@bushizhanghan/dsh-publish-gate 0.1.5 → 0.2.0

package/README.md

@@ -4,15 +4,18 @@
 >
 > 发布一个 DSH 插件有七步，每一步都有一个**直到你付出代价才说话的坑**：`files` 忘了 `lib/` 于是发出去一个空包、PowerShell 写下的 BOM 让 `JSON.parse` 报一个不提 BOM 的错、patch 的 insert 行缩进错了于是插件装上了但**永远不加载**、裸包名让 granular token 收到一个既不说 token 也不说 scope 的 403。这个插件把整条链路的每个静默坑变成一条确定性检查。
 
-六个 agent 工具：全量门禁、patch 专项、市场条目校验、版本推进、多插件体检、发布命令清单。
+八个 agent 工具：全量门禁、运行时注册检查、发后校验、patch 专项、市场条目校验、版本推进、多插件体检、发布命令清单。
+
+门禁分三层：**清单层**看 package.json / patch / 入口源码，**产物层**真的跑一遍 `npm pack --dry-run` 看 npm 到底会发出什么，**运行时层**在独立子进程里 `import()` 入口并 `apply(ctx)` 一遍，看它到底注册了什么。
 
 ## 典型用法（写完插件后）
 
 ```
 我写好了一个新插件 X，帮我发出去
-→ agent 先调 publish_gate(X) 查所有静默坑
+→ agent 先调 publish_gate(X) 查所有静默坑（清单 + 产物 + 运行时三层）
 → 有 blocker 就修，修完再跑
 → 全绿后调 publish_gate_commands(X, {version}) 拿 GitHub/npm/市场三步的命令，照抄执行
+→ 发完调 publish_gate_verify(X) 确认 registry 上那包的 shasum 和你本地这份一致
 ```
 
 ## 安装
@@ -26,11 +29,13 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 
 | 工具 | 作用 |
 |---|---|
-| `publish_gate` | 全量门禁：静态检查 + 网络检查，返回 `safeToPublish` |
+| `publish_gate` | 全量门禁：清单 + 产物 + 运行时 + 网络，返回 `safeToPublish`（`skipPack` / `skipTools` / `skipNetwork` 可逐层跳过） |
+| `publish_gate_tools` | 只跑运行时层：在子进程里 `apply(ctx)`，看注册了哪些工具、有没有缺 `execute`、重名、`presentCall` 抛错、`card` 用了宿主不认识的值 |
+| `publish_gate_verify` | 发后校验：`npm pack --dry-run` 的 shasum 和 registry 上的 `dist.shasum` 逐字节比，比版本号猜准 |
 | `publish_gate_patch` | 只查 `cordis.patch.yml`——「插件装了但工具没出现」的第一个怀疑对象 |
 | `publish_gate_market` | 校验市场条目 YAML（url/name/category/description 双语） |
 | `publish_gate_next_version` | 当前版本、是否已被 registry 占用、建议 bump 到多少（本地比 npm 旧时从 npm 的 latest 往上加，不会推荐一个已被占用的版本） |
-| `publish_gate_doctor` | 扫整个目录，按 blocker 数排序，看哪个插件还不能发 |
+| `publish_gate_doctor` | 扫整个目录，按 blocker 数排序，附带每个插件的真实包体积，看哪个还不能发 |
 | `publish_gate_commands` | 按顺序列出发布命令，并标出这台机器已经走到哪一步 |
 
 ## 检查清单
@@ -58,7 +63,39 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | `registry-unreachable` | registry 回了 500/429 —— 版本检查**没跑**，所以别把它当干净 |
 
