@xneog/dsh-base 0.1.0-20260818184352-4561870be6

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/bundle/base/README.md
+README.md: 00a177d4dd65de8706aa0e27a79d06a9a50eb55a
+README.zh.md: ad70fc16035d3dd70b04e78c31aea90acf61119b

package/README.md

@@ -0,0 +1,22 @@
+# `@xneog/dsh-base`
+
+English | [中文](README.zh.md)
+
+The shared dsh core as a profile bundle: [`cordis.patch.yml`](cordis.patch.yml) inserts every base plugin row — model adapters, the shared [`agent-default-model`](../../core/agent-default-model/README.md) selection, tools, persistence, policy, settings/credentials, telemetry, and host-level subagent providers — over the empty profile root, as the first layer of every profile's `dsh.profile.bundles` list. This bundle neither depends on nor mounts the optional Codex and Claude Code providers; an opting-in Profile installs and mounts the selected provider once on the host plane, while Agent Presets decide whether their agents receive the corresponding model-facing delegation tools. Later bundle layers (e.g. [`dsh-web-app`](../web-app/README.md)) and the user's profile `cordis.patch.yml` override these rows by id; a patch replaces a row's whole `config`, so mode-specific values live in mode bundles, not here. The package has no runtime API; the profile composer resolves the patch through the `dsh.bundle.patch` manifest field, never through code.
+
+The patch gates both shell stacks by platform on its own rows: `bash-sandbox`/`tool-bash` carry `disabled: !!js process.platform === 'win32'` (bash has no Windows runner), and their twins `pwsh-sandbox`/`tool-pwsh` mount on win32 only with the inverted expression — one shared patch file, exactly one shell stack per host. The permission surface stays exactly as on POSIX: `sandbox`/`sandbox-policy` enforce the file-effect policy through the Windows ACL restricted-token runner (the win32 chain of `dsh-sandbox-local` → `@xneog/dsh-sandbox-windows-acl`), the permission switcher and the approval service run unchanged, and `fs-sandbox` keeps fencing `ctx.fs` writes — mounting `dsh-fs-local` alongside it would double-register `ctx.fs` and fail the load. A Windows host that prefers the unconfined local pwsh executor or full access overrides these rows through its profile or home `cordis.patch.yml` (the bash-restore recipe must be complete: disable `pwsh-sandbox`/`tool-pwsh` AND re-enable `bash-sandbox`/`tool-bash` — both executor families register the same `bash` service, so an incomplete recipe fails loud at load). POSIX hosts see the pwsh rows disabled.
+
+The row set and its rationale are documented inline in the patch file; the [generated composition graph](../../../apps/cli/composition.md) renders it.
+
+## Model Experience
+
+Indirectly, through the inserted rows: this bundle selects the shipped persona-less prompt base, tool set, and DeepSeek adapter that mode bundles specialize, and contributes no model-visible text of its own.
+
+#### KV Cache effect
+
+None directly; each inserted row's package owns its effect.
+
+## Known Limitations and Deferred Work
+
+- **A patch replaces whole row configs** — profile overrides must restate every field a row keeps; there is no deep-merge layer.
+- **The Windows temp grant is a private per-session subdirectory** — `workspace-write` confines writes to the workspace plus the session's own temp subdirectory (`<temp>\dsh-<hash>`, TMP/TEMP rewritten for confined children); `read-only` grants nothing. See `@xneog/dsh-sandbox-windows-acl`.

