dsh-openwrite 0.2.27 → 0.2.33

package/scripts/plugin-doctor.mjs

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+// Offline maintenance checks. Never reads credentials, starts a model, or edits profiles.
+import { readFile, realpath } from 'node:fs/promises'
+import { execFileSync } from 'node:child_process'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { isAbsolute, join, resolve } from 'node:path'
+import { homedir } from 'node:os'
+import { load } from 'js-yaml'
+import { inspectProfile } from './maintenance.mjs'
+import { detectCompanions } from '../companions.mjs'
+
+const root = fileURLToPath(new URL('../', import.meta.url))
+const packageDirs = ['.', 'packages/openwrite-bridge', 'packages/studio-panel']
+const isDsh = name => /^@deepseek-ai\/dsh(?:-|$)/.test(name)
+const lockName = path => path.match(/(?:^|\/)node_modules\/(@deepseek-ai\/[^/]+)$/)?.[1]
+const readJson = async path => JSON.parse(await readFile(path, 'utf8'))
+const exactVersion = value => /^\d+\.\d+\.\d+(?:-[\w.-]+)?$/.test(value ?? '')
+
+export function auditVersions(manifest, lock, baseline, graph = {}) {
+  const errors = []
+  if (!exactVersion(baseline)) errors.push('DSH baseline must be an exact version')
+  for (const field of ['dependencies', 'devDependencies', 'peerDependencies']) {
+    const declared = manifest[field] ?? {}
+    const locked = lock.packages?.['']?.[field] ?? {}
+    for (const name of new Set([...Object.keys(declared), ...Object.keys(locked)])) {
+      if (declared[name] !== locked[name]) errors.push(`lock metadata differs: ${field}.${name}`)
+      // Build dependencies remain pinned; public peers may enumerate verified hosts.
+      const peerVersions = typeof declared[name] === 'string' ? declared[name].split(' || ') : []
+      const verified = manifest.dsh?.compatibility?.dshReleases ?? {}
+      const compatiblePeer = field === 'peerDependencies' && peerVersions.length > 0
+        && peerVersions.includes(graph[name] ?? baseline)
+        && peerVersions.every(value => exactVersion(value)
+          && (value === (graph[name] ?? baseline) || verified[value] === 'compatible'))
+      if (isDsh(name) && declared[name] !== undefined && declared[name] !== (graph[name] ?? baseline) && !compatiblePeer) {
+        errors.push(`unpinned DSH dependency: ${name}=${declared[name]}`)
+      }
+      if (isDsh(name) && declared[name] !== undefined
+        && (field !== 'peerDependencies' || !manifest.peerDependenciesMeta?.[name]?.optional)
+        && !lock.packages?.[`node_modules/${name}`]) {
+        errors.push(`required SDK missing from lock: ${name}`)
+      }
+    }
+  }
+  for (const [path, entry] of Object.entries(lock.packages ?? {})) {
+    const name = lockName(path)
+    if (name && isDsh(name) && entry.version !== (graph[name] ?? baseline)) {
+      errors.push(`DSH lock drift: ${name}=${entry.version}, expected ${baseline}`)
+    }
+    if (name === '@deepseek-ai/cordis' && entry.version !== (graph[name] ?? '4.0.2')) {
+      errors.push(`Cordis lock drift: ${entry.version}, expected ${graph[name] ?? '4.0.2'}`)
+    }
+  }
+  if (!lock.packages?.['']) errors.push('missing lockfile root metadata')
+  return errors
+}
+
+const exportPaths = value => typeof value === 'string' ? [value]
+  : value && typeof value === 'object' ? Object.values(value).flatMap(exportPaths) : []
+const packagePath = path => path?.replace(/^\.\//, '')
+
+export function auditBundle(manifest, files, patch) {
+  const errors = []
+  const available = new Set(files)
+  const required = [manifest.main, manifest.types, manifest.dsh?.bundle?.patch,
+    ...exportPaths(manifest.exports)]
+  if (!manifest.dsh?.bundle?.patch) errors.push('missing dsh.bundle.patch')
+  if (!manifest.main || !manifest.types) errors.push('missing host JS/types entry')
+  for (const path of required.filter(Boolean)) {
+    if (isAbsolute(path) || path.split(/[\\/]/).includes('..') || path.includes('\\')) {
+      errors.push(`entry escapes package: ${path}`)
+    } else if (!available.has(packagePath(path))) errors.push(`entry missing from tarball: ${path}`)
+  }
+  const rows = Array.isArray(patch) ? patch.flatMap(op => op?.insert ?? []) : []
+  if (rows.filter(row => row.name === manifest.name).length !== 1) {
+    errors.push('bundle patch must mount its host package exactly once')
+  }
+  const ids = rows.map(row => row.id)
+  if (ids.some(id => typeof id !== 'string' || !id) || new Set(ids).size !== ids.length) {
+    errors.push('bundle patch has missing/duplicate row ids')
+  }
+  if (manifest.dsh?.client || manifest.exports?.['./client']) {
+    if (manifest.dsh?.client?.platform !== 'web' || !manifest.exports?.['./client']) {
+      errors.push('web client needs platform=web and ./client export')
+    }
+    // The host route serves these on demand; a source-tree-only build can mask omissions.
+    for (const path of ['LICENSE', 'dist/index.css', 'dist/index.min.js',
+      'dist/css/content-theme/dark.css', 'dist/css/content-theme/light.css',
+      'dist/js/lute/lute.min.js', 'dist/js/icons/ant.js', 'dist/js/i18n/zh_CN.js']) {
+      if (!available.has(`vendor/vditor/${path}`)) errors.push(`editor asset missing from tarball: ${path}`)
+    }
+  }
+  return errors
+}
+
+async function checkProfiles(report) {
