super-dsh 0.3.0-e → 0.3.0-f

package/README.md

@@ -22,62 +22,20 @@ six primary `@pgmi-builds/agent-*` packages and three OPTIONAL SDK halves).
 Restart the profile after replacing a loaded package. Each foreign world's
 DSH home is created under `<DSH_HOME>/agents/<label>/` on first boot.
 
-## Better Dash delivery and native Web defaults
-
-Super Dash declares [Better Dash](../better-dsh/) at the synchronized exact
-version in ordinary npm `dependencies`; it contains no Better files or archive.
-One `npm install super-dsh@<version>` or native Plugin Manager installation
-resolves both packages from the configured registry. Publish Better first, then
-Super. Pi's prebuilt SDK dependency tree retains its separate bundled delivery.
-
-DSH does not recursively expose transitive bundles. On startup the coordinator
-registers the already downloaded exact Better version using native profile
-package operations **offline**, without installation hooks or another registry
-fetch. This automatic local registration is separate from the user's single
-installation command. Missing cached data reports a failure instead of falling
-back to online fetching. Replacing loaded code or promoting loaded provenance
-requires the documented cold restart.
-
-The Plugin Manager shows both packages as parallel installed bundles with their
-own YAML and independent switches. Better's Code source is `better-dsh@<version>`.
-Updates retain disablement and same-version explicit uninstall; removing Super
-retains the directly registered Better. Old `bundle-artifacts/` caches are left
-intact for previous installations, but new releases do not write them. With Super
-disabled, registration waits until Super is enabled. dev WebMCP is
-separate and test-only.
-
-Both packages use the same local dual-build pipeline. Tests serve the exact
-unpublished artifact pair through a read-only local registry, without modifying
-the release manifest or preinstalling Better. Current iteration: **0.3.0-f**.
-
-For a tarball URL installation in the native Web UI, put the `.tgz` URL in the
-main Add plugin input and keep the separate Registry selection on the official
-npm registry. A tarball file server is not an npm registry.
-
-Disabling Better restores native Web binding, trusted-host, login and onboarding
-policies. Remote deployments must supply native DSH trusted-host configuration;
-Super does not take ownership of those Better policies.
-
-Better Dash owns the native DSH policies: `dashr-web-trust` retains cookie
-authentication while accepting authenticated serving Host/Origin values; its
-password page provides new-client login. Cookie expiry and authority binding remain.
-`dashr-webserver` defaults to `0.0.0.0`; native `--port` and explicit loopback
-`--host` overrides are preserved. Super Dash carries no duplicate WebTrust.
-To restore the native address fence, set `dashr-web-trust`'s `trustAllHosts: false`.
-
-Better Dash also disables automatic credential onboarding and acknowledges the
-installed Models client's current welcome version before the listener opens.
-Manual model configuration remains available. To restore native welcome behavior:
-
-```yaml
-- id: dashr-welcome-notice
-  disabled: true
-```
+## Better Dash delivery
+
+Super installs [Better Dash](../better-dsh/) at runtime through the native DSH
+Plugin Manager, requesting its installed Super version first, then `better-dsh@latest`, then bare
+`better-dsh` after each preceding failure. The packages have no dependency edge or shared physical payload;
+both retain independent native Plugin Manager rows and component switches.
+
+First-use intent lives under `$DSH_HOME/superd/companions/`, so manual removal
+remains removed across restarts and upgrades. Hub Settings offers explicit
+reinstallation. Both packages ship at synchronized versions; publish Better
+before Super. Pi's prebuilt SDK retains its separate bundled delivery.
 
-Version-only upstream bumps adapt at the next startup. A renamed private constant
-or changed bundle layout fails explicitly and requires adaptation or disabling the
-entry. Dev WebMCP lives in the root `dev-webmcp/` directory and is included
-only as an extra development profile bundle, never in either release tarball.
+Better's welcome policy uses the official client onboarding slot. Native
+WebServer and HMR stay in place; listener configuration belongs to deployment.
 
 ## Runtimes
 

package/client/index.js

@@ -2198,6 +2198,145 @@ async function removeProvider(agentKey, namespace, id, doFetch) {
 	return requireProvidersView(await callRuntimeSettings(agentKey, namespace, "remove", { request: { id } }, doFetch));
 }
 
