super-dsh 0.3.0-a → 0.3.0-d

package/README.md

@@ -24,28 +24,31 @@ DSH home is created under `<DSH_HOME>/agents/<label>/` on first boot.
 
 ## Better Dash delivery and native Web defaults
 
-The release embeds [Better Dash](../better-dsh/) and Pi's prebuilt SDK dependency tree.
-Every `scripts/pack.mjs` invocation first builds the current same-repository
-`../better-dsh` and packs it with the same npm approach, then embeds that
-artifact using `bundledDependencies`. Missing source or an exact version mismatch
-fails the build; Better Dash is never fetched from a registry during this step.
-The pack verifies every embedded file against the independent Better Dash tarball.
-
-Install Super Dash alone: on first startup its delivery component registers the
-exact enclosed Better Dash tarball through the installed harness's native package
-operation. The native Plugin Manager then shows **Super Dash** and **Better Dash**
-as parallel installed bundles. Their switches are independent: Better alone keeps
-native tools; Super alone keeps Hub/A2A and foreign agents. dev WebMCP stays separate.
-Super never includes Better's YAML in its own bundle patch.
-
-The archive is cached in the current DSH home's `bundle-artifacts/` directory, so
-Better remains reinstallable after Super is removed. An update preserves a retained
-Better disablement; replacing an already installed package requires a DSH restart.
-When both bundles are disabled, companion updates wait until either is enabled.
-Explicitly uninstalling Better is respected for the same Super artifact.
-Both source directories share one repository, and Better Dash remains separately
-installable with the same version, currently **0.3.0-a**. Pi's bundled dependencies
-require no installation-script approval from the consumer.
+Super Dash declares [Better Dash](../better-dsh/) at the synchronized exact
+version in ordinary npm `dependencies`; it contains no Better files or archive.
+One `npm install super-dsh@<version>` or native Plugin Manager installation
+resolves both packages from the configured registry. Publish Better first, then
+Super. Pi's prebuilt SDK dependency tree retains its separate bundled delivery.
+
+DSH does not recursively expose transitive bundles. On startup the coordinator
+registers the already downloaded exact Better version using native profile
+package operations **offline**, without installation hooks or another registry
+fetch. This automatic local registration is separate from the user's single
+installation command. Missing cached data reports a failure instead of falling
+back to online fetching. Replacing loaded code or promoting loaded provenance
+requires the documented cold restart.
+
+The Plugin Manager shows both packages as parallel installed bundles with their
+own YAML and independent switches. Better's Code source is `better-dsh@<version>`.
+Updates retain disablement and same-version explicit uninstall; removing Super
+retains the directly registered Better. Old `bundle-artifacts/` caches are left
+intact for previous installations, but new releases do not write them. With Super
+disabled, registration waits until Super is enabled. dev WebMCP is
+separate and test-only.
+
+Both packages use the same local dual-build pipeline. Tests serve the exact
+unpublished artifact pair through a read-only local registry, without modifying
+the release manifest or preinstalling Better. Current iteration: **0.3.0-f**.
 
 For a tarball URL installation in the native Web UI, put the `.tgz` URL in the
 main Add plugin input and keep the separate Registry selection on the official

package/cordis.patch.yml

@@ -12,8 +12,8 @@
 #                              zero-port sibling root, mounted under /<label>
 #   - super-dsh/join           the generic hub joiner for the standalone
 #                              claude adapter (R2)
-# DSH-only WebTrust, WebServer and onboarding policies belong to the bundled
-# Better Dash package, registered as an independent profile bundle.
+# DSH-only WebTrust, WebServer and onboarding policies belong to the exact registry
+# Better Dash dependency, registered as an independent profile bundle.
 #   - super-dsh/a2a            the agent-facing A2A tool face (mesh P3): the
 #                              single `superd-hub` model tool on ctx0's tools
 #                              service (dormant without tools; world trees
@@ -22,7 +22,7 @@
 # Profile-layer values (webserver port/host, settings path) stay in the USER's
 # profile patch layer, never here.
 - insert:
-    # Register the bundled local companion as an independent native bundle.
+    # Register the already installed exact registry companion as an independent native bundle.
     - id: superd-bundle-setup
       name: 'super-dsh/setup'
     # BARE package row: subpath rows (…/agents/omp) are permanently not client

