dsh-plugin-shop 0.8.6 → 0.8.7-beta.0

package/README.md

@@ -35,9 +35,9 @@ install them once with `npm install -g @deepseek-ai/dsh pnpm` and verify with
 # holds back very recent releases, so a bare `add dsh-plugin-shop` can hand
 # you an older version for a while. Pin the current release — refresh it
 # with `npm view dsh-plugin-shop version`.
-dsh plugin --profile web add dsh-plugin-shop@0.8.5
+dsh plugin --profile web add dsh-plugin-shop@0.8.6
 # or straight through npx, nothing installed:
-npx -y @deepseek-ai/dsh plugin --profile web add dsh-plugin-shop@0.8.5
+npx -y @deepseek-ai/dsh plugin --profile web add dsh-plugin-shop@0.8.6
 ```
 
 Replace `web` with your profile if you use another one. Then restart `dsh` once — a
@@ -67,7 +67,7 @@ ls -1 "${DSH_HOME:-$HOME/.dsh}/profiles" | grep -v '^node_modules$'
 cooldown, and deterministic installs are the point of the agent path.
 
 ```sh
-dsh plugin --profile <profile> add dsh-plugin-shop@0.8.5
+dsh plugin --profile <profile> add dsh-plugin-shop@0.8.6
 ```
 
 **3. Verify — do not skip this.** A zero exit from step 2 means pnpm resolved the

package/lib/client.js

@@ -4321,6 +4321,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					"profiles": union([_undefined(), array(string())]).optional()
 				})]).optional(),
 				"dshPeers": union([_undefined(), record(string(), string())]).optional(),
+				"manifestVersion": union([_undefined(), string()]).optional(),
 				"unpackedSize": union([_undefined(), number()]).optional(),
 				"installSize": union([_undefined(), number()]).optional(),
 				"archived": union([
@@ -6484,10 +6485,13 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		*
 		* The second is the one harness reason that blocks (design
 		* 2026-09-26-dsh-017-readiness, B1, amending "warn, never block"): dsh 0.1.7
-		* refuses the install itself, before pnpm runs, and the shop cannot install
-		* past it. The verdict is dsh's own rule on the profile's own exemptions, so
-		* a disabled button is dsh's answer given early, never the shop's opinion —
-		* and recording the exemption the card shows is what enables it again.
+		* refuses the install itself, an npm entry before pnpm runs and a github
+		* entry after it, rolling the profile back, and the shop cannot install past
+		* it. The verdict is dsh's own rule on the profile's own exemptions, whichever
+		* channel the entry comes from (design
+		* 2026-09-28-bundle-components-and-github-peers, section 7.3), so a disabled
+		* button is dsh's answer given early, never the shop's opinion — and
+		* recording the exemption the card shows is what enables it again.
 		*/
 		function refusesInstall(blockers) {
 			return blockers.some((blocker) => blocker.kind === "name-taken" || blocker.kind === "harness-peers");

package/lib/index.js

@@ -21,7 +21,7 @@ import { isMap, isSeq, parseDocument } from "yaml";
 * both the source tree (tests) and the bundled `lib/index.js` sit exactly
 * one level below the package root, so the same relative URL resolves in
 * both. */
-function ownManifest() {
+function ownManifest$1() {
 	return JSON.parse(readFileSync(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8"));
 }
 /**
@@ -48,7 +48,7 @@ function versionAtLoad(read) {
 }
 /** The version of the code in this process, read when the module was first
 * evaluated — at boot, before any self-update could rewrite the file. */
-const runningVersion = versionAtLoad(() => ownManifest().version);
+const runningVersion = versionAtLoad(() => ownManifest$1().version);
 /**
 * Which run of the code this is: drawn when the module is first evaluated,
 * fixed for the life of the process, and different in the next one.
@@ -70,7 +70,7 @@ const bootId = randomUUID();
 * compare against is worth a verdict.
