@sparkelf/dsh-plus 0.2.4-alpha.47 → 0.2.5-alpha.49

package/lib/types/standalone-profile.js

@@ -9,12 +9,12 @@
  * bundle's own list.
  */
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
 import { dirname, join, posix, resolve, win32 } from 'node:path';
 import { parseDocument } from 'yaml';
+import { projectEdition, readDistributionFacts } from "./manifest.js";
 import { readPatchSet } from "./patch-set.js";
 /** Profile name a standalone installation owns when its package declares none. */
 export const STANDALONE_PROFILE = 'plus';
@@ -94,16 +94,29 @@ function requireRecord(value, label) {
         throw new Error(label + ' must be an object');
     return value;
 }
-function requireStringArray(value, label) {
-    if (!Array.isArray(value) || value.some(entry => typeof entry !== 'string'))
-        throw new Error(label + ' must be a string array');
-    return value;
-}
-/** Read one non-empty string field. */
-function requireString(value, label) {
-    if (typeof value !== 'string' || value.trim() === '')
-        throw new Error(label + ' must be a non-empty string');
-    return value;
+/**
+ * Resolve the file that was actually invoked from the path the shell was handed.
+ *
+ * A global npm install links `<prefix>/bin/dsh-plus` to the package entry. Resolving
+ * `@sparkelf/dsh-plus` from that link starts at the bin directory, which has no
+ * `node_modules`, so every globally installed command reported the distribution as
+ * missing. The real path is the package file, and the package resolves its own name.
+ *
+ * @param invoked - `process.argv[1]`, or undefined when node ran without a script.
+ * @param fallback - this module's own file, used when there is no script path.
+ * @returns an absolute path that exists, or the input when it cannot be resolved.
+ */
+export function resolveInvocationAnchor(invoked, fallback) {
+    if (invoked === undefined || invoked === '')
+        return realpathSync(fallback);
+    try {
+        return realpathSync(invoked);
+    }
+    catch {
+        // A path the filesystem no longer knows cannot be resolved; the caller's error message is
+        // more useful with what it was given than with a second failure here.
+        return resolve(invoked);
+    }
 }
 /** Resolve the DSH home, honouring the environment override the launcher itself reads. */
 export function resolveHome(env = process.env) {
@@ -143,15 +156,12 @@ export function isWithin(candidate, parent, platform = process.platform) {
  * @returns absolute path to the installed distribution.
  */
 export function resolveDistributionDirectory(anchor) {
-    const ownDirectory = dirname(dirname(fileURLToPath(import.meta.url)));
     let resolved;
     try {
         resolved = dirname(createRequire(anchor).resolve('@sparkelf/dsh-plus/package.json'));
     }
     catch {
-        // `npx @sparkelf/dsh-plus ...` runs the CLI from a temporary install, so the consumer
-        // tree has no copy to resolve. The running module's own package is the distribution.
-        return ownDirectory;
+        throw new Error('@sparkelf/dsh-plus is not installed in ' + dirname(anchor) + '; run this command from the directory that installed it');
     }
     // A resolution that leaves the consumer tree means the module answered from its own
     // installation, which reports health for a distribution the consumer never installed.
@@ -167,64 +177,25 @@ export function resolveDistributionDirectory(anchor) {
             break;
         current = parent;
     }
-    return ownDirectory;
+    throw new Error('@sparkelf/dsh-plus resolved outside ' + resolve(dirname(anchor)) + ' (found ' + resolved + '); run this command from the directory that installed it');
 }
-export function readDistributionProfile(distributionDirectory) {
-    const manifest = requireRecord(JSON.parse(readFileSync(join(distributionDirectory, 'package.json'), 'utf8')), 'Plus distribution manifest');
-    const plus = requireRecord(manifest.dshPlus, 'dshPlus');
-    const profile = requireRecord(plus.profile, 'dshPlus.profile');
-    const dependencies = requireDependencyMap(requireRecord(profile.dependencies, 'dshPlus.profile.dependencies'), 'dshPlus.profile.dependencies');
-    const rawAllowBuilds = requireRecord(profile.allowBuilds, 'dshPlus.profile.allowBuilds');
-    const allowBuilds = {};
-    for (const [name, allowed] of Object.entries(rawAllowBuilds)) {
-        if (typeof allowed !== 'boolean')
-            throw new Error('dshPlus.profile.allowBuilds.' + name + ' must be a boolean');
-        allowBuilds[name] = allowed;
-    }
-    // An override substitutes our republished build for an official package by name: the
-    // built code imports the official specifier, so the installed location has to keep
-    // that name while its contents come from ours.
