dsh-plugin-marketplace 0.2.2 → 0.2.4

package/cordis.patch.yml

@@ -0,0 +1,10 @@
+# dsh-plugin-marketplace — bundle patch layer
+#
+# Declares the marketplace as a Cordis loader entry. Shipping this file
+# (and the `dsh.bundle.patch` manifest field) makes the package a standard
+# profile bundle: `dsh plugin --profile <p> add dsh-plugin-marketplace`
+# (and any other bundle-list registration) loads it without the boot-time
+# "declares no dsh.bundle" failure, and the entry mounts automatically.
+- insert:
+    - id: plugin-marketplace
+      name: 'dsh-plugin-marketplace'

package/index.js

@@ -1,162 +1,295 @@
-/**
- * dsh-plugin-marketplace — node half.
- *
- * Host side of the marketplace: owns a `plugin-marketplace` settings
- * namespace used as a message channel between the browser UI and this
- * process. The client writes an `install` request; the settings watch here
- * spawns `dsh plugin --profile <p> add <pkg>` (npm install into the profile)
- * and appends the mount row to the profile's cordis.patch.yml, then reports
- * progress/result back through `installState`.
- *
- * The settings section UI itself lives in the browser half (exports["./client"]).
- */
-import { execFile } from "node:child_process";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import os from "node:os";
-import z from "@deepseek-ai/schemastery";
-import { installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
-import { ensureSettingsNamespaceExposed } from "./vendor/dsh-settings-expose.js";
-
-/** Cordis plugin name. */
-const name = "plugin-marketplace";
-/** Settings namespace owned by this plugin (Web UI settings section + install channel). */
-const NS = settingsNamespace("plugin-marketplace");
-
-/** Runtime schema: the install request + the install state report. */
-const Config = z.object({
-  install: z.object({
-    /** npm package name to install ("" = no pending request). */
-    pkg: z.string().default(""),
-    /** client-set timestamp; host dedups on it. */
-    ts: z.number().default(0),
-  }),
-  installState: z.object({
-    status: z.string().default("idle"), // idle | running | ok | error
-    message: z.string().default(""),
-    ts: z.number().default(0),
-  }),
-});
-
-/** npm package-name shape (scope/name, no spaces, no path chars). */
-const PKG_NAME = /^@?[a-z0-9][a-z0-9-._]*(?:\/[a-z0-9][a-z0-9-._]*)?$/;
-
-function apply(ctx, config) {
-  let sourceGetter = null;
-  let lastTs = 0;
-
-  // ── settings-backed configuration ─────────────────────────────────────────
-  // The browser half edits this namespace; `onChange` fires on every write,
-  // which is what turns an `install` request into a real install.
-  installSettingsSection(ctx, NS, Config, config, {
-    setSource: (getter) => {
-      sourceGetter = getter;
-    },
-    onChange: () => {
-      void maybeRunInstall();
-    },
-  });
-
-  // dsh-host-apiproxy hard-codes which namespaces the Web client may touch;
-  // patch the allowlist idempotently so the client can write install requests.
-  ensureSettingsNamespaceExposed(ctx, "plugin-marketplace", ctx.logger);
-
-  /** Resolved current config (settings layer over the entry). */
-  function current() {
-    return sourceGetter ? sourceGetter() : config;
-  }
-
-  /** Write the install-state report (and clear the consumed request). */
-  async function report(status, message, pkg) {
-    const settings = ctx.get("settings");
-    if (!settings) return;
-    const ts = Date.now();
-    await settings.update(NS, {
-      installState: { status, message, ts, pkg: pkg || "" },
-      install: { pkg: "", ts: 0 },
-    }).catch((error) => {
-      ctx.logger.warn(`[plugin-marketplace] state write failed: ${String(error)}`);
-    });
-  }
-
-  /** Find the active profile name from the process args ("web" default). */
-  function profileName() {
-    const argv = process.argv;
-    const i = argv.indexOf("--profile");
-    if (i >= 0 && argv[i + 1]) return argv[i + 1];
-    return "web";
-  }
-
-  /** The dsh CLI entry used to boot this process (its own bin.js). */
-  function dshBin() {
-    return process.argv[1];
-  }
-
-  /** Append a mount row for `pkg` to cordis.patch.yml (idempotent). */
-  function ensureMounted(pkg, profile) {
-    const dshHome = process.env.DSH_HOME || join(os.homedir(), ".dsh");
-    const patchPath = join(dshHome, "profiles", profile, "cordis.patch.yml");
-    if (!existsSync(patchPath)) return " (patch file not found; mount manually)";
-    const id = pkg.replace(/^@[^/]+\//, "").replace(/[^a-z0-9-]/g, "-") || pkg;
-    let src = readFileSync(patchPath, "utf8");
-    if (src.includes(`name: '${pkg}'`) || src.includes(`name: "${pkg}"`)) return " (already mounted)";
-    // Append under the first `- insert:` list; match its indentation (4 spaces
-    // is the convention used by dsh profiles).
