refactor(plugins): read a bundle's one-liner from the package description only

The dsh manifest gains no description field: a bundle's card shows the
package.json description, and the shipped optional bundles carry no
display title or description of their own until localized metadata is
designed. The plugin author tutorial shows the bundle declaration alone.

apps/web/tests/expected/plugin-manager/live-enabled.expected.md

@@ -8,17 +8,17 @@
 - text: "3"
 - list:
   - listitem:
-    - button "查看 Agent Teams": Agent Teams
-    - text: 官方 实验功能：把子代理委派换成 Agent Teams 的团队协作工具，这是宿主层，需与 Agent Teams Web 面板一起开启。
-    - switch "启用 Agent Teams"
+    - button "查看 experimental-agent-team-profile": experimental-agent-team-profile
+    - text: 官方 Experimental profile bundle enabling Agent Teams over dsh-base
+    - switch "启用 experimental-agent-team-profile"
   - listitem:
-    - button "查看 Agent Teams Web 面板": Agent Teams Web 面板
-    - text: 官方 实验功能：在浏览器里显示 Agent Teams 的团队名单、任务板和成员导航，需先开启 Agent Teams。
-    - switch "启用 Agent Teams Web 面板"
+    - button "查看 experimental-agent-team-web-profile": experimental-agent-team-web-profile
+    - text: 官方 Experimental Web profile layer for Agent Teams Remote and UI plugins
+    - switch "启用 experimental-agent-team-web-profile"
   - listitem:
-    - button "查看 Auto review": Auto review
-    - text: 官方 实验功能：为当前会话的权限选择器增加 Auto review，每次工具调用前由模型评估风险再执行；可能误放行或误拒绝，并消耗额外 token。
-    - switch "启用 Auto review"
+    - button "查看 experimental-auto-review": experimental-auto-review
+    - text: 官方 Per-tool LLM authorization review for the DeepSeek Harness Auto permission preset
+    - switch "启用 experimental-auto-review"
 - heading "已安装" [level=3]
 - text: "1"
 - list:

apps/web/tests/expected/plugin-manager/manager.expected.md

@@ -8,17 +8,17 @@
 - text: "3"
 - list:
   - listitem:
-    - button "查看 Agent Teams": Agent Teams
-    - text: 官方 实验功能：把子代理委派换成 Agent Teams 的团队协作工具，这是宿主层，需与 Agent Teams Web 面板一起开启。
-    - switch "启用 Agent Teams"
+    - button "查看 experimental-agent-team-profile": experimental-agent-team-profile
+    - text: 官方 Experimental profile bundle enabling Agent Teams over dsh-base
+    - switch "启用 experimental-agent-team-profile"
   - listitem:
-    - button "查看 Agent Teams Web 面板": Agent Teams Web 面板
-    - text: 官方 实验功能：在浏览器里显示 Agent Teams 的团队名单、任务板和成员导航，需先开启 Agent Teams。
-    - switch "启用 Agent Teams Web 面板"
+    - button "查看 experimental-agent-team-web-profile": experimental-agent-team-web-profile
+    - text: 官方 Experimental Web profile layer for Agent Teams Remote and UI plugins
+    - switch "启用 experimental-agent-team-web-profile"
   - listitem:
-    - button "查看 Auto review": Auto review
-    - text: 官方 实验功能：为当前会话的权限选择器增加 Auto review，每次工具调用前由模型评估风险再执行；可能误放行或误拒绝，并消耗额外 token。
-    - switch "启用 Auto review"
+    - button "查看 experimental-auto-review": experimental-auto-review
+    - text: 官方 Per-tool LLM authorization review for the DeepSeek Harness Auto permission preset
+    - switch "启用 experimental-auto-review"
 - heading "已安装" [level=3]
 - text: "1"
 - list:

docs/config-catalog.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/config-catalog.md
-config-catalog.md: 90c632c730888c30e38e58676824db0c557b8cc1
-config-catalog.zh.md: 554f64e8659b795285b4fb425ab0f050c210ee34
+config-catalog.md: ba691e83e0e81bf608f090c56cca6b797074116b
+config-catalog.zh.md: 78d39e6e85329d797699b0a6e9e151e13d48fa5e