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-dsh",
-  "version": "0.3.0-a",
+  "version": "0.3.0-d",
   "description": "Super D for the DeepSeek Harness (DSH) — one dsh plugin that mounts the superd hub (runtime selector, roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
   "type": "module",
   "license": "MIT",
@@ -69,7 +69,7 @@
     "agent-agy-sdk/package.json",
     "agent-agy-sdk/cordis.patch.yml",
     "agent-agy-sdk/bridge",
-    "bundles"
+    "superd-hub/scripts/register-companion.mjs"
   ],
   "dsh": {
     "bundle": {
@@ -83,7 +83,7 @@
     }
   },
   "dependencies": {
-    "better-dsh": "0.3.0-a",
+    "better-dsh": "0.3.0-d",
     "@earendil-works/pi-coding-agent": "0.84.2",
     "zod": "4.4.3",
     "@modelcontextprotocol/sdk": "^1.29.0"
@@ -104,7 +104,11 @@
     "@deepseek-ai/dsh-typert-protocol": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-user-approval": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-user-questions": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-client-connection": ">=0.1.5-0 <0.3.0-0"
+    "@deepseek-ai/dsh-client-connection": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-app-boot": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-atomic-write": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-cmdline": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-plugin-manager": ">=0.1.5-0 <0.3.0-0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
@@ -154,20 +158,28 @@
     },
     "@deepseek-ai/dsh-client-connection": {
       "optional": true
+    },
+    "@deepseek-ai/dsh-app-boot": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-atomic-write": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-cmdline": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-plugin-manager": {
+      "optional": true
     }
   },
   "publishConfig": {
     "access": "public"
   },
   "bundledDependencies": [
-    "better-dsh",
     "@earendil-works/pi-coding-agent"
   ],
   "homepage": "https://github.com/pgmi-builds/super-dsh",
   "bugs": {
     "url": "https://github.com/pgmi-builds/super-dsh/issues"
-  },
-  "superd": {
-    "delivery": "./bundles/manifest.json"
   }
 }

package/superd-hub/dist/bundle-setup.d.ts

@@ -1,2 +1,17 @@
-/** Delivery only: reuse the exact locally bundled Better implementation. */
-export { default } from '../../node_modules/better-dsh/lib/bundle-delivery.js';
+import type { Context } from '@deepseek-ai/cordis';
+import type { ProfileContext } from '@deepseek-ai/dsh-app-boot';
+export declare const name = "superd-bundle-setup";
+export declare const inject: string[];
+interface DeliveryResult {
+    installed: string[];
+    restartRequired: boolean;
+}
+/** First registration enables a companion; native reconciliation preserves retained disablement. */
+export declare function reconcileRegistryCompanions(profile: ProfileContext, signal?: AbortSignal): Promise<DeliveryResult>;
+export declare function apply(ctx: Context): void;
+declare const _default: {
+    name: string;
+    inject: string[];
+    apply: typeof apply;
+};
+export default _default;