 */
 function ownPeerRanges() {
-	const declared = ownManifest().peerDependencies;
+	const declared = ownManifest$1().peerDependencies;
 	if (declared === null || typeof declared !== "object") return {};
 	const ranges = {};
 	for (const [spec, range] of Object.entries(declared)) if (typeof range === "string") ranges[spec] = range;
@@ -649,6 +649,7 @@ const entrySchema = z.object({
 		profiles: z.array(z.string()).optional()
 	}).optional(),
 	dshPeers: z.record(z.string(), z.string()).optional(),
+	manifestVersion: z.string().optional(),
 	unpackedSize: z.number().int().nonnegative().optional(),
 	installSize: z.number().int().nonnegative().optional(),
 	archived: z.boolean().optional()
@@ -1249,20 +1250,35 @@ function unmetProfile(declared, running, templates) {
 * could not tell".
 *
 * The rule is dsh's own (`check`, from the running app-boot), handed the
-* manifest dsh's installer reads before it installs a registry spec — `pnpm
-* view <spec> name version peerDependencies`, measured in dsh-plugin-manager
-* 0.1.7-rc.2 — with the catalog's `dshPeers` for the peers. Those are the
-* only peers the rule reads, verbatim. What this cannot see errs toward
-* silence, never toward a refusal dsh would not make: a malformed peer range
-* elsewhere in the manifest, which dsh rejects only after installing, and
-* the plugins a bundle's patch rows name, which it checks then too. Those
-* reach the reader as the install's own failure (`installFailureDetail`).
-*
-* npm entries only. dsh keys an exemption by the INSTALLED manifest's
-* `name@version`, and a github entry's catalog version is a commit: its
-* exemption status cannot be read, and a refusal named here could never be
-* cleared from the shop. dsh refuses such an install itself, and says how
-* to exempt it.
+* manifest dsh's installer judges (`ownManifest`): the name and version dsh
+* keys an exemption by, with the catalog's `dshPeers` for the peers. Those
+* are the only peers the rule reads, verbatim. Both channels are judged, each
+* by the manifest dsh reads for it:
+*
+* - An npm entry by its catalog `version`. dsh reads that manifest before it
+*   installs a registry spec: `pnpm view <spec> name version
+*   peerDependencies`, measured in dsh-plugin-manager 0.1.7-rc.2.
+* - A github entry by `manifestVersion`, the version of the manifest dsh
+*   installs: at the pinned commit (a subpackage's own), or in the release
+*   asset a rescued entry installs from. dsh skips a git or tarball spec
+*   before pnpm and judges the installed manifest after it, rolling the
+*   install back on a refusal (the same dsh-plugin-manager). The entry's
+*   catalog `version` is a commit or a tag, so without `manifestVersion` it
+*   is not judged at all: judged by its commit instead, it would miss an
+*   exemption the profile holds under its real `name@version`, disabling an
+*   install dsh accepts, and could offer no command, since `allow-version`
+*   records no commit (design 2026-09-28-bundle-components-and-github-peers,
+*   sections 6.1 and 7.3).
+*
+* dsh's key names no channel: an exemption recorded for one `name@version`
+* clears every entry whose manifest carries it, npm or github, here as in
+* dsh.
+*
+* What this cannot see errs toward silence, never toward a refusal dsh would
+* not make: a malformed peer range elsewhere in the manifest, which dsh
+* rejects only after installing, and the plugins a bundle's patch rows name,
+* which it checks then too. Those reach the reader as the install's own
+* failure (`installFailureDetail`).
 *
 * A throw from the check forms no verdict for that entry, as a resolver's
 * throw does in `incompatibilityMap`.
@@ -1270,14 +1286,11 @@ function unmetProfile(declared, running, templates) {
 function peerVerdictsOf(entries, check, exemptions, profile) {
 	const out = {};
 	for (const entry of entries) {
-		if (entry.source !== "npm" || entry.dshPeers === void 0) continue;
+		const manifest = ownManifest(entry);
+		if (manifest === null) continue;
 		let issue;
 		try {
-			issue = check.evaluate({
-				name: entry.name,
-				version: entry.version,
-				peerDependencies: entry.dshPeers
-			}, exemptions);
+			issue = check.evaluate(manifest, exemptions);
 		} catch {
 			continue;
 		}
@@ -1290,6 +1303,28 @@ function peerVerdictsOf(entries, check, exemptions, profile) {
 	}
 	return out;
 }
+/**
+* The manifest dsh judges an entry's install by, as `peerVerdictsOf` hands it
+* to the rule, or null when none can be formed: the entry declares no
+* harness peers, or it is a github entry with no `manifestVersion`. An npm
+* entry's catalog `version` is its manifest's; a github entry's is a commit
+* or a tag, so its manifest's own version is the one recorded beside its
+* peers, and the key is read on github entries only.
