dsh-enhancement-suite 0.1.0 → 0.1.2

package/README.md

@@ -94,8 +94,8 @@ dsh-enhance update --profile headless
 ## How it installs
 
 1. Every plugin is installed through the **official CLI**: `dsh plugin --profile <profile> add <package>`. This suite never loads the plugins through its own dependency graph or its own cordis patch — the four upstream packages stay independent in the profile.
-2. `dsh-plugin-marketplace` declares `dsh.bundle.patch`, so `dsh plugin add` reconciles it into `dsh.profile.bundles` and its bundle layer auto-mounts it.
-3. The other three are plain dependencies; the suite appends their mount rows to the profile's `cordis.patch.yml` with the same safe, idempotent logic the marketplace's own one-click install uses (an empty `[]` patch is replaced correctly, duplicates are skipped, and a flow-style array is refused instead of corrupted).
+2. All four plugins now declare `dsh.bundle.patch` (as of vision 0.3.9 / soul-md 0.5.4 / tdai-memory 0.2.9 / marketplace 0.2.4), so `dsh plugin add` reconciles each into `dsh.profile.bundles` and its own bundle layer auto-mounts it.
+3. For profiles that mounted a plugin manually before it gained its bundle manifest, the suite **removes the stale manual row** from `cordis.patch.yml` — two mounts of the same entry id would abort boot. (Non-bundle third-party plugins still get the safe idempotent mount logic: empty `[]` patches are replaced correctly, duplicates are skipped, flow-style arrays are refused instead of corrupted.)
 4. Restart `dsh web` and the plugins load.
 
 Every step reports a clear `✓` / `✗`, failures are never swallowed, and no API key is read, printed, or forwarded.

package/bin/dsh-enhance.mjs

@@ -84,18 +84,30 @@ function findDsh() {
   return null;
 }
 
+/** Quote one argument for a Windows cmd line (no shell interpolation). */
+function quoteArg(arg) {
+  return '"' + String(arg).replace(/"/g, '\\"') + '"';
+}
+
 /**
  * Spawn one subprocess with an argument array (never a shell string).
- * On Windows the resolved .cmd shim is executed through the shell with
- * per-argument quoting applied by Node, which keeps every argument opaque.
+ * On Windows a .cmd shim (dsh.cmd / pnpm.cmd) is executed through the
+ * shell; the command line is built here with per-argument quoting, so
+ * Node's `args + shell:true` deprecation (DEP0190) is not triggered.
  */
-function run(bin, args, { capture = false } = {}) {
+function run(bin, args, { capture = false, cwd } = {}) {
   return new Promise((resolve) => {
-    const child = spawn(bin, args, {
-      shell: process.platform === "win32",
+    const opts = {
       stdio: capture ? ["ignore", "pipe", "pipe"] : "inherit",
       windowsHide: true,
-    });
+      ...(cwd ? { cwd } : {}),
+    };
+    let child;
+    if (process.platform === "win32") {
+      child = spawn([bin, ...args].map(quoteArg).join(" "), { ...opts, shell: true });
+    } else {
+      child = spawn(bin, args, opts);
+    }
     let stdout = "";
     let stderr = "";
     if (capture) {
@@ -127,6 +139,88 @@ function installedVersion(pkg, profile) {
   return installedManifest(pkg, profile)?.version ?? null;
 }
 