package/superd-hub/dist/bundle-setup.js

@@ -1,2 +1,158 @@
-/** Delivery only: reuse the exact locally bundled Better implementation. */
-export { default } from '../../node_modules/better-dsh/lib/bundle-delivery.js';
+/** Register pack companions through the installed harness's native package operations. */
+import { createHash } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { readFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { withFileLock, writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
+import * as AppBoot from '@deepseek-ai/dsh-app-boot';
+export const name = 'superd-bundle-setup';
+export const inject = ['profileContext', 'appReady'];
+const hash = (bytes) => createHash('sha256').update(bytes).digest('hex');
+// Refresh-capable hosts retain loaded package provenance: promoting the
+// companion from its containing pack to a direct dependency needs a restart.
+// Older hosts without this API keep their first-registration behavior.
+const nativePackages = AppBoot.PluginPackages?.prototype;
+const restartForPromotion = nativePackages !== undefined && typeof Reflect.get(nativePackages, 'refresh') === 'function';
+const json = async (path) => JSON.parse(await readFile(path, 'utf8'));
+async function optionalJson(path) {
+    try {
+        return await json(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+}
+/** A child process avoids inheriting a running HMR transaction's AsyncLocalStorage. */
+async function installNative(profile, expected, signal) {
+    signal?.throwIfAborted();
+    const childScript = fileURLToPath(new URL('../scripts/register-companion.mjs', import.meta.url));
+    return new Promise((done, fail) => {
+        const child = spawn(process.execPath, [childScript], { stdio: ['pipe', 'pipe', 'pipe'], cwd: profile.dir });
+        let output = '', diagnostic = '';
+        const abort = () => { child.kill('SIGTERM'); };
+        const timeout = setTimeout(abort, 360_000);
+        signal?.addEventListener('abort', abort, { once: true });
+        child.stdout.setEncoding('utf8').on('data', chunk => { output = (output + chunk).slice(-32768); });
+        child.stderr.setEncoding('utf8').on('data', chunk => { diagnostic = (diagnostic + chunk).slice(-4096); });
+        child.on('error', fail);
+        child.on('close', code => {
+            clearTimeout(timeout);
+            signal?.removeEventListener('abort', abort);
+            if (signal?.aborted) {
+                fail(signal.reason);
+                return;
+            }
+            if (code !== 0) {
+                fail(new Error(`Native companion registration failed (${code}): ${diagnostic.trim() || output.trim()}`));
+                return;
+            }
+            try {
+                const result = JSON.parse(output);
+                if (result.exitCode !== 0)
+                    fail(new Error(`Native companion registration failed (${result.exitCode}); diagnostics: ${result.logPath ?? 'unavailable'}`));
+                else if (!['installed', 'owner-changed', 'companion-changed', 'companion-removed'].includes(result.disposition))
+                    fail(new Error('Native companion registration returned an invalid disposition'));
+                else
+                    done(result.disposition);
+            }
+            catch (error) {
+                fail(error);
+            }
+        });
+        child.stdin.on('error', () => { });
+        child.stdin.end(JSON.stringify({ profile, expected }));
+    });
+}
+/** First registration enables a companion; native reconciliation preserves retained disablement. */
+export async function reconcileRegistryCompanions(profile, signal) {
+    const directory = join(profile.home, 'companion-registration');
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const key = hash(profile.dir);
+    return withFileLock(join(directory, key + '.delivery'), async () => {
+        signal?.throwIfAborted();
+        const receiptPath = join(directory, key + '.json');
+        const receipts = await optionalJson(receiptPath) ?? {};
+        const manifest = await json(join(profile.dir, 'package.json'));
+        const result = { installed: [], restartRequired: false };
+        for (const owner of Object.keys(manifest.dependencies ?? {})) {
+            const ownerDir = join(profile.dir, 'node_modules', owner);
+            const ownerManifest = await optionalJson(join(ownerDir, 'package.json'));
+            if (owner !== 'super-dsh' || ownerManifest?.name !== owner)
+                continue;
+            const version = ownerManifest.dependencies?.['better-dsh'];
+            if (version === undefined || version !== ownerManifest.version)
+                throw new Error('Super Dash requires its synchronized exact Better registry dependency');
+            const item = { name: 'better-dsh', version };
+            const current = await json(join(profile.dir, 'package.json'));
+            const ownerSpec = current.dependencies?.[owner];
+            if (ownerSpec === undefined)
+                continue;
+            const priorSpec = current.dependencies?.[item.name];
+            const receiptKey = `${owner}:${item.name}`;
+            if (priorSpec === undefined && receipts[receiptKey] === version)
+                continue; // same-version explicit removal
+            const installed = await optionalJson(join(profile.dir, 'node_modules', item.name, 'package.json'));
+            if (priorSpec === version && installed?.name === item.name && installed.version === version) {
+                receipts[receiptKey] = version;
+                await writeFileAtomic(receiptPath, JSON.stringify(receipts) + '\n', { mode: 0o600 });
+                continue;
+            }
+            signal?.throwIfAborted();
+            const disposition = await installNative(profile, { owner, ownerSpec, companion: item, ...priorSpec === undefined ? {} : { priorSpec } }, signal);
+            if (disposition === 'owner-changed' || disposition === 'companion-changed')
+                continue;
+            receipts[receiptKey] = version;
+            await writeFileAtomic(receiptPath, JSON.stringify(receipts) + '\n', { mode: 0o600 });
+            if (disposition === 'companion-removed')
+                continue;
+            result.installed.push(`${item.name}@${item.version}`);
+            result.restartRequired ||= priorSpec !== undefined || restartForPromotion;
+        }
+        return result;
+    }, { waitMs: 120000 });
+}
+export function apply(ctx) {
+    const signal = new AbortController();
+    let started = false, running = false, again = false;
+    const reconcile = async () => {
+        if (!started || signal.signal.aborted)
+            return;
+        if (running) {
+            again = true;
+            return;
+        }
+        running = true;
+        try {
+            const result = await reconcileRegistryCompanions(ctx.profileContext, signal.signal);
+            if (result.installed.length) {
+                ctx.logger.info(`Registered ${result.installed.join(', ')} from its installed exact registry dependency${result.restartRequired ? '; restart DSH to use the updated code' : ''}`);
+                ctx.emit('plugin-manager/changed', { reason: 'install' });
+            }
+        }
+        catch (error) {
+            if (!signal.signal.aborted)
+                ctx.logger.error('Offline registry companion registration failed; retry the Super installation before re-enabling the bundle', error);
+        }
+        finally {
+            running = false;
+            if (again && !signal.signal.aborted) {
+                again = false;
+                void reconcile();
+            }
+        }
+    };
+    ctx.effect(() => {
+        const offReady = ctx.appReady.onReady(() => { started = true; void reconcile(); });
+        const offChange = ctx.on('plugin-manager/changed', () => { void reconcile(); });
+        return () => {
+            offReady();
+            offChange();
+            signal.abort();
+            // Never await a child here: manager HMR may be holding the profile lock it needs.
+        };
+    }, 'bundle-delivery: native registration');
+}
+export default { name, inject, apply };