package/README.zh.md

@@ -0,0 +1,22 @@
+# `@xneog/dsh-base`
+
+[English](README.md) | 中文
+
+以 profile 组合包形式交付的共享 dsh 核心：[`cordis.patch.yml`](cordis.patch.yml) 在空的 profile 根之上插入全部基础插件行——模型适配器、共享的 [`agent-default-model`](../../core/agent-default-model/README.md) 选择、工具、持久化、策略、settings／credentials、遥测与宿主级 subagent provider——作为每个 profile 的 `dsh.profile.bundles` 列表中的第一层。这个 bundle 既不依赖也不挂载可选的 Codex 与 Claude Code provider；选择产品集成的 Profile 会安装目标 provider 并在 host plane（宿主平面）挂载一次，Agent Preset 则决定自己的 agent 是否获得对应的面向模型委派工具。后续的组合包层（例如 [`dsh-web-app`](../web-app/README.md)）和用户 profile 的 `cordis.patch.yml` 按 id 覆盖这些行；patch 会替换目标行的整个 `config`，因此模式专属的值放在各模式组合包中，而不是这里。该包没有运行时 API；profile 组合器通过 manifest（元数据清单）的 `dsh.bundle.patch` 字段解析 patch，绝不通过代码。
+
+patch 在自身上按平台门控两个 shell 栈：`bash-sandbox`/`tool-bash` 携带 `disabled: !!js process.platform === 'win32'`（bash 没有 Windows runner），它们的孪生行 `pwsh-sandbox`/`tool-pwsh` 以取反的表达式仅在 win32 挂载——同一份 patch 文件，每个宿主恰好挂载一个 shell 栈。权限面与 POSIX 完全一致：`sandbox`/`sandbox-policy` 通过 Windows ACL 受限令牌 runner（`dsh-sandbox-local` 的 win32 链 → `@xneog/dsh-sandbox-windows-acl`）执行文件效果策略，权限切换器与 approval 服务原样运行，`fs-sandbox` 继续围栏 `ctx.fs` 写入——在其旁再挂载 `dsh-fs-local` 会重复注册 `ctx.fs` 并在加载时失败。偏好不受沙盒约束的本地 pwsh 执行器或完整访问的 Windows 主机通过其 profile 或 home 的 `cordis.patch.yml` 覆盖这些行（bash 恢复配方必须完整：禁用 `pwsh-sandbox`/`tool-pwsh` 并重新启用 `bash-sandbox`/`tool-bash`——两个执行器家族注册同一个 `bash` 服务，配方不完整会在加载时直接报错）。POSIX 主机看到的是被禁用的 pwsh 行。
+
+行集合及其设计依据以行内注释写在 patch 文件里；[生成的组合图](../../../apps/cli/composition.md)负责渲染它。
+
+## 模型体验
+
+通过插入的行间接产生影响：该组合包选定了随发行版交付的无 persona 提示词基座、工具集合与 DeepSeek 适配器，供各模式组合包进一步特化；它自身不贡献任何模型可见文本。
+
+#### KV Cache 影响
+
+无直接影响；每条插入行的影响由其所属的包负责。
+
+## 已知限制与暂缓事项
+
+- **patch 会替换整行 `config`**：profile 覆盖必须重述该行需要保留的每个字段；不存在深度合并层。
+- **Windows 的临时目录授权是按会话的私有子目录**——`workspace-write` 把写入限制在工作区与会话自己的 temp 子目录（`<temp>\dsh-<hash>`，受限子进程的 TMP/TEMP 被改写）；`read-only` 不授予任何临时目录写入权限。见 `@xneog/dsh-sandbox-windows-acl`。

