dsh-unplug 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+## 0.1.0 (2026-08-20)
+
+- Initial release.
+- list/remove/disable/enable/audit commands.
+- Agent-callable `unplug` tool.
+- dsh-unplug/v1 report format.
+- Zero runtime dependencies; read-only by default.

package/CONTRIBUTING.md

@@ -0,0 +1,13 @@
+# Contributing to dsh-unplug
+
+1. Fork the repository.
+2. Create a feature branch.
+3. Run `pnpm install && pnpm typecheck && pnpm test` before committing.
+4. Open a pull request.
+
+By contributing, you agree that your contributions will be licensed under the same
+license as this project.
+
+## Code of Conduct
+
+Be respectful, constructive, and evidence-based. No personal attacks.

package/README.md

@@ -0,0 +1,52 @@
+# dsh-unplug
+
+Plug/unplug any DeepSeek Harness plugin cleanly.
+
+**Why?** The official `dsh plugin remove` only handles bundles in the profile's
+`dsh.profile.bundles` list. It does not:
+
+- Remove patch rows from `cordis.patch.yml` (profile or home level)
+- Disable/enable without deleting
+- Audit for orphaned rows or dangling bundle references
+
+`dsh-unplug` fills all three gaps.
+
+## Quick start
+
+```sh
+dsh plugin add dsh-unplug
+```
+
+## CLI
+
+```sh
+dsh-unplug list                         # show every mounted plugin row
+dsh-unplug remove <plugin> --yes        # fully unplug (bundle + patch + deps)
+dsh-unplug disable <plugin>             # disable without deleting
+dsh-unplug enable <plugin>              # re-enable
+dsh-unplug audit                        # detect orphaned/dangling state
+```
+
+Options: `--profile <name>` (default: `default`), `--home <path>`, `--json`, `--yes`.
+
+## Agent-callable tool
+
+Once installed, the agent gains the `unplug` tool:
+
+- `list` / `audit` — always allowed (read-only)
+- `remove <plugin> force: true` — requires explicit confirmation
+- `disable` / `enable` — reversible, no confirmation needed
+
+Returns a `dsh-unplug/v1` report.
+
+## How it works
+
+- Bundle list (`dsh.profile.bundles`) — remove entry + pnpm remove
+- Disabled list (`dsh.profile.disabledBundles`) — move between bundles/disabled lists
+- Profile `cordis.patch.yml` — delete entry or toggle `disabled: true`
+- Home `cordis.patch.yml` — same as above
+- Orphaned rows — detect + report via audit
+
+## License
+
+MIT

package/SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+| ------- | --------- |
+| 0.1.x   | Yes       |
+
+## Reporting a Vulnerability
+
+This plugin is read-only by default; destructive operations (remove) require explicit
+`--yes` / `force: true`. If you find a way to bypass these guards, please open an
+issue at [github.com/zoahdev/dsh-unplug/issues](https://github.com/zoahdev/dsh-unplug/issues).

package/cordis.patch.yml

@@ -0,0 +1,4 @@
+- insert:
+    - id: unplug
+      name: dsh-unplug
+      config: {}

package/lib/bin.js

@@ -0,0 +1,5 @@
+/** bin entry for dsh-unplug. */
+import { main } from './cli.js';
+main(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+});

