mirror of
https://github.com/deepseek-ai/deepseek-harness.git
synced 2026-11-10 12:47:44 +08:00
A bundle package is not a plugin row, so startup admission never read its own DSH peers: a bundle installed outside DSH or before a DSH upgrade still applied its patch layer. loadProfileDirectory now skips such a bundle like an unreadable one unless the profile exempts that exact pair. A post-install refusal in a profile without a lockfile reinstalls from the restored manifest instead of failing a frozen install and leaving the rejected packages in node_modules. Compatibility warnings now name the `dsh plugin allow-version` command for CLI-managed profiles, startup denials name the row id instead of a resolved module URL, and the CLI no longer reports "pnpm failed" when pnpm never ran.