package/cordis.patch.yml

@@ -0,0 +1,451 @@
+# The dsh-base bundle patch: the shared core of every dsh profile, applied as
+# ONE insert over the empty profile root. Later bundle patches and the user's
+# profile cordis.patch.yml address these rows by id, with the last write
+# winning per row.
+#
+# A patch replaces the targeted row's whole `config` rather than merging into
+# it, so a row whose value differs by mode does NOT live here: it belongs to
+# each mode bundle, keeping any single row down to one bundle layer plus the
+# user's. Mode-specific rows appear below only with shared plugin identity and
+# neutral defaults; each mode bundle restates its complete configuration.
+#
+# Row order carries no load semantics (activation is service-availability
+# driven); the grouping is for readers.
+
+- insert:
+    - id: timer
+      name: '@xneog/cordis-plugin-timer'
+
+    - id: hmr
+      name: '@xneog/cordis-plugin-hmr'
+      config:
+        root: ['.']
+
+    - id: llm
+      name: '@xneog/dsh-llm'
+
+    - id: session
+      name: '@xneog/dsh-session'
+
+    - id: typert
+      name: '@xneog/dsh-typert-registry'
+
+    - id: typert-loader
+      name: '@xneog/dsh-typert-loader'
+
+    - id: typert-gateway
+      name: '@xneog/dsh-api-gateway'
+
+    - id: session-title
+      name: '@xneog/dsh-session-title'
+      config:
+        fallbackMaxWords: 5
+        fallbackMaxBytes: 40
+        maxTitleBytes: 80
+
+    - id: session-title-llm
+      name: '@xneog/dsh-session-title-first-prompt-llm'
+      config:
+        targetWords: 5
+        targetCjkCharacters: 10
+        maxInputBytes: 4096
+        maxOutputTokens: 64
+        timeoutMs: 60000
+
+    - id: user-questions
+      name: '@xneog/dsh-user-questions'
+
+    - id: agent
+      name: '@xneog/dsh-agent'
+
+    # The transport-independent default for Agents created by entry points.
+    # Settings may supply a saved selection; consumers read it at creation time.
+    - id: agent-default-model
+      name: '@xneog/dsh-agent-default-model'
+      config:
+        provider: deepseek-official
+        model: deepseek-v4-flash
+
+    - id: jobs
+      name: '@xneog/dsh-jobs-local'
+
+    - id: llm-retry
+      name: '@xneog/dsh-llm-retry'
+
+    # User-settings document (`$DSH_HOME/settings.yaml`, hot-reloaded): a
+    # `llm-deepseek:` or `llm-pi-ai:` section there overrides the adapter entries
+    # below without a restart, and is what the web Models page writes.
+    - id: settings
+      name: '@xneog/dsh-settings-file'
+
+    # Credential sources: inherited environment over the managed
+    # `$DSH_HOME/.credentials.yaml`, with project and user `.env` fallbacks.
+    # Adapters resolve references per request; the Models page writes only the
+    # managed document, which is never materialized into the process environment.
+    - id: credentials
+      name: '@xneog/dsh-credentials-local'
+
+    # The pi-ai multi-provider twin, mounted dormant: zero routes (and no extra
+    # models in the picker) until a `llm-pi-ai:` settings section supplies provider
+    # profiles — then those routes register live, keys resolving per request
+    # through their apiKeyEnv references, and drop again when the section empties.
+    # Supplying those profiles is exactly what the web Models page does. Which
+    # adapters exist is composition; which providers run is the user's settings
+    # document.
+    - id: llm-pi-ai
+      name: '@xneog/dsh-llm-pi-ai'
+
+    - id: session-persistence-jsonl
+      name: '@xneog/dsh-session-persistence-jsonl'
+      config:
+        root: !!js dshHomePath('sessions')
+
+    # Durable image bytes live outside the append-only session log. Messages
+    # keep content-addressed references that this shared backend resolves for
+    # provider requests and authorized history reads.
+    - id: attachment-local
+      name: '@xneog/dsh-attachment-local'
+
+    # Full-text session search is opt-in. `openAt: never` keeps
+    # ctx.sessionQuery mounted — exact reads, titles, and lineage traces