docs/config-catalog.md

@@ -1823,7 +1823,7 @@ export interface Config {
 }
 ```
 
-Source: [`packages/boot/plugin-manager/src/index.ts:31`](../packages/boot/plugin-manager/src/index.ts)
+Source: [`packages/boot/plugin-manager/src/index.ts:33`](../packages/boot/plugin-manager/src/index.ts)
 
 <a id="deepseek-aidsh-plugin-package-inventory-deepseek"></a>
 

docs/config-catalog.zh.md

@@ -1825,7 +1825,7 @@ export interface Config {
 }
 ```
 
-来源： [`packages/boot/plugin-manager/src/index.ts:31`](../packages/boot/plugin-manager/src/index.ts)
+来源： [`packages/boot/plugin-manager/src/index.ts:33`](../packages/boot/plugin-manager/src/index.ts)
 
 <a id="deepseek-aidsh-plugin-package-inventory-deepseek"></a>
 

docs/user/develop/basic/publish.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/user/develop/basic/publish.md
-publish.md: da3a80a809a2e01b5f5914178a8d34e8c4453fc1
-publish.zh.md: 3baa952d42c3a223b8ce1aeea326799e10cbe1f5
+publish.md: 17b0cb80f9cf385773ae9e1f4d7061ec1df9c1a2
+publish.zh.md: 3cc65af58d34028a6bff03455451153e2c7f439b

docs/user/develop/basic/publish.md

@@ -39,16 +39,10 @@ Create `hello-plugin/package.json`:
   "type": "module",
   "main": "index.js",
   "files": ["index.js", "cordis.patch.yml"],
-  "dsh": {
-    "title": "Hello plugin",
-    "description": "Logs a greeting when it loads.",
-    "bundle": { "patch": "./cordis.patch.yml" }
-  }
+  "dsh": { "bundle": { "patch": "./cordis.patch.yml" } }
 }
 ```
 
-`dsh.title` and `dsh.description` are what users see where bundles are listed, such as the Web sidebar's Plugins page; without them the page shows the package name stripped of its scope and `dsh-` prefix, and the package `description`.
-
 Create `hello-plugin/index.js` with the plugin entry point:
 
 ```js

docs/user/develop/basic/publish.zh.md

@@ -39,16 +39,10 @@ hello-plugin/
   "type": "module",
   "main": "index.js",
   "files": ["index.js", "cordis.patch.yml"],
-  "dsh": {
-    "title": "Hello plugin",
-    "description": "Logs a greeting when it loads.",
-    "bundle": { "patch": "./cordis.patch.yml" }
-  }
+  "dsh": { "bundle": { "patch": "./cordis.patch.yml" } }
 }
 ```
 
-`dsh.title` 与 `dsh.description` 是用户在组合包列表（例如 Web 侧栏的插件页）里看到的名字和简介；没有它们时，页面显示去掉 scope 和 `dsh-` 前缀的包名，以及包的 `description`。
-
 创建 `hello-plugin/index.js`，写入插件入口：
 
 ```js

packages/boot/plugin-manager/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/boot/plugin-manager/README.md
-README.md: 1d4217a8992300061e12ab397c6879d5ddedd009
-README.zh.md: ba76024f4eadc4781b2c87afe35b8a0ae3112b78
+README.md: 3acb64892a8955763d2989ed12d6b2c1ead9efce
+README.zh.md: d69848c23b6b1c2b25dd8600ff073229cb290fb8

packages/boot/plugin-manager/README.md

@@ -39,7 +39,7 @@ A plugin toggle updates only `disabled` in the last matching override in the pro
 
 `inspect(spec)` reads what a spec names before anything installs: a registry name is asked of the registry through `pnpm view`, run in the profile directory so the same registry and proxy settings apply as to the install; an absolute path has its `package.json` read; a git address or tarball answers only its form. The answer carries the name, version, description, `dsh.title`, and whether the package declares a bundle, or a `problem`: `invalid-spec`, `already-installed`, `not-found`, `not-a-package`, `not-a-bundle`, `network`, or `unknown`. A caller's `signal` or `inspectTimeoutMs` ends the lookup.
 