-    const insertAt = src.search(/^- insert:\s*$/m);
-    const row = `\n    - id: ${id}\n      name: '${pkg}'`;
-    if (insertAt >= 0) {
-      src = src.slice(0, insertAt + "- insert:".length) + row + src.slice(insertAt + "- insert:".length);
-    } else {
-      src += `\n- insert:${row}\n`;
-    }
-    writeFileSync(patchPath, src, "utf8");
-    return " (mounted in cordis.patch.yml)";
-  }
-
-  /** Run the install; resolve {code, stdout, stderr}. */
-  function runInstall(pkg, profile) {
-    const bin = dshBin();
-    const node = process.execPath;
-    return new Promise((resolve) => {
-      execFile(node, [bin, "plugin", "--profile", profile, "add", pkg], {
-        timeout: 5 * 60 * 1000,
-        maxBuffer: 8 * 1024 * 1024,
-        windowsHide: true,
-      }, (error, stdout, stderr) => {
-        resolve({ code: error ? (error.code ?? 1) : 0, stdout, stderr });
-      });
-    });
-  }
-
-  async function maybeRunInstall() {
-    try {
-      const cfg = current();
-      const req = cfg?.install;
-      if (!req || !req.pkg || req.ts === lastTs || req.ts === 0) return;
-      lastTs = req.ts;
-      const pkg = String(req.pkg).trim();
-      if (!PKG_NAME.test(pkg)) {
-        await report("error", `invalid package name: ${pkg}`, pkg);
-        return;
-      }
-      const profile = profileName();
-      ctx.logger.info(`[plugin-marketplace] installing ${pkg} (profile=${profile})…`);
-      await report("running", `installing ${pkg}…`, pkg);
-      const result = await runInstall(pkg, profile);
-      if (result.code !== 0) {
-        const tail = (result.stderr || result.stdout || "").trim().split("\n").slice(-3).join(" ");
-        ctx.logger.warn(`[plugin-marketplace] install failed (${result.code}): ${tail}`);
-        await report("error", `install failed: ${tail || "unknown error"}`, pkg);
-        return;
-      }
-      const mountNote = ensureMounted(pkg, profile);
-      ctx.logger.info(`[plugin-marketplace] ${pkg} installed${mountNote}`);
-      await report("ok", `${pkg} installed${mountNote}. Restart dsh web to load it.`, pkg);
-    } catch (error) {
-      ctx.logger.warn(`[plugin-marketplace] install flow failed: ${String(error)}`);
-      await report("error", String(error instanceof Error ? error.message : error));
-    }
-  }
-}
-
-export { Config, apply, name };
+/**
+ * dsh-plugin-marketplace — node half.
+ *
+ * Host side of the marketplace: owns a `plugin-marketplace` settings
+ * namespace used as a message channel between the browser UI and this
+ * process. The client writes an `install` request; the settings watch here
+ * spawns `dsh plugin --profile <p> add <pkg>` (npm install into the profile)
+ * and appends the mount row to the profile's cordis.patch.yml, then reports
+ * progress/result back through `installState`.
+ *
+ * The settings section UI itself lives in the browser half (exports["./client"]).