+    # (session export, subagent-fork Workspace inheritance) stay available —
+    # while search calls fail with SESSION_QUERY_SEARCH_DISABLED and SQLite is
+    # never opened; the Web sidebar search matches titles and workspace names
+    # only. Deployments enabling content search override `openAt` to
+    # `first-search` or `startup` in a later patch layer (profile
+    # cordis.patch.yml or a --patch overlay), typically with a durable `path`.
+    - id: session-query-sqlite
+      name: '@xneog/dsh-session-query-sqlite'
+      config:
+        path: ':memory:'
+        openAt: never
+
+    # Shared projection registry: subagent catalog identity (mode/label) folds
+    # through its registered units, so the `list_agents` surface below fails
+    # loud without it; web layers reuse this same mount for list rows.
+    - id: session-projection
+      name: '@xneog/dsh-session-projection'
+
+    # Session telemetry is mounted but disabled by default. DSH_TELEMETRY_MODE
+    # explicitly opts into FULL or FEEDBACK_ONLY reporting; uploading mirrors
+    # session-log records onto OTLP/HTTP logs with no session-telemetry/record redaction
+    # rule, so exports are the raw captured copy. The deployment stance, env
+    # seams, and follow-ups are pinned in the default-off Agent Note.
+    # DSH_TELEMETRY_OTLP_URL overrides the production endpoint. A non-empty
+    # DSH_TELEMETRY_DISABLED — any value, including '0'/'false' — opts the
+    # process out (the launchers patch the row disabled; config cannot disable
+    # a row). Exports carry the harness home's anonymous user id ($DSH_HOME/.anonymous-user-id,
+    # random UUID; delete the file to reset the identity) as the Resource's
+    # user.id. The exporter/processor values normally bound the shutdown drain
+    # to ~1s against an unreachable collector: exporter.timeoutMillis is both
+    # the per-attempt socket timeout and the retry deadline (1s effectively
+    # disables the SDK's 5-try backoff), while maxExportBatchSize == maxQueueSize
+    # (both explicit) makes the drain a single batch. The SDK awaits
+    # exporter.forceFlush() outside exportTimeoutMillis, so the backend's 3s
+    # shutdownTimeoutMillis is the load-bearing outer bound when a transport
+    # promise never settles. Every CLI exit path drains it by disposing the root
+    # on SIGINT/SIGTERM.
+    - id: session-telemetry-otel
+      name: '@xneog/dsh-session-telemetry-otel'
+      config:
+        mode: !!js process.env.DSH_TELEMETRY_MODE || 'DISABLED'
+        shutdownTimeoutMillis: 3000
+        exporter:
+          url: !!js process.env.DSH_TELEMETRY_OTLP_URL ?? 'https://harness-telemetry.deepseeksvc.com/v1/logs'
+          compression: gzip
+          timeoutMillis: 1000
+        processor:
+          scheduledDelayMillis: 10000
+          maxQueueSize: 2048
+          maxExportBatchSize: 2048
+          exportTimeoutMillis: 1500
+
+    - id: subprocess
+      name: '@xneog/dsh-subprocess-local'
+
+    # Every shipped CLI mode starts with the same file-effect boundary.
+    # The environment remains an explicit deployment override; otherwise fresh
+    # sessions pin workspace-write + ask through the permission service below.
+    - id: sandbox
+      name: '@xneog/dsh-sandbox-local'
+
+    - id: sandbox-policy
+      name: '@xneog/dsh-sandbox-policy'
+      config:
+        mode: !!js process.env.DSH_PERMISSION_MODE ?? 'workspace-write'
+        workspaceRoot: !!js process.cwd()
+
+    - id: bash-sandbox
+      name: '@xneog/dsh-bash-sandbox'
+      disabled: !!js process.platform === 'win32'
+      config:
+        timeoutMs: 60000
+
+    - id: pwsh-sandbox
+      name: '@xneog/dsh-pwsh-sandbox'
+      disabled: !!js process.platform !== 'win32'
+
+    - id: approval
+      name: '@xneog/dsh-user-approval'
+      config:
+        policy: !!js "(process.env.DSH_PERMISSION_MODE ?? 'workspace-write') === 'danger-full-access' ? 'never' : 'ask'"
+
+    - id: permission
+      name: '@xneog/dsh-permission-presets'
