refactor(cli): simplify profile composition and dump paths

- composeProfile keeps layers as bundle/user/overlay+flags segments instead
  of one flat list later re-sliced by index arithmetic; the row index drops
  the group-walk (profile trees are flat patch compositions) and the double
  composition.
- The config dump anchors on the profile's real empty root (written by the
  shared prepareProfile) instead of materializing a temp file, so dump and
  boot compose over the identical base by construction.
- dsh-base drops its patchPath export: the dsh.patch manifest field is the
  one contract; the package carries no runtime API.
- packageDirFromAnchor is paths-probe only (the require.resolve fast path
  duplicated the probe's outcome); basename() replaces hand-rolled path
  splitting; verify-cordis-config stops re-reading bundle manifests in-loop.

packages/bundle/base/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/bundle/base/README.md
-README.md: dd44e825f9a62c8b5e49a6af31c17b242a1927d7
-README.zh.md: 7227345591b5ddf6d27a88038074ed3541b01102
+README.md: 627dddc3808f67a2624e6e5b4d7f71c1617f227a
+README.zh.md: 84f48357d7b66df334d9f78eff64b0c7de3080e1

packages/bundle/base/README.md

@@ -2,7 +2,7 @@
 
 English | [中文](README.zh.md)
 
-The shared dsh core as a profile bundle: [`cordis.patch.yml`](cordis.patch.yml) inserts every base plugin row — model adapters, tools, persistence, policy, settings/credentials, repository Plugins, telemetry — over the empty profile root, as the first layer of every profile's `dsh.plugins` list. Later bundle layers (e.g. [`dsh-web-app`](../web-app/README.md)) and the user's profile `cordis.patch.yml` override these rows by id; a patch replaces a row's whole `config`, so mode-specific values live in mode bundles, not here. The package's TypeScript surface is a single `patchPath` convenience export; the profile composer resolves the patch through the `dsh.patch` manifest field, never through code.
+The shared dsh core as a profile bundle: [`cordis.patch.yml`](cordis.patch.yml) inserts every base plugin row — model adapters, tools, persistence, policy, settings/credentials, repository Plugins, telemetry — over the empty profile root, as the first layer of every profile's `dsh.plugins` list. Later bundle layers (e.g. [`dsh-web-app`](../web-app/README.md)) and the user's profile `cordis.patch.yml` override these rows by id; a patch replaces a row's whole `config`, so mode-specific values live in mode bundles, not here. The package has no runtime API; the profile composer resolves the patch through the `dsh.patch` manifest field, never through code.
 
 The row set and its rationale are documented inline in the patch file; the [generated composition graph](../../../apps/cli/composition.md) renders it.
 

packages/bundle/base/README.zh.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 中文
 
-以 profile 组合包形式交付的共享 dsh 核心：[`cordis.patch.yml`](cordis.patch.yml) 在空的 profile 根之上插入全部基础插件行——模型适配器、工具、持久化、策略、settings／credentials、repository 插件、遥测——作为每个 profile 的 `dsh.plugins` 列表中的第一层。后续的组合包层（例如 [`dsh-web-app`](../web-app/README.md)）和用户 profile 的 `cordis.patch.yml` 按 id 覆盖这些行；patch 会替换目标行的整个 `config`，因此模式专属的值放在各模式组合包中，而不是这里。该包的 TypeScript 表层只有一个便利导出 `patchPath`；profile 组合器通过 manifest（元数据清单）的 `dsh.patch` 字段解析 patch，绝不通过代码。
+以 profile 组合包形式交付的共享 dsh 核心：[`cordis.patch.yml`](cordis.patch.yml) 在空的 profile 根之上插入全部基础插件行——模型适配器、工具、持久化、策略、settings／credentials、repository 插件、遥测——作为每个 profile 的 `dsh.plugins` 列表中的第一层。后续的组合包层（例如 [`dsh-web-app`](../web-app/README.md)）和用户 profile 的 `cordis.patch.yml` 按 id 覆盖这些行；patch 会替换目标行的整个 `config`，因此模式专属的值放在各模式组合包中，而不是这里。该包没有运行时 API；profile 组合器通过 manifest（元数据清单）的 `dsh.patch` 字段解析 patch，绝不通过代码。
 
 行集合及其设计依据以行内注释写在 patch 文件里；[生成的组合图](../../../apps/cli/composition.md)负责渲染它。
 

packages/bundle/base/src/index.ts

@@ -1,14 +1,9 @@
 /**
  * @deepseek-ai/dsh-base — the shared dsh core as a profile bundle. The
- * package's substance is `cordis.patch.yml` (declared by the `dsh.patch`
- * manifest field): every profile's first patch layer, inserting the base
- * plugin rows over the empty profile root. This module only names the patch
- * for consumers that need the path programmatically (the profile composer
- * resolves it through the manifest field, not through this export).
+ * package's substance is `cordis.patch.yml`, declared by the `dsh.patch`
+ * manifest field and resolved by the profile composer through that field;
+ * this module carries no runtime API.
  * @module @deepseek-ai/dsh-base
  */
 