+//#endregion
+//#region src/client/companion-api.ts
+async function callCompanion(operation, doFetch) {
+	const method = `superdCompanions/${operation}`;
+	const response = await (doFetch ?? ((path, init) => fetch(path, init)))(`/api/${method}`, {
+		method: "POST",
+		credentials: "same-origin",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			type: "client-request",
+			rpcId: mintRpcId(),
+			method,
+			payload: { args: {} }
+		})
+	});
+	if (!response.ok) throw new Error(`Better Dash: HTTP ${response.status}`);
+	let body;
+	try {
+		body = JSON.parse(await response.text());
+	} catch {
+		throw new Error("Better Dash: unreadable response");
+	}
+	const result = body?.result;
+	if (result?.ok !== true) throw new Error(result?.error?.message ?? "Better Dash: request failed");
+	const value = result.value;
+	if (value === null || typeof value !== "object" || typeof value.installed !== "boolean" || typeof value.installing !== "boolean" || typeof value.requestedVersion !== "string" || value.version !== void 0 && typeof value.version !== "string" || value.enabled !== void 0 && typeof value.enabled !== "boolean" || value.error !== void 0 && typeof value.error !== "string") throw new Error("Better Dash: invalid status");
+	return value;
+}
+
+//#endregion
+//#region src/client/CompanionSettings.tsx
+/** Native plugin switches remain in Plugin Manager; this row provides explicit recovery. */
+function CompanionSettings() {
+	const [status, setStatus] = react.default.useState();
+	const [error, setError] = react.default.useState();
+	const [busy, setBusy] = react.default.useState(false);
+	const live = react.default.useRef(false);
+	const operation = react.default.useRef(false);
+	react.default.useEffect(() => {
+		live.current = true;
+		let reading = false;
+		const refresh = async () => {
+			if (reading || operation.current) return;
+			reading = true;
+			try {
+				const next = await callCompanion("getBetterDash");
+				if (live.current) {
+					setStatus(next);
+					setError(next.error);
+				}
+			} catch (cause) {
+				if (live.current) setError(cause instanceof Error ? cause.message : String(cause));
+			} finally {
+				reading = false;
+			}
+		};
+		refresh();
+		const timer = window.setInterval(() => {
+			refresh();
+		}, 5e3);
+		return () => {
+			live.current = false;
+			window.clearInterval(timer);
+		};
+	}, []);
+	const install = async () => {
+		if (operation.current) return;
+		operation.current = true;
+		setBusy(true);
+		setError(void 0);
+		try {
+			const next = await callCompanion("installBetterDash");
+			if (live.current) {
+				setStatus(next);
+				setError(next.error);
+			}
+		} catch (cause) {
+			if (live.current) setError(cause instanceof Error ? cause.message : String(cause));
+		} finally {
+			operation.current = false;
+			if (live.current) setBusy(false);
+		}
+	};
+	const installing = busy || status?.installing === true;
+	const label = status === void 0 ? "Loading…" : status.installed ? `Installed${status.version ? " · " + status.version : ""}${status.enabled === false ? " · Disabled" : ""}` : "Not installed";
+	return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+		style: {
+			borderRadius: 12,
+			padding: "12px 14px",
+			background: "var(--dsw-alias-interactive-bg-hover)"
+		},
+		children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+			style: {
+				display: "flex",
+				alignItems: "center",
+				gap: 16
+			},
+			children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: { flex: 1 },
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					style: {
+						fontSize: 14,
+						fontWeight: 600
+					},
+					children: "Better Dash"
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					role: "status",
+					style: {
+						fontSize: 12,
+						color: "var(--dsw-alias-label-secondary)",
+						marginTop: 4
+					},
+					children: installing ? "Installing…" : label
+				})]
+			}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+				type: "button",
+				disabled: installing || status?.installed === true,
+				onClick: () => {
+					install();
+				},
+				style: {
+					padding: "6px 12px",
+					borderRadius: 8,
+					cursor: installing || status?.installed ? "default" : "pointer"
+				},
+				children: installing ? "Installing…" : status?.installed ? "Installed" : "Install"
+			})]
+		}), error && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+			role: "alert",
+			style: {
+				fontSize: 12,
+				margin: "8px 0 0",
+				color: "var(--dsw-alias-state-error-primary)"
+			},
+			children: error
+		})]
+	});
+}
+
 //#endregion
 //#region src/client/HubPage.tsx
 const EMPTY_DRAFT = {
@@ -3415,16 +3554,8 @@ function HubPage() {
 					},
 					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(GroupHead, {
 						title: "Settings",
-						count: 0
-					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-						style: {
-							margin: 0,
-							fontSize: 13,
-							lineHeight: "20px",
-							color: "var(--dsw-alias-label-tertiary)"
-						},
-						children: "Hub preferences — pairing, runtime visibility, and orchestration defaults land with the hub service."
-					})]
+						count: 1
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CompanionSettings, {})]
 				}),
 				tab === "home" && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 					style: {

package/cordis.patch.yml

@@ -12,8 +12,8 @@
 #                              zero-port sibling root, mounted under /<label>
 #   - super-dsh/join           the generic hub joiner for the standalone
 #                              claude adapter (R2)
-# DSH-only WebTrust, WebServer and onboarding policies belong to the exact registry
-# Better Dash dependency, registered as an independent profile bundle.
+# DSH-only WebTrust and onboarding policies belong to independently installed
+# Better Dash; the native Plugin Manager owns its package and enablement.
 #   - super-dsh/a2a            the agent-facing A2A tool face (mesh P3): the
 #                              single `superd-hub` model tool on ctx0's tools
 #                              service (dormant without tools; world trees
@@ -22,7 +22,7 @@
 # Profile-layer values (webserver port/host, settings path) stay in the USER's
 # profile patch layer, never here.
 - insert:
-    # Register the already installed exact registry companion as an independent native bundle.
+    # Expose native companion management and perform first-use installation.
     - id: superd-bundle-setup
       name: 'super-dsh/setup'
     # BARE package row: subpath rows (…/agents/omp) are permanently not client

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-dsh",
-  "version": "0.3.0-e",
+  "version": "0.3.0-f",
   "description": "Super D for the DeepSeek Harness (DSH) — one dsh plugin that mounts the superd hub (runtime selector, roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
   "type": "module",
   "license": "MIT",
@@ -68,8 +68,7 @@
     "agent-agy-sdk/dist",
     "agent-agy-sdk/package.json",
     "agent-agy-sdk/cordis.patch.yml",
-    "agent-agy-sdk/bridge",
-    "superd-hub/scripts/register-companion.mjs"
+    "agent-agy-sdk/bridge"
   ],
   "dsh": {
     "bundle": {
@@ -83,7 +82,6 @@
     }
   },
   "dependencies": {
-    "better-dsh": "0.3.0-e",
     "@earendil-works/pi-coding-agent": "0.84.2",
     "zod": "4.4.3",
     "@modelcontextprotocol/sdk": "^1.29.0"

package/superd-hub/dist/bundle-setup.d.ts

@@ -1,13 +1,23 @@
+/** Better Dash is installed by the current profile's native Plugin Manager. */
 import type { Context } from '@deepseek-ai/cordis';
-import type { ProfileContext } from '@deepseek-ai/dsh-app-boot';
+import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
+import { BetterDashCompanion } from './companions.js';
+import type { BetterDashStatus } from './companion-contract.js';
+export { BetterDashCompanion } from './companions.js';
+export type { BetterDashStatus } from './companion-contract.js';
 export declare const name = "superd-bundle-setup";
 export declare const inject: string[];
-interface DeliveryResult {
-    installed: string[];
-    restartRequired: boolean;
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        superdCompanions: SuperdCompanions;
+    }
+}
+export declare class SuperdCompanions extends TypertRemoteService {
+    private readonly companion;
+    constructor(ctx: Context, companion: BetterDashCompanion);
+    getBetterDash(): Promise<BetterDashStatus>;
+    installBetterDash(): Promise<BetterDashStatus>;
 }
-/** First registration enables a companion; native reconciliation preserves retained disablement. */
-export declare function reconcileRegistryCompanions(profile: ProfileContext, signal?: AbortSignal): Promise<DeliveryResult>;
 export declare function apply(ctx: Context): void;
 declare const _default: {
     name: string;