+      config:
+        presets:
+          read-only:
+            sandbox: read-only
+            approval: ask
+          workspace-write:
+            sandbox: workspace-write
+            approval: ask
+          danger-full-access:
+            sandbox: danger-full-access
+            approval: never
+
+    - id: shell-env
+      name: '@xneog/dsh-shell-env'
+
+    - id: tool-bash
+      name: '@xneog/dsh-tool-bash'
+      disabled: !!js process.platform === 'win32'
+
+    - id: tool-pwsh
+      name: '@xneog/dsh-tool-pwsh'
+      disabled: !!js process.platform !== 'win32'
+
+    - id: tool-jobs
+      name: '@xneog/dsh-tool-jobs'
+
+    - id: fs-observation-policy
+      name: '@xneog/dsh-fs-observation-policy'
+
+    - id: tool-fs
+      name: '@xneog/dsh-tool-fs'
+
+    - id: tool-fs-search
+      name: '@xneog/dsh-tool-fs-search'
+      config:
+        sampleOverCapGlobResults: false
+
+    - id: agent-instructions
+      name: '@xneog/dsh-agent-instructions'
+      config:
+        maxBytes: 65536
+
+    - id: skill
+      name: '@xneog/dsh-skill'
+
+    - id: skill-filesystem
+      name: '@xneog/dsh-skill-filesystem'
+
+    - id: skill-badge
+      name: '@xneog/dsh-skill-badge'
+      disabled: true
+
+    - id: tool-skill
+      name: '@xneog/dsh-tool-skill'
+
+    - id: commands
+      name: '@xneog/dsh-commands'
+
+    - id: command-feedback
+      name: '@xneog/dsh-command-feedback'
+
+    - id: goal
+      name: '@xneog/dsh-goal'
+
+    - id: goal-round-driver
+      name: '@xneog/dsh-goal-round-driver'
+
+    - id: command-goal
+      name: '@xneog/dsh-command-goal'
+
+    - id: plan-mode
+      name: '@xneog/dsh-plan-mode'
+      config:
+        section: |
+              You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+              Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+              The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed only to keep the request shape stable. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+              Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+              Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+
+    - id: token-meter
+      name: '@xneog/dsh-token-meter'
+
+    - id: compaction-basic
+      name: '@xneog/dsh-compaction-basic'
+
+    # Human `/compact`: one useful reduction below the automatic threshold. Backend
+    # independent, so it follows whichever compaction service this leaf mounts.
+    - id: command-compact
+      name: '@xneog/dsh-command-compact'
+
+    - id: subagent
+      name: '@xneog/dsh-subagent'
+
+    - id: subagent-spawn-in-process
+      name: '@xneog/dsh-subagent-spawn-in-process'
+      config:
+        providerName: spawn
+
+    - id: subagent-fork-in-process
+      name: '@xneog/dsh-subagent-fork-in-process'
+      config:
+        providerName: fork
+
+    # Continuable background children are selected per delegation tool. The
+    # separately loaded follow-up tool registers the one global `send_message`.
+    - id: tool-subagent-control
+      name: '@xneog/dsh-tool-subagent-control'
+
+    - id: tool-subagent-list-agents
+      name: '@xneog/dsh-tool-subagent-control/list-agents'
+
+    - id: tool-subagent
+      name: '@xneog/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: subagent
+        backgroundMode: continuable
+
+    # Fork stays one-shot: a continuable child's `report` tool and prompt
+    # section precede the inherited history a fork exists to reuse; one-shot
+    # fork children install neither, keeping the parent's request prefix.
+    # See .agents/notes/implemented/architecture/2026-08-10-fork-children-stay-one-shot.md.
+    - id: tool-subagent-fork
+      name: '@xneog/dsh-tool-subagent'
+      config:
+        provider: fork
+        toolName: subagent_fork
+        backgroundMode: one-shot
+
+    # Optional direct-child return channel; absent from roots and one-shot agents.
+    - id: tool-subagent-report
+      name: '@xneog/dsh-tool-subagent-report'
+
+    - id: workflow-worker-thread
