dsh-plugin-shop 0.8.3 → 0.8.4-beta.1

package/lib/types/host/peers.d.ts

@@ -7,12 +7,151 @@ import { type EntryIdentity } from '../shared/identity.ts';
  * drive every verdict and exactly one call site touches the filesystem. */
 export type PeerResolver = (spec: string) => boolean;
 /**
- * The production resolver: the same question the harness's own
- * ClientModuleRegistry asks, through a require anchored at the profile. Asking
- * what the loader asks is what keeps this verdict and the runtime's behaviour
- * from drifting apart.
+ * The two filesystem reads the package lookup makes. Injected so fixtures can
+ * drive every branch of the walk — including a permission failure, which a
+ * real directory cannot stage when the suite runs as root — while
+ * `NODE_LOOKUP_FS` below stays the one place this module touches the disk.
+ */
+export interface PackageLookupFs {
+    /** `statSync`'s contract: follows symlinks, and throws an errno error
+     * (`code` set) for a path it cannot stat. */
+    stat(path: string): {
+        isDirectory(): boolean;
+        isFile(): boolean;
+    };
+    /** `readFileSync(path, 'utf8')`'s contract: throws for a file it cannot read. */
+    readFile(path: string): string;
+}
+/**
+ * The directory `spec` is installed at as seen from `fromDir`, or null when
+ * it is not installed there: the walk's match (`findPackageDir`), and only
+ * when that directory holds a `package.json` that stats as a FILE. Anything
+ * else is ABSENT — a match with no manifest, a manifest that is not a file,
+ * one whose stat fails — because the loader matches that directory and the
+ * import fails there. The case this exists for: an uninstall that stops
+ * part-way (on Windows a locked file is enough) can leave
+ * `<profile>/node_modules/L/` holding nothing but a nested `node_modules/`,
+ * and a plugin declaring L then fails with ERR_MODULE_NOT_FOUND; while any
+ * directory counted as present, the badge naming L disappeared. The lookup
+ * before that one, `require.resolve('<spec>/package.json')`, required the
+ * manifest too.
+ *
+ * The manifest is stat-ed and never read here: presence is the file, and
+ * what it says is the version resolver's question. So a manifest that exists
+ * but cannot be read or parsed is a present package with no readable version.
+ *
+ * One edge is knowingly given up: a directory holding `index.js` and no
+ * manifest DOES import — Node's legacy main resolution tries `index.js` in a
+ * match without a manifest — but reads absent here. No package manager
+ * installs that shape.
+ *
+ * Throws only for a `spec` that is not a bare package name. This one lookup
+ * is behind the presence resolver, the version resolver, and the running
+ * harness's own `@deepseek-ai/dsh-app-boot` (`harness.ts`).
+ */
+export declare function packageDirectory(fromDir: string, spec: string, fs?: PackageLookupFs): string | null;
+/** `nodeResolver` over an injected filesystem, walking up from `fromDir` —
+ * the seam fixtures drive the lookup through. */
+export declare function packageResolver(fromDir: string, fs: PackageLookupFs): PeerResolver;
+/**
+ * The production resolver, anchored at the profile. A peer is present when
+ * the first ancestor `node_modules/<spec>` that is a directory holds a
+ * `package.json` file — the directory the ESM resolver that loads plugins'
+ * host halves matches for a bare package, and a manifest in it
+ * (`findPackageDir`, `packageDirectory`). From `<profile>/cordis.yml` the
+ * walk reads `<profile>/node_modules`, then `$DSH_HOME/profiles/node_modules`
+ * — the link farm dsh-app-boot's `healProfilesModuleFallback` keeps, pointing
+ * into the global dsh install, on 0.1.5; 0.1.7 keeps none, and on a harness
+ * that serves its packages another way `harnessPackageResolver` asks it in
+ * front of this walk — and so on up to the root, past any candidate
+ * it cannot stat, as Node's reader walks past one (measured on Node 26.6.0
+ * with a looping link in front of a real copy: the import loads the copy).
+ * The one shape where this and the loader knowingly disagree is a directory
+ * holding `index.js` and no manifest, which imports and reads absent here;
