feat(cli)!: dsh boots profiles; plugin subcommand manages them via pnpm

dsh --profile <name> replaces the fixed entry modes: --config and -p are
removed, --patch adds overlays over the composed profile, a positional task
selects one-shot mode (requires the headless-runner row), and dsh web stays as
the alias for --profile web carrying the Web flag family as patches. dsh
plugin --profile <name> forwards verbatim to pnpm in the profile directory,
initializes on first use, and reconciles the dsh.plugins layer list after
add/remove (patch-less packages warn and stay plain dependencies). Config
dumps and the keyless web e2e scaffold compose the same bundle layers over the
same empty root as the boot.

scripts/demo-cordis.mjs

@@ -6,7 +6,7 @@ import { spawn } from 'node:child_process'
 const SURFACES = new Map([
   // The browser surface with the cordis toolset layered on: `dsh web --config`
   // applies this overlay over the shipped web composition; it owns port 3081.
-  ['web', ['--import', 'tsx', 'apps/cli/src/bin.ts', 'web', '--config', 'examples/web-cordis/cordis.yml']],
+  ['web', ['--import', 'tsx', 'apps/cli/src/bin.ts', 'web', '--patch', 'examples/web-cordis/cordis.yml']],
   ['acp', ['--import', 'tsx', 'packages/examples/acp-demo/src/bin.ts', '--config', 'examples/acp-agent/cordis-tools.cordis.yml']],
 ])
 

scripts/gen-doc-graphs.ts

@@ -598,7 +598,8 @@ function parseExampleCordis(rel: string): ExamplePlugin[] {
     if (current?.name) plugins.push({ id: current.id, name: current.name })
   }
   for (const line of text.split('\n')) {
-    const id = /^-\s+id:\s+(.+?)\s*$/.exec(line)
+    // Top-level rows (`- id:`) and bundle-patch insert rows (`    - id:`).
+    const id = /^\s*-\s+id:\s+(.+?)\s*$/.exec(line)
     if (id?.[1] !== undefined) {
       flush()
       current = { id: stripYamlScalar(id[1]) }
@@ -620,9 +621,9 @@ const APP_EXAMPLES = [
     id: 'dsh_base',
     rel: 'apps/cli/composition.md',
     title: 'DSH Base Composition',
-    label: 'apps/cli/config/base.cordis.yml',
-    config: 'apps/cli/config/base.cordis.yml',
-    summary: 'The raw CLI applies one required caller-selected patch list over this shared base; Web and headless apply their own shipped overlays.',
+    label: 'packages/bundle/base/cordis.patch.yml',
+    config: 'packages/bundle/base/cordis.patch.yml',
+    summary: 'The dsh-base bundle patch every profile applies first; mode bundles (dsh-web-app, dsh-headless) and the user\'s profile layer patch over it.',
   },
   {
     id: 'headless',

scripts/gen-tool-catalog.ts

@@ -392,7 +392,7 @@ const TOOL_PACKAGES: ToolPackage[] = [
       await ctx.plugin(ToolSubagent, { provider: 'mock' })
     },
     note:
-      'The registered tool name is the load-time `toolName` config (default `subagent`); the schema above is that default. The shipped example agents load this package once per subagent backend, so the model additionally sees `subagent_fork` (bound to the fork backend) with an identical schema — see `apps/cli/config/base.cordis.yml` and `examples/acp-agent/cordis.yml`.',
+      'The registered tool name is the load-time `toolName` config (default `subagent`); the schema above is that default. The shipped example agents load this package once per subagent backend, so the model additionally sees `subagent_fork` (bound to the fork backend) with an identical schema — see `packages/bundle/base/cordis.patch.yml` and `examples/acp-agent/cordis.yml`.',
   },
   {
     pkg: '@deepseek-ai/dsh-tool-subagent-control',

scripts/verify-cordis-config.ts

@@ -149,11 +149,33 @@ function validateExampleResolution(): string[] {
 }
 
 function validateAppResolution(): string[] {
-  const dependencies = readManifest('apps/cli/package.json').dependencies ?? {}
+  const violations: string[] = []
+  // App overlays (and any config left under apps/cli/config) resolve from the
+  // dsh app's own dependency surface — the profile module fallback mirrors it.
+  const appDependencies = {
+    ...readManifest('apps/cli/package.json').dependencies,
+    // The fallback also links every bundle's own dependencies (healProfilesModuleFallback).
+    ...Object.fromEntries(globSync('packages/bundle/*/package.json', { cwd: root })
+      .flatMap(file => Object.entries(readManifest(file).dependencies ?? {}))),
+  }
   const shipped = new Set(globSync('*.cordis.yml', { cwd: resolve(root, 'apps/cli/config') })
     .map(file => `apps/cli/config/${file}`))
-  const references = pluginReferences.filter(reference => shipped.has(reference.file) || appOverlayFiles.has(reference.file))
-  return missingPluginDependencies(references, dependencies, 'apps/cli/package.json')
+  const appReferences = pluginReferences.filter(reference => shipped.has(reference.file) || appOverlayFiles.has(reference.file))
+  violations.push(...missingPluginDependencies(appReferences, appDependencies, 'apps/cli/package.json or a bundle manifest'))
+  // Each bundle's patch rows must resolve from that bundle's own dependencies:
+  // per-layer resolution anchors on the bundle package directory.
+  for (const manifestPath of globSync('packages/bundle/*/package.json', { cwd: root })) {
+    const bundleDir = manifestPath.replace(/\/package\.json$/, '')
+    const dependencies = readManifest(manifestPath).dependencies ?? {}
+    const references = pluginReferences.filter(reference => reference.file.startsWith(`${bundleDir}/`))
+    violations.push(...missingPluginDependencies(
+      // A bundle may mount its own package (the web-app runtime row).
+      references.filter(reference => packageNameFromSpecifier(reference.name) !== readManifest(manifestPath).name),
+      dependencies,
+      manifestPath,
+    ))
+  }
+  return violations
 }
 
 /**