+  const home = process.env.DSH_HOME ?? join(process.env.HOME ?? '', '.dsh')
+  for (const profile of ['web', 'headless']) {
+    const dir = join(home, 'profiles', profile)
+    await report(`profile ${profile}`, async () => {
+      const manifest = await readJson(join(dir, 'package.json'))
+      const name = 'dsh-openwrite'
+      if (manifest.dsh?.profile?.bundles?.filter(n => n === name).length !== 1) throw new Error('standard bundle not installed exactly once')
+      const installed = await realpath(join(dir, 'node_modules', name))
+      const pkg = await readJson(join(installed, 'package.json'))
+      if (pkg.name !== name || !pkg.dsh?.bundle?.patch) throw new Error('invalid installed bundle')
+      await readFile(join(installed, 'release/runtime-manifest.json'))
+      const leftover = inspectProfile(manifest).leftover
+      if (leftover.length) throw new Error(`legacy packages still in bundles or dependencies (${leftover.join(', ')}); run openwrite-maintenance migrate --apply with dsh stopped`)
+    })
+  }
+}
+
+export async function doctor({ profiles = false } = {}) {
+  let failures = 0
+  const report = async (label, check) => {
+    try { await check(); console.log(`PASS  ${label}`) }
+    catch (error) { failures++; console.error(`FAIL  ${label}: ${error.message}`) }
+  }
+  const assertClean = errors => { if (errors.length) throw new Error(errors.slice(0, 8).join('; ') + (errors.length > 8 ? `; +${errors.length - 8} more` : '')) }
+  const rootManifest = await readJson(join(root, 'package.json'))
+  const compatibility = await readJson(join(root, 'release/sdk-compatibility.json'))
+  const baseline = rootManifest.devDependencies?.['@deepseek-ai/dsh']
+  console.log(`dsh-Openwrite doctor — DSH ${baseline}, Cordis 4.0.2 (offline)`)
+  await report('Node >= 22.19.0', () => {
+    const [major, minor] = process.versions.node.split('.').map(Number)
+    if (major < 22 || (major === 22 && minor < 19)) throw new Error(`found ${process.versions.node}`)
+  })
+  for (const relative of packageDirs) {
+    const dir = resolve(root, relative)
+    const manifest = await readJson(join(dir, 'package.json'))
+    const lock = await readJson(join(dir, 'package-lock.json'))
+    await report(`${relative}: manifest + lock compatibility`, () => assertClean(auditVersions(manifest, lock, baseline, compatibility.packages)))
+    await report(`${relative}: installed SDK matches lock`, async () => {
+      const errors = []
+      for (const [path, entry] of Object.entries(lock.packages ?? {})) {
+        const name = lockName(path)
+        if (!name || (!isDsh(name) && name !== '@deepseek-ai/cordis')) continue
+        try {
+          const installed = await readJson(join(dir, path, 'package.json'))
+          if (installed.version !== entry.version) errors.push(`${name}=${installed.version}, lock=${entry.version}`)
+        } catch { errors.push(`missing ${name}; run npm ci in ${relative}`) }
+      }
+      assertClean(errors)
+    })
+    if (relative === '.') continue
+    await report(`${manifest.name}: packed entries + patch + assets`, async () => {
+      const packed = JSON.parse(execFileSync('npm', ['pack', '--dry-run', '--json', '--ignore-scripts'],
+        { cwd: dir, encoding: 'utf8', timeout: 30000, stdio: ['ignore', 'pipe', 'pipe'] }))
+      const patch = load(await readFile(join(dir, manifest.dsh.bundle.patch), 'utf8'))
+      assertClean(auditBundle(manifest, packed[0].files.map(file => file.path), patch))
+      const host = await import(pathToFileURL(join(dir, manifest.main)).href)
+      if (host.name !== manifest.name || typeof host.apply !== 'function') throw new Error('host must export name + apply')
+    })
+  }
+  if (profiles) await checkProfiles(report)
+  await report('companion plugins', async () => {
+    const home = process.env.DSH_HOME?.trim() || join(homedir(), '.dsh')
+    const companions = await detectCompanions(home)
+    const lines = []
+    if (companions.dog.installed) lines.push(`dsh-dog ${companions.dog.usable ? 'active' : `inactive (${companions.dog.reason})`}`)
+    if (companions.ops.installed) lines.push(`dsh-ops ${companions.ops.usable ? 'active' : `inactive (${companions.ops.reason})`}`)
+    if (companions.freeModel.installed) lines.push(`dsh-our-free-model ${companions.freeModel.usable ? 'active' : `inactive (${companions.freeModel.reason})`}`)
+    if (companions.host === null && (companions.dog.installed || companions.ops.installed || companions.freeModel.installed)) {
+      throw new Error(`host version unresolved; companion decisions stay fail-closed (${lines.join(', ')})`)
+    }
+    console.log(`      ${lines.join(', ') || 'none installed'}`)
+  })
+  console.log(failures ? `${failures} check(s) failed.` : 'All checks passed. No model or live-service call was made.')
+  return failures ? 1 : 0
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const unknown = process.argv.slice(2).filter(arg => arg !== '--profiles')
+  if (unknown.length) { console.error('Usage: node scripts/plugin-doctor.mjs [--profiles]'); process.exitCode = 2 }
+  else {
+    try { process.exitCode = await doctor({ profiles: process.argv.includes('--profiles') }) }
+    catch (error) { console.error(`FAIL  ${error.message}`); process.exitCode = 1 }
+  }
+}