-    const overrides = {};
-    const rawOverrides = profile.overrides === undefined
-        ? {}
-        : requireRecord(profile.overrides, 'dshPlus.profile.overrides');
-    for (const [name, spec] of Object.entries(rawOverrides)) {
-        if (typeof spec !== 'string' || spec === '')
-            throw new Error('dshPlus.profile.overrides.' + name + ' must be a non-empty string');
-        overrides[name] = spec;
-    }
-    const editions = {};
-    const rawEditions = plus.editions === undefined ? {} : requireRecord(plus.editions, 'dshPlus.editions');
-    for (const [id, value] of Object.entries(rawEditions)) {
-        const edition = requireRecord(value, 'dshPlus.editions.' + id);
-        editions[id] = {
-            label: requireString(edition.label, 'dshPlus.editions.' + id + '.label'),
-            bundles: requireStringArray(edition.bundles, 'dshPlus.editions.' + id + '.bundles'),
-            packages: requireDependencyMap(requireRecord(edition.packages, 'dshPlus.editions.' + id + '.packages'), 'dshPlus.editions.' + id + '.packages'),
-        };
-    }
-    const compatibility = requireRecord(plus.compatibility, 'dshPlus.compatibility');
+/** The reviewed bundle order and pins the installed distribution declares, for one variant. */
+export function readDistributionProfile(distributionDirectory, editionId, extraExcludes = []) {
+    const facts = readDistributionFacts(distributionDirectory);
+    const projection = projectEdition(facts, editionId, extraExcludes);
     return {
-        name: String(manifest.name),
-        bundles: requireStringArray(profile.bundles, 'dshPlus.profile.bundles'),
-        dependencies,
-        allowBuilds,
-        overrides,
-        editions,
-        dshRange: String(compatibility.dsh),
-        version: String(manifest.version),
+        name: facts.name,
+        version: facts.version,
+        dshRange: '>=' + facts.runtimeVersion,
+        runtimeVersion: facts.runtimeVersion,
+        bundles: projection.bundles,
+        dependencies: projection.dependencies,
+        allowBuilds: projection.allowBuilds,
+        overrides: projection.overrides,
+        omittedPackages: projection.omittedPackages,
+        editions: facts.editions,
     };
 }
-/** Read one package-name-to-spec map, rejecting empty entries. */
-function requireDependencyMap(value, label) {
-    const dependencies = {};
-    for (const [name, spec] of Object.entries(value)) {
-        if (typeof spec !== 'string' || spec === '')
-            throw new Error(label + '.' + name + ' must be a non-empty string');
-        dependencies[name] = spec;
-    }
-    return dependencies;
-}
 /**
  * Give the profile its own installed tree, built from the distribution's declarations.
  *
@@ -241,18 +212,11 @@ function requireDependencyMap(value, label) {
  * twice; `dsh-plus apply` remains the command that reinstalls after a change.
  *
  * @param paths - resolved standalone paths.
- * @param consumerDirectory - directory whose `node_modules` holds the installation.
  */
-export function installProfilePackages(paths, consumerDirectory) {
-    const consumerModules = join(consumerDirectory, 'node_modules');
-    if (!existsSync(consumerModules)) {
-        // `npx @sparkelf/dsh-plus` runs from a temporary package tree that has no launcher
-        // beside it. The profile installs its own tree, so there is nothing to link from
-        // the caller; only the profile's packages matter.