package/superd-hub/dist/bundle-setup.js

@@ -1,158 +1,94 @@
-/** Register pack companions through the installed harness's native package operations. */
-import { createHash } from 'node:crypto';
-import { spawn } from 'node:child_process';
-import { readFile, mkdir } from 'node:fs/promises';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { withFileLock, writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
-import * as AppBoot from '@deepseek-ai/dsh-app-boot';
-export const name = 'superd-bundle-setup';
-export const inject = ['profileContext', 'appReady'];
-const hash = (bytes) => createHash('sha256').update(bytes).digest('hex');
-// Refresh-capable hosts retain loaded package provenance: promoting the
-// companion from its containing pack to a direct dependency needs a restart.
-// Older hosts without this API keep their first-registration behavior.
-const nativePackages = AppBoot.PluginPackages?.prototype;
-const restartForPromotion = nativePackages !== undefined && typeof Reflect.get(nativePackages, 'refresh') === 'function';
-const json = async (path) => JSON.parse(await readFile(path, 'utf8'));
-async function optionalJson(path) {
-    try {
-        return await json(path);
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
     }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return undefined;
-        throw error;
-    }
-}
-/** A child process avoids inheriting a running HMR transaction's AsyncLocalStorage. */
-async function installNative(profile, expected, signal) {
-    signal?.throwIfAborted();
-    const childScript = fileURLToPath(new URL('../scripts/register-companion.mjs', import.meta.url));
-    return new Promise((done, fail) => {
-        const child = spawn(process.execPath, [childScript], { stdio: ['pipe', 'pipe', 'pipe'], cwd: profile.dir });
-        let output = '', diagnostic = '';
-        const abort = () => { child.kill('SIGTERM'); };
-        const timeout = setTimeout(abort, 360_000);
-        signal?.addEventListener('abort', abort, { once: true });
-        child.stdout.setEncoding('utf8').on('data', chunk => { output = (output + chunk).slice(-32768); });
-        child.stderr.setEncoding('utf8').on('data', chunk => { diagnostic = (diagnostic + chunk).slice(-4096); });
-        child.on('error', fail);
-        child.on('close', code => {
-            clearTimeout(timeout);
-            signal?.removeEventListener('abort', abort);
-            if (signal?.aborted) {
-                fail(signal.reason);
-                return;
-            }
-            if (code !== 0) {
-                fail(new Error(`Native companion registration failed (${code}): ${diagnostic.trim() || output.trim()}`));
-                return;
-            }
-            try {
-                const result = JSON.parse(output);
-                if (result.exitCode !== 0)
-                    fail(new Error(`Native companion registration failed (${result.exitCode}); diagnostics: ${result.logPath ?? 'unavailable'}`));
-                else if (!['installed', 'owner-changed', 'companion-changed', 'companion-removed'].includes(result.disposition))
-                    fail(new Error('Native companion registration returned an invalid disposition'));
-                else
-                    done(result.disposition);
-            }
-            catch (error) {
-                fail(error);
-            }
-        });
-        child.stdin.on('error', () => { });
-        child.stdin.end(JSON.stringify({ profile, expected }));
-    });
-}
-/** First registration enables a companion; native reconciliation preserves retained disablement. */
-export async function reconcileRegistryCompanions(profile, signal) {
-    const directory = join(profile.home, 'companion-registration');
-    await mkdir(directory, { recursive: true, mode: 0o700 });
-    const key = hash(profile.dir);
-    return withFileLock(join(directory, key + '.delivery'), async () => {
-        signal?.throwIfAborted();
-        const receiptPath = join(directory, key + '.json');
-        const receipts = await optionalJson(receiptPath) ?? {};
-        const manifest = await json(join(profile.dir, 'package.json'));
-        const result = { installed: [], restartRequired: false };
-        for (const owner of Object.keys(manifest.dependencies ?? {})) {
-            const ownerDir = join(profile.dir, 'node_modules', owner);
-            const ownerManifest = await optionalJson(join(ownerDir, 'package.json'));
-            if (owner !== 'super-dsh' || ownerManifest?.name !== owner)
-                continue;
-            const version = ownerManifest.dependencies?.['better-dsh'];
-            if (version === undefined || version !== ownerManifest.version)
-                throw new Error('Super Dash requires its synchronized exact Better registry dependency');
-            const item = { name: 'better-dsh', version };
-            const current = await json(join(profile.dir, 'package.json'));
-            const ownerSpec = current.dependencies?.[owner];
-            if (ownerSpec === undefined)
-                continue;
-            const priorSpec = current.dependencies?.[item.name];
-            const receiptKey = `${owner}:${item.name}`;
-            if (priorSpec === undefined && receipts[receiptKey] === version)
-                continue; // same-version explicit removal
-            const installed = await optionalJson(join(profile.dir, 'node_modules', item.name, 'package.json'));
-            if (priorSpec === version && installed?.name === item.name && installed.version === version) {
-                receipts[receiptKey] = version;
-                await writeFileAtomic(receiptPath, JSON.stringify(receipts) + '\n', { mode: 0o600 });
-                continue;
-            }
-            signal?.throwIfAborted();
-            const disposition = await installNative(profile, { owner, ownerSpec, companion: item, ...priorSpec === undefined ? {} : { priorSpec } }, signal);
-            if (disposition === 'owner-changed' || disposition === 'companion-changed')
-                continue;
-            receipts[receiptKey] = version;
-            await writeFileAtomic(receiptPath, JSON.stringify(receipts) + '\n', { mode: 0o600 });
-            if (disposition === 'companion-removed')
-                continue;
-            result.installed.push(`${item.name}@${item.version}`);
-            result.restartRequired ||= priorSpec !== undefined || restartForPromotion;
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
         }
-        return result;
-    }, { waitMs: 120000 });
-}
-export function apply(ctx) {
-    const signal = new AbortController();
-    let started = false, running = false, again = false;
-    const reconcile = async () => {
-        if (!started || signal.signal.aborted)
-            return;
-        if (running) {
-            again = true;
-            return;
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
         }
-        running = true;
-        try {
-            const result = await reconcileRegistryCompanions(ctx.profileContext, signal.signal);
-            if (result.installed.length) {
-                ctx.logger.info(`Registered ${result.installed.join(', ')} from its installed exact registry dependency${result.restartRequired ? '; restart DSH to use the updated code' : ''}`);
-                ctx.emit('plugin-manager/changed', { reason: 'install' });
-            }
-        }
-        catch (error) {
-            if (!signal.signal.aborted)
-                ctx.logger.error('Offline registry companion registration failed; retry the Super installation before re-enabling the bundle', error);
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
+import { BetterDashCompanion } from './companions.js';
+import { PACK_VERSION } from './pack-version.js';
+export { BetterDashCompanion } from './companions.js';
+export const name = 'superd-bundle-setup';
+export const inject = ['profileContext', 'appReady'];
+let SuperdCompanions = (() => {
+    let _classSuper = TypertRemoteService;
+    let _instanceExtraInitializers = [];
+    let _getBetterDash_decorators;
+    let _installBetterDash_decorators;
+    return class SuperdCompanions extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _getBetterDash_decorators = [Remote];
+            _installBetterDash_decorators = [Remote];
+            __esDecorate(this, null, _getBetterDash_decorators, { kind: "method", name: "getBetterDash", static: false, private: false, access: { has: obj => "getBetterDash" in obj, get: obj => obj.getBetterDash }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _installBetterDash_decorators, { kind: "method", name: "installBetterDash", static: false, private: false, access: { has: obj => "installBetterDash" in obj, get: obj => obj.installBetterDash }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        finally {
-            running = false;
-            if (again && !signal.signal.aborted) {
-                again = false;
-                void reconcile();
-            }
+        companion = __runInitializers(this, _instanceExtraInitializers);
+        constructor(ctx, companion) {
+            super(ctx, 'superdCompanions');
+            this.companion = companion;
         }
+        getBetterDash() { return this.companion.getBetterDash(); }
+        installBetterDash() { return this.companion.installBetterDash(); }
     };
+})();
+export { SuperdCompanions };
+export function apply(ctx) {
+    const companion = new BetterDashCompanion(ctx.profileContext, PACK_VERSION, () => ctx.get('pluginManager'));
+    new SuperdCompanions(ctx, companion);
     ctx.effect(() => {
-        const offReady = ctx.appReady.onReady(() => { started = true; void reconcile(); });
-        const offChange = ctx.on('plugin-manager/changed', () => { void reconcile(); });
-        return () => {
-            offReady();
-            offChange();
-            signal.abort();
-            // Never await a child here: manager HMR may be holding the profile lock it needs.
+        let ready = false, registering = true;
+        const start = () => {
+            void companion.ensureAutomatic().then(status => {
+                if (status.error !== undefined)
+                    ctx.logger.warn(status.error);
+            }).catch(error => ctx.logger.warn('Better Dash companion status failed', error));
         };
-    }, 'bundle-delivery: native registration');
+        const offReady = ctx.appReady.onReady(() => {
+            ready = true;
+            // Cold readiness occurs after boot, outside HMR. A live mount gets an
+            // immediate callback while its parent HMR transaction is still active:
+            // wait for the native changed notification below instead.
+            if (!registering)
+                start();
+        });
+        registering = false;
+        const offChange = ctx.on('plugin-manager/changed', () => {
+            // Native configure/HMR has finished here, but the parent's profile lock
+            // is still held. Return immediately; child install queues that lock.
+            if (ready)
+                start();
+        });
+        return () => { offReady(); offChange(); companion.dispose(); };
+    }, 'bundle-delivery: native companions');
 }
 export default { name, inject, apply };

