@bushizhanghan/dsh-publish-gate 0.1.5 → 0.1.6

package/README.md

@@ -90,7 +90,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 ## 开发
 
 ```sh
-node --test    # 26 个测试（含 4 个真实插件作 fixture）
+node --test    # 27 个测试（含 4 个真实插件作 fixture）
 ```
 
 ## License

package/lib/engine.js

@@ -519,7 +519,10 @@ export function checkEntrySource(dir) {
   if (!/export\s+(?:const|function)\s+apply/.test(text)) out.push(F('no-apply-export', 'error', 'lib/index.js does not export `apply`', 'cordis calls apply(ctx, config); without it nothing happens.', 'Add `export function apply(ctx, config) {}`.'))
   if (!/export\s+const\s+inject/.test(text)) out.push(F('no-inject', 'warn', 'lib/index.js does not export `inject`', 'Without an inject list the service is resolved late and `ctx.tools` may be undefined when apply runs.', 'Add `export const inject = [\'tools\']`.'))
   // require() in ESM blows up at load
-  if (/^\s*const\s+\w+\s*=\s*require\(/m.test(text)) {
+  // Any call form, including destructuring and a member access: `const {a} = require(…)`,
+  // `x = require(…)`, `require('node:fs').readFileSync`. A bare `require(` inside a
+  // string is not matched because the regex requires a call with a quote argument.
+  if (/\brequire\s*\(\s*['"`]/.test(text)) {
     out.push(
       F(
         'require-in-esm',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bushizhanghan/dsh-publish-gate",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Helps DSH plugin AUTHORS publish their plugins: a one-command gate that turns every silent failure in the publish path into a deterministic check — package.json completeness, BOM, YAML/JSON parseability, junction and patch insert correctness, npm scope permissions, GitHub repo and token state, market entry format, LICENSE/README, test suite. 帮助插件作者一键发布：写完插件后跑一遍门禁，把发布链路上的每个静默坑变成确定性检查，然后 GitHub + npm + 市场一键三连。",
   "type": "module",
   "main": "lib/index.js",