package/scripts/prepare.mjs

@@ -7,7 +7,7 @@ const root = fileURLToPath(new URL('../', import.meta.url))
 const manifest = JSON.parse(await readFile(new URL('../release/runtime-manifest.json', import.meta.url), 'utf8'))
 let built = false
 await access(new URL('../release/' + manifest.wheel.file, import.meta.url))
-for (const dir of ['packages/openwrite-bridge', 'packages/studio-panel', 'vendor/dsh-dog']) {
+for (const dir of ['packages/openwrite-bridge', 'packages/studio-panel']) {
   try { await access(new URL(`../${dir}/lib/index.js`, import.meta.url)); await access(new URL(`../${dir}/lib/${dir.endsWith('openwrite-bridge') ? 'preset-tools.js' : 'client.js'}`, import.meta.url)); continue } catch {}
   built = true
   for (const args of [['ci', '--ignore-scripts', '--no-audit', '--no-fund'], ['run', 'build']]) {
@@ -15,7 +15,16 @@ for (const dir of ['packages/openwrite-bridge', 'packages/studio-panel', 'vendor
     if (result.status !== 0) throw new Error(`${dir}: ${args.join(' ')} failed`)
   }
 }
-if (built) {
+// Provenance must be refreshed whenever the source tree no longer matches the
+// recorded hash, not merely when this run happened to build. Gating on `built`
+// alone means "edit src/, then pack without rebuilding" publishes a tarball
+// whose release/source.json still names the previous tree — and that file is
+// gitignored, so release-report.mjs's dirty check cannot see it either.
+let provenanceStale = true
+try {
+  provenanceStale = !JSON.parse(await readFile(new URL('../release/source.json', import.meta.url), 'utf8')).sourceTreeSha256
+} catch { /* missing or unreadable: regenerate */ }
+if (built || provenanceStale) {
   const result = spawnSync(process.execPath, [fileURLToPath(new URL('./release-provenance.mjs', import.meta.url))], { cwd: root, stdio: 'inherit' })
   if (result.status !== 0) throw new Error('Release provenance generation failed')
 }

package/scripts/safe-upgrade.mjs

@@ -1,16 +1,29 @@
 #!/usr/bin/env node
 // Offline profile upgrades retain the previous complete dependency tree until commit.
-import { cp, mkdir, readFile, readdir, rename, writeFile, open, access, readlink, symlink, unlink } from 'node:fs/promises'
+import { cp, mkdir, readFile, readdir, rename, writeFile, open, access, readlink, symlink, unlink, realpath, lstat, rmdir, rm, utimes } from 'node:fs/promises'
 import { spawn, spawnSync } from 'node:child_process'
 import { join, resolve, relative, isAbsolute, dirname, sep } from 'node:path'
 import { randomUUID, createHash } from 'node:crypto'
 import { homedir } from 'node:os'
 import { pathToFileURL } from 'node:url'
-import { lock as acquireLock } from 'proper-lockfile'
-import yaml from 'js-yaml'
+import { createRequire } from 'node:module'
 
