[Bug] v0.1.6-alpha.1: computer-use packages missing dsh.bundle break profile boot

[AlonDan]

Summary

Since dsh v0.1.6-alpha.1, any profile that lists @deepseek-ai/dsh-computer-use or @deepseek-ai/dsh-experimental-computer-use-cua-driver-native in dsh.profile.bundles crashes on boot with a hard error.

Both packages were published to npm at version 0.1.6-alpha.1 without any dsh.bundle manifest, while the new dsh-app-boot loader (also 0.1.6-alpha.1) strictly requires dsh.bundle.patch for every package listed in dsh.profile.bundles. Because dsh plugin add is the documented installation flow and it appends the package to the profile's bundles list, following the docs makes the profile unbootable immediately after upgrading dsh from v0.1.5-rc.2 to v0.1.6-alpha.1.

Environment

Item	Value
dsh	@deepseek-ai/dsh@0.1.6-alpha.1 (npm)
dsh-app-boot	0.1.6-alpha.1
OS	Windows 11
Node.js	v25.8.2
Profile	application-owned profile (desktop shell launches dsh web)

Steps to reproduce

1. Install @deepseek-ai/dsh@0.1.6-alpha.1.
2. Add the official computer-use plugin into a profile:
   dsh plugin --profile web add @deepseek-ai/dsh-computer-use@0.1.6-alpha.1
   (the CLI appends it to dsh.profile.bundles).
3. Run dsh --profile web.

Actual result

Boot aborts during profile composition (the model backend — NINFER — starts fine; the crash is purely in the profile layer composition):

file:///…/node_modules/@deepseek-ai/dsh-app-boot/lib/index.js:1019
                if (declared === void 0) throw new Error(`${binName}: profile bundle ${JSON.stringify(packageName)} declares no dsh.bundle in its package.json`);
                                               ^

Error: dsh: profile bundle "@deepseek-ai/dsh-computer-use" declares no dsh.bundle in its package.json
    at file:///…/node_modules/@deepseek-ai/dsh-app-boot/lib/index.js:1019:34
    at Array.map (<anonymous>)
    at loadProfileDirectory (file:///…/node_modules/@deepseek-ai/dsh-app-boot/lib/index.js:1016:25)
    at loadProfile (file:///…/node_modules/@deepseek-ai/dsh-app-boot/lib/index.js:1061:9)
    at prepareProfile (file:///…/node_modules/@deepseek-ai/dsh/lib/profile-boot-CuwbWsnH.js:208:18)
    at composeProfile (file:///…/node_modules/@deepseek-ai/dsh/lib/profile-boot-CuwbWsnH.js:233:18)
    at runProfile (file:///…/node_modules/@deepseek-ai/dsh/lib/profile-boot-CuwbWsnH.js:286:25)
    at async runCli (file:///…/node_modules/@deepseek-ai/dsh/lib/bin.js:146:4)
    at async file:///…/node_modules/@deepseek-ai/dsh/lib/bin.js:168:23

Node.js v25.8.2

Expected result

Per the official guide ("Package and install a plugin"), a package without a dsh.bundle declaration "still installs, but only as a plain dependency: dsh plugin prints a warning and activates no layer" — i.e., warn-and-skip, not a hard crash. Alternatively, the two official 0.1.6-alpha.1 packages should ship a valid manifest so the documented install flow works end to end.

Evidence — verified against the npm registry

The published tarballs were downloaded and unpacked directly:

1. @deepseek-ai/dsh-computer-use@0.1.6-alpha.1
Tarball: https://registry.npmjs.org/@deepseek-ai/dsh-computer-use/-/dsh-computer-use-0.1.6-alpha.1.tgz

• Contents: package.json, lib/index.js, lib/types/*, READMEs, LICENSE.
• Its package.json contains no dsh key at all (no dsh.bundle), and the package ships no cordis.patch.yml (the files list is only lib/*).

2. @deepseek-ai/dsh-experimental-computer-use-cua-driver-native@0.1.6-alpha.1
Tarball: https://registry.npmjs.org/@deepseek-ai/dsh-experimental-computer-use-cua-driver-native/-/dsh-experimental-computer-use-cua-driver-native-0.1.6-alpha.1.tgz

• Same situation: no dsh key, no patch file.