package/lib/cli.js

@@ -0,0 +1,164 @@
+/**
+ * CLI entry for dsh-unplug.
+ *   dsh-unplug <command> [options]
+ * Commands: list, remove, disable, enable, audit
+ * Options: --profile, --home, --yes, --json
+ */
+import { dshHome } from './lib/paths.js';
+import { audit } from './lib/audit.js';
+import { removePlugin, setPluginEnabled } from './lib/remove.js';
+function usage() {
+    return [
+        'dsh-unplug — plug/unplug any DeepSeek Harness plugin cleanly',
+        '',
+        'Usage:',
+        '  dsh-unplug <command> [options]',
+        '',
+        'Commands:',
+        '  list               List all mounted plugin rows across bundles and patches',
+        '  remove <plugin>    Fully unplug a plugin (bundles + patch rows + dependencies)',
+        '  disable <plugin>   Disable without deleting (removes from bundles, keeps deps)',
+        '  enable <plugin>    Re-enable a disabled plugin (re-adds to bundles, clears disabled flag)',
+        '  audit              Detect orphaned rows, dangling bundles, missing patch files',
+        '',
+        'Options:',
+        '  --profile <name>   Profile name (default: default)',
+        '  --home <path>      DSH_HOME path (default: env DSH_HOME or ~/.dsh)',
+        '  --yes              Confirm destructive operations (remove)',
+        '  --json             Output machine-readable JSON report',
+        '  --help             Show this help',
+        '',
+        'Examples:',
+        '  dsh-unplug list',
+        '  dsh-unplug remove dsh-disk-audit --yes',
+        '  dsh-unplug disable dsh-readme-forge --profile my-profile',
+        '  dsh-unplug enable dsh-readme-forge --json',
+    ].join('\n');
+}
+function parseArgs(argv) {
+    const options = { command: '', profile: 'default', home: '', yes: false, json: false };
+    const positional = [];
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        switch (arg) {
+            case '--help':
+            case '-h': return { help: true };
+            case '--json':
+                options.json = true;
+                break;
+            case '--yes':
+                options.yes = true;
+                break;
+            case '--profile':
+                options.profile = argv[++i];
+                if (options.profile === undefined)
+                    return { error: '--profile requires a value' };
+                break;
+            case '--home':
+                options.home = argv[++i];
+                if (options.home === undefined)
+                    return { error: '--home requires a path' };
+                break;
+            default:
+                if (arg.startsWith('-'))
+                    return { error: `unknown option: ${arg}` };
+                positional.push(arg);
+        }
+    }
+    if (positional.length === 0)
+        return { error: 'missing command (try --help)' };
+    options.command = positional[0];
+    options.plugin = positional[1];
+    return options;
+}
+function printResult(value, json) {
+    const report = value;
+    if (json) {
+        console.log(JSON.stringify(report, null, 2));
+        return report.ok === true ? 0 : 1;
+    }
+    if (report.ok === false) {
+        const err = report.error ?? {};
+        console.error(`Error: ${err.message ?? 'unknown error'} (${err.code ?? 'UNKNOWN'})`);
+        return 1;
+    }
+    switch (report.command ?? '') {
+        case 'list':
+        case 'audit':
+            console.log(`Profile: ${report.profile ?? 'default'}`);
+            console.log(`Bundles (${(report.bundles ?? []).length}): ${(report.bundles ?? []).join(', ') || '(none)'}`);
+            console.log(`Disabled (${(report.disabledBundles ?? []).length}): ${(report.disabledBundles ?? []).join(', ') || '(none)'}`);
+            console.log(`Rows (${(report.rows ?? []).length})`);
+            for (const row of (report.rows ?? [])) {
+                console.log(`  ${row.disabled ? '🔴' : '🟢'} ${row.id} (${row.name ?? ''}) [${row.layer}]`);
+            }
+            if ((report.issues ?? []).length > 0) {
+                console.log(`Issues (${report.issues.length}):`);
+                for (const issue of report.issues) {
+                    console.log(`  ⚠ ${issue.detail}`);
+                }
+            }
+            break;
+        case 'remove':
+            console.log(`Removed: bundle=${report.removedBundle} patchRows=${report.patchRowsRemoved} pnpm=${report.pnpmRemoved}`);
+            if (report.note)
+                console.log(`Note: ${report.note}`);
+            break;
+        case 'disable':
+        case 'enable':
+            console.log(`${report.enabled ? 'Enabled' : 'Disabled'}: bundleMoved=${report.bundleMoved} patchChanged=${report.patchChanged}`);
+            break;
+    }
+    return 0;
+}
+export async function main(argv) {
+    const parsed = parseArgs(argv);
+    if ('help' in parsed) {
+        console.log(usage());
+        return 0;
+    }
+    if ('error' in parsed) {
+        console.error(parsed.error);
+        console.error(usage());
+        return 2;
+    }
+    const { command, plugin, profile, home, yes, json } = parsed;
+    const resolvedHome = home || dshHome();
+    try {
+        switch (command) {
+            case 'list':
+            case 'audit': {
+                const result = audit(resolvedHome, profile);
+                return printResult({ ...result, command, profile }, json);
+            }
+            case 'remove': {
+                if (!yes) {
+                    console.error('remove requires --yes to confirm');
+                    return 2;
+                }
+                if (!plugin) {
+                    console.error('remove requires a plugin name');
+                    return 2;
+                }
+                const result = removePlugin(resolvedHome, profile, plugin, { force: yes });
+                return printResult({ ...result, command }, json);
+            }
+            case 'disable':
+            case 'enable': {
+                if (!plugin) {
+                    console.error(`${command} requires a plugin name`);
+                    return 2;
+                }
+                const result = setPluginEnabled(resolvedHome, profile, plugin, command === 'enable');
+                return printResult({ ...result, command }, json);
+            }
+            default:
+                console.error(`unknown command: ${command} (try --help)`);
+                return 2;
+        }
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        return 1;
+    }
+}