 const PROFILE = /^[a-zA-Z0-9_-]+$/
 const digest = bytes => createHash('sha256').update(bytes).digest('hex')
+function upgradeDependencies(home, profile) {
+  // Release archives do not contain node_modules. Resolve the same dependencies
+  // from the explicitly selected installed profile, without loading its plugin.
+  const resolvers = [createRequire(import.meta.url), createRequire(join(profileDirectory(home, profile), 'package.json'))]
+  const load = name => {
+    for (const require of resolvers) {
+      try { return require(name) } catch (error) {
+        if (error.code !== 'MODULE_NOT_FOUND') throw error
+      }
+    }
+    throw new Error(`UPGRADE_DEPENDENCY_MISSING: ${name}; run this tool from an installed OpenWrite package or repair dependencies in the selected profile first`)
+  }
+  return { acquireLock: load('proper-lockfile').lock, yaml: load('js-yaml') }
+}
 async function exists(path) { try { await access(path); return true } catch (error) { if (error.code === 'ENOENT') return false; throw error } }
 async function save(path, value) {
   const pending = path + '.pending-' + randomUUID()
@@ -18,7 +31,70 @@ async function save(path, value) {
   await rename(pending, path)
 }
 
-async function relocateProfileLinks(staging, previous, replacementRoot = staging) {
+// Recovery cannot load dependencies through a profile which is between renames.
+// Use proper-lockfile's same canonical <profiles>.lock directory and fresh mtime
+// protocol, without importing any code from the missing or backup profile.
+export async function acquireRecoveryLock(home) {
+  const path = (await realpath(join(resolve(home), 'profiles'))) + '.lock'
+  const locked = () => Object.assign(new Error('ELOCKED: another profile operation holds the upgrade lock'), { code: 'ELOCKED' })
+  const same = (a, b) => a.dev === b.dev && a.ino === b.ino && a.birthtimeMs === b.birthtimeMs
+  let owner
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try { await mkdir(path, { mode: 0o700 }); owner = await lstat(path); break }
+    catch (error) {
+      if (error.code !== 'EEXIST') throw error
+      let observed
+      try { observed = await lstat(path) } catch (cause) { if (cause.code === 'ENOENT') continue; throw cause }
+      if (!observed.isDirectory() || Date.now() - observed.mtimeMs <= 30_000) throw locked()
+      const current = await lstat(path)
+      if (!same(observed, current) || observed.mtimeMs !== current.mtimeMs) throw locked()
+      try { await rmdir(path) } catch (cause) { if (cause.code !== 'ENOENT') throw locked() }
+    }
+  }
+  if (!owner) throw locked()
+  let pending = Promise.resolve(), compromised
+  const assertOwned = async () => {
+    if (compromised) throw compromised
+    const current = await lstat(path)
+    if (!same(owner, current)) throw locked()
+  }
+  const timer = setInterval(() => {
+    pending = pending.then(async () => {
+      await assertOwned()
+      const now = new Date()
+      await utimes(path, now, now)
+    }).catch(error => { compromised = error })
+  }, 1000)
+  timer.unref()
+  return {
+    async assertOwned() { await pending; await assertOwned() },
+    async release() {
+      clearInterval(timer)
+      await pending
+      await assertOwned()
+      await rmdir(path)
+    },
+  }
+}
+
+async function pinArchive(home, archive) {
+  const bytes = await readFile(archive)
+  const sha256 = digest(bytes)
+  const cache = join(resolve(home), 'openwrite', 'packages')
+  await mkdir(cache, { recursive: true, mode: 0o700 })
+  const destination = join(cache, sha256 + '.tgz')
+  if (await exists(destination) && digest(await readFile(destination)) === sha256) return { path: destination, sha256 }
+  const pending = join(cache, '.' + sha256 + '-' + randomUUID() + '.pending')
+  try {
+    const handle = await open(pending, 'wx', 0o600)
+    try { await handle.writeFile(bytes); await handle.sync() } finally { await handle.close() }
+    if (digest(await readFile(pending)) !== sha256) throw new Error('PACKAGE_CACHE_CONFLICT: temporary archive verification failed')
+    await rename(pending, destination)
+    return { path: destination, sha256 }
+  } finally { try { await unlink(pending) } catch (error) { if (error.code !== 'ENOENT') throw error } }
+}
+
+async function relocateProfileLinks(staging, previous, replacementRoot, yaml) {
   const visit = async directory => {
     for (const entry of await readdir(directory, { withFileTypes: true })) {
       const path = join(directory, entry.name)
@@ -87,6 +163,16 @@ async function runInstall(home, profile, spec, log) {
   } finally { clearTimeout(timer); clearTimeout(drainTimer); clearTimeout(escalation); await writes }
 }
 