package/superd-hub/dist/client/companion-api.d.ts

@@ -0,0 +1,5 @@
+/** Local ctx0 companion management, independent of the selected agent world. */
+import { type FetchLike } from './runtime-settings-api.js';
+import type { BetterDashStatus } from '../companion-contract.js';
+export type CompanionOperation = 'getBetterDash' | 'installBetterDash';
+export declare function callCompanion(operation: CompanionOperation, doFetch?: FetchLike): Promise<BetterDashStatus>;

package/superd-hub/dist/client/companion-api.js

@@ -0,0 +1,30 @@
+/** Local ctx0 companion management, independent of the selected agent world. */
+import { mintRpcId } from './runtime-settings-api.js';
+export async function callCompanion(operation, doFetch) {
+    const method = `superdCompanions/${operation}`;
+    const send = doFetch ?? ((path, init) => fetch(path, init));
+    const response = await send(`/api/${method}`, {
+        method: 'POST', credentials: 'same-origin', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ type: 'client-request', rpcId: mintRpcId(), method, payload: { args: {} } }),
+    });
+    if (!response.ok)
+        throw new Error(`Better Dash: HTTP ${response.status}`);
+    let body;
+    try {
+        body = JSON.parse(await response.text());
+    }
+    catch {
+        throw new Error('Better Dash: unreadable response');
+    }
+    const result = body?.result;
+    if (result?.ok !== true)
+        throw new Error(result?.error?.message ?? 'Better Dash: request failed');
+    const value = result.value;
+    if (value === null || typeof value !== 'object' || typeof value.installed !== 'boolean'
+        || typeof value.installing !== 'boolean' || typeof value.requestedVersion !== 'string'
+        || (value.version !== undefined && typeof value.version !== 'string')
+        || (value.enabled !== undefined && typeof value.enabled !== 'boolean')
+        || (value.error !== undefined && typeof value.error !== 'string'))
+        throw new Error('Better Dash: invalid status');
+    return value;
+}