package/lib/index.js

@@ -0,0 +1,151 @@
+/**
+ * dsh-unplug — plug/unplug any DeepSeek Harness plugin cleanly.
+ * @module dsh-unplug
+ */
+import Schema from '@deepseek-ai/schemastery';
+import { defineTool } from '@deepseek-ai/dsh-tools';
+import { createRequire } from 'node:module';
+import { satisfiesCaret } from './lib/version.js';
+import { dshHome } from './lib/paths.js';
+import { audit } from './lib/audit.js';
+import { removePlugin, setPluginEnabled } from './lib/remove.js';
+export const name = 'dsh-unplug';
+export const inject = ['tools'];
+export const TESTED_PEER_RANGE = '^0.1.0-rc.6';
+const require = createRequire(import.meta.url);
+export function resolvedDshToolsVersion() {
+    try {
+        const pkg = require('@deepseek-ai/dsh-tools/package.json');
+        return pkg.version ?? 'unknown';
+    }
+    catch {
+        return 'unresolved';
+    }
+}
+export function assertPeerCompatible() {
+    const version = resolvedDshToolsVersion();
+    if (!satisfiesCaret(version, TESTED_PEER_RANGE)) {
+        throw new Error(`dsh-unplug: resolved @deepseek-ai/dsh-tools ${version}, but this plugin is tested with `
+            + `${TESTED_PEER_RANGE}. Upgrade DeepSeek Harness to 0.1.0-rc.6 or later, then reinstall this plugin.`);
+    }
+}
+export const Config = Schema.object({
+    defaultProfile: Schema.string().default('default'),
+});
+function errorReport(code, message, profile, command) {
+    return { schema: 'dsh-unplug/v1', ok: false, command, profile, error: { code, message } };
+}
+export function apply(ctx, config) {
+    assertPeerCompatible();
+    ctx.tools.register(defineTool({
+        name: 'unplug',
+        description: 'Manage plugins: list every mounted layer, remove a plugin cleanly (bundles + patch rows + dependencies), '
+            + 'disable/enable without deleting, and audit for orphaned/dangling plugin state. '
+            + 'Read-only commands (list, audit) are always allowed. Destructive commands (remove) require `force: true`. '
+            + 'Returns a dsh-unplug/v1 report.',
+        parameters: {
+            command: {
+                type: 'string',
+                required: true,
+                enum: ['list', 'remove', 'disable', 'enable', 'audit'],
+                description: 'Action to perform',
+            },
+            plugin: {
+                type: 'string',
+                description: 'Plugin id or package name to target (required for remove/disable/enable)',
+            },
+            profile: {
+                type: 'string',
+                description: 'Profile name (defaults to the configured defaultProfile)',
+            },
+            force: {
+                type: 'boolean',
+                description: 'Required for remove: confirm the destructive operation',
+            },
+            home: {
+                type: 'string',
+                description: 'DSH_HOME path (defaults to env DSH_HOME or ~/.dsh)',
+            },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    schema: { type: 'string' },
+                    ok: { type: 'boolean' },
+                    command: { type: 'string' },
+                    plugin: { type: 'string' },
+                    profile: { type: 'string' },
+                    removedBundle: { type: 'boolean' },
+                    patchRowsRemoved: { type: 'number' },
+                    pnpmRemoved: { type: 'boolean' },
+                    note: { type: 'string' },
+                    enabled: { type: 'boolean' },
+                    bundleMoved: { type: 'boolean' },
+                    patchChanged: { type: 'boolean' },
+                    error: {
+                        type: 'object',
+                        additionalProperties: false,
+                        properties: { code: { type: 'string' }, message: { type: 'string' } },
+                    },
+                    bundles: { type: 'array' },
+                    disabledBundles: { type: 'array' },
+                },
+            },
+            render: (_args, value) => [{ type: 'text', text: JSON.stringify(value, null, 2) }],
+        },
+        async execute(args) {
+            const home = args.home ?? dshHome();
+            const profile = args.profile ?? config.defaultProfile ?? 'default';
+            try {
+                switch (args.command) {
+                    case 'list':
+                    case 'audit': {
+                        const result = audit(home, profile);
+                        return { schema: 'dsh-unplug/v1', ok: true, command: args.command, profile, bundles: result.bundles, disabledBundles: result.disabledBundles };
+                    }
+                    case 'remove': {
+                        if (!args.force)
+                            return errorReport('UNPLUG_REQUIRES_FORCE', 'Remove requires `force: true` to confirm the destructive operation', profile, args.command);
+                        if (!args.plugin)
+                            return errorReport('UNPLUG_MISSING_PLUGIN', 'remove requires a plugin id or package name', profile, args.command);
+                        const result = removePlugin(home, profile, args.plugin, { force: args.force });
+                        return {
+                            schema: result.schema,
+                            ok: result.ok,
+                            command: args.command,
+                            plugin: result.plugin,
+                            profile: result.profile,
+                            removedBundle: result.removedBundle,
+                            patchRowsRemoved: result.patchRowsRemoved,
+                            pnpmRemoved: result.pnpmRemoved,
+                            note: result.note,
+                        };
+                    }
+                    case 'disable':
+                    case 'enable': {
+                        if (!args.plugin)
+                            return errorReport('UNPLUG_MISSING_PLUGIN', `${args.command} requires a plugin id or package name`, profile, args.command);
+                        const result = setPluginEnabled(home, profile, args.plugin, args.command === 'enable');
+                        return {
+                            schema: result.schema,
+                            ok: result.ok,
+                            command: args.command,
+                            plugin: result.plugin,
+                            profile: result.profile,
+                            enabled: result.enabled,
+                            bundleMoved: result.bundleMoved,
+                            patchChanged: result.patchChanged,
+                        };
+                    }
+                    default:
+                        return errorReport('UNPLUG_UNKNOWN_COMMAND', `Unknown command: ${args.command}`, profile, args.command);
+                }
+            }
+            catch (error) {
+                return errorReport('UNPLUG_ERROR', error instanceof Error ? error.message : String(error), profile, args.command);
+            }
+        },
+    }));
+}