+      name: '@xneog/dsh-workflow-worker-thread'
+      config:
+        provider: spawn
+
+    - id: tool-workflow
+      name: '@xneog/dsh-tool-workflow'
+
+    - id: timeout-policy
+      name: '@xneog/dsh-tool-call-timeout-policy'
+
+    - id: spill-local
+      name: '@xneog/dsh-spill-local'
+
+    - id: spill-policy
+      name: '@xneog/dsh-spill-policy'
+      config:
+        maxInlineBytes: 50000
+
+    # Durability checkpoints before each model request and top-level dispatch.
+    - id: session-checkpoint-policy
+      name: '@xneog/dsh-session-checkpoint-policy'
+
+    # Compacts oversized tool results before the broader conversation compactor
+    # runs, preserving the model-visible result within the configured budget.
+    - id: tool-result-pruner
+      name: '@xneog/dsh-compaction-tool-result-pruner'
+      config:
+        thresholdChars: 8192
+        headChars: 4096
+        tailChars: 1024
+
+    - id: tool-todo
+      name: '@xneog/dsh-tool-todo'
+      config:
+        allowParallelInProgress: true
+
+    # Persisted same-session goals reach the model and the slash menu here; the
+    # domain, driver, and `/goal` command are above.
+    - id: tool-goal
+      name: '@xneog/dsh-tool-goal'
+
+    # Fresh-agent Ralph iteration over a build-time-fixed script.
+    - id: tool-ralph
+      name: '@xneog/dsh-tool-ralph'
+      config:
+        subagentProvider: spawn
+        maxRounds: 64
+
+    - id: tool-str-replace-editor
+      name: '@xneog/dsh-tool-str-replace-editor'
+      config:
+        maxOutputChars: 16000
+
+    # Consecutive-repeat reminders on the tool chain.
+    - id: repeat-tool-reminder
+      name: '@xneog/dsh-repeat-tool-reminder'
+      config:
+        thresholds: [3, 5, 8]
+        argumentsPreviewChars: 500
+
+    # Every mode enables the stable model-facing web_search tool. DeepSeek search
+    # resolves the same DEEPSEEK_API_KEY credential the Models page manages for
+    # chat, at each search; its Messages endpoint is separate from the
+    # chat-completions endpoint, so it takes its own base-URL override. Fetch stays
+    # disabled and no fetch provider is mounted: that provider defers SSRF
+    # protection and the model would choose the request target. Search is a full
+    # auxiliary model request with server-side retrieval, so this shipped DeepSeek
+    # route gets 60s while the provider-neutral tool default remains 30s.
+    - id: web
+      name: '@xneog/dsh-web'
+      config:
+        searchProvider: deepseek-official
+
+    - id: web-search-deepseek
+      name: '@xneog/dsh-web-search-deepseek'
+      config:
+        apiKeyEnv: DEEPSEEK_API_KEY
+
+    - id: tool-web
+      name: '@xneog/dsh-tool-web'
+      config:
+        fetch: false
+        searchTimeoutMs: 60000
+
+    # ── rows every mode mounts, whose values each overlay may state ──────────────
+
+    # The tool registry. Presentation mode is a deployment choice; omitting it here
+    # keeps the schema default (native).
+    - id: tools
+      name: '@xneog/dsh-tools'
+
+    # The deployment persona is a deployment choice; plan-mode and tool plugins own
+    # their own prompt sections.
+    - id: system-prompt
+      name: '@xneog/dsh-system-prompt'
+      config:
+        persona: ''
+
+    # Agents created at startup. The base stays empty; raw overlays may create
+    # agents, while Web creates sessions on client request.
+    - id: agent-loop
+      name: '@xneog/dsh-agent-loop'
+      config:
+        agents: []
+
+    # The sandboxed filesystem provider. `cwd` defaults to `process.cwd()`; an
+    # overlay can pin another workspace.
+    - id: fs-sandbox
+      name: '@xneog/dsh-fs-sandbox'
+
+    # The native DeepSeek adapter. No key or endpoint is inlined: both resolve per
+    # request from the `llm-deepseek:` settings section over this entry, with the
+    # key coming from the credential store below. Thinking defaults are a deployment
+    # choice.
+    - id: llm-deepseek
+      name: '@xneog/dsh-llm-deepseek'