-        installWithRegistryFallback(paths);
-        alignReplacedPackageNames(join(paths.profileDirectory, 'node_modules'));
-        return;
-    }
+export function installProfilePackages(paths, omitted = new Set(), runtimeVersion, registry) {
+    // The profile owns its dependency tree: it declares the launcher and every plugin, so it can
+    // install without a consumer tree beside it. A globally installed distribution has none --
+    // its only node_modules is the one npm laid out around the command itself.
     const profileModules = join(paths.profileDirectory, 'node_modules');
     if (existsSync(profileModules)) {
         // A profile installed before the distribution declared overrides still needs the
@@ -260,9 +224,142 @@ export function installProfilePackages(paths, consumerDirectory) {
         linkNestedBundles(paths, profileModules);
         return;
     }
-    installWithRegistryFallback(paths);
-    alignReplacedPackageNames(profileModules);
+    installWithRegistryFallback(paths.profileDirectory);
+    // A range admits the next prerelease, so the official family lands one generation ahead of
+    // the runtime the republished builds were cut against. Realign, then finish the tree.
+    if (runtimeVersion !== undefined && registry !== undefined) {
+        alignOfficialVersions(paths.profileDirectory, runtimeVersion, registry);
+    }
+    alignReplacedPackageNames(profileModules, omitted);
     linkNestedBundles(paths, profileModules);
+    assertProfileBundles(paths.profileDirectory);
+}
+/** Package names a package declares as peers on the official runtime family. */
+function officialPeers(profileDirectory) {
+    const peers = new Set();
+    const manifests = [];
+    for (const scope of [join(profileDirectory, 'node_modules'), join(profileDirectory, 'node_modules', '@deepseek-ai')]) {
+        if (!existsSync(scope))
+            continue;
+        for (const entry of readdirSync(scope)) {
+            if (entry.startsWith('.'))
+                continue;
+            if (entry.startsWith('@') && entry !== '@deepseek-ai')
+                continue;
+            if (entry === '@deepseek-ai') {
+                for (const scoped of readdirSync(scope))
+                    manifests.push(join(scope, scoped, 'package.json'));
+                continue;
+            }
+            manifests.push(join(scope, entry, 'package.json'));
+        }
+    }
+    for (const manifestPath of manifests) {
+        if (!existsSync(manifestPath))
+            continue;
+        try {
+            const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+            for (const peer of Object.keys(manifest.peerDependencies ?? {})) {
+                if (peer.startsWith('@deepseek-ai/dsh') && peer !== '@deepseek-ai/dsh')
+                    peers.add(peer);
+            }
+        }
+        catch {
+            // A package whose manifest cannot be read declares no peer this step can act on.
+        }
+    }
+    return peers;
+}
+/**
+ * Which of the given package versions a registry serves.
+ *
+ * The probe runs in one Node child: one process per name is slow, and the caller needs the
+ * answer before the second install.
+ *
+ * @param names - package names to check.
+ * @param version - exact version each must serve.
+ * @param registry - registry base URL.
+ * @returns the names the registry serves at that version.
+ */
+function servedVersions(names, version, registry) {
+    if (names.length === 0)
+        return new Set();
+    const script = `
+    const [names, version, registry] = JSON.parse(process.argv[1])
+    const base = registry.replace(/\\/$/, '')
+    const queue = [...names]
+    const served = []
+    await Promise.all(Array.from({ length: 10 }, async () => {
+      while (queue.length > 0) {
+        const name = queue.shift()
+        try {
+          const response = await fetch(base + '/' + name.replace('/', '%2f') + '/' + version)
+          if (response.ok) served.push(name)
+        } catch {}
+      }
+    }))
+    process.stdout.write(served.join('\\n'))
+  `;
+    const result = spawnSync(process.execPath, ['--input-type=module', '-e', script, JSON.stringify([names, version, registry])], { encoding: 'utf8' });
+    if (result.status !== 0)
+        return new Set();
+    return new Set(result.stdout.split('\n').map(entry => entry.trim()).filter(entry => entry !== ''));
+}
+/**
+ * Move the shared official services onto the runtime's exact version.