+*/
+function ownManifest(entry) {
+	if (entry.dshPeers === void 0) return null;
+	if (entry.source === "npm") return {
+		name: entry.name,
+		version: entry.version,
+		peerDependencies: entry.dshPeers
+	};
+	if (entry.manifestVersion === void 0) return null;
+	return {
+		name: entry.name,
+		version: entry.manifestVersion,
+		peerDependencies: entry.dshPeers
+	};
+}
 /** npm's package-name grammar as dsh's exemption records accept it, verbatim
 * from app-boot 0.1.7-rc.2 (`PACKAGE_NAME` in profile-compatibility). */
 const EXEMPTION_PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
@@ -1671,10 +1706,14 @@ const REFUSAL_WARNING_TAIL = " Running it may cause crashes or data loss.";
 /**
 * dsh's own refusal of an install (0.1.7 on) as one detail, or null when the
 * log holds none. The install was dsh's to refuse, not pnpm's to fail: it
-* refuses before pnpm runs, when it can read the manifest — a registry spec,
-* which the catalog's peer verdict already predicts — and after pnpm
-* succeeded otherwise, restoring the profile. Reading that as a pnpm failure
-* sent the reader to `dsh plugin install`, which repairs nothing.
+* refuses before pnpm runs, when it can read the manifest — a registry spec —
+* and after pnpm succeeded otherwise, restoring the profile. The catalog's
+* peer verdict predicts the first, and the second only for a github entry's
+* own peers, judged by the manifest version the catalog records
+* (`peerVerdictsOf`). It predicts no refusal of a bundle's components, and
+* none of a github entry that carries no usable manifest version: dsh makes
+* those after pnpm all the same. Reading any refusal as a pnpm failure sent
+* the reader to `dsh plugin install`, which repairs nothing.
 *
 * The detail is what dsh refused, what it restored, and the command that
 * records its exact-version exemption, rebuilt from what dsh printed through

package/lib/typert.host.js

@@ -50,6 +50,7 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
   'profiles': z.union([z.undefined(), z.array(z.string())]).optional(),
 })]).optional(),
   'dshPeers': z.union([z.undefined(), z.record(z.string(), z.string())]).optional(),
+  'manifestVersion': z.union([z.undefined(), z.string()]).optional(),
   'unpackedSize': z.union([z.undefined(), z.number()]).optional(),
   'installSize': z.union([z.undefined(), z.number()]).optional(),
   'archived': z.union([z.undefined(), z.literal(false), z.literal(true)]).optional(),
@@ -498,7 +499,7 @@ export const TYPERT = {
           },
           {
             "name": "CatalogEntry",
-            "declaration": "export interface CatalogEntry {\n    name: string;\n    version: string;\n    integrity: string | null;\n    publishedAt: string | null;\n    repository: string | null;\n    license: string | null;\n    tier: 'verified' | 'verified-stale' | 'community';\n    metadata: 'declared' | 'derived';\n    review?: { reviewedVersion?: string; reviewedCommit?: string; reviewedSha256?: string; repo?: string; reviewer: string; reviewCommit: string; notes: string; };\n    catalog?: CatalogSection;\n    source: 'npm' | 'github';\n    publisher?: string;\n    repo?: string;\n    subdir?: string;\n    tarball?: { url: string; sha256: string; };\n    added?: string;\n    peers?: string[];\n    compatibility?: { dsh?: string; profiles?: string[]; };\n    dshPeers?: Record<string, string>;\n    unpackedSize?: number;\n    installSize?: number;\n    archived?: boolean;\n}"
+            "declaration": "export interface CatalogEntry {\n    name: string;\n    version: string;\n    integrity: string | null;\n    publishedAt: string | null;\n    repository: string | null;\n    license: string | null;\n    tier: 'verified' | 'verified-stale' | 'community';\n    metadata: 'declared' | 'derived';\n    review?: { reviewedVersion?: string; reviewedCommit?: string; reviewedSha256?: string; repo?: string; reviewer: string; reviewCommit: string; notes: string; };\n    catalog?: CatalogSection;\n    source: 'npm' | 'github';\n    publisher?: string;\n    repo?: string;\n    subdir?: string;\n    tarball?: { url: string; sha256: string; };\n    added?: string;\n    peers?: string[];\n    compatibility?: { dsh?: string; profiles?: string[]; };\n    dshPeers?: Record<string, string>;\n    manifestVersion?: string;\n    unpackedSize?: number;\n    installSize?: number;\n    archived?: boolean;\n}"