package/lib/index.js

@@ -0,0 +1 @@
+export {};

package/lib/invariant.js

@@ -0,0 +1,19 @@
+//#region lib/types/invariant.js
+/**
+* Package-owned invariant companion for `@xneog/dsh-base`.
+* @module @xneog/dsh-base/invariant
+*/
+const PACKAGE_NAME = "@xneog/dsh-base";
+/** Cordis companion plugin name. */
+const name = "base-bundle-invariant";
+/** Service required before the companion can register. */
+const inject = ["invariants"];
+const install = () => {};
+/**
+* Register this package's invariant companion.
+* @param ctx - Cordis context carrying the invariant service.
+* @returns the installed registration's disposer after setup succeeds.
+*/
+const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//#endregion
+export { apply, inject, name };

package/lib/types/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @xneog/dsh-base — the shared dsh core as a profile bundle. The
+ * package's substance is `cordis.patch.yml`, declared by the `dsh.bundle.patch`
+ * manifest field and resolved by the profile composer through that field;
+ * this module carries no runtime API.
+ * @module @xneog/dsh-base
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/lib/types/invariant.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Package-owned invariant companion for `@xneog/dsh-base`.
+ * @module @xneog/dsh-base/invariant
+ */
+import type { Context } from '@xneog/cordis';
+/** Cordis companion plugin name. */
+export declare const name = "base-bundle-invariant";
+/** Service required before the companion can register. */
+export declare const inject: string[];
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/package.json

@@ -0,0 +1,128 @@
+{
+  "name": "@xneog/dsh-base",
+  "description": "The shared dsh core as a profile bundle: every profile's first patch layer, inserting the base plugin rows over the empty profile root",
+  "version": "0.1.0-20260818184352-4561870be6",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/gomes007-alt/xneog-harness.git",
+    "directory": "packages/bundle/base"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "cordis.patch.yml",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "dependencies": {
+    "@xneog/cordis-plugin-hmr": "0.1.0-20260818184352-4561870be6",
+    "@xneog/cordis-plugin-timer": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-agent": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-agent-default-model": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-agent-loop": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-attachment-local": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-shell-env": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-bash-sandbox": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-command-compact": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-command-feedback": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-command-goal": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-commands": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-compaction-basic": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-compaction-tool-result-pruner": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-credentials-local": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-fs-local": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-fs-observation-policy": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-fs-sandbox": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-goal": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-goal-round-driver": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-api-gateway": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-llm": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-llm-deepseek": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-llm-pi-ai": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-llm-retry": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-permission-presets": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-plan-mode": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-pwsh-sandbox": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-repeat-tool-reminder": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-sandbox-local": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-sandbox-policy": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-session": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-session-checkpoint-policy": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-session-persistence-jsonl": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-session-projection": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-session-query-sqlite": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-session-telemetry-otel": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-session-title": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-session-title-first-prompt-llm": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-settings-file": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-skill": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-skill-badge": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-skill-filesystem": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-spill-local": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-spill-policy": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-subagent": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-subagent-fork-in-process": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-subagent-spawn-in-process": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-subprocess-local": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-system-prompt": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-jobs-local": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-call-timeout-policy": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-token-meter": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-bash": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-fs": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-fs-search": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-goal": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-pwsh": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-ralph": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-skill": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-str-replace-editor": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-subagent": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-subagent-control": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-subagent-report": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-jobs": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-todo": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-web": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tool-workflow": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-tools": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-typert-loader": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-typert-registry": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-user-approval": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-user-questions": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-web": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-web-search-deepseek": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-workflow-worker-thread": "0.1.0-20260818184352-4561870be6",
+    "@xneog/dsh-agent-instructions": "0.1.0-20260818184352-4561870be6"
+  },
+  "peerDependencies": {
+    "@xneog/dsh-invariants": "0.1.0-20260818184352-4561870be6",
+    "@xneog/cordis": "0.1.0-20260818184352-4561870be6"
+  },
+  "devDependencies": {
+    "@xneog/dsh-invariants": "0.1.0-20260818184352-4561870be6",
+    "@xneog/cordis": "0.1.0-20260818184352-4561870be6"
+  }
+}