+ *
+ * The republished builds were cut against one runtime, and DSH disables a row when the exact
+ * peers a plugin declares disagree with the process it shares. Plugins declare those services as
+ * peers, so the names worth pinning are the peers actually installed -- read from the tree and
+ * checked against the registry. The rest of the official family keeps its resolved versions:
+ * pinning everything traded one mismatch for a tree with holes.
+ *
+ * @param profileDirectory - profile whose tree was just installed.
+ * @param runtimeVersion - exact runtime the profile boots.
+ * @param registry - registry the profile installs from.
+ * @returns how many services were realigned.
+ */
+export function alignOfficialVersions(profileDirectory, runtimeVersion, registry) {
+    const wanted = [...officialPeers(profileDirectory)];
+    const served = servedVersions(wanted, runtimeVersion, registry);
+    if (served.size === 0)
+        return 0;
+    const workspacePath = join(profileDirectory, 'pnpm-workspace.yaml');
+    const document = parseDocument(readFileSync(workspacePath, 'utf8'));
+    let changed = 0;
+    for (const name of served) {
+        if (document.getIn(['overrides', name]) === runtimeVersion)
+            continue;
+        document.setIn(['overrides', name], runtimeVersion);
+        changed += 1;
+    }
+    if (changed === 0)
+        return 0;
+    writeFileSync(workspacePath, String(document));
+    rmSync(join(profileDirectory, 'pnpm-lock.yaml'), { force: true });
+    installWithRegistryFallback(profileDirectory);
+    return changed;
+}
+/**
+ * Assert every bundle row the profile declares resolves in its installed tree.
+ *
+ * A row without an installed package mounts nothing and reports nothing: the client module
+ * system simply never registers it, and every earlier step passes. Reading the rows back from
+ * the manifest on disk rather than from the projection is what makes this cover the tree the
+ * launcher actually boots.
+ *
+ * @param profileDirectory - profile whose node_modules was just installed.
+ */
+export function assertProfileBundles(profileDirectory) {
+    const manifest = JSON.parse(readFileSync(join(profileDirectory, 'package.json'), 'utf8'));
+    const missing = [];
+    for (const name of manifest.dsh?.profile?.bundles ?? []) {
+        if (!existsSync(join(profileDirectory, 'node_modules', name, 'package.json')))
+            missing.push(name);
+    }
+    if (missing.length > 0) {
+        throw new Error('the profile mounts bundles it did not install: ' + missing.join(', '));
+    }
 }
 /**
  * Install the profile from the first registry that answers.
@@ -273,21 +370,13 @@ export function installProfilePackages(paths, consumerDirectory) {
  *
  * @param paths - resolved standalone paths.
  */
-function installWithRegistryFallback(paths) {
+function installWithRegistryFallback(profileDirectory) {
     const registries = registryOrder();
     for (const [index, registry] of registries.entries()) {
-        // A lockfile written against the previous registry keeps its resolved URLs, so the
-        // second attempt would fetch from the registry that just failed. Drop it and resolve
-        // against the registry being tried.
-        if (index > 0)
-            rmSync(join(paths.profileDirectory, 'pnpm-lock.yaml'), { force: true });
         const result = spawnSync('pnpm', ['install', '--no-frozen-lockfile', '--registry', registry], {
-            cwd: paths.profileDirectory,
+            cwd: profileDirectory,
             stdio: 'inherit',
             shell: process.platform === 'win32',
-            // A registry that accepts the connection but never answers would otherwise hold the
-            // first start for pnpm's full retry budget before the fallback got a chance.
-            timeout: 5 * 60_000,
         });
         if (result.error !== undefined)
             throw result.error;
@@ -316,22 +405,54 @@ function installWithRegistryFallback(paths) {
  *
  * @param profileModules - the profile's \`node_modules\` directory.