package/lib/lib/audit.js

@@ -0,0 +1,59 @@
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { parsePatch } from './patches.js';
+import { bundlesOf, disabledBundlesOf, readProfileManifest } from './manifest.js';
+import { isResolvable, resolveBundleManifest, resolveBundlePatchPath } from './resolve.js';
+function rowsFromPatch(file, layer) {
+    if (file === undefined || !existsSync(file))
+        return [];
+    const text = readFileSync(file, 'utf8');
+    return parsePatch(text).entries.map((entry) => ({
+        id: entry.id,
+        name: entry.name,
+        op: entry.op,
+        disabled: entry.disabled,
+        layer,
+        file,
+    }));
+}
+export function audit(home, profileName) {
+    const profileDir = path.join(home, 'profiles', profileName);
+    const manifest = existsSync(path.join(profileDir, 'package.json'))
+        ? readProfileManifest(profileDir)
+        : { dependencies: {}, dsh: { profile: { bundles: [], disabledBundles: [] } } };
+    const bundles = bundlesOf(manifest);
+    const disabledBundles = disabledBundlesOf(manifest);
+    const rows = [];
+    const issues = [];
+    for (const pkg of bundles) {
+        if (!isResolvable(profileDir, pkg)) {
+            issues.push({ kind: 'dangling-bundle', detail: `bundle "${pkg}" is listed but not resolvable from ${profileDir}` });
+            continue;
+        }
+        const bundleManifest = resolveBundleManifest(profileDir, pkg);
+        const patchPath = resolveBundlePatchPath(profileDir, pkg);
+        if (bundleManifest?.dsh?.bundle?.patch === undefined) {
+            issues.push({ kind: 'bundle-without-patch', detail: `bundle "${pkg}" declares no dsh.bundle.patch` });
+        }
+        else if (patchPath === undefined || !existsSync(patchPath)) {
+            issues.push({ kind: 'missing-patch-file', detail: `bundle "${pkg}" patch file missing: ${String(patchPath)}` });
+        }
+        else {
+            for (const row of rowsFromPatch(patchPath, 'bundle')) {
+                row.bundle = pkg;
+                rows.push(row);
+            }
+        }
+    }
+    const profilePatch = path.join(profileDir, 'cordis.patch.yml');
+    const homePatch = path.join(home, 'cordis.patch.yml');
+    rows.push(...rowsFromPatch(profilePatch, 'profile-patch'));
+    rows.push(...rowsFromPatch(homePatch, 'home-patch'));
+    const resolvableNames = new Set([...bundles, ...disabledBundles]);
+    for (const row of rows) {
+        if (row.name !== undefined && !resolvableNames.has(row.name) && row.layer !== 'home-patch') {
+            issues.push({ kind: 'orphan-row', detail: `patch row "${row.id}" references "${row.name}" which is not an installed bundle` });
+        }
+    }
+    return { rows, issues, bundles, disabledBundles };
+}

package/lib/lib/manifest.js

@@ -0,0 +1,65 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+export const PROFILE_MANIFEST = 'package.json';
+export function readProfileManifest(dir) {
+    const text = readFileSync(path.join(dir, PROFILE_MANIFEST), 'utf8');
+    return JSON.parse(text);
+}
+export function writeProfileManifest(dir, manifest) {
+    writeFileSync(path.join(dir, PROFILE_MANIFEST), JSON.stringify(manifest, null, 2) + '\n', 'utf8');
+}
+export function bundlesOf(manifest) {
+    return manifest.dsh?.profile?.bundles ?? [];
+}
+export function disabledBundlesOf(manifest) {
+    return manifest.dsh?.profile?.disabledBundles ?? [];
+}
+export function removeBundle(manifest, pkg) {
+    const bundles = bundlesOf(manifest);
+    const disabled = disabledBundlesOf(manifest);
+    const removed = bundles.includes(pkg);
+    const disabledRemoved = disabled.includes(pkg);
+    if (!removed && !disabledRemoved)
+        return { removed: false, disabledRemoved: false };
+    if (manifest.dsh === undefined)
+        manifest.dsh = {};
+    if (manifest.dsh.profile === undefined)
+        manifest.dsh.profile = {};
+    if (removed)
+        manifest.dsh.profile.bundles = bundles.filter((entry) => entry !== pkg);
+    if (disabledRemoved)
+        manifest.dsh.profile.disabledBundles = disabled.filter((entry) => entry !== pkg);
+    if (manifest.dependencies !== undefined)
+        delete manifest.dependencies[pkg];
+    return { removed, disabledRemoved };
+}
+export function disableBundle(manifest, pkg) {
+    const bundles = bundlesOf(manifest);
+    if (!bundles.includes(pkg))
+        return false;
+    if (manifest.dsh === undefined)
+        manifest.dsh = {};
+    if (manifest.dsh.profile === undefined)
+        manifest.dsh.profile = {};
+    manifest.dsh.profile.bundles = bundles.filter((entry) => entry !== pkg);
+    const disabled = disabledBundlesOf(manifest);
+    if (!disabled.includes(pkg))
+        disabled.push(pkg);
+    manifest.dsh.profile.disabledBundles = disabled;
+    return true;
+}
+export function enableBundle(manifest, pkg) {
+    const disabled = disabledBundlesOf(manifest);
+    if (!disabled.includes(pkg))
+        return false;
+    if (manifest.dsh === undefined)
+        manifest.dsh = {};
+    if (manifest.dsh.profile === undefined)
+        manifest.dsh.profile = {};
+    manifest.dsh.profile.disabledBundles = disabled.filter((entry) => entry !== pkg);
+    const bundles = bundlesOf(manifest);
+    if (!bundles.includes(pkg))
+        bundles.push(pkg);
+    manifest.dsh.profile.bundles = bundles;
+    return true;
+}