package/superd-hub/dist/spawn-world.js

@@ -28,6 +28,7 @@ import { entryListSchema } from '@deepseek-ai/cordis-plugin-include';
 import { existsSync, writeFileSync, readFileSync, readdirSync, realpathSync } from 'node:fs';
 import { join } from 'node:path';
 import { superdTrustedHosts } from './world-mount.js';
+import { widenWorldResolution } from './world-resolution.js';
 /**
  * Republish the host's live resolution with THIS world added as a linked
  * root (spec §2.1, contract-legal form): `profilesDir`/`profileDir` are
@@ -97,11 +98,7 @@ async function publishWorldInHostResolutionTurn(packages, launcher, opts, worldP
     if (!publishedRoots.has(rootName)) {
         publishedRoots.set(rootName, { name: rootName, realPath: opts.home });
     }
-    packages.replace({
-        ...base,
-        entries: [...base.entries, ...publishedEntries.values()],
-        linkedRoots: [...base.linkedRoots, ...publishedRoots.values()],
-    });
+    packages.replace(widenWorldResolution(base, { installAnchor: launcher.installAnchor, home: launcher.home, profileDir: profile.dir }, publishedEntries.values(), publishedRoots.values()));
 }
 /** Bare package name of a module specifier (`@scope/pkg/sub` → `@scope/pkg`). */
 function barePackageNameOf(specifier) {