-`installBundle` accepts a caller-generated `requestId`, under which `plugin-manager/install-log` streams each pnpm run's output and `plugin-manager/install-state` announces `installing`, `cancelling`, and `applying`. `cancelInstall(requestId)` stops the run and answers `cancelled` only after pnpm exited and the files are back, `too-late` once the bundle is being applied, and `not-running` for any other id; the install call then reports `application: 'cancelled'`. A run that fails, is cancelled, or adds a package without a bundle patch restores `package.json` and `pnpm-lock.yaml` as they were; `packageResult.kind` classifies a failed run from its exit and output, and `bundle` names the package a finished run added. `listBundles` carries each bundle's title and one-liner (`dsh.title` and `dsh.description`, else the package `description`), the rows its patch declares with their live entries, and the built-in rows it overrides; it lists the profile's own bundles, the bundles the installation supplies, and a selected name without a bundle patch as a `not-bundle` problem, while an unselected plain dependency is left out. A bundle the launcher's `OPTIONAL_BUNDLES` names is `optional`: shipped switched off for the person to turn on, never removable, and selected by no shipped template ([rationale](../../../.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md)). Every completed operation emits `plugin-manager/changed`; a patch generation applied outside the manager, by HMR's watcher after a CLI or hand edit, announces nothing, so the page learns of it on its next read.
+`installBundle` accepts a caller-generated `requestId`, under which `plugin-manager/install-log` streams each pnpm run's output and `plugin-manager/install-state` announces `installing`, `cancelling`, and `applying`. `cancelInstall(requestId)` stops the run and answers `cancelled` only after pnpm exited and the files are back, `too-late` once the bundle is being applied, and `not-running` for any other id; the install call then reports `application: 'cancelled'`. A run that fails, is cancelled, or adds a package without a bundle patch restores `package.json` and `pnpm-lock.yaml` as they were; `packageResult.kind` classifies a failed run from its exit and output, and `bundle` names the package a finished run added. `listBundles` carries each bundle's title and one-liner (`dsh.title`, else the package name, and the package `description`), the rows its patch declares with their live entries, and the built-in rows it overrides; it lists the profile's own bundles, the bundles the installation supplies, and a selected name without a bundle patch as a `not-bundle` problem, while an unselected plain dependency is left out. A bundle the launcher's `OPTIONAL_BUNDLES` names is `optional`: shipped switched off for the person to turn on, never removable, and selected by no shipped template ([rationale](../../../.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md)). Every completed operation emits `plugin-manager/changed`; a patch generation applied outside the manager, by HMR's watcher after a CLI or hand edit, announces nothing, so the page learns of it on its next read.
 
 When pnpm 11 blocks dependency scripts, the failed installation reports every pending package name in the profile under `pendingBuilds`, including names left by earlier attempts; a failed run restores `package.json` and `pnpm-lock.yaml` but deliberately not `pnpm-workspace.yaml`, where pnpm records them. The Web plugin page offers **Allow these scripts and retry**; the tool can grant permission on the user's behalf through `approvedBuilds` on `install_bundle`, after the user approves those scripts in the conversation. The service validates pending names; it does not verify conversation approval. Approval persists by package name in this profile, permits commands with the host user's permissions, and survives another installation failure. Only currently undecided names can be approved; existing denials and wildcard rules cannot be overridden through this action. Approval rejects YAML anchors or aliases inside `allowBuilds`. Retry preserves the original activation choice.
 

packages/boot/plugin-manager/README.zh.md

@@ -39,7 +39,7 @@ kind: "package-reference"
 
 `inspect(spec)` 在任何东西安装之前读出 spec 指向什么：注册表包名通过 `pnpm view` 询问注册表，在 profile 目录中运行，因而与安装使用同样的注册表与代理设置；绝对路径读取其 `package.json`；git 地址或 tarball 只答复自己的形式。答复携带名称、版本、描述、`dsh.title` 以及该包是否声明组合包，否则给出 `problem`：`invalid-spec`、`already-installed`、`not-found`、`not-a-package`、`not-a-bundle`、`network` 或 `unknown`。调用方的 `signal` 或 `inspectTimeoutMs` 会结束查询。
 