           },
           {
             "name": "CatalogSection",

package/lib/typert.remote-client.js

@@ -50,6 +50,7 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
   'profiles': z.union([z.undefined(), z.array(z.string())]).optional(),
 })]).optional(),
   'dshPeers': z.union([z.undefined(), z.record(z.string(), z.string())]).optional(),
+  'manifestVersion': z.union([z.undefined(), z.string()]).optional(),
   'unpackedSize': z.union([z.undefined(), z.number()]).optional(),
   'installSize': z.union([z.undefined(), z.number()]).optional(),
   'archived': z.union([z.undefined(), z.literal(false), z.literal(true)]).optional(),

package/lib/types/client/present.d.ts

@@ -134,10 +134,13 @@ export declare function readsIncompatible(blockers: readonly {
  *
  * The second is the one harness reason that blocks (design
  * 2026-09-26-dsh-017-readiness, B1, amending "warn, never block"): dsh 0.1.7
- * refuses the install itself, before pnpm runs, and the shop cannot install
- * past it. The verdict is dsh's own rule on the profile's own exemptions, so
- * a disabled button is dsh's answer given early, never the shop's opinion —
- * and recording the exemption the card shows is what enables it again.
+ * refuses the install itself, an npm entry before pnpm runs and a github
+ * entry after it, rolling the profile back, and the shop cannot install past
+ * it. The verdict is dsh's own rule on the profile's own exemptions, whichever
+ * channel the entry comes from (design
+ * 2026-09-28-bundle-components-and-github-peers, section 7.3), so a disabled
+ * button is dsh's answer given early, never the shop's opinion — and
+ * recording the exemption the card shows is what enables it again.
  */
 export declare function refusesInstall(blockers: readonly {
     kind: BlockerKind;

package/lib/types/host/compatibility.d.ts

@@ -181,20 +181,35 @@ export declare function compatibilityMap(entries: readonly (EntryIdentity & {
  * could not tell".
  *
  * The rule is dsh's own (`check`, from the running app-boot), handed the
- * manifest dsh's installer reads before it installs a registry spec — `pnpm
- * view <spec> name version peerDependencies`, measured in dsh-plugin-manager
- * 0.1.7-rc.2 — with the catalog's `dshPeers` for the peers. Those are the
- * only peers the rule reads, verbatim. What this cannot see errs toward
- * silence, never toward a refusal dsh would not make: a malformed peer range
- * elsewhere in the manifest, which dsh rejects only after installing, and
- * the plugins a bundle's patch rows name, which it checks then too. Those
- * reach the reader as the install's own failure (`installFailureDetail`).
+ * manifest dsh's installer judges (`ownManifest`): the name and version dsh
+ * keys an exemption by, with the catalog's `dshPeers` for the peers. Those
+ * are the only peers the rule reads, verbatim. Both channels are judged, each
+ * by the manifest dsh reads for it:
  *
- * npm entries only. dsh keys an exemption by the INSTALLED manifest's
- * `name@version`, and a github entry's catalog version is a commit: its
- * exemption status cannot be read, and a refusal named here could never be
- * cleared from the shop. dsh refuses such an install itself, and says how
- * to exempt it.
+ * - An npm entry by its catalog `version`. dsh reads that manifest before it
+ *   installs a registry spec: `pnpm view <spec> name version
+ *   peerDependencies`, measured in dsh-plugin-manager 0.1.7-rc.2.