  */
-export function alignReplacedPackageNames(profileModules) {
-    const scoped = join(profileModules, '@deepseek-ai');
-    if (!existsSync(scoped))
+export function alignReplacedPackageNames(profileModules, omitted = new Set()) {
+    if (!existsSync(profileModules))
         return;
-    for (const entry of readdirSync(scoped)) {
-        const manifestPath = join(scoped, entry, 'package.json');
+    // A replaced package is installed at the name its loader row declares, but the manifest inside
+    // still names our scope: the client module system requires the directory's package to declare
+    // the directory name, so the panels it renders would never register. Both scopes are walked
+    // because a row can be an unscoped alias (`dsh-better-sidebar`) onto a scoped build.
+    const align = (expected, manifestPath) => {
         if (!existsSync(manifestPath))
-            continue;
+            return;
         const declared = JSON.parse(readFileSync(manifestPath, 'utf8'));
-        const expected = '@deepseek-ai/' + entry;
-        if (declared.name === expected)
-            continue;
-        const replaced = { ...declared, name: expected };
+        if (declared.name === expected || omitted.has(expected))
+            return;
         const temporary = manifestPath + '.dsh-name';
-        writeFileSync(temporary, JSON.stringify(replaced, null, 2) + '\n');
+        writeFileSync(temporary, JSON.stringify({ ...declared, name: expected }, null, 2) + '\n');
         renameSync(temporary, manifestPath);
+    };
+    for (const entry of readdirSync(profileModules)) {
+        if (entry.startsWith('.'))
+            continue;
+        if (!entry.startsWith('@')) {
+            // An unscoped row is an npm alias onto a scoped build. The package imports its real
+            // scoped name, so renaming it would break its own imports; exposing the scoped name as
+            // a link is what makes both the row and the package resolve.
+            const manifestPath = join(profileModules, entry, 'package.json');
+            if (!existsSync(manifestPath))
+                continue;
+            const declared = JSON.parse(readFileSync(manifestPath, 'utf8'));
+            if (declared.name === undefined || declared.name === entry)
+                continue;
+            const [scope, name] = declared.name.split('/');
+            if (scope === undefined || name === undefined)
+                continue;
+            mkdirSync(join(profileModules, scope), { recursive: true });
+            const link = join(profileModules, scope, name);
+            if (existsSync(link))
+                continue;
+            try {
+                symlinkSync(join('..', entry), link, 'junction');
+            }
+            catch {
+                // A concurrent install may have created the same link; the existing one is equivalent.
+            }
+            continue;
+        }
+        for (const scoped of readdirSync(join(profileModules, entry))) {
+            align(entry + '/' + scoped, join(profileModules, entry, scoped, 'package.json'));
+        }
     }
 }
 /** The npm registry the distribution installs from by default. */
@@ -350,12 +471,8 @@ const MAINLAND_REGISTRY = 'https://registry.npmmirror.com';
  */
 export function registryOrder() {
     const configured = process.env.DSH_PLUS_INSTALL_REGISTRY;
-    if (configured !== undefined && configured !== '') {
-        // The fallback must be the other registry, not the configured one again: an override
-        // set to the mirror used to fall back to the same mirror and fail twice.
-        const fallback = configured === MAINLAND_REGISTRY ? OFFICIAL_REGISTRY : MAINLAND_REGISTRY;
-        return [configured, fallback];
-    }
+    if (configured !== undefined && configured !== '')
+        return [configured, MAINLAND_REGISTRY];
     // Intl reports the system locale on every platform. The POSIX variables are empty on
     // Windows, so reading them alone classified every Windows console as non-mainland and
     // reached the origin first — measured in a consumer's log, which showed npmjs failing
@@ -447,15 +564,30 @@ function linkBundle(consumerModules, name, source) {
     }
 }
 /** Resolve every path a command needs, without creating anything. */
-export function resolvePaths(anchor, env = process.env) {
+export function resolvePaths(anchor, env = process.env, editionId) {
     const home = resolveHome(env);
-    const declaration = readStandaloneDeclaration(anchor);
+    const distributionDirectory = resolveDistributionDirectory(anchor);
+    // An edition is a fact of the distribution now, so the profile name and the omission set come
+    // from it. Without one, a legacy forwarder package may still declare them; the distribution's
+    // own default profile is the fallback.