+ * no package manager installs it (`packageDirectory`).
+ *
+ * It used to ask `require.resolve('<spec>/package.json')`, a question that
+ * answered wrongly twice:
+ *
+ *  - Under a packaged dsh executable (`process.pkg`) the link farm holds ESM
+ *    proxy packages instead of symlinks, and a proxy's `exports` leaves
+ *    `./package.json` out on purpose, so resolving it threw
+ *    ERR_PACKAGE_PATH_NOT_EXPORTED for every proxied peer. Presence read that
+ *    as present; the version resolver below could read nothing. Reproduced:
+ *    a proxy at `0.2.0-rc.1` against a declared `^0.1.1-rc.2` gave presence
+ *    true, version null, mismatches `[]` — the load-time self-check could
+ *    never fire under a packaged dsh.
+ *  - Node caches a SUCCESSFUL CJS resolution for the life of the process
+ *    (`Module._pathCache`, keyed on request + lookup paths) and hands the
+ *    cached filename back without looking at the disk; a failure is not
+ *    cached. Measured on Node 26.6.0 in one process: absent → false,
+ *    installed → true, uninstalled → STILL true. A peer the reader removed
+ *    left every plugin declaring it unflagged until dsh restarted.
+ *
+ * So nothing is cached and `exports` is never consulted: every call stats
+ * afresh, and a package with a manifest is present whatever its `exports`
+ * says. `stat` follows symlinks, so a link to nothing reads absent — which
+ * matters, because the link farm adds links and never prunes them: 29 of its
+ * 511 dangled on the machine this was measured on, after upgrades.
+ *
+ * The global folders — `NODE_PATH`, `~/.node_modules`, `~/.node_libraries`,
+ * `$PREFIX/lib/node` — are deliberately not searched: the ESM resolver that
+ * loads plugin host code does not search them either. That is not academic.
+ * pnpm's bin shims export `NODE_PATH` (this repo's own `node_modules/.bin/
+ * vitest` points it into the virtual store), and under one the old lookup
+ * found harness packages from any anchor at all, a temp directory included.
+ *
+ * It throws only for a `spec` that is not a bare package name, and
+ * `incompatibilityMap` turns the throw into no verdict: a hostile name is not
+ * a fact about this installation, and false is an accusation. Nothing on the
+ * filesystem makes it throw. It used to throw on a stat failure other than
+ * ENOENT or ENOTDIR as well, reasoning that such a candidate "may hold the
+ * package" — but the loader never asks what a candidate it cannot stat holds;
+ * it walks on (`findPackageDir`), so the throw silenced true badges and
+ * established nothing.
  */
 export declare function nodeResolver(baseUrl: string): PeerResolver;
+/**
+ * The one method of dsh's `pluginPackages` service the peer check reads: the
+ * harness's own answer to "which package does this import reach?".
+ *
+ * dsh 0.1.7 stopped mirroring its installation into
+ * `$DSH_HOME/profiles/node_modules`. It serves those packages to every
+ * profile through Node's module hooks instead — its runtime resolution
+ * routes a plugin's bare import of any package in the installation's
+ * dependency closure to the package that declares it — so the walk
+ * `nodeResolver` makes, which reads the disk around the profile, finds none
+ * of them. Measured on 0.1.7-rc.2 against the live catalog, the walk read
+ * `@deepseek-ai/dsh-tools` as missing for 1,038 entries, and the shop badged
+ * 2,214 where 0.1.5-rc.3 badges 570 (design
+ * 2026-09-01-harness-compatibility §11). `packageOf` answers from that
+ * resolution for the importer `parentURL` names; 0.1.5 has no such service.
+ *
+ * Typed loosely because the answer crosses in from the harness: only a
+ * string `manifestPath` is used.
+ */
+export interface HarnessPackageLookup {
+    packageOf(specifier: string, parentURL: string): {
+        manifestPath?: unknown;
+    } | undefined;
+}
+/**
+ * Presence on a harness that serves its packages through its runtime
+ * resolution (`HarnessPackageLookup`): present when the harness reaches a
+ * package for `spec` from `parentURL`, the profile anchor, and otherwise
+ * whatever `walk` answers — `nodeResolver` over the same anchor, in
+ * production. Asking the harness first asks the loader's own question, since