+const dryRunMode = () => process.env.DSH_ENHANCE_DRY_RUN === "1";
+
+/** Locate pnpm on PATH (pnpm.cmd / pnpm.exe / pnpm). */
+function findPnpm() {
+  const names = process.platform === "win32" ? ["pnpm.cmd", "pnpm.exe", "pnpm"] : ["pnpm"];
+  const entries = (process.env.PATH ?? "").split(process.platform === "win32" ? ";" : ":").filter(Boolean);
+  for (const dir of entries) {
+    for (const name of names) {
+      const candidate = join(dir, name);
+      if (existsSync(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+
+/** Latest published version of a package from the npm registry (no auth). */
+async function latestVersion(pkg) {
+  try {
+    const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(pkg)}`, {
+      headers: { Accept: "application/vnd.npm.install-v1+json" },
+      signal: AbortSignal.timeout(15000),
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return (data && data["dist-tags"] && data["dist-tags"].latest) || null;
+  } catch {
+    return null;
+  }
+}
+
+function profileJson(profile) {
+  try {
+    return JSON.parse(readFileSync(join(profileDir(profile), "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Set dependencies[pkg] to `^version` in the profile manifest so pnpm
+ * resolves the freshly published version (plain `pnpm update` keeps the
+ * lockfile resolution when the old version still satisfies the range).
+ * Returns true when the manifest would be / was changed.
+ */
+function bumpProfileRange(profile, pkg, version) {
+  const json = profileJson(profile);
+  if (!json || !json.dependencies || typeof json.dependencies[pkg] !== "string") return false;
+  const want = `^${version}`;
+  if (json.dependencies[pkg] === want) return false;
+  if (dryRunMode()) return true;
+  json.dependencies[pkg] = want;
+  writeFileSync(join(profileDir(profile), "package.json"), JSON.stringify(json, null, 2) + "\n", "utf8");
+  return true;
+}
+
+/**
+ * Make sure `${pkg}@${version}` appears in pnpm-workspace.yaml's
+ * minimumReleaseAgeExclude (pnpm 11 blocks freshly published packages until
+ * they reach a minimum release age). Returns true when the file changed.
+ */
+function ensureReleaseAgeExclude(profile, pkg, version) {
+  const patch = join(profileDir(profile), "pnpm-workspace.yaml");
+  if (!existsSync(patch)) return false;
+  const entry = `${pkg}@${version}`;
+  const src = readFileSync(patch, "utf8");
+  if (src.includes(entry)) return false;
+  if (dryRunMode()) return true;
+  const lines = src.split("\n");
+  const idx = lines.findIndex((l) => l.trim() === "minimumReleaseAgeExclude:");
+  let next;
+  if (idx >= 0) {
+    let insertAt = idx + 1;
+    while (insertAt < lines.length && /^[ \t]+- /.test(lines[insertAt])) insertAt += 1;
+    lines.splice(insertAt, 0, `  - ${entry}`);
+    next = lines.join("\n");
+  } else {
+    next = src.replace(/\s*$/, "") + `\nminimumReleaseAgeExclude:\n  - ${entry}\n`;
+  }
+  writeFileSync(patch, next, "utf8");
+  return true;
+}
+
 /** Bundle plugins are auto-mounted by their own dsh.bundle layer. */
 function isBundlePackage(pkg, profile) {
   const manifest = installedManifest(pkg, profile);
@@ -151,13 +245,36 @@ function isMountedInPatch(pkg, profile) {
  * Mirrors the marketplace's own logic: bundle plugins are skipped (their
  * bundle layer auto-mounts them), an empty `[]` patch is replaced with a
  * block-style insert list, and a non-empty flow-style array is refused
- * rather than corrupted.
+ * rather than corrupted. For bundle plugins, any STALE manual row left by an
+ * earlier non-bundle version is removed — two mounts of the same entry id
+ * abort boot.
  */
+function escapeRegExp(text) {
+  return String(text).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** Remove a `- id: ...` + `name: '<pkg>'` manual mount block, if present. */
+function stripManualRow(src, pkg) {
+  const pattern = new RegExp(`[ \\t]*- id: [^\\n]*\\n[ \\t]*name: ['"]${escapeRegExp(pkg)}['"]\\n?`, "g");
+  return src.replace(pattern, "");
+}
+
 function ensureMounted(pkg, profile) {
   const patch = join(profileDir(profile), "cordis.patch.yml");
   if (!existsSync(patch)) return { changed: false, note: "cordis.patch.yml not found; mount manually" };