+/**
+ * `.plugin-manager` is host-owned state, not ours: it must never be staged, or a
+ * POSIX upgrade would commit a snapshot of it that later upgrades then restore.
+ * Compared on a normalized relative path so the check is separator-agnostic —
+ * `path.join` yields `\` on win32, which a literal '/' test can never match.
+ */
+function isHostManagedState(relativePath) {
+  return relativePath === '.plugin-manager' || relativePath.startsWith(`.plugin-manager${sep}`)
+}
+
 function profileDirectory(home, profile) {
   if (!PROFILE.test(profile)) throw new Error('Invalid profile name')
   return join(resolve(home), 'profiles', profile)
@@ -99,10 +185,15 @@ export async function recoverUpgrade(home, operationId, options = {}) {
   const operation = JSON.parse(await readFile(join(root, 'operation.json'), 'utf8'))
   const target = profileDirectory(home, operation.profile)
   await (options.assertStopped || assertHostStopped)(home, operation.profile)
-  const previous = join(root, 'previous-profile')
-  const release = await acquireLock(join(home, 'profiles'), { realpath: true, retries: 0 })
+
+const previous = join(root, 'previous-profile')
+  const lease = await acquireRecoveryLock(home)
   try {
     if (!await exists(target) && await exists(previous)) {
+      if (!operation.old_manifest_sha256 || digest(await readFile(join(previous, 'package.json'))) !== operation.old_manifest_sha256) {
+        throw new Error('PROFILE_CHANGED: backup manifest differs from the approved operation; no profile restored')
+      }
+      await lease.assertOwned()
       await rename(previous, target)
       operation.status = 'rolled_back'
     } else if (await exists(target)) {
@@ -111,17 +202,22 @@ export async function recoverUpgrade(home, operationId, options = {}) {
       else if (actual === operation.old_manifest_sha256) operation.status = 'rolled_back'
       else throw new Error('PROFILE_CHANGED: preserve the backup and reconcile the profile manually')
     } else throw new Error('RECOVERY_REQUIRED: neither active nor previous profile is available')
+    await lease.assertOwned()
     await save(join(root, 'operation.json'), operation)
     return { operation_id: operationId, status: operation.status, backup: previous }
-  } finally { await release() }
+  } finally { await lease.release() }
 }
 
 /** Stage a complete profile beside the active tree, validate, then swap while stopped. */
 export async function upgradeProfile(home, profile, spec, options = {}) {
   if (typeof spec !== 'string' || !spec || spec.startsWith('-') || /[\r\n]/.test(spec)) throw new Error('A package spec or Release tarball is required')
+  // A bare add can preserve a profile's old exact dependency/lock selection
+  // even after npm latest moved (#142). An upgrade must request a new version.
+  if (spec === 'dsh-openwrite') spec = 'dsh-openwrite@latest'
   const target = profileDirectory(home, profile)
   const stopped = options.assertStopped || assertHostStopped
   await stopped(home, profile)
+  const { acquireLock, yaml } = upgradeDependencies(home, profile)
   const release = await acquireLock(join(home, 'profiles'), { realpath: true, retries: 0 })
   const id = 'upgrade_' + randomUUID()
   const root = join(resolve(home), 'openwrite', 'upgrades', id)
@@ -140,9 +236,21 @@ export async function upgradeProfile(home, profile, spec, options = {}) {
     operation.old_manifest_sha256 = digest(oldManifest)
     await save(join(root, 'operation.json'), operation)
     await cp(target, staging, { recursive: true, dereference: false, verbatimSymlinks: true,
-      filter: source => !source.includes('/.plugin-manager/') && !source.endsWith('/.plugin-manager') })
-    await relocateProfileLinks(staging, target)
-    await (options.run || runInstall)(home, stagingName, spec, log)
+      filter: source => !isHostManagedState(relative(target, source)) })
+    await relocateProfileLinks(staging, target, staging, yaml)
+    // A downloaded tarball may live in a disposable directory. Pin its bytes
+    // below DSH_HOME before the installer writes file: references into locks.
+    let installSpec = spec
+    const localPath = spec.startsWith('file:') ? spec.slice(5) : spec
+    if (/\.(?:tgz|tar\.gz)$/i.test(localPath) && await exists(resolve(localPath))) {
+      const archive = resolve(localPath)
+      const pinned = await pinArchive(home, archive)
+      installSpec = pinned.path
+      operation.install_spec = installSpec
+      operation.package_sha256 = pinned.sha256
+      await save(join(root, 'operation.json'), operation)
+    }
+    await (options.run || runInstall)(home, stagingName, installSpec, log)
     const installed = JSON.parse(await readFile(join(staging, 'node_modules', 'dsh-openwrite', 'package.json'), 'utf8'))
     if (installed.name !== 'dsh-openwrite' || !installed.version || !installed.dsh?.bundle?.patch) throw new Error('BUNDLE_INCOMPLETE: staged OpenWrite manifest is invalid')
     const bundleRoot = join(staging, 'node_modules', 'dsh-openwrite')
@@ -152,7 +260,7 @@ export async function upgradeProfile(home, profile, spec, options = {}) {
     operation.new_manifest_sha256 = digest(await readFile(join(staging, 'package.json')))
     if (digest(await readFile(join(target, 'package.json'))) !== operation.old_manifest_sha256) throw new Error('PROFILE_CHANGED: the active profile changed during staging')
     await stopped(home, profile)
-    await relocateProfileLinks(staging, staging, target)
+    await relocateProfileLinks(staging, staging, target, yaml)
     operation.status = 'swapping'
     await save(join(root, 'operation.json'), operation)
     await rename(target, previous)
@@ -172,7 +280,16 @@ export async function upgradeProfile(home, profile, spec, options = {}) {
     await save(join(root, 'operation.json'), operation)
     error.message += `; operation=${id}; log=${logPath}`
     throw error
-  } finally { try { await log?.close() } finally { await release() } }
+  } finally {
+    try { await log?.close() } finally {
+      // The staging directory is a full profile copy including node_modules, so
+      // every failed upgrade used to leave hundreds of MB behind with nothing to
+      // reclaim it. On success it has been renamed onto the target, so removing
+      // it here is a no-op; on any failure path it is reclaimed.
+      try { await rm(staging, { recursive: true, force: true }) } catch { /* best effort */ }
+      await release()
+    }
+  }
 }
 