 ### 值得在发布前知道的（warn / info）
-`unscoped-name`（granular token 的 403）、`repo-missing`、`patch-name-unresolvable`（junction 放错层级）、`no-readme` / `readme-no-install` / `readme-no-profile`、`license-mismatch`、`no-tests` / `no-test-files` / `no-test-script`、`no-engines`、`bad-repo-url`、`no-git` / `no-gitignore`，以及市场条目的 `market-*` 全系列。
+`unscoped-name`（granular token 的 403）、`repo-missing`、`patch-name-unresolvable`（junction 放错层级）、`no-readme` / `readme-no-install` / `readme-no-profile`、`license-mismatch`、`no-tests` / `no-test-files` / `no-test-script`、`no-engines`、`bad-repo-url`、`no-git` / `no-gitignore`、`readme-tool-undocumented`（README 没提这个工具）/ `readme-test-count`（README 写的测试数和真实数不一致），以及市场条目的 `market-*` 全系列。
+
+### 产物层：npm 到底会发出什么
+
+清单层只看 `files` 字段，而 npm 有它自己的规矩（`main` / `exports` 指向的文件强制入包、README/LICENSE/package.json 强制入包）。所以这一层真的跑一遍 `npm pack --dry-run --json --ignore-scripts`，读它返回的文件清单和体积。
+
+| 规则 | 抓什么 |
+|---|---|
+| `pack-omits-lib` | tarball 里没有 `lib/`——发出去是空包，**npm 不警告** |
+| `pack-omits-patch` | `dsh.bundle.patch` 指的文件没进 tarball，装上不挂载 |
+| `pack-omits-readme` / `pack-omits-license` | README / LICENSE 没进包 |
+| `pack-oversize` | 解包 >5 MB 是 error、>1 MB 是 warn，并点名最大的三个文件。测试 fixture 是常见元凶——我的一个插件曾把 20 MB 的算例目录发上去，装了它的人每次都要下 20 MB |
+| `pack-unexpected-dir` | `fixtures` / `test` / `tests` / `src` 被打进包里 |
+| `pack-script-build` | 有 `prepack` / `prepare`：dry run 用了 `--ignore-scripts`，这次清单**不代表**真正发布时的产物 |
+| `pack-unavailable` | npm 跑不起来（warn）——产物层没跑，别把它当干净 |
+
+### 运行时层：`apply` 之后到底注册了什么
+
+前两层都是读文件，读不出「装上能不能用」。这一层在独立子进程里 `import()` 入口、用假 ctx 调一次 `apply(ctx)`，把 `ctx.tools.register` 收到的每一条拿回来检查。20 秒超时，你的插件代码不在宿主进程里跑。
+
+| 规则 | 抓什么 |
+|---|---|
+| `entry-import-failed` | `import()` 入口就抛——装上必定不加载 |
+| `apply-threw` | `apply(ctx)` 抛 |
+| `tool-none-registered` | 入口能加载，但一个工具都没注册 |
+| `tool-missing-execute` / `tool-missing-output-schema` | 注册项缺 `execute` / `output.schema`（宿主用 schema 校验返回值，缺了等于没校验） |
+| `tool-duplicate-name` | 两个工具同名，后者静默覆盖前者 |
+| `tool-present-call-throws` | `presentCall` 抛——调用记录渲染时炸 |
+| `tool-bad-card-kind` | `card: 'generic'` 的 `kind` 不在宿主认识的那一组里（`other` / `execute` / `search` / `read` / `edit` / `delete` / `fetch`）。注册不报错，卡片渲染坏掉——我五个插件一起踩过 |
+
+### 代码卫生
+
+`lib-debugger`（error）、`lib-console-log`、`lib-hardcoded-path`（`C:\Users\...` 硬编码）、`lib-url-pathname`（`new URL(...).pathname` 在中文路径上会百分号编码，得用 `fileURLToPath`）、`inject-missing-<service>`（用了 `ctx.tools` / `ctx.web` / `ctx.webServer` / `ctx.setInterval` 却没写进 `inject`，服务永远注入不进来）。
 
 ## 一个真实的例子
 
@@ -82,15 +119,20 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 
 ## 设计取舍
 
-- **静态检查不需要网络**：`publish_gate` 默认带网络检查（版本占用、repo 存在），但 `skipNetwork` 让它在离线和 CI 里同样可用；网络失败一律降级成「未知」，不让门禁本身变成障碍。
-- **只读**：修不修由你定，每条 finding 都带 `fix` 文案。门禁的职责是把话说清楚，不是替你做决定。
-- **确定性**：全部规则是文件内容或 registry/GitHub API 检查，没有 LLM 调用——一条规则答错，你可以直接看规则。
-- **自举**：这个插件的测试把四个已发布插件当 fixture，断言它们在门禁下零 blocker；规则如果有任何误报倾向，测试先炸。
+- **三层，按代价排序**：清单层最便宜、先跑；产物层要起一个 npm（约 1–2 秒）；运行时层要起一个 node 子进程。前一层没过的错误通常值得先修，但三层都会跑完——一次给全，比来回问好。
+- **产物层用 `npm pack --dry-run`，不用自己推 `files` 规则**：npm 的入包规则（`main` / `exports` 强制入包、README/LICENSE 强制入包、`.npmignore` 优先级）比自己实现的准。唯一的代价是它需要这台机器上有 npm，所以跑不起来时降级成 `pack-unavailable` 而不是报错。
+- **运行时层真的执行插件代码**：这是唯一能回答「装上能不能用」的办法。代价是 `apply()` 会跑，所以：假 ctx 是 Proxy 不落盘、20 秒硬超时、`skipTools` 一键跳过。
+- **`--ignore-scripts`**：dry run 不跑 `prepack`，否则检查会触发一次构建。代价是清单可能和真实产物不同，所以有 `pack-script-build` 把这件事说出来。
+- **`publish_gate_verify` 比 shasum，不比版本号**：版本号相同而字节不同（发了又改、或本地根本没发）是最常见的自欺。`npm pack --dry-run` 的 shasum 和 registry 的 `dist.shasum` 是同一套算法，所以这个比较是精确的。
+- **只读**：修不修由你定，每条 finding 都带 `fix` 文案。门禁的职责是把话说清楚，不是替你做决定——所以没有 `--fix`。
+- **确定性**：全部规则是文件内容、子进程或 registry/GitHub API 检查，没有 LLM 调用——一条规则答错，你可以直接看规则。
+- **自举**：这个插件的测试把九个已发布插件当 fixture，断言它们在门禁下零 blocker；规则如果有任何误报倾向，测试先炸。
 