package/superd-hub/dist/world-resolution.d.ts

@@ -0,0 +1,6 @@
+import type { ProfileRuntimeResolution, RuntimeResolution } from '@deepseek-ai/dsh-app-boot';
+type ResolutionSource = ConstructorParameters<typeof ProfileRuntimeResolution>[0];
+type WorldEntry = RuntimeResolution['entries'][number];
+type WorldRoot = RuntimeResolution['linkedRoots'][number];
+export declare function widenWorldResolution(base: RuntimeResolution, source: ResolutionSource, entries: Iterable<WorldEntry>, linkedRoots: Iterable<WorldRoot>): RuntimeResolution;
+export {};

package/superd-hub/dist/world-resolution.js

@@ -0,0 +1,39 @@
+/** Preserve the host's native package refresh while retaining world import roots. */
+import * as AppBoot from '@deepseek-ai/dsh-app-boot';
+/** A native recomputable generation with the worlds' additional mappings. */
+const WorldRuntimeResolution = typeof AppBoot.ProfileRuntimeResolution === 'function'
+    ? class WorldRuntimeResolution extends AppBoot.ProfileRuntimeResolution {
+        // The parent freezes `this`; private slots still accept constructor values.
+        #source;
+        #worldEntries;
+        #worldRoots;
+        constructor(base, source, entries, roots) {
+            const names = new Set(base.entries.map((entry) => entry.name));
+            const rootNames = new Set(base.linkedRoots.map((root) => root.name));
+            super(source, {
+                ...base,
+                // A package now supplied by the native table owns its own mapping.
+                entries: Object.freeze([...base.entries, ...entries.filter((entry) => !names.has(entry.name))]),
+                linkedRoots: Object.freeze([...base.linkedRoots, ...roots.filter((root) => !rootNames.has(root.name))]),
+            });
+            this.#source = source;
+            this.#worldEntries = entries;
+            this.#worldRoots = roots;
+        }
+        async computeLatestResolution() {
+            // Recompute native mappings from disk, then widen the successor again.
+            // Keeping only world additions prevents removed native packages lingering.
+            return new WorldRuntimeResolution(await super.computeLatestResolution(), this.#source, this.#worldEntries, this.#worldRoots);
+        }
+    }
+    : undefined;
+export function widenWorldResolution(base, source, entries, linkedRoots) {
+    const worldEntries = Object.freeze([...entries]);
+    const worldRoots = Object.freeze([...linkedRoots]);
+    // Earlier supported hosts expose data generations and have no refresh API.
+    // Keep that contract without evaluating a class extending a missing export.
+    if (WorldRuntimeResolution === undefined) {
+        return { ...base, entries: [...base.entries, ...worldEntries], linkedRoots: [...base.linkedRoots, ...worldRoots] };
+    }
+    return new WorldRuntimeResolution(base, Object.freeze({ ...source }), worldEntries, worldRoots);
+}

package/superd-hub/package.json

@@ -18,7 +18,8 @@
     "dist",
     "lib",
     "assets",
-    "cordis.patch.yml"
+    "cordis.patch.yml",
+    "scripts/register-companion.mjs"
   ],
   "dsh": {
     "bundle": {
@@ -50,7 +51,11 @@
     "@deepseek-ai/dsh-host-webserver": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-tools": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-typert-protocol": ">=0.1.5-0 <0.3.0-0",
-    "@deepseek-ai/dsh-client-connection": ">=0.1.5-0 <0.3.0-0"
+    "@deepseek-ai/dsh-client-connection": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-app-boot": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-atomic-write": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-cmdline": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-plugin-manager": ">=0.1.5-0 <0.3.0-0"
   },
   "peerDependenciesMeta": {
     "@earendil-works/pi-coding-agent": {
@@ -76,6 +81,18 @@
     },
     "@deepseek-ai/dsh-client-connection": {
       "optional": true
+    },
+    "@deepseek-ai/dsh-app-boot": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-atomic-write": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-cmdline": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-plugin-manager": {
+      "optional": true
     }
   },
   "devDependencies": {