-import { fileURLToPath } from 'node:url'
-
-/** Absolute path of this bundle's profile patch. */
-export const patchPath: string = fileURLToPath(new URL('../cordis.patch.yml', import.meta.url))
+export {}

packages/bundle/base/tests/base.spec.ts

@@ -1,19 +1,21 @@
 /**
- * The bundle's substance is its patch file: the convenience export must point
- * at the real, parseable patch list the `dsh.patch` manifest field declares.
+ * The bundle's substance is its patch file: the `dsh.patch` manifest field
+ * must name a real, parseable patch list.
  */
 
 import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { resolve } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import * as yaml from 'js-yaml'
 import { entryListSchema } from '@cordisjs/plugin-include'
-import { patchPath } from '../src/index.ts'
 
 describe('dsh-base bundle', () => {
-  it('exports the path of a parseable patch list matching the manifest declaration', () => {
-    const manifest = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as { dsh?: { patch?: string } }
+  it('declares a parseable patch list through the dsh.patch manifest field', () => {
+    const root = fileURLToPath(new URL('..', import.meta.url))
+    const manifest = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8')) as { dsh?: { patch?: string } }
     expect(manifest.dsh?.patch).toBe('./cordis.patch.yml')
-    const parsed = yaml.load(readFileSync(patchPath, 'utf8'), { schema: entryListSchema })
+    const parsed = yaml.load(readFileSync(resolve(root, manifest.dsh!.patch!), 'utf8'), { schema: entryListSchema })
     expect(Array.isArray(parsed)).toBe(true)
     // The base layer is one insert list over the empty profile root.
     const rows = (parsed as { insert?: { id?: string }[] }[]).flatMap(patch => patch.insert ?? [])

packages/ui/app-boot/src/profile.ts

@@ -25,7 +25,7 @@ import { createRequire } from 'node:module'
 import {
   existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync,
 } from 'node:fs'
-import { dirname, join } from 'node:path'
+import { basename, dirname, join } from 'node:path'
 import type { EntryOptions } from '@cordisjs/plugin-loader'
 import { applyEntryPatches, type PatchOptions } from '@cordisjs/plugin-include'
 import { resolveDshHome } from '@deepseek-ai/dsh-paths'
@@ -133,10 +133,7 @@ export function initProfile(dir: string, plugins: readonly string[]): void {
   const manifestPath = join(dir, 'package.json')
   if (!existsSync(manifestPath)) {
     const manifest: ProfileManifest & { private: boolean } = {
-      // `dir` always carries at least one segment, so at(-1) cannot miss;
-      // the fallback only satisfies the type.
-      /* v8 ignore next */
-      name: `dsh-profile-${join(dir).split(/[/\\]/).at(-1) ?? 'profile'}`,
+      name: `dsh-profile-${basename(dir)}`,
       private: true,
       dependencies: {},
       dsh: { plugins: [...plugins] },
@@ -267,21 +264,16 @@ export function writeProfileManifest(dir: string, manifest: ProfileManifest): vo
 
 /**
  * Resolve a package's root directory from one anchor without depending on the
- * package exporting `./package.json`: probe the require resolution paths for
- * a directory holding the named manifest. This is Node's own lookup order, so
- * the result matches what the Loader would import from the same anchor.
+ * package exporting `./package.json` (`require.resolve` would need that):
+ * probe the require resolution paths for a directory holding the named
+ * manifest. This is Node's own node_modules lookup order, so the result
+ * matches what the Loader would import from the same anchor, and
+ * `existsSync` follows the symlinks pnpm's isolated layout uses.
  */
 function packageDirFromAnchor(anchor: string, packageName: string): string | undefined {
-  const require = createRequire(anchor)
-  // Fast path: the package exports its manifest (every in-box package does).
-  try {
-    return dirname(require.resolve(`${packageName}/package.json`))
-  } catch {
-    // Exports-encapsulated package — fall through to the paths probe.
-  }
   // resolve.paths returns null only for builtins, which no bundle name is.
   /* v8 ignore next */
-  for (const searchPath of require.resolve.paths(packageName) ?? []) {
+  for (const searchPath of createRequire(anchor).resolve.paths(packageName) ?? []) {
     const candidate = join(searchPath, packageName)
     if (existsSync(join(candidate, 'package.json'))) return candidate
   }
@@ -307,11 +299,9 @@ export function resolveBundleDir(
     const dir = packageDirFromAnchor(anchor, packageName)
     if (dir !== undefined) return dir
   }
-  // profileDir always carries at least one segment; String() only satisfies the type.
-  const profileName = String(join(profileDir).split(/[/\\]/).at(-1))
   throw new Error(
     `${binName}: cannot resolve profile bundle ${JSON.stringify(packageName)} from the dsh installation or ${profileDir}; `
-    + `run 'dsh plugin --profile ${profileName} install' if its dependency is not installed`,
+    + `run 'dsh plugin --profile ${basename(profileDir)} install' if its dependency is not installed`,
   )
 }