 /** Disable only an incomplete OpenWrite bundle so a stopped profile can boot for repair. */
@@ -187,6 +304,7 @@ export async function repairProfile(home, profile, apply = false, options = {})
   const enabled = manifest.dsh?.profile?.bundles?.includes('dsh-openwrite') === true
   if (!apply || !broken || !enabled) return { profile, incomplete: broken, enabled, changed: false }
   await (options.assertStopped || assertHostStopped)(home, profile)
+  const { acquireLock } = upgradeDependencies(home, profile)
   const release = await acquireLock(join(home, 'profiles'), { realpath: true, retries: 0 })
   try {
     if (await readFile(manifestPath, 'utf8') !== original) throw new Error('PROFILE_CHANGED: refresh repair inspection')
@@ -202,7 +320,17 @@ if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1]
   const value = name => { const i = process.argv.indexOf(name); return i < 0 ? undefined : process.argv[i + 1] }
   const home = resolve(process.env.DSH_HOME || join(homedir(), '.dsh'))
   try {
-    const profile = value('--profile') || 'web'
+    // `--profile` as the last argument yields undefined, and `|| 'web'` then
+    // silently operates on `web` and exits 0 - the same bug fixed in
+    // maintenance.mjs. A trailing flag is a usage error, not a default.
+    const profileIndex = process.argv.indexOf('--profile')
+    if (profileIndex >= 0) {
+      const named = process.argv[profileIndex + 1]
+      if (named === undefined || named === '') {
+        throw new Error('Usage: openwrite-safe-upgrade [--upgrade|--repair|--recover <id>] --profile <name> [--apply] [--package <path>]')
+      }
+    }
+    const profile = profileIndex < 0 ? 'web' : process.argv[profileIndex + 1]
     const result = value('--recover') ? await recoverUpgrade(home, value('--recover'))
       : process.argv.includes('--repair') ? await repairProfile(home, profile, process.argv.includes('--apply'))
       : await upgradeProfile(home, profile, value('--package'))

package/dog-tools.mjs

@@ -1,11 +0,0 @@
-export const name = '@dsh-novel/openwrite-dog-tools'
-export const inject = ['tools', 'openwriteDog']
-export function apply(ctx) {
-  for (const tool of ctx.openwriteDog.tools) ctx.effect(() => ctx.tools.register(tool))
-  ctx.effect(() => ctx.tools.guard(execution => {
-    if (!execution.name.startsWith('dog_') || ['dog_status', 'dog_wait', 'dog_validate'].includes(execution.name)) return
-    if (!execution.agent) return 'DoG requires an Agent session'
-    if (execution.agent.ctx.get('planMode')?.get(execution.agent).active) return 'DoG execution is disabled in plan mode'
-    if (!ctx.get('sandboxPolicy') || ctx.get('sandboxPolicy').resolve({ session: execution.agent.session }).mode === 'read-only') return 'DoG execution is disabled in read-only mode'
-  }))
-}