-  if (isInProfileBundles(pkg, profile)) return { changed: false, note: "already mounted via dsh.profile.bundles" };
-  if (isBundlePackage(pkg, profile)) return { changed: false, note: "bundle plugin: auto-mounted via its own dsh.bundle layer" };
+  const inBundles = isInProfileBundles(pkg, profile);
+  if (inBundles || isBundlePackage(pkg, profile)) {
+    // The bundle layer auto-mounts this plugin. Remove a stale manual row
+    // (written before the package gained its dsh.bundle manifest) so boot
+    // does not fail with a duplicate loader entry.
+    let src = readFileSync(patch, "utf8");
+    const cleaned = stripManualRow(src, pkg);
+    if (cleaned !== src) {
+      if (process.env.DSH_ENHANCE_DRY_RUN !== "1") writeFileSync(patch, cleaned, "utf8");
+      return { changed: true, note: "removed stale manual mount row (bundle layer auto-mounts)" };
+    }
+    return { changed: false, note: inBundles ? "already mounted via dsh.profile.bundles" : "bundle plugin: auto-mounted via its own dsh.bundle layer" };
+  }
   let src = readFileSync(patch, "utf8");
   if (src.includes(`name: '${pkg}'`) || src.includes(`name: "${pkg}"`)) return { changed: false, note: "already mounted in cordis.patch.yml" };
   const id = pkg.replace(/^@[^/]+\//, "").replace(/[^a-z0-9-]/g, "-") || pkg;
@@ -290,10 +407,21 @@ async function cmdInstall(profile, only, dryRun) {
   const failures = [];
   for (const p of plugins) {
     info(`${p.emoji} ${p.name}`);
+    const latest = await latestVersion(p.name);
+    const installed = installedVersion(p.name, profile);
     const addArgs = ["plugin", "--profile", profile, "add", p.name];
     if (dryRun) {
+      ok(`npm latest: ${latest ?? "unknown (network?)"}; installed: ${installed ?? "not installed"}`);
+      if (latest && installed && installed !== latest) {
+        ok(`would bump range to ^${latest} (pnpm keeps stale lockfile versions otherwise)`);
+        ok(`would ensure minimumReleaseAgeExclude entry for ${p.name}@${latest}`);
+      }
       ok(`would run: dsh ${addArgs.join(" ")}`);
     } else {
+      if (latest && installed && installed !== latest) {
+        if (bumpProfileRange(profile, p.name, latest)) info(`range align: ^${installed} → ^${latest}`);
+        ensureReleaseAgeExclude(profile, p.name, latest);
+      }
       const result = await run(dsh, addArgs);
       if (result.code !== 0) {
         const tail = (result.stderr || result.stdout || "").trim().split("\n").slice(-3).join(" ");
@@ -302,6 +430,25 @@ async function cmdInstall(profile, only, dryRun) {
         continue;
       }
       ok(`installed via dsh plugin add`);
+      const after = installedVersion(p.name, profile);
+      if (latest && after !== latest) {
+        const pnpm = findPnpm();
+        if (!pnpm) {
+          bad(`${p.name}: still at ${after ?? "?"}, npm latest ${latest} — install pnpm and re-run`);
+          failures.push(`${p.name}: version mismatch (${after ?? "?"} ≠ ${latest})`);
+          continue;
+        }
+        info(`installed ${after ?? "?"} ≠ latest ${latest} — running pnpm install as fallback`);
+        const pr = await run(pnpm, ["install"], { capture: true, cwd: profileDir(profile) });
+        const final = installedVersion(p.name, profile);
+        if (pr.code !== 0 || final !== latest) {
+          const tail = (pr.stderr || pr.stdout || "").trim().split("\n").slice(-3).join(" ");
+          bad(`${p.name}: still at ${final ?? "?"}, npm latest ${latest} (pnpm exit ${pr.code}): ${tail || "no output"}`);
+          failures.push(`${p.name}: version mismatch (${final ?? "?"} ≠ ${latest})`);
+          continue;
+        }
+        ok(`pnpm install fallback: ${final}`);
+      }
     }
     const mount = ensureMounted(p.name, profile);
     if (dryRun) {
@@ -342,21 +489,52 @@ async function cmdUpdate(profile, only, dryRun) {
       info(`${p.emoji} ${p.name}: not installed — run "dsh-enhance install" first`);
       continue;
     }
+    const installed = installedVersion(p.name, profile);
+    info(`${p.emoji} ${p.name} (installed ${installed})`);
+    const latest = await latestVersion(p.name);