+ * a plugin's import goes through the same resolution. The walk stays behind
+ * it because either answer can only clear a badge, never raise one, and a
+ * false badge is the failure this module exists to avoid.
+ *
+ * Throws, which `incompatibilityMap` turns into no verdict for the entries
+ * declaring `spec`, for a name that is not a bare package name and for
+ * anything the service throws. A harness that cannot answer is silence:
+ * falling back to the walk alone would read every package it serves as
+ * missing.
+ */
+export declare function harnessPackageResolver(walk: PeerResolver, lookup: HarnessPackageLookup, parentURL: string, fs?: PackageLookupFs): PeerResolver;
 /**
  * Package name → the peer names that did not resolve. A key is present only
  * when at least one peer is missing, so an absent key means "runs here, or we
@@ -41,15 +180,47 @@ export interface PeerVersionMismatch {
     /** The version the installation actually provides. */
     found: string;
 }
+/** `nodeVersionResolver` over an injected filesystem, walking up from
+ * `fromDir` — the seam fixtures drive the lookup through. */
+export declare function packageVersionResolver(fromDir: string, fs: PackageLookupFs): PeerVersionResolver;
 /**
- * The production resolver: `nodeResolver`'s own resolution, kept this time
- * instead of collapsed to a boolean. Anything that leaves no version to read
- * answers null — a peer that is absent, one that restricts `./package.json`
- * in its exports, an unreadable or malformed manifest, a manifest with no
- * `version`. Absence is deliberately NOT reported as a version violation:
- * `incompatibilityMap` is what covers a missing peer.
+ * The production version resolver: `nodeResolver`'s lookup, then the matched
+ * directory's own `package.json`, read directly. Reading it directly is the
+ * fix, not a shortcut: resolving `<spec>/package.json` is what an exports map
+ * can refuse, and a packaged dsh's module proxy refuses it by construction
+ * while carrying the proxied package's version in exactly that file (see
+ * `nodeResolver`).
+ *
+ * The directory is the one the presence resolver finds present — the walk's
+ * first directory match, holding a `package.json` file (`packageDirectory`;
+ * `findPackageDir` cites Node's reader) — so the two never disagree about
+ * which copy is installed: a candidate nobody can stat is walked past to the
+ * copy further up, whose version is then the answer, exactly as the loader
+ * imports that copy (measured on Node 26.6.0 with a looping link in front of
+ * it); a match without a manifest is absent, and shadows every copy above
+ * it. An `index.js`-only directory, which the loader would import, has no
+ * manifest to read a version from either way.
+ *
+ * Anything that leaves no version to read answers null: a spec that is not a
+ * bare package name, a peer that is absent, a manifest that is unreadable or
+ * malformed, a `version` that is not a non-empty string. Absence is
+ * deliberately NOT reported as a version violation: `incompatibilityMap` is
+ * what covers a missing peer.
  */
 export declare function nodeVersionResolver(baseUrl: string): PeerVersionResolver;
+/**
+ * `harnessPackageResolver`'s twin for versions: read afresh from the manifest
+ * of the package the harness reaches for `spec` — the copy a plugin's import
+ * loads, which the walk cannot see on dsh 0.1.7 — and `walk`'s answer only
+ * when the harness reaches none. A manifest the harness names but nobody can
+ * read or parse answers null, never the walk's version: the walk may match
+ * another copy, and the version must describe the copy presence found (see
+ * `nodeVersionResolver`).
+ *
+ * Null for a name that is not a bare package name and for a service that
+ * throws, as null is already this resolver's no-verdict signal.
+ */
+export declare function harnessPackageVersionResolver(walk: PeerVersionResolver, lookup: HarnessPackageLookup, parentURL: string, fs?: PackageLookupFs): PeerVersionResolver;
 /**
  * The declared peers whose provided version is outside the declared range,
  * ordered by peer name. Pure: the module graph arrives through `resolve`.