+ * - A github entry by `manifestVersion`, the version of the manifest dsh
+ *   installs: at the pinned commit (a subpackage's own), or in the release
+ *   asset a rescued entry installs from. dsh skips a git or tarball spec
+ *   before pnpm and judges the installed manifest after it, rolling the
+ *   install back on a refusal (the same dsh-plugin-manager). The entry's
+ *   catalog `version` is a commit or a tag, so without `manifestVersion` it
+ *   is not judged at all: judged by its commit instead, it would miss an
+ *   exemption the profile holds under its real `name@version`, disabling an
+ *   install dsh accepts, and could offer no command, since `allow-version`
+ *   records no commit (design 2026-09-28-bundle-components-and-github-peers,
+ *   sections 6.1 and 7.3).
+ *
+ * dsh's key names no channel: an exemption recorded for one `name@version`
+ * clears every entry whose manifest carries it, npm or github, here as in
+ * dsh.
+ *
+ * What this cannot see errs toward silence, never toward a refusal dsh would
+ * not make: a malformed peer range elsewhere in the manifest, which dsh
+ * rejects only after installing, and the plugins a bundle's patch rows name,
+ * which it checks then too. Those reach the reader as the install's own
+ * failure (`installFailureDetail`).
  *
  * A throw from the check forms no verdict for that entry, as a resolver's
  * throw does in `incompatibilityMap`.
@@ -202,6 +217,7 @@ export declare function compatibilityMap(entries: readonly (EntryIdentity & {
 export declare function peerVerdictsOf(entries: readonly (EntryIdentity & {
     version: string;
     dshPeers?: Record<string, string>;
+    manifestVersion?: string;
 })[], check: PeerCheck, exemptions: Record<string, string[]>, profile: string): Record<string, PeerVerdict>;
 /**
  * The command that records dsh's exact-version exemption for one refused

package/lib/types/host/types.d.ts

@@ -78,12 +78,26 @@ export interface CatalogEntry {
     /** The package's peers on the harness itself (`@deepseek-ai/dsh` and
      * `@deepseek-ai/dsh-*`) with their ranges verbatim, optional ones and empty
      * ranges included — what dsh 0.1.7 refuses an install on. The host hands
-     * them to the running dsh's own check (`peerVerdictsOf`). npm entries only:
-     * dsh keys the exemption that clears its refusal by the installed
-     * manifest's version, which a github entry's catalog version is not
-     * (registry `Entry.dshPeers`). Absent when the package declares none, or
-     * when its catalog predates the field. */
+     * them to the running dsh's own check (`peerVerdictsOf`) on both channels:
+     * an npm entry is judged by its catalog `version`, a github entry by
+     * {@link manifestVersion}, because dsh keys the exemption that clears its
+     * refusal by the installed manifest's version, which a github entry's
+     * catalog version is not (registry `Entry.dshPeers`; design
+     * 2026-09-28-bundle-components-and-github-peers, section 7.3). Absent when
+     * the package declares none, or when its catalog predates the field; on a
+     * github entry also when its manifest names no usable version, since both
+     * keys drop together, and until the registry re-reads its repository under
+     * the rule that records them. */
     dshPeers?: Record<string, string>;
+    /** A github entry's installed manifest `version` (registry
+     * `Entry.manifestVersion`): the version dsh keys an exemption by, where the
+     * entry's catalog `version` is a commit or a release tag. Present exactly
+     * when a github entry's {@link dshPeers} is. An npm entry's own `version` is
+     * its manifest's, so `peerVerdictsOf` never reads this key on one, and a
+     * github entry without it is not judged at all (design
+     * 2026-09-28-bundle-components-and-github-peers, section 7.3). Absent when
+     * the catalog predates the field. */
+    manifestVersion?: string;
     /** Wire-compatibility key, not a field to read — see {@link installSize},
      * which the catalog parse fills from this one. It names npm's OWN quantity
      * (`dist.unpackedSize`), so it is npm-only and the parse REFUSES one on a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-shop",
-  "version": "0.8.6",
+  "version": "0.8.7-beta.0",
   "description": "The DeepSeek Harness plugin shop: browse, install, enable, and update dsh plugins from a git-auditable catalog.",
   "keywords": [
     "dsh-plugin",