package/superd-hub/scripts/register-companion.mjs

@@ -0,0 +1,100 @@
+// Separate-process entry for the SAME native package operations used by dsh plugin.
+// No shell interpolation, package scripts, upstream edits, or online companion lookup.
+import { createRequire } from 'node:module'
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+let input = ''
+for await (const bytes of process.stdin) input += bytes
+const {profile,expected} = JSON.parse(input)
+const require = createRequire(profile.installAnchor)
+const {runProfilePnpm,saveManifest} = await import(pathToFileURL(require.resolve('@deepseek-ai/dsh-plugin-manager/operations')).href)
+const {withFileLock,writeFileAtomic} = await import(pathToFileURL(require.resolve('@deepseek-ai/dsh-atomic-write')).href)
+const abort = new AbortController()
+process.once('SIGTERM', () => abort.abort())
+const json = async path => JSON.parse(await readFile(path, 'utf8'))
+async function optionalJson(path) { try { return await json(path) } catch(error) { if(error.code === 'ENOENT') return undefined; throw error } }
+const skipped = disposition => ({ exitCode: 0, disposition })
+// Complete each native acquisition/release before observing cancellation;
+// exiting during its async lock-file write can strand incomplete lock metadata.
+async function withCancellableProfileLock(operation) {
+  const path = join(profile.dir, 'package.json'), deadline = Date.now() + 120000
+  for (;;) {
+    abort.signal.throwIfAborted()
+    let acquired = false
+    try {
+      return await withFileLock(path, async () => {
+        acquired = true
+        abort.signal.throwIfAborted()
+        return operation()
+      }, { waitMs: Math.min(250, Math.max(0, deadline - Date.now())) })
+    } catch (error) {
+      abort.signal.throwIfAborted()
+      if (acquired || Date.now() >= deadline
+        || error.message !== `atomic-write: timed out waiting for the writer lock at ${path}.lock`) throw error
+    }
+  }
+}
+const result = await withCancellableProfileLock(async () => {
+  abort.signal.throwIfAborted()
+  const current = await json(join(profile.dir, 'package.json'))
+  if (typeof expected.ownerSpec !== 'string' || current.dependencies?.[expected.owner] !== expected.ownerSpec) return skipped('owner-changed')
+  const ownerDir = join(profile.dir, 'node_modules', expected.owner)
+  let owner
+  try { owner = await json(join(ownerDir, 'package.json')) }
+  catch (error) { if (error.code === 'ENOENT') return skipped('owner-changed'); throw error }
+  const item=expected.companion
+  if(owner.name !== 'super-dsh' || owner.version !== item.version || owner.dependencies?.[item.name] !== item.version) return skipped('owner-changed')
+  // Resolve from the owner: a retained older direct Better may coexist with the new transitive version.
+  const ownerRequire=createRequire(join(ownerDir,'package.json'))
+  const downloaded=await json(ownerRequire.resolve(item.name+'/package.json'))
+  if(downloaded.name !== item.name || downloaded.version !== item.version) throw new Error('The user installation did not fetch the exact companion dependency')
+  const prior = current.dependencies?.[item.name]
+  if (prior !== expected.priorSpec) return skipped(prior === undefined && expected.priorSpec !== undefined ? 'companion-removed' : 'companion-changed')
+  abort.signal.throwIfAborted()
+  // A plain npm consumer already has the exact transitive files but not a pnpm
+  // store. Fresh hoisted registration changes metadata only, preserving npm ci.