package/lib/lib/patches.js

@@ -0,0 +1,138 @@
+/**
+ * Minimal, formatting-preserving editor for dsh cordis.patch.yml layers.
+ *
+ * The patch shape we handle is the one `dsh plugin` and every bundle uses:
+ *
+ *   - insert:
+ *       - id: disk-audit
+ *         name: dsh-disk-audit
+ *         config: {}
+ *   - override:
+ *       - id: unplug
+ *         disabled: true
+ *
+ * We only need to find entries by id/name, toggle `disabled`, and delete an
+ * entry (plus its now-empty op block). Everything else is preserved verbatim.
+ */
+const OP_RE = /^(\s*)-\s*([a-zA-Z_$][\w$-]*)\s*:\s*$/;
+const ENTRY_RE = /^(\s*)-\s*id:\s*(.+?)\s*$/;
+const KEY_RE = /^(\s*)(name|disabled):\s*(.+?)\s*$/;
+/** Parse a patch text into lines plus entry descriptors (0-based line numbers). */
+export function parsePatch(text) {
+    const lines = text.split(/\r?\n/);
+    const entries = [];
+    let op = '';
+    let opIndent = -1;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const opMatch = OP_RE.exec(line);
+        if (opMatch !== null) {
+            op = opMatch[2];
+            opIndent = opMatch[1].length;
+            continue;
+        }
+        const entryMatch = ENTRY_RE.exec(line);
+        if (entryMatch === null || entryMatch[1].length <= opIndent) {
+            if (line.trim() !== '' && (line.match(/^\s*-\s*/) !== null) && op !== '') {
+                // Another list under this op we do not model (e.g. `- $patch`).
+                continue;
+            }
+            continue;
+        }
+        const indent = entryMatch[1].length;
+        const id = entryMatch[2];
+        let end = i + 1;
+        let name;
+        let disabled = false;
+        for (let j = i + 1; j < lines.length; j++) {
+            const next = lines[j];
+            if (next.trim() === '')
+                continue;
+            if (!/^\s/.test(next) || (next.match(/^\s*/)?.[0].length ?? 0) <= indent)
+                break;
+            const keyMatch = KEY_RE.exec(next);
+            if (keyMatch !== null && keyMatch[1].length > indent) {
+                if (keyMatch[2] === 'name')
+                    name = keyMatch[3];
+                if (keyMatch[2] === 'disabled')
+                    disabled = keyMatch[3].toLowerCase() !== 'false';
+            }
+            end = j + 1;
+        }
+        entries.push({ op, id, name, disabled, indent, startLine: i, endLine: end });
+        i = end - 1;
+    }
+    return { lines, entries };
+}
+function entryKey(entry, plugin) {
+    return entry.id === plugin || entry.name === plugin;
+}
+/** Set or clear `disabled:` on the first matching entry. */
+export function setEntryDisabled(text, plugin, disabled) {
+    const { lines, entries } = parsePatch(text);
+    const entry = entries.find((candidate) => entryKey(candidate, plugin));
+    if (entry === undefined)
+        return { text, found: false, changed: false };
+    let changed = false;
+    const next = [];
+    for (let i = 0; i < lines.length; i++) {
+        if (i === entry.startLine) {
+            next.push(lines[i]);
+            if (disabled && !entry.disabled) {
+                const keyIndent = ' '.repeat(entry.indent + 2);
+                next.push(`${keyIndent}disabled: true`);
+                changed = true;
+            }
+            continue;
+        }
+        if (i >= entry.startLine + 1 && i < entry.endLine) {
+            if (i === entry.startLine + 1 && disabled && entry.disabled) {
+                // already disabled; leave as-is
+                next.push(lines[i]);
+                continue;
+            }
+            const keyMatch = KEY_RE.exec(lines[i]);
+            if (keyMatch !== null && keyMatch[2] === 'disabled' && !disabled) {
+                changed = true;
+                continue; // drop the disabled line
+            }
+            next.push(lines[i]);
+            continue;
+        }
+        next.push(lines[i]);
+    }
+    if (!disabled && entry.disabled)
+        changed = true;
+    return { text: next.join('\n'), found: true, changed };
+}
+/** Delete the first matching entry (and its op block when it becomes empty). */
+export function removeEntry(text, plugin) {
+    const { lines, entries } = parsePatch(text);
+    const entry = entries.find((candidate) => entryKey(candidate, plugin));
+    if (entry === undefined)
+        return { text, found: false, changed: false };
+    // Find the op header that owns this entry.
+    let opLine = -1;
+    for (let i = entry.startLine - 1; i >= 0; i--) {
+        const opMatch = OP_RE.exec(lines[i]);
+        if (opMatch !== null && opMatch[1].length < entry.indent) {
+            opLine = i;
+            break;
+        }
+        if (lines[i].trim() !== '' && (lines[i].match(/^\s*/)?.[0].length ?? 0) <= entry.indent - 2)
+            break;
+    }
+    const drop = new Set();
+    for (let i = entry.startLine; i < entry.endLine; i++)
+        drop.add(i);
+    if (opLine >= 0) {
+        const remaining = entries.filter((candidate) => candidate.op === entry.op && candidate !== entry);
+        if (remaining.length === 0)
+            drop.add(opLine);
+    }
+    return {
+        text: lines.filter((_, i) => !drop.has(i)).join('\n'),
+        found: true,
+        changed: true,
+    };
+}

package/lib/lib/paths.js

@@ -0,0 +1,13 @@
+import os from 'node:os';
+import path from 'node:path';
+/** Locate $DSH_HOME (or the conventional ~/.dsh fallback). */
+export function dshHome(env = process.env) {
+    const explicit = env.DSH_HOME?.trim();
+    return explicit !== undefined && explicit !== '' ? explicit : path.join(os.homedir(), '.dsh');
+}
+export function profilesDir(home) {
+    return path.join(home, 'profiles');
+}
+export function profileDir(home, name) {
+    return path.join(profilesDir(home), name);
+}