+ */
+import { execFile } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import os from "node:os";
+import z from "@deepseek-ai/schemastery";
+import { BlockAssembler, createUserMessage } from "@deepseek-ai/dsh-llm";
+import { installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
+import { ensureSettingsNamespaceExposed } from "./vendor/dsh-settings-expose.js";
+
+/** Cordis plugin name. */
+const name = "plugin-marketplace";
+/** Services this plugin needs injected from the host tree (ctx.get requires inject). */
+const inject = ["llm", "agentDefaultModel"];
+/** Settings namespace owned by this plugin (Web UI settings section + install channel). */
+const NS = settingsNamespace("plugin-marketplace");
+
+/** Runtime schema: the install request + the install state report. */
+const Config = z.object({
+  install: z.object({
+    /** npm package name to install ("" = no pending request). */
+    pkg: z.string().default(""),
+    /** client-set timestamp; host dedups on it. */
+    ts: z.number().default(0),
+  }),
+  installState: z.object({
+    status: z.string().default("idle"), // idle | running | ok | error
+    message: z.string().default(""),
+    ts: z.number().default(0),
+  }),
+  /** AI-explain request (client writes repo/desc/readme, host answers). */
+  aiExplain: z.object({
+    repo: z.string().default(""),
+    desc: z.string().default(""),
+    readme: z.string().default(""),
+    ts: z.number().default(0),
+  }),
+  aiExplainResult: z.object({
+    status: z.string().default("idle"), // idle | running | ok | error
+    text: z.string().default(""),
+    ts: z.number().default(0),
+  }),
+});
+
+/** npm package-name shape (scope/name, no spaces, no path chars). */
+const PKG_NAME = /^@?[a-z0-9][a-z0-9-._]*(?:\/[a-z0-9][a-z0-9-._]*)?$/;
+
+function apply(ctx, config) {
+  let sourceGetter = null;
+  let lastTs = 0;
+  let lastExplainTs = 0;
+
+  // ── settings-backed configuration ─────────────────────────────────────────
+  // The browser half edits this namespace; `onChange` fires on every write,
+  // which is what turns an `install` request into a real install.
+  installSettingsSection(ctx, NS, Config, config, {
+    setSource: (getter) => {
+      sourceGetter = getter;
+    },
+    onChange: () => {
+      void maybeRunInstall();
+      void maybeRunExplain();
+    },
+  });
+
+  // dsh-host-apiproxy hard-codes which namespaces the Web client may touch;
+  // patch the allowlist idempotently so the client can write install requests.
+  ensureSettingsNamespaceExposed(ctx, "plugin-marketplace", ctx.logger);
+
+  /** Resolved current config (settings layer over the entry). */
+  function current() {
+    return sourceGetter ? sourceGetter() : config;
+  }
+
+  /** Write the install-state report (and clear the consumed request). */
+  async function report(status, message, pkg) {
+    const settings = ctx.get("settings");
+    if (!settings) return;
+    const ts = Date.now();
+    await settings.update(NS, {
+      installState: { status, message, ts, pkg: pkg || "" },
+      install: { pkg: "", ts: 0 },
+    }).catch((error) => {
+      ctx.logger.warn(`[plugin-marketplace] state write failed: ${String(error)}`);
+    });
+  }
+
+  /** Find the active profile name from the process args ("web" default). */
+  function profileName() {
+    const argv = process.argv;
+    const i = argv.indexOf("--profile");
+    if (i >= 0 && argv[i + 1]) return argv[i + 1];
+    return "web";
+  }
+
+  /** The dsh CLI entry used to boot this process (its own bin.js). */
+  function dshBin() {
+    return process.argv[1];
+  }
+
+  /** Read the profile manifest (its `dsh.profile.bundles` list), or null. */
+  function profileManifest(profile) {
+    try {
+      const dshHome = process.env.DSH_HOME || join(os.homedir(), ".dsh");
+      return JSON.parse(readFileSync(join(dshHome, "profiles", profile, "package.json"), "utf8"));
+    } catch {
+      return null;
+    }
+  }
+
+  /** Whether the installed package declares dsh.bundle.patch (auto-mounted via its bundle layer). */
+  function isBundlePackage(pkg, profile) {
+    try {
+      const dshHome = process.env.DSH_HOME || join(os.homedir(), ".dsh");
+      const manifest = JSON.parse(readFileSync(join(dshHome, "profiles", profile, "node_modules", pkg, "package.json"), "utf8"));
+      return typeof manifest?.dsh?.bundle?.patch === "string" && manifest.dsh.bundle.patch.length > 0;
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Append a mount row for `pkg` to cordis.patch.yml (idempotent).
+   * Bundle plugins (already in `dsh.profile.bundles`, or whose installed
+   * package declares `dsh.bundle.patch`) are mounted by their own bundle
+   * layer — adding a manual row would create a duplicate loader entry and
+   * abort boot, so they are skipped here.
