@aiwayds/dsh-llm-proxy 0.8.0 → 0.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwayds/dsh-llm-proxy",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "dsh plugin: SYSTEM proxy (env) + LLM traffic-splitting proxy via a process-global undici routing dispatcher",
   "type": "module",
   "main": "lib/index.js",
@@ -37,10 +37,9 @@
     "build": "tsc -p tsconfig.json",
     "check": "tsc --noEmit -p tsconfig.json",
     "pretest": "npm run build",
-    "prepare": "npm run build",
+    "prepare": "node scripts/link-dsh-closure.mjs && npm run build",
     "test": "node --test test/match.test.mjs test/router.test.mjs test/config.test.mjs test/skill.test.mjs test/dispose.test.mjs test/e2e.test.mjs && node test/packaged-install.test.mjs",
-    "smoke": "node scripts/smoke-boot.mjs",
-    "postinstall": "node scripts/link-dsh-closure.mjs"
+    "smoke": "node scripts/smoke-boot.mjs"
   },
   "dependencies": {
     "undici": "8.9.0"
@@ -67,9 +66,9 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.1.0",
-    "@deepseek-ai/dsh-scope": "0.2.2-rc.1",
-    "@deepseek-ai/dsh-settings": "0.2.2-rc.1",
-    "@deepseek-ai/dsh-skill": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-scope": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-settings": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-skill": "0.2.2-rc.2",
     "@deepseek-ai/schemastery": "3.19.0",
     "@types/node": "^24.0.0",
     "typescript": "^5.9.0"

package/scripts/link-dsh-closure.mjs

@@ -1,5 +1,5 @@
 /**
- * Postinstall linker: point every `node_modules/@deepseek-ai/*` entry at the
+ * Install-hook linker: point every `node_modules/@deepseek-ai/*` entry at the
  * global dsh closure.
  *
  * Why this exists: dsh-tui-pi is a plugin that runs *inside* the installed
@@ -17,7 +17,12 @@
  * (`Property 'settings' does not exist on type 'Context'`), so they must stay
  * *undeclared*. pnpm then treats the closure links as extraneous — and, as
  * it prunes entries it once managed, the links can still disappear after an
- * install. This script re-creates them on every `pnpm install` (postinstall).
+ * install. This script re-creates them on every root install (the `prepare`
+ * hook). It is deliberately NOT `postinstall`: pnpm 11 treats any dependency
+ * install hook as an unapproved build (strictDepBuilds) and fails the
+ * consumer's install with ERR_PNPM_IGNORED_BUILDS, while `prepare` never runs
+ * for registry dependencies — so the published package carries no install
+ * hook at all.
  *
  * It is a no-op (exit 0) when no global dsh install is found — a dev machine
  * without dsh simply cannot typecheck against dsh types.
@@ -29,17 +34,28 @@ import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const repoRoot = dirname(dirname(fileURLToPath(import.meta.url)))
-// Guard: this postinstall is a dev-machine convenience for THIS repo. A
-// published tarball ships scripts/ (the hook must resolve), but the linker
-// must never touch a consumer's node_modules there — it would delete their
-// @deepseek-ai packages and replace them with symlinks into their global dsh
-// closure. pnpm ≥10 blocks dependency lifecycle scripts by default, but npm
-// would run this — exit silently outside the repo. The repo markers must be
-// things the files allow-list never ships: tsconfig.json (dev typecheck
-// input) and .git.
+// Guard: this hook is a dev-machine convenience for THIS repo. The published
+// tarball ships scripts/ and the `prepare` script (a dev hook, carried but
+// never executed for registry dependencies), and the linker must never touch
+// a consumer's node_modules there — it would delete their @deepseek-ai
+// packages and replace them with symlinks into their global dsh closure. Exit
+// silently outside the repo. The repo markers must be things the files
+// allow-list never ships: tsconfig.json (dev typecheck input) and .git.
 if (!existsSync(join(repoRoot, 'tsconfig.json')) || !existsSync(join(repoRoot, '.git'))) {
   process.exit(0)
 }
+// Second guard: npm runs `prepare` inside a throwaway clone when installing a
+// git dependency, and a root project install in a subdirectory walks up to
+// this package with INIT_CWD elsewhere. Only a direct root install (INIT_CWD
+// = repoRoot, or unset for `node scripts/...`) may link.
+const initCwd = process.env.INIT_CWD
+if (initCwd !== undefined && initCwd !== '') {
+  try {
+    if (realpathSync(initCwd) !== realpathSync(repoRoot)) process.exit(0)
+  } catch {
+    process.exit(0)
+  }
+}
 const scopeDir = join(repoRoot, 'node_modules', '@deepseek-ai')
 
 /** The global dsh package's own `node_modules/@deepseek-ai` closure dir. */

package/scripts/smoke-boot.mjs

@@ -9,7 +9,11 @@
 //      blocks dependency lifecycle scripts by default, which is exactly how
 //      the #2-class tarball breakage (postinstall → unshipped file) stayed
 //      invisible to every pnpm-based install; npm-class clients (the desktop
-//      plugin manager) are the ones that run it.
+//      plugin manager) are the ones that run it. Since the pnpm 11
+//      strictDepBuilds fix the tarball has no install hook to run (the dev
+//      linker rides `prepare`, which npm/pnpm skip for registry
+//      dependencies), so this proves the hook-free package installs and boots
+//      clean.
 //   4. `dsh --profile smoke --dump-config` must compose the plugin into the
 //      tree (mount/patch-layer proof)
 //   5. a real boot under a timeout must load the plugin tree without a