package/lib/lib/remove.js

@@ -0,0 +1,134 @@
+import { existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { disableBundle, enableBundle, removeBundle, readProfileManifest, writeProfileManifest } from './manifest.js';
+import { removeEntry, setEntryDisabled } from './patches.js';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { audit } from './audit.js';
+import { parsePatch } from './patches.js';
+function resolvePlugin(home, profileDir, profileName, plugin) {
+    const manifest = readProfileManifest(profileDir);
+    const allBundles = [...(manifest.dsh?.profile?.bundles ?? []), ...(manifest.dsh?.profile?.disabledBundles ?? [])];
+    // Direct bundle name match
+    if (allBundles.includes(plugin))
+        return { bundleName: plugin, rowId: plugin };
+    // Check patch rows for id/name match
+    for (const file of [path.join(profileDir, 'cordis.patch.yml'), path.join(home, 'cordis.patch.yml')]) {
+        if (!existsSync(file))
+            continue;
+        for (const entry of parsePatch(readFileSync(file, 'utf8')).entries) {
+            if (entry.id === plugin)
+                return { bundleName: entry.name, rowId: entry.id };
+            if (entry.name === plugin)
+                return { bundleName: entry.name, rowId: entry.id };
+        }
+    }
+    return { bundleName: undefined, rowId: undefined };
+}
+function stripRows(file, plugin) {
+    if (file === undefined || !existsSync(file))
+        return 0;
+    let text = readFileSync(file, 'utf8');
+    let removed = 0;
+    for (;;) {
+        const result = removeEntry(text, plugin);
+        if (!result.found || !result.changed)
+            break;
+        text = result.text;
+        removed++;
+    }
+    if (removed > 0)
+        writeFileSync(file, text, 'utf8');
+    return removed;
+}
+/**
+ * Fully unplug a plugin from one profile: bundle list, disabled list,
+ * dependencies, patch rows (profile + home), then pnpm sync and re-audit.
+ */
+export function removePlugin(home, profileName, plugin, options) {
+    const profileDir = path.join(home, 'profiles', profileName);
+    const manifestPath = path.join(profileDir, 'package.json');
+    if (!existsSync(manifestPath)) {
+        throw new Error(`profile "${profileName}" not found at ${profileDir}`);
+    }
+    const resolved = resolvePlugin(home, profileDir, profileName, plugin);
+    const pkgName = resolved.bundleName ?? plugin;
+    const rowId = resolved.rowId ?? plugin;
+    const manifest = readProfileManifest(profileDir);
+    const { removed, disabledRemoved } = removeBundle(manifest, pkgName);
+    if (removed || disabledRemoved)
+        writeProfileManifest(profileDir, manifest);
+    let patchRowsRemoved = stripRows(path.join(profileDir, 'cordis.patch.yml'), rowId);
+    patchRowsRemoved += stripRows(path.join(home, 'cordis.patch.yml'), rowId);
+    let pnpmRemoved = false;
+    let note;
+    if (options.runPnpm !== false) {
+        const result = spawnSync('pnpm', ['remove', pkgName], {
+            cwd: profileDir,
+            encoding: 'utf8',
+            timeout: 60000,
+            windowsHide: true,
+            shell: process.platform === 'win32',
+        });
+        if (result.status === 0)
+            pnpmRemoved = true;
+        else
+            note = `pnpm remove exited ${result.status ?? 'none'}: ${(result.stderr || result.stdout || '').trim().slice(0, 300)}`;
+    }
+    const post = audit(home, profileName);
+    const ok = removed || disabledRemoved || patchRowsRemoved > 0;
+    if (!ok) {
+        throw new Error(`plugin "${plugin}" is not mounted in profile "${profileName}" (nothing to unplug)`);
+    }
+    return {
+        schema: 'dsh-unplug/v1',
+        ok: true,
+        plugin,
+        profile: profileName,
+        removedBundle: removed,
+        patchRowsRemoved,
+        pnpmRemoved,
+        note,
+        audit: post,
+    };
+}
+/** Disable or enable a plugin across bundle list and patch layers. */
+export function setPluginEnabled(home, profileName, plugin, enabled) {
+    const profileDir = path.join(home, 'profiles', profileName);
+    const manifestPath = path.join(profileDir, 'package.json');
+    if (!existsSync(manifestPath)) {
+        throw new Error(`profile "${profileName}" not found at ${profileDir}`);
+    }
+    const resolved = resolvePlugin(home, profileDir, profileName, plugin);
+    const pkgName = resolved.bundleName ?? plugin;
+    const rowId = resolved.rowId ?? plugin;
+    const manifest = readProfileManifest(profileDir);
+    const bundleMoved = enabled ? enableBundle(manifest, pkgName) : disableBundle(manifest, pkgName);
+    if (bundleMoved)
+        writeProfileManifest(profileDir, manifest);
+    let patchChanged = false;
+    const files = [path.join(profileDir, 'cordis.patch.yml'), path.join(home, 'cordis.patch.yml')];
+    for (const file of files) {
+        if (!existsSync(file))
+            continue;
+        const text = readFileSync(file, 'utf8');
+        const result = setEntryDisabled(text, rowId, !enabled);
+        if (result.found && result.changed) {
+            writeFileSync(file, result.text, 'utf8');
+            patchChanged = true;
+        }
+    }
+    if (!bundleMoved && !patchChanged) {
+        throw new Error(`plugin "${plugin}" is not mounted in profile "${profileName}" (nothing to ${enabled ? 'enable' : 'disable'})`);
+    }
+    return {
+        schema: 'dsh-unplug/v1',
+        ok: true,
+        plugin,
+        profile: profileName,
+        enabled,
+        bundleMoved,
+        patchChanged,
+        audit: audit(home, profileName),
+    };
+}

package/lib/lib/report.js

@@ -0,0 +1,4 @@
+/** Helpers for the dsh-unplug/v1 report envelope. */
+export function errorReport(code, message) {
+    return { schema: 'dsh-unplug/v1', ok: false, error: { code, message } };
+}