package/superd-hub/dist/companion-contract.d.ts

@@ -0,0 +1,9 @@
+/** Browser-safe ctx0 companion status returned by the native unary API. */
+export interface BetterDashStatus {
+    installed: boolean;
+    version?: string;
+    enabled?: boolean;
+    installing: boolean;
+    error?: string;
+    requestedVersion: string;
+}

package/superd-hub/dist/companion-contract.js

@@ -0,0 +1 @@
+export {};

package/superd-hub/dist/companions.d.ts

@@ -0,0 +1,30 @@
+import type { ProfileContext } from '@deepseek-ai/dsh-app-boot';
+import type { PluginManager } from '@deepseek-ai/dsh-plugin-manager';
+import type { BetterDashStatus } from './companion-contract.js';
+type Manager = Pick<PluginManager, 'listBundles' | 'installBundle'>;
+/** One controller per native profile; no package, registry, HMR or selection writer of its own. */
+export declare class BetterDashCompanion {
+    private readonly version;
+    private readonly manager;
+    private readonly directory;
+    private readonly receipt;
+    private readonly legacy;
+    private initialized?;
+    private intent;
+    private active?;
+    private stopped;
+    private restartNotice?;
+    constructor(profile: Pick<ProfileContext, 'home' | 'dir'>, version: string, manager: () => Manager | undefined);
+    private initialize;
+    private cleanLegacy;
+    private save;
+    getBetterDash(): Promise<BetterDashStatus>;
+    ensureAutomatic(): Promise<BetterDashStatus>;
+    installBetterDash(): Promise<BetterDashStatus>;
+    private run;
+    private install;
+    /** Read-only observation: an intermediate native event must never trigger reinstatement. */
+    observeNativeChange(): Promise<BetterDashStatus>;
+    dispose(): void;
+}
+export {};

package/superd-hub/dist/companions.js

@@ -0,0 +1,199 @@
+/** Companion intent and the single native installation operation. */
+import { createHash } from 'node:crypto';
+import { readFile, mkdir, unlink, rmdir } from 'node:fs/promises';
+import { join, dirname } from 'node:path';
+import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
+const message = (error) => error instanceof Error ? error.message : String(error);
+async function optionalJson(path) {
+    try {
+        return JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+}
+function nativeFailure(result) {
+    if ((result.application === 'applied' || result.application === 'restart-required') && result.error === undefined
+        && (result.packageResult === undefined || result.packageResult.exitCode === 0))
+        return undefined;
+    return [result.application, result.error?.code, result.error?.diagnostic,
+        result.packageResult?.kind, result.packageResult?.logPath].filter(Boolean).join(': ');
+}
+/** One controller per native profile; no package, registry, HMR or selection writer of its own. */
+export class BetterDashCompanion {
+    version;
+    manager;
+    directory;
+    receipt;
+    legacy;
+    initialized;
+    intent = { attempted: false };
+    active;
+    stopped = false;
+    restartNotice;
+    constructor(profile, version, manager) {
+        this.version = version;
+        this.manager = manager;
+        const key = createHash('sha256').update(profile.dir).digest('hex') + '.json';
+        this.directory = join(profile.home, 'superd', 'companions');
+        this.receipt = join(this.directory, key);
+        this.legacy = join(profile.home, 'companion-registration', key);
+    }
+    initialize() {
+        return this.initialized ??= (async () => {
+            const saved = await optionalJson(this.receipt);
+            if (saved !== undefined) {
+                this.intent = saved;
+                await this.cleanLegacy();
+                return;
+            }
+            const old = await optionalJson(this.legacy);
+            // Any old registration was first use. An absent Better now means removal,
+            // including when Super has since changed version; never resurrect it.
+            if (old?.['super-dsh:better-dsh'] !== undefined) {
+                this.intent = { attempted: true };
+                await this.save();
+                await this.cleanLegacy();
+            }
+        })();
+    }
+    async cleanLegacy() {
+        try {
+            await unlink(this.legacy);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        try {
+            await rmdir(dirname(this.legacy));
+        }
+        catch (error) {
+            if (!['ENOENT', 'ENOTEMPTY'].includes(error.code ?? ''))
+                throw error;
+        }
+    }
+    async save() {
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        await writeFileAtomic(this.receipt, JSON.stringify(this.intent) + '\n', { mode: 0o600 });
+    }
+    async getBetterDash() {
+        const status = { installed: false, installing: this.active !== undefined, requestedVersion: this.version };
+        try {
+            await this.initialize();
+            const manager = this.manager();
+            if (manager === undefined)
+                throw new Error('Native Plugin Manager is unavailable; enable it and retry Install in Settings.');
+            const better = (await manager.listBundles()).find(bundle => bundle.name === 'better-dsh' && bundle.installed);
+            if (better !== undefined) {
+                status.installed = true;
+                if (better.version !== undefined)
+                    status.version = better.version;
+                status.enabled = better.enabled;
+                // An installed dependency alone does not prove application succeeded:
+                // native configure can fail after writing that dependency. Only a
+                // missing -> installed recovery clears a previous failure here.
+                if (this.active === undefined && this.intent.error !== undefined && this.intent.missingAfterFailure === true) {
+                    delete this.intent.error;
+                    delete this.intent.missingAfterFailure;
+                    await this.save();
+                }
+            }
+            else {
+                this.restartNotice = undefined;
+                if (this.active === undefined && this.intent.error !== undefined && this.intent.missingAfterFailure !== true) {
+                    this.intent.missingAfterFailure = true;
+                    await this.save();
+                }
+            }
+            const error = this.intent.error ?? this.restartNotice;
+            if (error !== undefined)
+                status.error = error;
+        }
+        catch (error) {
+            status.error = message(error);
+        }
+        return status;
+    }
+    ensureAutomatic() { return this.run(false); }
+    installBetterDash() { return this.run(true); }
+    run(manual) {
+        if (this.active !== undefined)
+            return this.active;
+        const task = this.install(manual).catch(async (error) => {
+            this.intent.error = `Better Dash installation failed: ${message(error)}. Check Better Dash in Plugin Manager; if missing, retry Install in Settings.`;
+            const status = await this.getBetterDash();
+            this.intent.missingAfterFailure = !status.installed;
+            try {
+                await this.save();
+            }
+            catch { /* Report the operation error even when persistence is unavailable. */ }
+            return status;
+        }).then(status => ({ ...status, installing: false })).finally(() => { this.active = undefined; });
+        this.active = task;
+        return task;
+    }
+    async install(manual) {
+        await this.initialize();
+        const before = await this.getBetterDash();
+        if (this.stopped)
+            return before;
+        if (before.installed) {
+            this.intent.attempted = true;
+            if (this.intent.missingAfterFailure === true) {
+                delete this.intent.error;
+                delete this.intent.missingAfterFailure;
+            }
+            await this.save();
+            return this.getBetterDash(); // Native disablement and installed versions belong to the user.
+        }
+        // Native changed notifications enter through this operation, so its
+        // read is active and deliberately cannot update the receipt itself.
+        // Record removal here even when first-use installation is already done.
+        if (this.intent.error !== undefined && this.intent.missingAfterFailure !== true) {
+            this.intent.missingAfterFailure = true;
+            await this.save();
+        }
+        if (!manual && this.intent.attempted)
+            return before;
+        this.intent = { attempted: true };
+        await this.save(); // First use is durable before native HMR can unload this row.
+        const manager = this.manager();
+        if (manager === undefined)
+            throw new Error('Native Plugin Manager is unavailable');
+        if (this.version === 'unknown' || this.version.trim() === '')
+            throw new Error('The installed Super Dash package version could not be read');
+        const failures = [];
+        for (const spec of [`better-dsh@${this.version}`, 'better-dsh@latest', 'better-dsh']) {
+            if (this.stopped)
+                break;
+            try {
+                const result = await manager.installBundle(spec);
+                const failure = nativeFailure(result);
+                if (failure === undefined) {
+                    const after = await this.getBetterDash();
+                    if (after.installed) {
+                        delete this.intent.error;
+                        delete this.intent.missingAfterFailure;
+                        this.restartNotice = result.application === 'restart-required'
+                            ? 'Better Dash is installed; restart DSH to apply the native change.' : undefined;
+                        await this.save();
+                        return this.getBetterDash();
+                    }
+                    failures.push(`${spec}: native manager reported ${result.application}, but Better Dash is not installed`);
+                }
+                else
+                    failures.push(`${spec}: ${failure}`);
+            }
+            catch (error) {
+                failures.push(`${spec}: ${message(error)}`);
+            }
+        }
+        throw new Error(failures.join('; ') || 'Super Dash companion component was unloaded');
+    }
+    /** Read-only observation: an intermediate native event must never trigger reinstatement. */
+    async observeNativeChange() { return this.getBetterDash(); }
+    dispose() { this.stopped = true; }
+}