package/presets/openwrite/skills/dog-delivery-query/SKILL.md

@@ -1,42 +0,0 @@
----
-name: dog-delivery-query
-description: Query a chapter delivery DoG graph across manuscript, review, revision application, and re-review closure. Use after writing or reviewing a chapter, after revision actions, or when the user asks whether a chapter is truly ready to deliver.
-user-invocable: false
----
-
-Language: follow the author's current conversation language for responses and help; preserve the manuscript language. Translate these instructions when presenting them.
-
-# 章节交付 DoG 查询
-
-章节写作、评审和修订工具会生成：
-
-`data/novels/{id}/data/dog/deliveries/{chapter}/dog-graph.json`
-
-这张图查询六个阶段：`writing → review → revision → application → rereview → closure`。
-它不替代 OpenWrite 的写章、六域累加评审或修订服务。
-
-## 查询流程
-
-1. 从最近一次 `novel_write_chapter`、`novel_review_chapter`、`novel_revision_*`
-   或 `novel_task_get` 结果的 `dog_delivery.graphPath` 找到图；conductor 输出使用
-   `dog_delivery_graph_path`。
-2. 依次调用 `dog_validate`、`dog_create`、`dog_run`、`dog_wait`，等待终态。
-3. 用 `dog_status` 读取 `review`、`revision` 和 `closure` evidence，再决定领域动作。
-4. 修订应用后必须重新调用 `novel_review_chapter`；只有复评对应当前正文 SHA 且门禁通过，
-   `closure` 才能成为 `closed`。
-
-## 状态解释
-
-- `review.missing`：正文存在但尚未评审。
-- `closure.review_failed`：当前正文已评审但未通过门禁，进入修订闭环。
-- `revision.proposal_pending`：提案已生成，等待作者确认应用或驳回。
-- `revision.applied_requires_rereview`：修订已写入正文，但不能视为问题已解决。
-- `closure.rereview_required`：必须对修订后的正文重新跑六域评审。
-- `closure.closed`：当前正文的最新评审通过，可以交付。
-
-## 约束
-
-- DoG 只查询 canonical manuscript/review/revision 文件，不直接修改它们。
-- 不因提案状态为 `applied` 就宣称问题关闭；必须以当前正文 SHA 对应的复评为准。
-- `needs_human` 是等待评审、确认或复评，不得描述成成功。
-- 应用或驳回修订仍遵守 OpenWrite 创作 Agent 的用户确认边界。

package/presets/openwrite/skills/dog-import-query/SKILL.md

@@ -1,29 +0,0 @@
----
-name: dog-import-query
-description: Query a smart-import DoG graph after a novel has been split into chapters. Use to inspect import completeness, AI precheck errors, and pending outline/asset/canonical setup.
-user-invocable: false
----
-
-Language: follow the author's current conversation language for responses and help; preserve the manuscript language. Translate these instructions when presenting them.
-
-# 拆书导入 DoG 验收
-
-`conductor/smart_import.py` 完成导入后会生成 `dog-graph.json`。这张图只验收导入
-结果，不负责写入章节、资产或大纲。
-
-## 工作流
-
-1. 从导入输出中找到 `data/novels/{id}/data/dog/imports/{IMPORT_ID}/dog-graph.json`。
-2. 依次调用 `dog_validate`、`dog_create`、`dog_run`、`dog_wait`，直到终态。
-3. 用 `dog_status` 查看 `manifest` 和每个 `chapter-ch_*` 节点的 evidence。
-4. 根节点通过后，读取 manifest 的 `construction.nextActions`，再调用规划和资产工具建立大纲、角色、世界观、进度和正典事件。
-5. 资产/大纲建立完成后重新运行 `novel_review_chapter`，再用 `dog-review-query`
-   查询六域评审和 37 个 legacy leaf。
-
-## 约束
-
-- DoG 失败只说明导入文件缺失、为空或 manifest 不一致；不要直接修改正文。
-- `status=partial|failed` 表示导入中途出错；先读取 manifest 的 `error` 和已完成的章节，再修复或重试导入。
-- `aiCheck.status=failed` 要如实报告，不能当成“无问题”。
-- `construction` 中的 `pending` 是后续建模待办，不是导入失败。
-- 不要让 DoG verifier 再调用 Studio 导入接口或重新读取原始整本小说。