-`installBundle` 接受调用方生成的 `requestId`，`plugin-manager/install-log` 在其下流式转发每次 pnpm 运行的输出，`plugin-manager/install-state` 通告 `installing`、`cancelling` 与 `applying`。`cancelInstall(requestId)` 停止运行，只在 pnpm 退出且文件恢复后答复 `cancelled`，组合包已在应用时答复 `too-late`，其他 id 答复 `not-running`；安装调用随后报告 `application: 'cancelled'`。失败、被取消或装入了没有组合包 patch 的包的运行，会把 `package.json` 与 `pnpm-lock.yaml` 恢复原样；`packageResult.kind` 按退出方式与输出对失败运行分类，`bundle` 给出完成的运行新增的包。`listBundles` 携带每个组合包的标题与一句话简介（`dsh.title` 与 `dsh.description`，没有则用包的 `description`）、其 patch 声明的行及其存活条目，以及它覆盖的内置行；它列出 profile 自己的组合包、安装提供的组合包，以及被选中却没有组合包 patch 的名字（作为 `not-bundle` 问题），未选中的普通依赖不列出。启动器的 `OPTIONAL_BUNDLES` 点名的组合包是 `optional`：随安装提供、默认关闭、由用户开启，永不可卸载，也不被任何随附模板选中（[理由](../../../.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.zh.md)）。每个完成的操作都会发出 `plugin-manager/changed`；在管理器之外应用的一代 patch（HMR 监视到 CLI 或手工编辑后）不发通知，页面要到下一次读取才知道。
+`installBundle` 接受调用方生成的 `requestId`，`plugin-manager/install-log` 在其下流式转发每次 pnpm 运行的输出，`plugin-manager/install-state` 通告 `installing`、`cancelling` 与 `applying`。`cancelInstall(requestId)` 停止运行，只在 pnpm 退出且文件恢复后答复 `cancelled`，组合包已在应用时答复 `too-late`，其他 id 答复 `not-running`；安装调用随后报告 `application: 'cancelled'`。失败、被取消或装入了没有组合包 patch 的包的运行，会把 `package.json` 与 `pnpm-lock.yaml` 恢复原样；`packageResult.kind` 按退出方式与输出对失败运行分类，`bundle` 给出完成的运行新增的包。`listBundles` 携带每个组合包的标题与一句话简介（`dsh.title`，没有则用包名；简介用包的 `description`）、其 patch 声明的行及其存活条目，以及它覆盖的内置行；它列出 profile 自己的组合包、安装提供的组合包，以及被选中却没有组合包 patch 的名字（作为 `not-bundle` 问题），未选中的普通依赖不列出。启动器的 `OPTIONAL_BUNDLES` 点名的组合包是 `optional`：随安装提供、默认关闭、由用户开启，永不可卸载，也不被任何随附模板选中（[理由](../../../.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.zh.md)）。每个完成的操作都会发出 `plugin-manager/changed`；在管理器之外应用的一代 patch（HMR 监视到 CLI 或手工编辑后）不发通知，页面要到下一次读取才知道。
 
 pnpm 11 拦下依赖脚本时，失败的安装在 `pendingBuilds` 里报告 profile 中所有待决定的包名，包括先前尝试留下的；失败的运行会恢复 `package.json` 与 `pnpm-lock.yaml`，但有意不恢复 pnpm 记录这些名字的 `pnpm-workspace.yaml`。Web 插件页提供**允许这些脚本并重试**；工具可以在用户于对话中批准这些脚本后，通过 `install_bundle` 的 `approvedBuilds` 代为授权。服务只校验待决定的名字，不核实对话中的批准。授权按包名保存在当前 profile，允许以宿主用户的权限执行命令，并在再次安装失败后保留。只能批准当前未决定的名字；已有的拒绝与通配规则不能通过此操作覆盖。`allowBuilds` 里出现 YAML 锚点或别名时拒绝授权。重试保留原来的启用选择。
 