+  const npmLockPath=join(profile.dir,'package-lock.json')
+  const npmLock=await optionalJson(npmLockPath)
+  const staged=structuredClone(current)
+  staged.dependencies={...staged.dependencies,[item.name]:item.version}
+  const selectNew=manifest=>{
+    if(prior !== undefined)return
+    const bundles=manifest.dsh?.profile?.bundles??[]
+    manifest.dsh={...manifest.dsh,profile:{...manifest.dsh?.profile,bundles:[...bundles,...bundles.includes(item.name)?[]:[item.name]]}}
+  }
+  const installedBefore=await optionalJson(join(profile.dir,'node_modules',item.name,'package.json'))
+  if(npmLock?.packages?.[''] && installedBefore?.version === item.version) {
+    const beforeLock=await readFile(npmLockPath,'utf8')
+    npmLock.packages[''].dependencies={...npmLock.packages[''].dependencies,[item.name]:item.version}
+    try {
+      selectNew(staged)
+      await writeFileAtomic(npmLockPath,JSON.stringify(npmLock,null,2)+'\n',{mode:0o600})
+      await saveManifest(profile.dir,staged)
+    } catch(error) { await writeFileAtomic(npmLockPath,beforeLock,{mode:0o600});await saveManifest(profile.dir,current);throw error }
+    return {exitCode:0,disposition:'installed'}
+  }
+  // No named spec: native add --offline still does online pnpm view preflight.
+  // Stage the exact dependency under the same lock, then re-layout cached files
+  // with the package manager that actually produced the consumer's lockfile.
+  await saveManifest(profile.dir,staged)
+  let operation
+  try {
+    operation=await runProfilePnpm({profile:profile.name,dir:profile.dir,installAnchor:profile.installAnchor,cwd:profile.dir,home:profile.home},
+      npmLock ? ['install','--offline','--ignore-scripts','--no-audit','--no-fund'] : ['install','--offline','--ignore-scripts','--no-frozen-lockfile'], {
+      ...profile.packageManager, ...npmLock?{command:'npm',args:[]}: {},
+      execution:'service', signal:abort.signal, outputBytes:16384,
+      lookupTimeoutMs:120000, idleTimeoutMs:120000,
+    })
+    if(operation.exitCode !== 0) { await saveManifest(profile.dir,current) }
+    else {
+      const installed=await json(join(profile.dir,'node_modules',item.name,'package.json'))
+      const after=await json(join(profile.dir,'package.json'))
+      if(installed.name !== item.name || installed.version !== item.version || after.dependencies?.[item.name] !== item.version) throw new Error('Native companion registration did not resolve the exact cached registry version')
+      selectNew(after)
+      await saveManifest(profile.dir,after)
+    }
+  } catch(error) { await saveManifest(profile.dir,current);throw error }
+  return { exitCode: operation.exitCode, logPath: operation.logPath, disposition: 'installed' }
+})
+process.stdout.write(JSON.stringify(result)+'\n')

package/bundles/manifest.json

@@ -1,10 +0,0 @@
-{
-  "companions": [
-    {
-      "name": "better-dsh",
-      "version": "0.3.0-a",
-      "tarball": "./better-dsh.tgz",
-      "sha256": "c3e2f2a40ffec8bd98816998107e9e041fff88016fa739a6462fed491ad24148"
-    }
-  ]
-}

package/node_modules/better-dsh/LICENSE

@@ -1,24 +0,0 @@
-MIT License
-
-Copyright (c) 2026 RimuruW and Yugimob (original pi-hashline-edit / pi-hashline-edit-pro)
-Copyright (c) 2026 pi-hashline-edit-lsz contributors (pi port, hashline core)
-Copyright (c) 2026 dsh-better-edit contributors (dsh port)
-Copyright (c) 2026 DASHR contributors (dsh-url-schema vendoring)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.