package/lib/types/host/plugin-manager.d.ts

@@ -0,0 +1,100 @@
+/**
+ * dsh's `pluginManager` service (0.1.7 on), as far as this shop calls it:
+ * design 2026-09-26-plugin-manager-delegation. Structural throughout: the
+ * build compiles against the 0.1.1-rc.2 harness floor, where
+ * `@deepseek-ai/dsh-plugin-manager` does not exist.
+ */
+import { type Activation } from './activation.ts';
+import type { HotRestartReason } from './hot.ts';
+/** The operations the shop calls. `cancelInstall` is optional because only
+ * the install deadline uses it. Answers stay `unknown` until `readChange`
+ * reads them: a later harness may add or drop fields. */
+export interface PluginManagerLike {
+    installBundle(spec: string, options: {
+        requestId: string;
+    }): Promise<unknown>;
+    removeBundle(name: string): Promise<unknown>;
+    /** `id` is the live loader entry id `listPlugins` reports (`include:...`),
+     * not the patch row id (dsh 0.1.7-rc.2 `setPluginEnabled`). */
+    setPluginEnabled(id: string, enabled: boolean): Promise<unknown>;
+    setBundleEnabled(name: string, enabled: boolean): Promise<unknown>;
+    cancelInstall?(requestId: string): Promise<unknown>;
+}
+/** The service, when `service` offers every required operation; else null.
+ * All or nothing: half a service would take an install and fail its
+ * uninstall. */
+export declare function asPluginManager(service: unknown): PluginManagerLike | null;
+export interface ManagerIncompatible {
+    name: string;
+    version: string;
+    runtimeVersion: string;
+    peers: Record<string, string>;
+}
+/** The facts of one answer, each checked for its type. */
+export interface ManagerChange {
+    application: string | null;
+    stage: string | null;
+    errorCode: string | null;
+    diagnostic: string | null;
+    incompatible: ManagerIncompatible[];
+    kind: string | null;
+    output: string;
+    pendingBuilds: string[];
+    failedAt: string | null;
+    /** Whether the profile's files differ from before the operation (dsh's
+     * `diskState`, which covers package.json). */
+    changed: boolean | null;
+    /** dsh keeps only the last 16 KB of a pnpm run's output; true when this
+     * answer's `packageResult.output` was cut short, so an absence in it
+     * proves nothing. */
+    truncated: boolean;
+}
+/** Read one `ChangeResult`. Every field is optional: one a later harness
+ * drops reads as absent, never as a crash. */
+export declare function readChange(raw: unknown): ManagerChange;
+/** `change`, with every clause naming a `dsh plugin` command removed from
+ * `diagnostic` and `output`: dsh's CLI refuses every `plugin` subcommand for
+ * the desktop profile, so a step dsh wrote assuming that command exists must
+ * not reach a reader there. Two dsh texts this exists for: dsh-app-boot's
+ * `pluginCompatibilityWarning` ("... with `dsh plugin allow-version` or the
+ * plugin manager ..."), whose sentence goes whole, and the restoration line
+ * after a failed repair ("..., but node_modules could not be reinstalled;
+ * run 'dsh plugin install'"), which keeps what it says dsh restored. A
+ * clause is a run between `; ` separators within a sentence; a sentence left
+ * with no clause is dropped, and so is a line left with no sentence. Every
+ * other line stays untouched, and a diagnostic left empty afterward reads as
+ * absent, the same way `codeReason` already treats one. */
+export declare function forDesktopReader(change: ManagerChange): ManagerChange;
+/** The end of a detail that passes on what a service call threw: `: ` and
+ * the message, scrubbed for a desktop reader as `forDesktopReader` scrubs
+ * dsh's answer, since a thrown message is dsh's text as well. A message left
+ * with nothing to say ends the detail with a period instead. */
+export declare function thrownTail(message: string, desktop: boolean): string;
+export interface ManagerOutcome {
+    state: 'done' | 'failed';
+    activation?: Activation;
+    restartReason?: HotRestartReason;
+    detail?: string;
+}
+export interface OutcomeContext {
+    profile: string;
+    name: string;
+    operation: 'install' | 'update' | 'uninstall';
+    /** The gateway's `imported` record holds the name (market borrowings section 1). */
+    alreadyImported: boolean;
+    hasClientHalf: boolean;
+    /** The desktop profile, whose readers can run no `dsh plugin` command. */
+    desktop: boolean;
+    timeoutMs: number;
+}
+/** The sentence a management code gets, plus dsh's own diagnostic. The
+ * diagnostic is trimmed and stripped of one trailing period so one that
+ * already ends in a period is not doubled; empty after that reads as
+ * absent. Exported: Task 7 builds the same tail for a non-terminal notice. */
+export declare function codeReason(change: ManagerChange, code: string): string;
+/** A `ChangeResult` as the shop's terminal install record: design
+ * 2026-09-26-plugin-manager-delegation, section 5, read by the first rule
+ * that matches. A removal that failed after dsh changed the profile says,
+ * after whichever rule read it, that the package is still installed and
+ * switched off. */
+export declare function managerOutcome(raw: unknown, context: OutcomeContext): ManagerOutcome;