     const args = ["plugin", "--profile", profile, "update", p.name];
     if (dryRun) {
+      ok(`npm latest: ${latest ?? "unknown (network?)"}`);
+      if (latest && installed && installed !== latest) {
+        ok(`would bump range to ^${latest} (pnpm keeps stale lockfile versions otherwise)`);
+        ok(`would ensure minimumReleaseAgeExclude entry for ${p.name}@${latest}`);
+      }
       ok(`would run: dsh ${args.join(" ")}`);
-    } else {
-      const result = await run(dsh, args);
-      if (result.code !== 0) {
-        const tail = (result.stderr || result.stdout || "").trim().split("\n").slice(-3).join(" ");
-        bad(`${p.name} update failed (${result.code}): ${tail || result.error?.message || "unknown error"}`);
-        failures.push(`${p.name}: dsh plugin update exited ${result.code}`);
+      continue;
+    }
+    if (latest && installed && installed !== latest) {
+      if (bumpProfileRange(profile, p.name, latest)) info(`range align: ^${installed} → ^${latest}`);
+      ensureReleaseAgeExclude(profile, p.name, latest);
+    }
+    const result = await run(dsh, args);
+    if (result.code !== 0) {
+      const tail = (result.stderr || result.stdout || "").trim().split("\n").slice(-3).join(" ");
+      bad(`${p.name} update failed (${result.code}): ${tail || result.error?.message || "unknown error"}`);
+      failures.push(`${p.name}: dsh plugin update exited ${result.code}`);
+      continue;
+    }
+    let after = installedVersion(p.name, profile);
+    ok(`updated: ${after ?? "latest"}`);
+    if (latest && after !== latest) {
+      const pnpm = findPnpm();
+      if (!pnpm) {
+        bad(`${p.name}: still at ${after ?? "?"}, npm latest ${latest} — install pnpm and re-run`);
+        failures.push(`${p.name}: version mismatch (${after ?? "?"} ≠ ${latest})`);
         continue;
       }
-      ok(`updated: ${p.name} → ${installedVersion(p.name, profile) ?? "latest"}`);
+      info(`installed ${after ?? "?"} ≠ latest ${latest} — running pnpm install as fallback`);
+      const pr = await run(pnpm, ["install"], { capture: true, cwd: profileDir(profile) });
+      after = installedVersion(p.name, profile);
+      if (pr.code !== 0 || after !== latest) {
+        const tail = (pr.stderr || pr.stdout || "").trim().split("\n").slice(-3).join(" ");
+        bad(`${p.name}: still at ${after ?? "?"}, npm latest ${latest} (pnpm exit ${pr.code}): ${tail || "no output"}`);
+        failures.push(`${p.name}: version mismatch (${after ?? "?"} ≠ ${latest})`);
+        continue;
+      }
+      ok(`pnpm install fallback: ${after}`);
     }
     const mount = ensureMounted(p.name, profile);
-    if (!dryRun && mount.changed) ok(mount.note);
+    if (mount.changed) ok(mount.note);
   }
   head("");
   if (failures.length > 0) {
@@ -398,9 +576,14 @@ function cmdDoctor(profile) {
       continue;
     }
     ok(`${p.emoji} ${p.name}: installed (${version})`);
-    const mounted = isInProfileBundles(p.name, profile) || isMountedInPatch(p.name, profile) || isBundlePackage(p.name, profile);
-    if (mounted) info(`   mounted: ${isInProfileBundles(p.name, profile) ? "dsh.profile.bundles" : isMountedInPatch(p.name, profile) ? "cordis.patch.yml" : "own dsh.bundle layer"}`);
-    else {
+    const inBundles = isInProfileBundles(p.name, profile);
+    const inPatch = isMountedInPatch(p.name, profile);
+    if (inBundles && inPatch) {
+      bad(`   duplicate mount: manual row in cordis.patch.yml AND dsh.profile.bundles — run "dsh-enhance install" to clean up`);
+      healthy = false;
+    } else if (inBundles || inPatch || isBundlePackage(p.name, profile)) {
+      info(`   mounted: ${inBundles ? "dsh.profile.bundles" : inPatch ? "cordis.patch.yml" : "own dsh.bundle layer"}`);
+    } else {
       bad(`   not mounted — run "dsh-enhance install"`);
       healthy = false;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-enhancement-suite",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Enhancement suite for DeepSeek Harness — the official installer and registry for Scorp1o117's Vision, Soul/Persona, Memory & Marketplace plugins.",
   "type": "module",
   "license": "MIT",