package/superd-hub/dist/fusion-transport.js

@@ -132,6 +132,7 @@ try {
   // is active.
   const isExempt = (path) => path === CONTROL || path.startsWith(CONTROL + '/')
     || path === CONTROL_PREFIX || path.startsWith(CONTROL_PREFIX + '/')
+    || path === '/api/superdCompanions' || path.startsWith('/api/superdCompanions/')
   // Key compare matches the server demux shape: searchParams.get('agent')
   // looks up PERCENT-DECODED keys, so '%61gent=x' demuxes as agent=x and the
   // surgery must strip those spellings too (+' ' wins the '+' spelling).

package/superd-hub/dist/gateway.js

@@ -82,24 +82,30 @@ export function apply(ctx, config) {
         // would multiply probes against every paired remote. The effect's
         // disposer IS the sweep disposer — the timer dies with the row
         // (unref'd, overlap-skipping, per-machine errors swallowed; mesh-link).
-        ctx.effect(() => startReprobeSweep({ home, intervalSec: config?.reprobeIntervalSec, immediate: true }), 'superd-hub: mesh reprobe sweep');
-        const dispose = registerHubRoute({
+        host.effect(() => startReprobeSweep({ home, intervalSec: config?.reprobeIntervalSec, immediate: true }), 'superd-hub: mesh reprobe sweep');
+        host.effect(() => registerHubRoute({
             real: real,
             authorize: (req, res) => connection.authorizeIndex(req, res),
             requestRejection: (req) => connection.requestRejection(req),
             gatewayOf: (label) => (federatedGatewayOf(label) ?? getTarget(label)?.gateway),
-        });
-        ctx.effect(() => dispose, 'superd-hub: /hub route family');
+        }), 'superd-hub: /hub route family');
         // P4 §8.2: the PTY executor's upgrade route — same gate as the /hub family
         // (authorizeIndex cookie auth first, then the browser-trust fence). The
         // dumb pump lives in exec-pty-rpc.ts; a2a-row owns the initiator half.
-        void registerPtyExecutor(real, {
-            authorize: (req, res) => connection.authorizeIndex(req, res),
-            requestRejection: (req) => connection.requestRejection(req),
-            log: consoleA2aLog(),
-        }).then((disposePty) => {
-            ctx.effect(() => disposePty, 'superd-hub: PTY executor upgrade route');
-        }, () => { });
+        // The async effect belongs to this Connection injection: disposal waits
+        // for setup and releases its route even when setup finishes during unload.
+        host.effect(async () => {
+            try {
+                return await registerPtyExecutor(real, {
+                    authorize: (req, res) => connection.authorizeIndex(req, res),
+                    requestRejection: (req) => connection.requestRejection(req),
+                    log: consoleA2aLog(),
+                });
+            }
+            catch {
+                return () => { };
+            }
+        }, 'superd-hub: PTY executor upgrade route');
     });
 }
 export default apply;

package/superd-hub/lib/client/index.js

@@ -2198,6 +2198,145 @@ async function removeProvider(agentKey, namespace, id, doFetch) {
 	return requireProvidersView(await callRuntimeSettings(agentKey, namespace, "remove", { request: { id } }, doFetch));
 }
 
