Heal sparse Desktop overrides and default-publish ops tools (0.1.51).

Plugin Manager often leaves a bare netxops enable stub that wipes Config on DSH 0.2; expand missing keys on Host apply, default groupOpsPublic on, and persist false explicitly so other installs get tools without hand-editing patches.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/agent-preset-install.ts

@@ -27,6 +27,7 @@ import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import type { Context } from '@deepseek-ai/cordis'
+import { healNetxopsProfileEntries } from './netx/heal-profile-entry.ts'
 
 export const NETXOPS_PRESET_ID = 'netxops'
 
@@ -610,4 +611,12 @@ export function ensureAgentPresetInstalled(logger: Context['logger']): void {
   } catch (error) {
     logger.error('netxops: failed to sync declarative preset into profile patch: %s', error)
   }
+  try {
+    // Plugin Manager often leaves `- id: netxops` / `disabled: false` with no
+    // config; DSH 0.2 replaces the whole Config → capability/public flags never
+    // apply. Expand missing keys from package defaults on every Host apply.
+    healNetxopsProfileEntries(logger)
+  } catch (error) {
+    logger.error('netxops: failed to heal host profile entry: %s', error)
+  }
 }