package/lib/types/host/profile.d.ts

@@ -3,6 +3,10 @@
 export interface UserLayerRow {
     id: string;
     disabled: boolean;
+    /** The module the entry mounts, when the caller knows it. A user-layer row
+     * that names a DIFFERENT module is one the harness skips
+     * (applyEntryPatches), so only this name lets a named row be written. */
+    name?: string;
 }
 /**
  * Find the profile directory that owns `startPath`.
@@ -19,10 +23,10 @@ export declare function discoverProfile(startPath: string, baseDir?: string): {
     dir: string;
 };
 /**
- * Upsert one row of the profile's user layer (`cordis.patch.yml`). Enabling
- * removes the row so the bundle default rules again; disabling writes
- * `{ id, disabled: true }` (§8: the CLI's watchUserPatches applies the change
- * hot through HMR). Existing rows for other ids are preserved verbatim.
+ * Set one entry's `disabled` key in the profile's user layer
+ * (`cordis.patch.yml`) — {@link setUserLayerRows} for a single row, with the
+ * same rules: one key changes and nothing else does (§8: the CLI's
+ * watchUserPatches applies the change hot through HMR).
  */
 export declare function setUserLayerRow(options: {
     profileDir: string;
@@ -35,6 +39,31 @@ export declare function setUserLayerRow(options: {
  * {@link ownedEntryIds}), and they toggle together: writing them one at a
  * time would read-modify-write the file once per entry, so a crash between
  * two writes would leave the package half disabled.
+ *
+ * The edit changes one key and nothing else (design
+ * 2026-09-26-market-borrowings §2). The layer is validated by the harness's
+ * own parser first, so one it cannot load still throws and is never
+ * rewritten; it is then edited as a YAML document, which keeps every comment,
+ * every other row, every other key and every `!!js` scalar as the user wrote
+ * them. The whole-file rewrite this replaced dropped each toggled id's row —
+ * and with it a `config:` override the user had put there — and dumped the
+ * list back through a library that models no comments, so the first toggle
+ * erased the header dsh writes into every new profile.
+ *
+ * For each entry the row written is the LAST one carrying its id, when the
+ * harness is sure to apply it: applyEntryPatches applies rows in order and
+ * each key replaces the entry's value, so the last row that sets `disabled`
+ * decides it. A row with `insert` is an insertion into a group, never an
+ * override; a row naming another module is skipped by the harness; a named
+ * row whose module the caller did not say cannot be judged. In each of those
+ * cases a row is appended instead, which the harness applies last whatever
+ * came before it — so appending is never wrong, only less tidy.
+ *
+ * An enable writes `disabled: false` rather than deleting the row, which is
+ * what lost a user's row or the comment above it; it is also the harness's
+ * own convention for this file from 0.1.7. The file keeps its permission bits
+ * across the rename (a new one is created owner-only, as the harness's writer
+ * does), because a config override can hold a credential.
  */
 export declare function setUserLayerRows(options: {
     profileDir: string;
@@ -65,6 +94,34 @@ export declare function ownedEntryIds(options: {
     profileDir: string;
     packageName: string;
 }): string[];
+/** One loader entry a package's bundle patch inserts: its id, and the module
+ * it mounts when the patch names one as a plain string. */
+export interface OwnedEntry {
+    id: string;
+    name: string | undefined;
+}
+/**
+ * {@link ownedEntryIds} with the module each entry mounts beside its id. The
+ * name is what the harness judges a NAMED user-layer row by — a row naming a
+ * different module is skipped (applyEntryPatches) — so it is what lets the
+ * toggle write a user's own named row rather than append one beside it. It is
+ * read through the harness's parser, so a relative name arrives anchored to a
+ * file URL exactly as the composed entry carries it; an `!!js` name has no
+ * plain value and reads as undefined. Throws where `ownedEntryIds` does.
+ */
+export declare function ownedEntries(options: {
+    profileDir: string;
+    packageName: string;
+}): OwnedEntry[];
+/**
+ * An installed package's own `dsh.bundle.patch`, exactly as declared, or
+ * undefined when the package, its manifest or the field is absent — or the
+ * manifest cannot be read, which no post-install check can judge either.
+ */
+export declare function declaredBundlePatch(options: {
+    profileDir: string;
+    packageName: string;
+}): unknown;
 /**
  * Does a live loader entry id belong to the package that owns `owned`?
  *