packages/boot/plugin-manager/src/index.ts

@@ -103,12 +103,12 @@ interface InstallationManifest {
 /** What a package manifest says about the package: identity, one-liner, and whether it is a bundle. */
 function inspectionOf(kind: 'registry' | 'path', manifest: object): Extract<PluginSpecInspection, { status: 'accepted' }> {
   const dsh = (manifest as { dsh?: unknown }).dsh
-  const declared = typeof dsh === 'object' && dsh !== null ? dsh as { title?: unknown; description?: unknown; bundle?: unknown } : undefined
+  const declared = typeof dsh === 'object' && dsh !== null ? dsh as { title?: unknown; bundle?: unknown } : undefined
   const title = declared === undefined ? undefined : stringField(declared, 'title')
   const bundle = declared !== undefined && typeof declared.bundle === 'object' && declared.bundle !== null
   const name = stringField(manifest, 'name')
   const version = stringField(manifest, 'version')
-  const description = (declared === undefined ? undefined : stringField(declared, 'description')) ?? stringField(manifest, 'description')
+  const description = stringField(manifest, 'description')
   return {
     status: 'accepted', kind, bundle,
     ...name === undefined ? {} : { name },
@@ -213,10 +213,9 @@ export class PluginManager extends TypertRemoteService {
         }
         const readOnlyReason = this.protectsManager(name) ? 'management-required' as const : undefined
         const title = info.dsh?.title
-        const description = info.dsh?.description ?? info.description
         bundles.push({ name, ...(info.version === undefined ? {} : { version: info.version }),
           ...(title === undefined ? {} : { title }),
-          ...(description === undefined || description === '' ? {} : { description }),
+          ...(info.description === undefined || info.description === '' ? {} : { description: info.description }),
           enabled, installed, optional, removable: removable && readOnlyReason === undefined,
           ...(readOnlyReason === undefined ? {} : { readOnlyReason }),
           ...this.declaredRows(name, info) })

packages/boot/plugin-manager/src/types.ts

@@ -35,7 +35,7 @@ export interface BundleInfo {
   version?: string
   /** `dsh.title` of the package manifest. */
   title?: string
-  /** `dsh.description` of the package manifest, else its `description`. */
+  /** `description` of the package manifest. */
   description?: string
   enabled: boolean
   /** Whether the profile's own dependencies hold the package; false for a bundle the dsh installation supplies. */
@@ -133,7 +133,7 @@ export type PluginSpecInspection =
     readonly kind: InstallSpecKind
     readonly name?: string
     readonly version?: string
-    /** `dsh.description` of the package manifest, else its `description`. */
+    /** `description` of the package manifest. */
     readonly description?: string
     /** `dsh.title` of the package manifest. */
     readonly title?: string

packages/boot/plugin-manager/tests/manager.spec.ts

@@ -564,11 +564,9 @@ it('reads what a spec names before installing it', async () => {
   const view = vi.spyOn(operations, 'viewProfilePackage')
   onTestFinished(() => { view.mockRestore() })
   const answers = (stdout: string) => view.mockResolvedValueOnce({ exitCode: 0, stdout, stderr: '', timedOut: false })
-  answers(JSON.stringify({
-    name: 'dsh-x', version: '1.4.2', description: 'A sidebar.', dsh: { title: 'Sidebar', description: 'A better sidebar.', bundle: { patch: './cordis.patch.yml' } },
-  }))
+  answers(JSON.stringify({ name: 'dsh-x', version: '1.4.2', description: 'A sidebar.', dsh: { title: 'Sidebar', bundle: { patch: './cordis.patch.yml' } } }))
   expect(await manager.inspect('dsh-x')).toEqual({
-    status: 'accepted', kind: 'registry', name: 'dsh-x', version: '1.4.2', description: 'A better sidebar.', title: 'Sidebar', bundle: true,
+    status: 'accepted', kind: 'registry', name: 'dsh-x', version: '1.4.2', description: 'A sidebar.', title: 'Sidebar', bundle: true,
   })
   expect(view).toHaveBeenCalledWith(dir, 'dsh-x', { command: 'pnpm-test', timeoutMs: 1000 })
   const signal = AbortSignal.abort()
@@ -676,7 +674,7 @@ it('refuses removal of a hot-installed bundle after HMR is disabled', async () =
   expect(await manager.removeBundle('later')).toMatchObject({ changed: false, application: 'failed' })
 })
 