+   */
+  function ensureMounted(pkg, profile) {
+    const dshHome = process.env.DSH_HOME || join(os.homedir(), ".dsh");
+    const patchPath = join(dshHome, "profiles", profile, "cordis.patch.yml");
+    if (!existsSync(patchPath)) return " (patch file not found; mount manually)";
+    const bundles = profileManifest(profile)?.dsh?.profile?.bundles ?? [];
+    if (bundles.includes(pkg)) return " (already mounted via dsh.profile.bundles)";
+    if (isBundlePackage(pkg, profile)) return " (bundle plugin: auto-mounted via its own dsh.bundle layer)";
+    const id = pkg.replace(/^@[^/]+\//, "").replace(/[^a-z0-9-]/g, "-") || pkg;
+    let src = readFileSync(patchPath, "utf8");
+    if (src.includes(`name: '${pkg}'`) || src.includes(`name: "${pkg}"`)) return " (already mounted)";
+    const row = `\n    - id: ${id}\n      name: '${pkg}'`;
+    // A flow-style empty array (`[]`, optionally after comment lines) is a
+    // valid empty patch: replace it with the block-style insert list.
+    // Appending after `[]` would produce two top-level documents in one
+    // stream and crash boot with a YAML parse error.
+    const emptyArray = /^(\s*(?:#[^\n]*\n?)*)\[\s*\]\s*$/.exec(src);
+    if (emptyArray) {
+      writeFileSync(patchPath, `${emptyArray[1]}- insert:${row}\n`, "utf8");
+      return " (mounted in cordis.patch.yml)";
+    }
+    // Insert under the first `- insert:` list; match its indentation (4
+    // spaces is the convention used by dsh profiles).
+    const insertAt = src.search(/^- insert:\s*$/m);
+    if (insertAt >= 0) {
+      src = src.slice(0, insertAt + "- insert:".length) + row + src.slice(insertAt + "- insert:".length);
+    } else {
+      // A non-empty flow-style array cannot be safely extended with string
+      // surgery — refuse rather than corrupt the file.
+      if (/^\s*\[/.test(src)) return " (patch file uses a flow-style array; mount manually)";
+      src += `\n- insert:${row}\n`;
+    }
+    writeFileSync(patchPath, src, "utf8");
+    return " (mounted in cordis.patch.yml)";
+  }
+
+  /** Run the install; resolve {code, stdout, stderr}. */
+  function runInstall(pkg, profile) {
+    const bin = dshBin();
+    const node = process.execPath;
+    return new Promise((resolve) => {
+      execFile(node, [bin, "plugin", "--profile", profile, "add", pkg], {
+        timeout: 5 * 60 * 1000,
+        maxBuffer: 8 * 1024 * 1024,
+        windowsHide: true,
+      }, (error, stdout, stderr) => {
+        resolve({ code: error ? (error.code ?? 1) : 0, stdout, stderr });
+      });
+    });
+  }
+
+  async function maybeRunInstall() {
+    try {
+      const cfg = current();
+      const req = cfg?.install;
+      if (!req || !req.pkg || req.ts === lastTs || req.ts === 0) return;
+      lastTs = req.ts;
+      const pkg = String(req.pkg).trim();
+      if (!PKG_NAME.test(pkg)) {
+        await report("error", `invalid package name: ${pkg}`, pkg);
+        return;
+      }
+      const profile = profileName();
+      ctx.logger.info(`[plugin-marketplace] installing ${pkg} (profile=${profile})…`);
+      await report("running", `installing ${pkg}…`, pkg);
+      const result = await runInstall(pkg, profile);
+      if (result.code !== 0) {
+        const tail = (result.stderr || result.stdout || "").trim().split("\n").slice(-3).join(" ");
+        ctx.logger.warn(`[plugin-marketplace] install failed (${result.code}): ${tail}`);
+        await report("error", `install failed: ${tail || "unknown error"}`, pkg);
+        return;
+      }
+      const mountNote = ensureMounted(pkg, profile);
+      ctx.logger.info(`[plugin-marketplace] ${pkg} installed${mountNote}`);
+      await report("ok", `${pkg} installed${mountNote}. Restart dsh web to load it.`, pkg);
+    } catch (error) {
+      ctx.logger.warn(`[plugin-marketplace] install flow failed: ${String(error)}`);
+      await report("error", String(error instanceof Error ? error.message : error));
+    }
+  }
+
+  /** Write the AI-explain result report (and clear the consumed request). */
+  async function reportExplain(status, text) {
+    const settings = ctx.get("settings");
+    if (!settings) return;
+    const ts = Date.now();
+    await settings.update(NS, {
+      aiExplainResult: { status, text, ts },
+      aiExplain: { repo: "", desc: "", readme: "", ts: 0 },
+    }).catch((error) => {
+      ctx.logger.warn(`[plugin-marketplace] explain state write failed: ${String(error)}`);
+    });
+  }
+
+  /**
+   * Answer an aiExplain request with the deployment's default model: tell the
+   * user in plain Chinese what this plugin roughly does. Uses the same
+   * settings-backed message channel as the install flow.