package/lib/lib/resolve.js

@@ -0,0 +1,38 @@
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+const require = createRequire(import.meta.url);
+/** Resolve an installed bundle's package.json from a profile directory. */
+export function resolveBundleManifest(profileDir, pkg) {
+    try {
+        const resolved = require.resolve(`${pkg}/package.json`, { paths: [profileDir] });
+        return JSON.parse(readFileSync(resolved, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Resolve a bundle's patch file path relative to its package root. */
+export function resolveBundlePatchPath(profileDir, pkg) {
+    const manifest = resolveBundleManifest(profileDir, pkg);
+    const patch = manifest?.dsh?.bundle?.patch;
+    if (patch === undefined)
+        return undefined;
+    try {
+        const pkgJson = require.resolve(`${pkg}/package.json`, { paths: [profileDir] });
+        return path.resolve(path.dirname(pkgJson), patch);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Check whether a package is resolvable from a profile directory. */
+export function isResolvable(profileDir, pkg) {
+    try {
+        require.resolve(`${pkg}/package.json`, { paths: [profileDir] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/lib/lib/version.js

@@ -0,0 +1,49 @@
+/** Minimal caret-range matching for the peer guard (subset of node-semver). */
+export function parseVersion(input) {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(input.trim());
+    if (match === null)
+        return null;
+    const prerelease = match[4] !== undefined && match[4] !== '' ? match[4].split('.') : null;
+    return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]), prerelease };
+}
+function compareIdentifiers(a, b) {
+    if (b === null)
+        return 1;
+    const length = Math.max(a.length, b.length);
+    for (let i = 0; i < length; i++) {
+        const left = a[i];
+        const right = b[i];
+        if (left === undefined)
+            return -1;
+        if (right === undefined)
+            return 1;
+        if (left !== right)
+            return left < right ? -1 : 1;
+    }
+    return 0;
+}
+export function satisfiesCaret(version, range) {
+    const m = /^\^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(range.trim());
+    if (m === null)
+        return false;
+    const v = parseVersion(version);
+    if (v === null)
+        return false;
+    const major = Number(m[1]);
+    const minor = Number(m[2]);
+    const patch = Number(m[3]);
+    const pre = m[4] !== undefined && m[4] !== '' ? m[4].split('.') : null;
+    if (v.major !== major || v.minor !== minor || v.patch < patch)
+        return false;
+    if (v.patch === patch) {
+        if (pre === null && v.prerelease !== null)
+            return false;
+        if (pre !== null && compareIdentifiers(v.prerelease ?? [], pre) < 0)
+            return false;
+    }
+    if (major > 0)
+        return v.major === major;
+    if (minor > 0)
+        return v.minor === minor;
+    return v.patch === patch;
+}

package/lib/types/bin.d.ts

@@ -0,0 +1,2 @@
+/** bin entry for dsh-unplug. */
+export {};

package/lib/types/cli.d.ts

@@ -0,0 +1,7 @@
+/**
+ * CLI entry for dsh-unplug.
+ *   dsh-unplug <command> [options]
+ * Commands: list, remove, disable, enable, audit
+ * Options: --profile, --home, --yes, --json
+ */
+export declare function main(argv: string[]): Promise<number>;

package/lib/types/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * dsh-unplug — plug/unplug any DeepSeek Harness plugin cleanly.
+ * @module dsh-unplug
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+export declare const name = "dsh-unplug";
+export declare const inject: string[];
+export declare const TESTED_PEER_RANGE = "^0.1.0-rc.6";
+export declare function resolvedDshToolsVersion(): string;
+export declare function assertPeerCompatible(): void;
+export interface Config {
+    defaultProfile?: string;
+}
+export declare const Config: Schema<Config>;
+export declare function apply(ctx: Context, config: Config): void;

package/lib/types/lib/audit.d.ts

@@ -0,0 +1,21 @@
+export type AuditKind = 'dangling-bundle' | 'orphan-row' | 'bundle-without-patch' | 'missing-patch-file';
+export interface AuditIssue {
+    kind: AuditKind;
+    detail: string;
+}
+export interface LayerRow {
+    id: string;
+    name: string | undefined;
+    op: string;
+    disabled: boolean;
+    layer: 'bundle' | 'profile-patch' | 'home-patch';
+    bundle?: string;
+    file?: string;
+}
+export interface AuditResult {
+    rows: LayerRow[];
+    issues: AuditIssue[];
+    bundles: string[];
+    disabledBundles: string[];
+}
+export declare function audit(home: string, profileName: string): AuditResult;

package/lib/types/lib/manifest.d.ts

@@ -0,0 +1,22 @@
+export interface ProfileManifest {
+    name?: string;
+    private?: boolean;
+    dependencies?: Record<string, string>;
+    dsh?: {
+        profile?: {
+            bundles?: string[];
+            disabledBundles?: string[];
+        };
+    };
+}
+export declare const PROFILE_MANIFEST = "package.json";
+export declare function readProfileManifest(dir: string): ProfileManifest;
+export declare function writeProfileManifest(dir: string, manifest: ProfileManifest): void;
+export declare function bundlesOf(manifest: ProfileManifest): string[];
+export declare function disabledBundlesOf(manifest: ProfileManifest): string[];
+export declare function removeBundle(manifest: ProfileManifest, pkg: string): {
+    removed: boolean;
+    disabledRemoved: boolean;
+};
+export declare function disableBundle(manifest: ProfileManifest, pkg: string): boolean;
+export declare function enableBundle(manifest: ProfileManifest, pkg: string): boolean;