package/presets/openwrite/skills/dog-review-query/SKILL.md

@@ -1,42 +0,0 @@
----
-name: dog-review-query
-description: Query an existing hierarchical OpenWrite review-v2 artifact through dsh-dog. Use after novel_review_chapter or when inspecting six quality domains, evidence, coverage, blockers, delivery status, or the 37 legacy checks. Never rerun model review from DoG.
-user-invocable: false
----
-
-Language: follow the author's current conversation language for responses and help; preserve the manuscript language. Translate these instructions when presenting them.
-
-# 分层评审 DoG 查询
-
-这个 Skill 只查询 OpenWrite 已物化的 review-v2 artifact。OpenWrite 的
-`novel_review_chapter` / conductor 是评审真源；DoG 读取 47 节点分层图：上下文、
-六个质量域、硬门禁、确定性聚合和 37 个兼容查询 leaf。DoG 不调用评审模型。
-
-## 工作流
-
-1. 如果本轮还没有评审结果，先按 OpenWrite 写作流程调用 `novel_review_chapter`。
-2. 找到评审输出目录中的 `dog-graph.json`。graph 与 `review.json`、`context.json`、
-   `domain-*.json`、`gate.json`、`aggregate.json` 和 `dim_01.json` …
-   `dim_37.json` 在同一目录。
-3. 读取 graph 后依次调用 `dog_validate`、`dog_create`、`dog_run`、`dog_wait`。
-   所有节点均使用 programmatic `review-record` verifier；`dog_run` 后必须等到终态。
-4. 用 `dog_status` 分别汇报 `qualityScore`、`coverage`、`gateStatus` 和
-   `deliveryStatus`，再按需展开域、criterion、evidence、issue 和 legacy ID。
-   `inconclusive` 表示覆盖不足、未请求或 artifact 不可判定，不能描述为通过。
-5. 只有 OpenWrite 的审查问题才能进入 `novel_revisions_*` 回炉闭环。应用修订后
-   必须复评，再用 `dog-delivery-query` 确认 `closure.closed`。DoG 的 `failure`
-   只负责定位问题，不直接改正文或资产。
-
-## 状态约定
-
-- `qualityScore` 是有可定位正文证据的正向累加分；issue 不直接扣分。
-- `coverage` 单独表达实际完成的评审范围；`inconclusive` 会降低覆盖率。
-- `gateStatus=blocked` 来自 hard-gate 或 critical finding，不改写质量分。
-- `deliveryStatus` 综合质量、覆盖、门禁和正文 SHA 新鲜度；它不是 `passed` 的别名。
-- 37 个 leaf 是 `legacy_check_ids` 查询入口，不是 37 个顶层计分维度。
-
-## 边界
-
-- 不要用 DoG verifier 直接调用 Studio 写入接口。
-- 不要把 warning 自动升级成失败；先展示 evidence，由 `review_gate` 和作者决定。
-- 不要用 `dog_run` 生成、补写或刷新评审；artifact 缺失或 stale 时回到 OpenWrite 流程。

package/scripts/dog/delivery-stage.js

@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-// dsh-dog verifier for one materialized chapter-delivery stage.
-
-import { readFile } from 'node:fs/promises'
-
-const inputPath = process.argv[2]
-if (!inputPath) {
-  process.stdout.write(JSON.stringify({ verdict: 'inconclusive', evidence: { error: 'missing input path' } }))
-  process.exit(0)
-}
-
-try {
-  const value = JSON.parse(await readFile(inputPath, 'utf8'))
-  if (value === null || typeof value !== 'object' || Array.isArray(value)) throw new Error('delivery stage must be an object')
-  if (!['delivery-stage', 'chapter-delivery'].includes(value.recordType)) throw new Error('record is not a delivery artifact')
-  if (!['pass', 'fail', 'inconclusive'].includes(value.verdict)) throw new Error('delivery stage has an invalid verdict')
-  process.stdout.write(JSON.stringify({
-    verdict: value.verdict,
-    evidence: {
-      chapterId: value.chapterId,
-      stage: value.stage,
-      status: value.status ?? (value.readyForDelivery ? 'ready' : 'not_ready'),
-      readyForDelivery: value.readyForDelivery,
-      ...(value.evidence !== null && typeof value.evidence === 'object' ? value.evidence : {}),
-    },
-  }))
-} catch (error) {
-  process.stdout.write(JSON.stringify({
-    verdict: 'inconclusive',
-    evidence: { error: error instanceof Error ? error.message : String(error) },
-  }))
-}

package/scripts/dog/import-chapter.js

@@ -1,20 +0,0 @@
-#!/usr/bin/env node
-// dsh-dog verifier for one imported manuscript chapter.
-
-import { readFile } from 'node:fs/promises'
-
-const inputPath = process.argv[2]
-if (!inputPath) {
-  process.stdout.write(JSON.stringify({ verdict: 'inconclusive', evidence: { error: 'missing input path' } }))
-  process.exit(0)
-}
-
-try {
-  const text = await readFile(inputPath, 'utf8')
-  if (!text.trim()) throw new Error('chapter file is empty')
-  const heading = text.match(/^#\s+(.+)$/m)?.[1]?.trim() ?? ''
-  if (!heading) throw new Error('chapter file has no markdown title')
-  process.stdout.write(JSON.stringify({ verdict: 'pass', evidence: { heading, bytes: Buffer.byteLength(text) } }))
-} catch (error) {
-  process.stdout.write(JSON.stringify({ verdict: 'fail', evidence: { error: error instanceof Error ? error.message : String(error) } }))
-}