-selection": "npm:@sparkelf/dsh-client-ui-model-selection@0.1.5-rc.2",
-        "@deepseek-ai/dsh-client-ui-primitives": "npm:@sparkelf/dsh-client-ui-primitives@0.1.5-rc.2",
-        "@deepseek-ai/dsh-client-ui-settings-models": "npm:@sparkelf/dsh-client-ui-settings-models@0.1.5-rc.2",
-        "@deepseek-ai/dsh-client-ui-trajectory": "npm:@sparkelf/dsh-client-ui-trajectory@0.1.5-rc.2",
-        "@deepseek-ai/dsh-host-frontend-static": "npm:@sparkelf/dsh-host-frontend-static@0.1.5-rc.2",
-        "@deepseek-ai/dsh-host-webserver": "npm:@sparkelf/dsh-host-webserver@0.1.5-rc.2",
-        "@deepseek-ai/dsh-llm-pi-ai": "npm:@sparkelf/dsh-llm-pi-ai@0.1.5-rc.2",
-        "@deepseek-ai/dsh-session-log-export": "npm:@sparkelf/dsh-session-log-export@0.1.5-rc.2",
-        "@deepseek-ai/dsh-tools": "npm:@sparkelf/dsh-tools@0.1.5-rc.2",
-        "@deepseek-ai/dsh-web-app": "npm:@sparkelf/dsh-web-app@0.1.5-rc.2",
-        "@deepseek-ai/dsh-web-frontend": "npm:@sparkelf/dsh-web-frontend@0.1.5-rc.2",
-        "@deepseek-ai/dsh-workspace": "npm:@sparkelf/dsh-workspace@0.1.5-rc.2"
+        "@deepseek-ai/dsh-agent-presets": "npm:@sparkelf/dsh-agent-presets@0.1.5-rc.6",
+        "@deepseek-ai/dsh-api-gateway": "npm:@sparkelf/dsh-api-gateway@0.1.5-rc.6",
+        "@deepseek-ai/dsh-api-session-controller": "npm:@sparkelf/dsh-api-session-controller@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-connection": "npm:@sparkelf/dsh-client-connection@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-agent-preset": "npm:@sparkelf/dsh-client-ui-agent-preset@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-conversation": "npm:@sparkelf/dsh-client-ui-conversation@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-deliverables": "npm:@sparkelf/dsh-client-ui-deliverables@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-layout": "npm:@sparkelf/dsh-client-ui-layout@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-model-selection": "npm:@sparkelf/dsh-client-ui-model-selection@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-primitives": "npm:@sparkelf/dsh-client-ui-primitives@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-settings-models": "npm:@sparkelf/dsh-client-ui-settings-models@0.1.5-rc.6",
+        "@deepseek-ai/dsh-client-ui-trajectory": "npm:@sparkelf/dsh-client-ui-trajectory@0.1.5-rc.6",
+        "@deepseek-ai/dsh-host-frontend-static": "npm:@sparkelf/dsh-host-frontend-static@0.1.5-rc.6",
+        "@deepseek-ai/dsh-host-webserver": "npm:@sparkelf/dsh-host-webserver@0.1.5-rc.6",
+        "@deepseek-ai/dsh-llm-pi-ai": "npm:@sparkelf/dsh-llm-pi-ai@0.1.5-rc.6",
+        "@deepseek-ai/dsh-session-log-export": "npm:@sparkelf/dsh-session-log-export@0.1.5-rc.6",
+        "@deepseek-ai/dsh-tools": "npm:@sparkelf/dsh-tools@0.1.5-rc.6",
+        "@deepseek-ai/dsh-web-app": "npm:@sparkelf/dsh-web-app@0.1.5-rc.6",
+        "@deepseek-ai/dsh-web-frontend": "npm:@sparkelf/dsh-web-frontend@0.1.5-rc.6",
+        "@deepseek-ai/dsh-workspace": "npm:@sparkelf/dsh-workspace@0.1.5-rc.6"
       }
     },
     "sourceBase": {
@@ -162,5 +166,5 @@
   },
   "type": "module",
   "types": "lib/types/index.d.ts",
-  "version": "0.1.0-rc.35"
+  "version": "0.1.0-rc.36"
 }