-it('offers the launcher\'s optional bundles switched off and never removable, preferring dsh.description', async () => {
+it('offers the launcher\'s optional bundles switched off and never removable', async () => {
   const { manager, profile } = await fixture()
   // The launcher names the bundles the installation ships; the fixture supplies one of them from the
   // installation's own node_modules, which the resolver consults before the profile's and before the repository's.
@@ -684,14 +682,13 @@ it('offers the launcher\'s optional bundles switched off and never removable, pr
   const supplied = join(profile.home, 'node_modules', offered)
   mkdirSync(supplied, { recursive: true })
   writeFileSync(join(supplied, 'package.json'), JSON.stringify({
-    name: offered, version: '3.0.0', description: 'Package one-liner.',
-    dsh: { title: 'Offered', description: 'Display one-liner.', bundle: { patch: './cordis.patch.yml' } },
+    name: offered, version: '3.0.0', description: 'Package one-liner.', dsh: { bundle: { patch: './cordis.patch.yml' } },
   }))
   writeFileSync(join(supplied, 'cordis.patch.yml'), JSON.stringify([{ insert: [{ id: 'offered-row', name: './plugin.mjs', config: { service: 'offeredProbe' } }] }]))
   writeFileSync(join(supplied, 'plugin.mjs'), 'export function apply(ctx, config) { ctx.provide(config?.service ?? "offeredProbe", true) }\n')
   writeFileSync(profile.installAnchor, JSON.stringify({ name: 'installation', dependencies: { [offered]: '3.0.0' } }))
   expect((await manager.listBundles()).find(row => row.name === offered)).toEqual({
-    name: offered, version: '3.0.0', title: 'Offered', description: 'Display one-liner.',
+    name: offered, version: '3.0.0', description: 'Package one-liner.',
     enabled: false, installed: false, optional: true, removable: false,
     rows: [{ rowId: 'offered-row', moduleName: pathToFileURL(join(supplied, 'plugin.mjs')).href }], overrides: [],
   })

packages/experimental/agent-team-profile/package.json

@@ -29,8 +29,6 @@
   ],
   "license": "MIT",
   "dsh": {
-    "title": "Agent Teams",
-    "description": "实验功能：把子代理委派换成 Agent Teams 的团队协作工具，这是宿主层，需与 Agent Teams Web 面板一起开启。",
     "bundle": {
       "patch": "./cordis.patch.yml"
     }

packages/experimental/agent-team-web-profile/package.json

@@ -29,8 +29,6 @@
   ],
   "license": "MIT",
   "dsh": {
-    "title": "Agent Teams Web 面板",
-    "description": "实验功能：在浏览器里显示 Agent Teams 的团队名单、任务板和成员导航，需先开启 Agent Teams。",
     "bundle": {
       "patch": "./cordis.patch.yml"
     }

packages/experimental/auto-review/package.json

@@ -71,8 +71,6 @@
     "access": "public"
   },
   "dsh": {
-    "title": "Auto review",
-    "description": "实验功能：为当前会话的权限选择器增加 Auto review，每次工具调用前由模型评估风险再执行；可能误放行或误拒绝，并消耗额外 token。",
     "bundle": {
       "patch": "./cordis.patch.yml"
     }

packages/util/package-manifest/src/types.ts

@@ -30,8 +30,6 @@ export interface DshManifest {
   manifestVersion?: 1
   /** Display title of the package, read without executing package code. */
   title?: string
-  /** Display one-liner of the package, read without executing package code; shown instead of the package `description`. */
-  description?: string
   /** Bundle metadata consumed by the profile launcher. */
   bundle?: DshBundleManifest
   /** Profile metadata consumed by the profile launcher. */