+    let profileName = STANDALONE_PROFILE;
+    let omittedPackages = {};
+    if (editionId !== undefined) {
+        const projection = projectEdition(readDistributionFacts(distributionDirectory), editionId);
+        profileName = projection.profileName;
+        omittedPackages = projection.omittedPackages;
+    }
+    else {
+        const declaration = readStandaloneDeclaration(anchor);
+        profileName = declaration.profileName;
+        omittedPackages = declaration.omittedPackages;
+    }
     return {
         home,
-        profileName: declaration.profileName,
-        omittedPackages: declaration.omittedPackages,
-        profileDirectory: join(home, 'profiles', declaration.profileName),
-        distributionDirectory: resolveDistributionDirectory(anchor),
+        profileName,
+        omittedPackages,
+        profileDirectory: join(home, 'profiles', profileName),
+        distributionDirectory,
     };
 }
 /**
@@ -471,140 +603,51 @@ export function resolvePaths(anchor, env = process.env) {
  * that installed them.
  *
  * @param paths - resolved standalone paths.
- * @param consumerDirectory - directory whose `node_modules` holds the installed packages.
- * @param edition - edition id whose package list to install, or undefined for the default.
+ * @param editionId - product edition to materialize.
+ * @param extraExcludes - packages the caller drops on top of the edition's own exclusions.
+ * @param dryRun - write the profile files without installing their dependency tree.
  * @returns whether this call created the manifest.
  */
-export function ensureProfile(paths, consumerDirectory, edition) {
+export function ensureProfile(paths, editionId, extraExcludes = [], dryRun = false) {
     const manifestPath = join(paths.profileDirectory, 'package.json');
-    const distribution = readDistributionProfile(paths.distributionDirectory);
-    const composition = edition === undefined ? undefined : distribution.editions[edition];
-    if (edition !== undefined && composition === undefined) {
-        const offered = Object.keys(distribution.editions);
-        throw new Error('unknown edition "' + edition + '"; this release offers '
-            + (offered.length === 0 ? '(none)' : offered.join(', ')));
-    }
-    // An edition lists only third-party, fork, and self-developed plugins. The official
-    // runtime is the CLI's responsibility and must not be duplicated in that list.
-    for (const name of Object.keys(composition?.packages ?? {})) {
-        if (name.startsWith('@deepseek-ai/')) {
-            throw new Error('edition "' + String(edition) + '" lists the official package ' + name
-                + '; editions contain only third-party or self-developed plugins');
-        }
-    }
-    const runtime = distribution.dshRange.replace(/^>=?/u, '');
-    const baseBundles = composition === undefined
-        ? distribution.bundles
-        : distribution.bundles.filter(bundle => bundle.startsWith('@deepseek-ai/') || bundle === '@sparkelf/dsh-plus');
-    const basePackages = composition === undefined
-        ? distribution.dependencies
-        : {
-            '@deepseek-ai/dsh': distribution.dshRange,
-            '@sparkelf/dsh-plus': distribution.version,
-            // `dsh-app-boot` declares its launcher as peer dependencies, and pnpm does not
-            // install a profile's transitive peers. Without these the boot loader resolves
-            // `@deepseek-ai/cordis-plugin-group` and fails before any plugin mounts.
-            '@deepseek-ai/cordis': '^4.0.6-alpha.1',
-            '@deepseek-ai/cordis-plugin-group': '^1.0.6-alpha.1',
-            '@deepseek-ai/cordis-plugin-include': '^1.0.11-alpha.1',
-            '@deepseek-ai/cordis-plugin-loader': '^1.0.7-alpha.1',
-            '@deepseek-ai/dsh-home-paths': runtime,
-            '@deepseek-ai/dsh-launch-environment': runtime,
-            // `dsh-session` / `dsh-tools` declare the rest of the runtime as peers; pnpm leaves
-            // them out of a profile install for the same reason as the launcher peers above.