+   */
+  async function maybeRunExplain() {
+    try {
+      const cfg = current();
+      const req = cfg?.aiExplain;
+      if (!req || !req.repo || req.ts === lastExplainTs || req.ts === 0) return;
+      lastExplainTs = req.ts;
+      const llm = ctx.llm;
+      if (!llm) {
+        await reportExplain("error", "LLM service unavailable; configure a model in Settings → Models.");
+        return;
+      }
+      // Route through the deployment's default model when one is configured.
+      let route = null;
+      try {
+        const defaults = ctx.agentDefaultModel?.currentSelection?.();
+        if (defaults?.provider && defaults?.model) route = defaults;
+      } catch { /* no default model service; fall back to the adapter default */ }
+      const repo = String(req.repo);
+      const desc = String(req.desc || "").trim();
+      const readme = String(req.readme || "").trim().slice(0, 1500);
+      const prompt =
+        `插件仓库：${repo}\n` +
+        (desc ? `简介：${desc}\n` : "") +
+        (readme ? `README 摘要：\n${readme}\n` : "") +
+        `\n请用简体中文、3~5 句话直接告诉我这个插件大概是干嘛的（核心用途、解决什么问题、适合谁）。不要复述仓库名，不要罗列安装步骤。`;
+      await reportExplain("running", "");
+      ctx.logger.info(`[plugin-marketplace] explaining ${repo} (model=${route ? `${route.provider}/${route.model}` : "default"})…`);
+      const messages = [createUserMessage({
+        content: [{ type: "text", text: prompt }],
+        source: { kind: "plugin", plugin: "dsh-plugin-marketplace" },
+      })];
+      const options = {
+        messages,
+        maxTokens: 400,
+        purpose: "plugin-marketplace-explain",
+      };
+      if (route) {
+        options.provider = route.provider;
+        options.model = route.model;
+      }
+      const assembler = new BlockAssembler();
+      for await (const chunk of ctx.llm.stream(options)) assembler.push(chunk);
+      const blocks = assembler.blocks();
+      const text = blocks
+        .filter((block) => block.type === "text")
+        .map((block) => block.text)
+        .join(" ")
+        .trim();
+      if (!text) throw new Error("model produced no text");
+      await reportExplain("ok", text);
+    } catch (error) {
+      ctx.logger.warn(`[plugin-marketplace] explain flow failed: ${String(error)}`);
+      await reportExplain("error", String(error instanceof Error ? error.message : error));
+    }
+  }
+}
+
+export { Config, apply, inject, name };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name":  "dsh-plugin-marketplace",
-    "version":  "0.2.2",
+    "version":  "0.2.4",
     "description":  "DeepSeek Harness Web UI 内置插件市场：在设置页直接浏览 github.com/topics/dsh-plugin，支持搜索、按 Star 排序、查看安装方式。",
     "type":  "module",
     "main":  "index.js",
@@ -10,6 +10,9 @@
                     "./package.json":  "./package.json"
                 },
     "dsh":  {
+                "bundle":  {
+                              "patch":  "./cordis.patch.yml"
+                          },
                 "client":  {
                                "platform":  "web"
                            }
@@ -17,6 +20,7 @@
     "files":  [
                   "index.js",
                   "client.js",
+                  "cordis.patch.yml",
                   "README.md",
                   "README.zh.md",
                   "LICENSE",
@@ -43,7 +47,8 @@
              },
     "peerDependencies":  {
                              "react":  "^18.2.0",
-                             "@deepseek-ai/dsh-settings":  "^0.1.0-rc.6"
+                             "@deepseek-ai/dsh-settings":  "^0.1.0-rc.6",
+                             "@deepseek-ai/dsh-llm":  "^0.1.0-rc.6"
                          },
     "dependencies":  {
                          "@deepseek-ai/schemastery":  "^3.18.1"

package/vendor/dsh-settings-expose.js

@@ -9,6 +9,18 @@
  * actually loaded by the host process, so the plugin's settings section
  * becomes visible in the Web UI without manual edits. A dsh update
  * overwrites the file; the next plugin start re-patches it.