package/lib/types/lib/patches.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Minimal, formatting-preserving editor for dsh cordis.patch.yml layers.
+ *
+ * The patch shape we handle is the one `dsh plugin` and every bundle uses:
+ *
+ *   - insert:
+ *       - id: disk-audit
+ *         name: dsh-disk-audit
+ *         config: {}
+ *   - override:
+ *       - id: unplug
+ *         disabled: true
+ *
+ * We only need to find entries by id/name, toggle `disabled`, and delete an
+ * entry (plus its now-empty op block). Everything else is preserved verbatim.
+ */
+export type PatchOp = 'insert' | 'override' | 'remove' | string;
+export interface PatchEntry {
+    op: PatchOp;
+    id: string;
+    name: string | undefined;
+    disabled: boolean;
+    indent: number;
+    startLine: number;
+    endLine: number;
+}
+export interface ParsedPatch {
+    lines: string[];
+    entries: PatchEntry[];
+}
+/** Parse a patch text into lines plus entry descriptors (0-based line numbers). */
+export declare function parsePatch(text: string): ParsedPatch;
+export interface EditResult {
+    text: string;
+    found: boolean;
+    changed: boolean;
+}
+/** Set or clear `disabled:` on the first matching entry. */
+export declare function setEntryDisabled(text: string, plugin: string, disabled: boolean): EditResult;
+/** Delete the first matching entry (and its op block when it becomes empty). */
+export declare function removeEntry(text: string, plugin: string): EditResult;

package/lib/types/lib/paths.d.ts

@@ -0,0 +1,4 @@
+/** Locate $DSH_HOME (or the conventional ~/.dsh fallback). */
+export declare function dshHome(env?: NodeJS.ProcessEnv): string;
+export declare function profilesDir(home: string): string;
+export declare function profileDir(home: string, name: string): string;

package/lib/types/lib/remove.d.ts

@@ -0,0 +1,33 @@
+import { type AuditResult } from './audit.js';
+export interface RemoveResult {
+    schema: 'dsh-unplug/v1';
+    ok: boolean;
+    plugin: string;
+    profile: string;
+    removedBundle: boolean;
+    patchRowsRemoved: number;
+    pnpmRemoved: boolean;
+    note?: string;
+    audit: AuditResult;
+}
+/**
+ * Fully unplug a plugin from one profile: bundle list, disabled list,
+ * dependencies, patch rows (profile + home), then pnpm sync and re-audit.
+ */
+export declare function removePlugin(home: string, profileName: string, plugin: string, options: {
+    force: boolean;
+    runPnpm?: boolean;
+}): RemoveResult;
+export interface ToggleResult {
+    schema: 'dsh-unplug/v1';
+    ok: boolean;
+    plugin: string;
+    profile: string;
+    enabled: boolean;
+    bundleMoved: boolean;
+    patchChanged: boolean;
+    note?: string;
+    audit: AuditResult;
+}
+/** Disable or enable a plugin across bundle list and patch layers. */
+export declare function setPluginEnabled(home: string, profileName: string, plugin: string, enabled: boolean): ToggleResult;

package/lib/types/lib/report.d.ts

@@ -0,0 +1,10 @@
+/** Helpers for the dsh-unplug/v1 report envelope. */
+export interface UnplugError {
+    schema: 'dsh-unplug/v1';
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
+}
+export declare function errorReport(code: string, message: string): UnplugError;

package/lib/types/lib/resolve.d.ts

@@ -0,0 +1,15 @@
+export interface BundleManifest {
+    name?: string;
+    version?: string;
+    dsh?: {
+        bundle?: {
+            patch?: string;
+        };
+    };
+}
+/** Resolve an installed bundle's package.json from a profile directory. */
+export declare function resolveBundleManifest(profileDir: string, pkg: string): BundleManifest | undefined;
+/** Resolve a bundle's patch file path relative to its package root. */
+export declare function resolveBundlePatchPath(profileDir: string, pkg: string): string | undefined;
+/** Check whether a package is resolvable from a profile directory. */
+export declare function isResolvable(profileDir: string, pkg: string): boolean;

package/lib/types/lib/version.d.ts

@@ -0,0 +1,8 @@
+/** Minimal caret-range matching for the peer guard (subset of node-semver). */
+export declare function parseVersion(input: string): {
+    major: number;
+    minor: number;
+    patch: number;
+    prerelease: string[] | null;
+} | null;
+export declare function satisfiesCaret(version: string, range: string): boolean;

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "dsh-unplug",
+  "version": "0.1.0",
+  "description": "Plug/unplug any DeepSeek Harness plugin cleanly: list every mounted layer, disable/enable without deleting, remove bundles + patch rows + dependencies in one pass, and audit for orphaned/dangling plugin state. Zero runtime dependencies; read-only by default.",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "bin": {
+    "dsh-unplug": "lib/bin.js"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "SECURITY.md",
+    "CONTRIBUTING.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:integration": "node scripts/integration-test.mjs"
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "plugin-manager",
+    "uninstall",
+    "lifecycle",
+    "unplug"
+  ],
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6",
+    "@types/node": "^22.20.0",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.9"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ]
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zoahdev/dsh-unplug.git"
+  },
+  "bugs": {
+    "url": "https://github.com/zoahdev/dsh-unplug/issues"
+  },
+  "homepage": "https://github.com/zoahdev/dsh-unplug"
+}