-            '@deepseek-ai/dsh-agent': runtime,
-            '@deepseek-ai/dsh-llm': runtime,
-            '@deepseek-ai/dsh-scope': runtime,
-            '@deepseek-ai/dsh-session': runtime,
-            '@deepseek-ai/dsh-system-prompt': runtime,
-            '@deepseek-ai/dsh-user-approval': runtime,
-            // Capability packages that the official plugins import but declare only as peers.
-            // A profile install leaves them out and boot then fails inside an otherwise
-            // healthy plugin's import with ERR_MODULE_NOT_FOUND.
-            '@deepseek-ai/dsh-attachment': runtime,
-            '@deepseek-ai/dsh-compaction': runtime,
-            '@deepseek-ai/dsh-fs': runtime,
-            '@deepseek-ai/dsh-shell': runtime,
-            '@deepseek-ai/dsh-spill': runtime,
-            '@deepseek-ai/dsh-sandbox': runtime,
-            '@deepseek-ai/dsh-ptc-runtime': runtime,
-            '@deepseek-ai/dsh-llm-deepseek': runtime,
-            '@deepseek-ai/dsh-deepseek-account': runtime,
-            '@deepseek-ai/dsh-anonymous-user-id': runtime,
-            '@deepseek-ai/dsh-bash-local': runtime,
-            '@deepseek-ai/dsh-client-store': runtime,
-            '@deepseek-ai/dsh-jobs': runtime,
-            '@deepseek-ai/dsh-sdk-protocol': runtime,
-            '@deepseek-ai/dsh-session-persistence': runtime,
-            '@deepseek-ai/dsh-session-telemetry': runtime,
-            '@deepseek-ai/dsh-session-title-llm': runtime,
-            '@deepseek-ai/dsh-util-workspace-path': runtime,
-            '@deepseek-ai/dsh-workflow': runtime,
-            ...Object.fromEntries(baseBundles
-                .filter(bundle => bundle.startsWith('@deepseek-ai/dsh-'))
-                .map(bundle => [bundle, runtime])),
-        };
-    const compositionPackages = composition === undefined
-        ? basePackages
-        : { ...basePackages, ...composition.packages };
-    // Official cordis rows name the historical unscoped packages. The fork ships under
-    // `@sparkelf/*`, so the row would fail to resolve unless the profile also carries the
-    // historical name as an alias to the same version.
-    const rowAliases = {
-        'dsh-better-sidebar': '@sparkelf/dsh-better-sidebar',
-        'dsh-sql-workbench': '@sparkelf/dsh-sql-workbench',
-    };
-    for (const [alias, target] of Object.entries(rowAliases)) {
-        const spec = compositionPackages[target];
-        if (spec !== undefined && compositionPackages[alias] === undefined) {
-            compositionPackages[alias] = 'npm:' + target + '@' + spec;
-        }
-    }
-    const compositionBundles = composition === undefined
-        ? baseBundles
-        : [...baseBundles, ...composition.bundles];
+    const distribution = readDistributionProfile(paths.distributionDirectory, editionId, extraExcludes);
     if (existsSync(manifestPath)) {
-        // A selected edition is an explicit install choice, so its packages and bundle order
-        // replace the profile's rather than being ignored. Other profile decisions stay.
-        if (composition !== undefined) {
-            const manifest = requireRecord(JSON.parse(readFileSync(manifestPath, 'utf8')), 'Plus profile manifest');
-            manifest.dependencies = { ...manifest.dependencies, ...compositionPackages };
-            manifest.dsh = {
-                ...manifest.dsh,
-                profile: {
-                    ...manifest.dsh?.profile,
-                    bundles: [...compositionBundles],
-                    ...(edition === undefined ? {} : { plusEdition: edition }),
-                },
-            };
-            writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
-        }
         // The workspace carries decisions the distribution owns — overrides and the build
         // script allowlist — and a distribution release changes them. Rewriting on every
         // start is what lets an upgraded installation receive the new values; a profile
         // written once keeps whatever its own release decided and can never be corrected.