+//#endregion
+//#region src/client/companion-api.ts
+async function callCompanion(operation, doFetch) {
+	const method = `superdCompanions/${operation}`;
+	const response = await (doFetch ?? ((path, init) => fetch(path, init)))(`/api/${method}`, {
+		method: "POST",
+		credentials: "same-origin",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			type: "client-request",
+			rpcId: mintRpcId(),
+			method,
+			payload: { args: {} }
+		})
+	});
+	if (!response.ok) throw new Error(`Better Dash: HTTP ${response.status}`);
+	let body;
+	try {
+		body = JSON.parse(await response.text());
+	} catch {
+		throw new Error("Better Dash: unreadable response");
+	}
+	const result = body?.result;
+	if (result?.ok !== true) throw new Error(result?.error?.message ?? "Better Dash: request failed");
+	const value = result.value;
+	if (value === null || typeof value !== "object" || typeof value.installed !== "boolean" || typeof value.installing !== "boolean" || typeof value.requestedVersion !== "string" || value.version !== void 0 && typeof value.version !== "string" || value.enabled !== void 0 && typeof value.enabled !== "boolean" || value.error !== void 0 && typeof value.error !== "string") throw new Error("Better Dash: invalid status");
+	return value;
+}
+
+//#endregion
+//#region src/client/CompanionSettings.tsx
+/** Native plugin switches remain in Plugin Manager; this row provides explicit recovery. */
+function CompanionSettings() {
+	const [status, setStatus] = react.default.useState();
+	const [error, setError] = react.default.useState();
+	const [busy, setBusy] = react.default.useState(false);
+	const live = react.default.useRef(false);
+	const operation = react.default.useRef(false);
+	react.default.useEffect(() => {
+		live.current = true;
+		let reading = false;
+		const refresh = async () => {
+			if (reading || operation.current) return;
+			reading = true;
+			try {
+				const next = await callCompanion("getBetterDash");
+				if (live.current) {
+					setStatus(next);
+					setError(next.error);
+				}
+			} catch (cause) {
+				if (live.current) setError(cause instanceof Error ? cause.message : String(cause));
+			} finally {
+				reading = false;
+			}
+		};
+		refresh();
+		const timer = window.setInterval(() => {
+			refresh();
+		}, 5e3);
+		return () => {
+			live.current = false;
+			window.clearInterval(timer);
+		};
+	}, []);
+	const install = async () => {
+		if (operation.current) return;
+		operation.current = true;
+		setBusy(true);
+		setError(void 0);
+		try {
+			const next = await callCompanion("installBetterDash");
+			if (live.current) {
+				setStatus(next);
+				setError(next.error);
+			}
+		} catch (cause) {
+			if (live.current) setError(cause instanceof Error ? cause.message : String(cause));
+		} finally {
+			operation.current = false;
+			if (live.current) setBusy(false);
+		}
+	};
+	const installing = busy || status?.installing === true;
+	const label = status === void 0 ? "Loading…" : status.installed ? `Installed${status.version ? " · " + status.version : ""}${status.enabled === false ? " · Disabled" : ""}` : "Not installed";
+	return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+		style: {
+			borderRadius: 12,
+			padding: "12px 14px",
+			background: "var(--dsw-alias-interactive-bg-hover)"
+		},
+		children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+			style: {
+				display: "flex",
+				alignItems: "center",
+				gap: 16
+			},
+			children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: { flex: 1 },
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					style: {
+						fontSize: 14,
+						fontWeight: 600
+					},
+					children: "Better Dash"
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					role: "status",
+					style: {
+						fontSize: 12,
+						color: "var(--dsw-alias-label-secondary)",
+						marginTop: 4
+					},
+					children: installing ? "Installing…" : label
+				})]
+			}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+				type: "button",
+				disabled: installing || status?.installed === true,
+				onClick: () => {
+					install();
+				},
+				style: {
+					padding: "6px 12px",
+					borderRadius: 8,
+					cursor: installing || status?.installed ? "default" : "pointer"
+				},
+				children: installing ? "Installing…" : status?.installed ? "Installed" : "Install"
+			})]
+		}), error && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+			role: "alert",
+			style: {
+				fontSize: 12,
+				margin: "8px 0 0",
+				color: "var(--dsw-alias-state-error-primary)"
+			},
+			children: error
+		})]
+	});
+}
+
 //#endregion
 //#region src/client/HubPage.tsx
 const EMPTY_DRAFT = {
@@ -3415,16 +3554,8 @@ function HubPage() {
 					},
 					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(GroupHead, {
 						title: "Settings",
-						count: 0
-					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-						style: {
-							margin: 0,
-							fontSize: 13,
-							lineHeight: "20px",
-							color: "var(--dsw-alias-label-tertiary)"
-						},
-						children: "Hub preferences — pairing, runtime visibility, and orchestration defaults land with the hub service."
-					})]
+						count: 1
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CompanionSettings, {})]
 				}),
 				tab === "home" && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 					style: {

package/superd-hub/package.json

@@ -18,8 +18,7 @@
     "dist",
     "lib",
     "assets",
-    "cordis.patch.yml",
-    "scripts/register-companion.mjs"
+    "cordis.patch.yml"
   ],
   "dsh": {
     "bundle": {