package/lib/types/host/restart.d.ts

@@ -12,9 +12,13 @@
 /** `shop/restart` result: committed, or a typed refusal issued BEFORE
  * anything is torn down. Once `ok` is returned the old process WILL exit —
  * the client monitors the new server and reports a failed boot with the
- * manual command. */
+ * manual command and `logFile`, the file the new process's output goes to:
+ * where a boot that died explains itself, at a path that depends on DSH_HOME
+ * and the shop row's `cacheDir`, which only the host knows. A host older than
+ * the field answers without it, so the client reads it as optional. */
 export type RestartOutcome = {
     ok: true;
+    logFile?: string;
 } | {
     ok: false;
     detail: string;

package/lib/types/host/types.d.ts

@@ -56,8 +56,34 @@ export interface CatalogEntry {
     };
     /** The date this entry first appeared in the catalog (YYYY-MM-DD). */
     added?: string;
-    /** The package's declared peer dependency names (schemaVersion 6). */
+    /** The names of the package's REQUIRED peer dependencies — a peer its
+     * author marks optional in `peerDependenciesMeta` is left out at harvest.
+     * Additive and optional, so it rides every schemaVersion: the version-6
+     * gate this comment used to name came off on 2026-09-03 without ever being
+     * opened. Present on npm entries. Not on github entries yet: the registry
+     * harvests their peers from 2026-09-24 but withholds them from the catalog
+     * (`withholdRepoPeers`) until `SHOP_EMIT_REPO_PEERS` flips, in the release
+     * commit that first promotes a shop refining peers against the browser's
+     * module table to `latest` (design 2026-09-01-harness-compatibility §9.8).
+     * An absent list forms no peer verdict. */
     peers?: string[];
+    /** The author's own `dsh.compatibility` declaration, when they published
+     * one. A REQUIREMENT, never a verdict: the host compares it against the
+     * running installation (`ShopCatalogResult.incompatibleHarness`). Additive
+     * and optional, so it rides every schemaVersion. */
+    compatibility?: {
+        dsh?: string;
+        profiles?: string[];
+    };
+    /** The package's peers on the harness itself (`@deepseek-ai/dsh` and
+     * `@deepseek-ai/dsh-*`) with their ranges verbatim, optional ones and empty
+     * ranges included — what dsh 0.1.7 refuses an install on. The host hands
+     * them to the running dsh's own check (`peerVerdictsOf`). npm entries only:
+     * dsh keys the exemption that clears its refusal by the installed
+     * manifest's version, which a github entry's catalog version is not
+     * (registry `Entry.dshPeers`). Absent when the package declares none, or
+     * when its catalog predates the field. */
+    dshPeers?: Record<string, string>;
     /** Wire-compatibility key, not a field to read — see {@link installSize},
      * which the catalog parse fills from this one. It names npm's OWN quantity
      * (`dist.unpackedSize`), so it is npm-only and the parse REFUSES one on a

package/lib/types/own-version.d.ts

@@ -4,10 +4,26 @@
  * both the source tree (tests) and the bundled `lib/index.js` sit exactly
  * one level below the package root, so the same relative URL resolves in
  * both. */
-export declare function ownVersion(): string;
+/**
+ * Read a version once and keep it: the answer to "which code is this".
+ *
+ * The file cannot answer that question later. A profile installs hoisted, so
+ * a self-update rewrites package.json in the directory the RUNNING code was
+ * loaded from, and every read after it names the version that will run after
+ * the next restart — which the version row then printed as the one running
+ * (design §7.3, 2026-09-27 amendment).
+ *
+ * A first read that throws is not kept: the module import must not fail over
+ * a version string, so the answer falls back to reading on demand, which is
+ * what the row always did.
+ */
+export declare function versionAtLoad(read: () => string): () => string;
+/** The version of the code in this process, read when the module was first
+ * evaluated — at boot, before any self-update could rewrite the file. */
+export declare const runningVersion: () => string;
 /**
  * The peer ranges this build declares — the input to the load-time harness
- * self-check. Read from the same shipped manifest as `ownVersion`, so the
+ * self-check. Read from the same shipped manifest as `runningVersion`, so the
  * ranges checked are the ones this build was actually published with, never
  * a second copy that can drift from them.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-shop",
-  "version": "0.8.3",
+  "version": "0.8.4-beta.1",
   "description": "The DeepSeek Harness plugin shop: browse, install, enable, and update dsh plugins from a git-auditable catalog.",
   "keywords": [
     "dsh-plugin",
@@ -75,6 +75,7 @@
   "dependencies": {
     "js-yaml": "^4.2.0",
     "semver": "^7.6.3",
+    "yaml": "^2.5.1",
     "zod": "^4.4.3"
   },
   "peerDependencies": {