-        writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds, paths.omittedPackages);
-        installProfilePackages(paths, consumerDirectory);
+        writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds, { ...paths.omittedPackages, ...distribution.omittedPackages });
+        if (!dryRun) {
+            installProfilePackages(paths, new Set(Object.keys(distribution.omittedPackages)), distribution.runtimeVersion, registryOrder()[0]);
+        }
         return false;
     }
     mkdirSync(paths.profileDirectory, { recursive: true });
     const manifest = {
-        name: 'dsh-profile-' + STANDALONE_PROFILE,
+        name: 'dsh-profile-' + paths.profileName,
         private: true,
         type: 'module',
-        dependencies: compositionPackages,
+        dependencies: {
+            '@sparkelf/dsh-plus': distribution.version,
+            // The launcher's own tree supplies every service package the bundles mount. A
+            // profile that lists only the distribution's plugins installs a partial tree and
+            // fails at load with a module the launcher would have carried.
+            '@deepseek-ai/dsh': distribution.dshRange,
+            ...distribution.dependencies,
+        },
         dsh: {
             profile: {
-                bundles: [...compositionBundles],
+                bundles: distribution.bundles,
                 patchReload: 'live',
-                ...(edition === undefined ? {} : { plusEdition: edition }),
             },
         },
     };
     writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
     // The overrides must reach the workspace before the install that reads them.
-    writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds, paths.omittedPackages);
-    installProfilePackages(paths, consumerDirectory);
+    writeProfileOverrides(paths.profileDirectory, distribution.overrides, distribution.allowBuilds, { ...paths.omittedPackages, ...distribution.omittedPackages });
+    if (!dryRun) {
+        installProfilePackages(paths, new Set(Object.keys(distribution.omittedPackages)), distribution.runtimeVersion, registryOrder()[0]);
+    }
     return true;
 }
 /**
@@ -642,7 +685,7 @@ function writeProfileOverrides(profileDirectory, overrides, allowBuilds, omitted
     if (document.get('nodeLinker') === undefined)
         document.set('nodeLinker', 'hoisted');
     if (document.get('autoInstallPeers') === undefined)
-        document.set('autoInstallPeers', true);
+        document.set('autoInstallPeers', false);
     writeFileSync(workspacePath, String(document));
 }
 /** Run git in one directory, returning undefined instead of throwing when asked to. */
@@ -676,8 +719,6 @@ export function applyProfileNpmPatches(distributionDirectory, profileDirectory)
     const patchSet = readPatchSet(distributionDirectory, manifest);
     const applied = [];
     for (const entry of [...patchSet.entries, ...patchSet.thirdPartyPatches]) {
-        // Only npm targets reach an installed package; a source target needs the
-        // official checkout, which a standalone installation does not have.
         if (entry.target.kind !== 'npm')
             continue;
         const targetName = entry.target.name;
@@ -698,22 +739,7 @@ function resolveInstalledPackage(from, packageName) {
         manifestPath = requireFrom.resolve(packageName + '/package.json');
     }
     catch {
-        // Some packages do not export `./package.json`; resolve the entry module instead and walk
-        // up to the directory that holds the manifest.
-        let directory;
-        try {
-            directory = dirname(requireFrom.resolve(packageName));
-        }
-        catch {
-            throw new Error(packageName + ' is not installed under ' + from);
-        }
-        while (!existsSync(resolve(directory, 'package.json'))) {
-            const parent = dirname(directory);
-            if (parent === directory)
-                throw new Error(packageName + ' has no resolvable package manifest under ' + from);
-            directory = parent;
-        }
-        manifestPath = resolve(directory, 'package.json');
+        throw new Error(packageName + ' is not installed under ' + from);
     }
     const manifest = requireRecord(JSON.parse(readFileSync(manifestPath, 'utf8')), packageName + ' manifest');
     return { name: packageName, version: String(manifest.version), directory: dirname(manifestPath), manifest };