The dsh-app-boot v0.1.6-alpha.1 loader (loadProfileDirectory) then executes:

const declared = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf8")).dsh?.bundle?.patch;
if (declared === void 0) throw new Error(`... declares no dsh.bundle in its package.json`);

Result: a package that dsh plugin add is happy to append to dsh.profile.bundles is guaranteed to make the profile unbootable.

Note on the manifest format change (possible breaking change)

The v0.1.5-rc.2 manifest format was the boolean form:

{ "dsh": { "bundle": true } }

which booted fine under the old loader. v0.1.6-alpha.1 requires the object form with a patch path:

{ "dsh": { "bundle": { "patch": "./cordis.patch.yml" } } }

If this is an intentional breaking change, it deserves a release note, and the two computer-use packages need to be re-published with the new format.

Workaround (confirmed working)

Remove the two entries from both dependencies and dsh.profile.bundles in the profile's package.json. The profile then boots normally on 0.1.6-alpha.1 with no other plugins affected.

Suggested fixes (any of the three)

• (a) Re-publish @deepseek-ai/dsh-computer-use and @deepseek-ai/dsh-experimental-computer-use-cua-driver-native with a valid dsh.bundle manifest (including the referenced patch file).
• (b) Have dsh plugin add not append bundle-less packages to dsh.profile.bundles (install as a plain dependency with a warning, as the docs describe).
• (c) Document the new strict loader behavior and the manifest-format change in the v0.1.6-alpha.1 release notes, and adjust the computer-use install flow accordingly.

[moonquake2004]

核实了你的分析，并且这条报告照出了我们一个更要紧的问题——我们自己推荐的自救第一步会在这类上给出假绿灯。两件事都记一下。

一、你的定位我逐条核对过。 在已装的 0.1.6-alpha.1 上：

• 两个包的 npm 元数据里确实没有 dsh 字段（registry.npmjs.org/@deepseek-ai/dsh-computer-use/0.1.6-alpha.1 → 无 dsh）；
• loader 侧确实强制：dsh-app-boot/lib/index.js:1019 就是那句 dsh.bundle in its package.json 的报错来源。

所以"照文档 dsh plugin add → 立刻不可启动"这条链条成立，而且它是升级即时生效的失败：profile 里多一行就起不来，回退版本才恢复。

二、这一类我们此前只覆盖了一半。 P1 早就在查"bundle 条目存在但未声明 dsh.bundle"，所以跑完整诊断能报出来。但我们最推荐的自救入口漏了它：--boot-check 只逐条 import entry——而这个包里没有 patch，自然没有任何 entry 可探，于是它输出：

装载模拟：检查 0 条 entry，失败 0 条
  ✓ 所有可探测 entry 均可导入——启动失败若仍发生，问题多在配置合并或原生环境

对一个注定起不来的 profile 说"全部可导入"，而用户正是按我们的建议先跑这一条的。假绿灯出现在最该给出结论的时刻，比不报更糟。

已修（dsh-doctor@0.6.1）：--boot-check（及其同步版，供 --safe-add 使用）在探测 entry 之前先判 bundle 级前置条件——列出的包若解析得到、却没有 dsh.bundle.patch，直接判失败：

✗ [computer-use-like] → (bundle 清单)
    missing-bundle-manifest: bundle 条目 computer-use-like 存在但未声明 dsh.bundle.patch
    修复方向：该包未声明 dsh.bundle（loader 会拒绝整个 profile）；升级/更换该包，或从 dsh.profile.bundles 移除
    先起来：npx @moonquake2004/dsh-doctor --quarantine computer-use-like

顺带说一句：修这个的时候我们自己的测试 fixture 也失真了——那几个用例建的插件同样没写 dsh.bundle，也就是说我们的测试一直在模拟一个 0.1.6 下会被 loader 拒绝的 profile。fixture 补上之后，测试才真正在测它想测的 import 路径。当一个新版本收紧了前置条件，所有"以前能跑"的 fixture 都会悄悄变成不合法输入，这点值得两边都记一下。

三、给你现在的处置：这两个包在修复发布前不该进 dsh.profile.bundles——上游要补的是它们自己的 manifest（那是发布级遗漏，不是配置问题）。如果你已经被卡住，--quarantine @deepseek-ai/dsh-computer-use 只改启动列表、不动包文件、可 --unquarantine 放回；如果你还没装，就等它们补齐 dsh.bundle 再装。不要在 profile 里手工"补"这个字段——那会绕过 loader 的一致性检查，之后出问题更难定位。