package/superd-hub/scripts/register-companion.mjs

@@ -1,100 +0,0 @@
-// Separate-process entry for the SAME native package operations used by dsh plugin.
-// No shell interpolation, package scripts, upstream edits, or online companion lookup.
-import { createRequire } from 'node:module'
-import { readFile } from 'node:fs/promises'
-import { join } from 'node:path'
-import { pathToFileURL } from 'node:url'
-let input = ''
-for await (const bytes of process.stdin) input += bytes
-const {profile,expected} = JSON.parse(input)
-const require = createRequire(profile.installAnchor)
-const {runProfilePnpm,saveManifest} = await import(pathToFileURL(require.resolve('@deepseek-ai/dsh-plugin-manager/operations')).href)
-const {withFileLock,writeFileAtomic} = await import(pathToFileURL(require.resolve('@deepseek-ai/dsh-atomic-write')).href)
-const abort = new AbortController()
-process.once('SIGTERM', () => abort.abort())
-const json = async path => JSON.parse(await readFile(path, 'utf8'))
-async function optionalJson(path) { try { return await json(path) } catch(error) { if(error.code === 'ENOENT') return undefined; throw error } }
-const skipped = disposition => ({ exitCode: 0, disposition })
-// Complete each native acquisition/release before observing cancellation;
-// exiting during its async lock-file write can strand incomplete lock metadata.
-async function withCancellableProfileLock(operation) {
-  const path = join(profile.dir, 'package.json'), deadline = Date.now() + 120000
-  for (;;) {
-    abort.signal.throwIfAborted()
-    let acquired = false
-    try {
-      return await withFileLock(path, async () => {
-        acquired = true
-        abort.signal.throwIfAborted()
-        return operation()
-      }, { waitMs: Math.min(250, Math.max(0, deadline - Date.now())) })
-    } catch (error) {
-      abort.signal.throwIfAborted()
-      if (acquired || Date.now() >= deadline
-        || error.message !== `atomic-write: timed out waiting for the writer lock at ${path}.lock`) throw error
-    }
-  }
-}
-const result = await withCancellableProfileLock(async () => {
-  abort.signal.throwIfAborted()
-  const current = await json(join(profile.dir, 'package.json'))
-  if (typeof expected.ownerSpec !== 'string' || current.dependencies?.[expected.owner] !== expected.ownerSpec) return skipped('owner-changed')
-  const ownerDir = join(profile.dir, 'node_modules', expected.owner)
-  let owner
-  try { owner = await json(join(ownerDir, 'package.json')) }
-  catch (error) { if (error.code === 'ENOENT') return skipped('owner-changed'); throw error }
-  const item=expected.companion
-  if(owner.name !== 'super-dsh' || owner.version !== item.version || owner.dependencies?.[item.name] !== item.version) return skipped('owner-changed')
-  // Resolve from the owner: a retained older direct Better may coexist with the new transitive version.
-  const ownerRequire=createRequire(join(ownerDir,'package.json'))
-  const downloaded=await json(ownerRequire.resolve(item.name+'/package.json'))
-  if(downloaded.name !== item.name || downloaded.version !== item.version) throw new Error('The user installation did not fetch the exact companion dependency')
-  const prior = current.dependencies?.[item.name]
-  if (prior !== expected.priorSpec) return skipped(prior === undefined && expected.priorSpec !== undefined ? 'companion-removed' : 'companion-changed')
-  abort.signal.throwIfAborted()
-  // A plain npm consumer already has the exact transitive files but not a pnpm
-  // store. Fresh hoisted registration changes metadata only, preserving npm ci.
-  const npmLockPath=join(profile.dir,'package-lock.json')
-  const npmLock=await optionalJson(npmLockPath)
-  const staged=structuredClone(current)
-  staged.dependencies={...staged.dependencies,[item.name]:item.version}
-  const selectNew=manifest=>{
-    if(prior !== undefined)return
-    const bundles=manifest.dsh?.profile?.bundles??[]
-    manifest.dsh={...manifest.dsh,profile:{...manifest.dsh?.profile,bundles:[...bundles,...bundles.includes(item.name)?[]:[item.name]]}}
-  }
-  const installedBefore=await optionalJson(join(profile.dir,'node_modules',item.name,'package.json'))
-  if(npmLock?.packages?.[''] && installedBefore?.version === item.version) {
-    const beforeLock=await readFile(npmLockPath,'utf8')
-    npmLock.packages[''].dependencies={...npmLock.packages[''].dependencies,[item.name]:item.version}
-    try {
-      selectNew(staged)
-      await writeFileAtomic(npmLockPath,JSON.stringify(npmLock,null,2)+'\n',{mode:0o600})
-      await saveManifest(profile.dir,staged)
-    } catch(error) { await writeFileAtomic(npmLockPath,beforeLock,{mode:0o600});await saveManifest(profile.dir,current);throw error }
-    return {exitCode:0,disposition:'installed'}
-  }
-  // No named spec: native add --offline still does online pnpm view preflight.
-  // Stage the exact dependency under the same lock, then re-layout cached files
-  // with the package manager that actually produced the consumer's lockfile.
-  await saveManifest(profile.dir,staged)
-  let operation
-  try {
-    operation=await runProfilePnpm({profile:profile.name,dir:profile.dir,installAnchor:profile.installAnchor,cwd:profile.dir,home:profile.home},
-      npmLock ? ['install','--offline','--ignore-scripts','--no-audit','--no-fund'] : ['install','--offline','--ignore-scripts','--no-frozen-lockfile'], {
-      ...profile.packageManager, ...npmLock?{command:'npm',args:[]}: {},
-      execution:'service', signal:abort.signal, outputBytes:16384,
-      lookupTimeoutMs:120000, idleTimeoutMs:120000,
-    })
-    if(operation.exitCode !== 0) { await saveManifest(profile.dir,current) }
-    else {
-      const installed=await json(join(profile.dir,'node_modules',item.name,'package.json'))
-      const after=await json(join(profile.dir,'package.json'))
-      if(installed.name !== item.name || installed.version !== item.version || after.dependencies?.[item.name] !== item.version) throw new Error('Native companion registration did not resolve the exact cached registry version')
-      selectNew(after)
-      await saveManifest(profile.dir,after)
-    }
-  } catch(error) { await saveManifest(profile.dir,current);throw error }
-  return { exitCode: operation.exitCode, logPath: operation.logPath, disposition: 'installed' }
-})
-process.stdout.write(JSON.stringify(result)+'\n')