+ *
+ * NOTE: dsh-host-apiproxy is an ESM package, so it never appears in the
+ * CommonJS `Module._cache` (lookup 1 only helps CJS hosts). Lookup 2 anchors
+ * on the running dsh bin, which always resolves the apiproxy as the app's
+ * own dependency; lookup 3 walks up from `@deepseek-ai/dsh-settings` for
+ * other npm layouts. pnpm-installed hosts resolve into an immutable store —
+ * the write then fails and the manual instruction below applies.
+ *
+ * Also note that patching the file only affects the NEXT process start: the
+ * running apiproxy already evaluated its allowlist at module load, so a
+ * settings channel opened mid-session still answers `settings-not-exposed`
+ * until `dsh web` is restarted.
  */
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
@@ -26,7 +38,7 @@ export function ensureSettingsNamespaceExposed(ctx, nsName, logger) {
   try {
     const target = findApiproxyIndex();
     if (!target) {
-      logger?.warn?.(`[settings-expose] could not locate dsh-host-apiproxy; add "${nsName}" to WEB_SETTINGS_NAMESPACES in dsh-host-apiproxy/lib/index.js to get a Web settings section`);
+      logger?.warn?.(`[settings-expose] could not locate dsh-host-apiproxy in this dsh install; the "${nsName}" settings channel will answer "not exposed". Fix: add "${nsName}" to WEB_SETTINGS_NAMESPACES in <dsh>/node_modules/@deepseek-ai/dsh-host-apiproxy/lib/index.js and restart dsh web`);
       return;
     }
     let src;
@@ -48,15 +60,16 @@ export function ensureSettingsNamespaceExposed(ctx, nsName, logger) {
       return;
     }
     writeFileSync(target, patched, "utf8");
-    logger?.info?.(`[settings-expose] added "${nsName}" to WEB_SETTINGS_NAMESPACES (${target}) — restart dsh web for the settings section to appear`);
+    logger?.info?.(`[settings-expose] added "${nsName}" to WEB_SETTINGS_NAMESPACES (${target}) — restart dsh web: the settings channel opens only in the NEXT process start`);
   } catch (error) {
-    logger?.warn?.(`[settings-expose] failed: ${String(error)}`);
+    logger?.warn?.(`[settings-expose] failed to expose "${nsName}" (${String(error)}); add it to WEB_SETTINGS_NAMESPACES in dsh-host-apiproxy/lib/index.js manually, then restart dsh web`);
   }
 }
 
 function findApiproxyIndex() {
   // 1) The host process has already loaded dsh-host-apiproxy: read the real
-  //    module path from the CommonJS module cache (any install layout).
+  //    module path from the CommonJS module cache (any install layout; ESM
+  //    hosts — every modern dsh — skip this).
   try {
     const Module = createRequire(import.meta.url)("module");
     const cache = Module._cache ?? {};
@@ -64,12 +77,30 @@ function findApiproxyIndex() {
       if (key.includes(`${sep}dsh-host-apiproxy${sep}`) && key.endsWith(`${sep}index.js`)) return key;
     }
   } catch { /* fall through */ }
-  // 2) Fallback: sibling of @deepseek-ai/dsh-settings (dsh's nested layout).
+  // 2) Resolve the apiproxy as a dependency of the running dsh app: the bin
+  //    (`node <dsh>/lib/bin.js`) anchors the app root in both shipped and
+  //    source layouts, and dsh-host-apiproxy is always one of its deps.
+  try {
+    const appRoot = dirname(dirname(process.argv[1] ?? ""));
+    const requireFromApp = createRequire(join(appRoot, "package.json"));
+    const entry = requireFromApp.resolve("@deepseek-ai/dsh-host-apiproxy");
+    if (entry.endsWith(`${sep}index.js`)) return entry;
+  } catch { /* fall through */ }
+  // 3) Walk up from @deepseek-ai/dsh-settings: the apiproxy is a scoped
+  //    sibling in the same dependency tree (flat/global and nested layouts).
   try {
     const require = createRequire(import.meta.url);
     const settingsEntry = require.resolve("@deepseek-ai/dsh-settings");
-    const candidate = join(dirname(dirname(dirname(settingsEntry))), "dsh-host-apiproxy", "lib", "index.js");
-    if (existsSync(candidate)) return candidate;
+    let dir = dirname(settingsEntry);
+    while (true) {
+      const scoped = join(dir, "@deepseek-ai", "dsh-host-apiproxy", "lib", "index.js");
+      if (existsSync(scoped)) return scoped;
+      const bare = join(dir, "dsh-host-apiproxy", "lib", "index.js");
+      if (existsSync(bare)) return bare;
+      const parent = dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
   } catch { /* fall through */ }
   return "";
 }