 ## 开发
 
 ```sh
-node --test    # 26 个测试（含 4 个真实插件作 fixture）
+node --test                      # 44 个引擎单测
+node test/integration.test.mjs   # 21 条集成断言（9 个真实插件作 fixture）
 ```
 
 ## License

package/lib/engine.js

@@ -6,9 +6,12 @@
 // unscoped npm name that returned E403, a git push that failed on the network
 // while the REST API worked. All of them are silent until the moment they cost
 // you a publish, so they are all checkable before you spend it.
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
-import { join, resolve } from 'node:path'
-import { homedir } from 'node:os'
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { join, relative } from 'node:path'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+
+const runFile = promisify(execFile)
 
 const safeRead = (p) => {
   try {
@@ -25,6 +28,42 @@ const safeText = (p) => {
 
 export const F = (rule, severity, title, detail, fix) => ({ rule, severity, title, detail, fix })
 
+/** package.json without the BOM trap. Null when it is missing or unparseable. */
+export function readPkgJson(dir) {
+  const text = safeText(join(dir, 'package.json'))
+  if (text === null) return null
+  try {
+    return JSON.parse(text.replace(/^\uFEFF/, ''))
+  } catch {
+    return null
+  }
+}
+
+/** Every file under root matching filter, skipping node_modules. */
+function walkFiles(root, filter, acc = []) {
+  let entries
+  try {
+    entries = readdirSync(root, { withFileTypes: true })
+  } catch {
+    return acc
+  }
+  for (const e of entries) {
+    const p = join(root, e.name)
+    if (e.isDirectory()) {
+      if (e.name !== 'node_modules') walkFiles(p, filter, acc)
+    } else if (filter.test(e.name)) acc.push(p)
+  }
+  return acc
+}
+
+/** Drop a trailing // comment so a commented-out line is not reported as live code. */
+const stripComment = (line) => line.replace(/\/\/.*$/, '')
+
+const bytesHuman = (n) => {
+  const v = Number(n) || 0
+  return v >= 1_048_576 ? `${(v / 1_048_576).toFixed(1)} MB` : v >= 1024 ? `${Math.round(v / 1024)} kB` : `${v} B`
+}
+
 // =====================================================================
 // package.json
 // =====================================================================
@@ -163,9 +202,13 @@ export function checkPackageJson(dir) {
     )
   }
 
-  // repository.url — GitHub Actions and the market link use it
-  if (typeof json.repository === 'string' && /^git\+/.test(json.repository) === false && !/github\.com/.test(json.repository)) {
-    out.push(F('bad-repo-url', 'warn', `repository "${json.repository}" is not a github.com URL`, 'The market listing and issue links will not resolve.', 'Use "git+https://github.com/<owner>/<repo>.git".'))
+  // repository.url — GitHub Actions and the market link use it. Both shapes
+  // occur: a bare string, and the {type,url} object npm documents. The object
+  // form used to slip through, because the check tested `typeof === 'string'`
+  // and every plugin in this workspace writes the object form.
+  const repoRaw = typeof json.repository === 'string' ? json.repository : json.repository?.url
+  if (typeof repoRaw === 'string' && !/github\.com/.test(repoRaw)) {
+    out.push(F('bad-repo-url', 'warn', `repository "${repoRaw}" is not a github.com URL`, 'The market listing and issue links will not resolve.', 'Use "git+https://github.com/<owner>/<repo>.git".'))
   }
 
   // engines — a too-low floor lets the install succeed and then crash
@@ -197,16 +240,7 @@ export function checkPatchYml(dir) {
   }
 
   // find insert rows and the package name they mount
-  const pkgJson = (() => {
-    const t = safeText(join(dir, 'package.json'))
-    if (!t) return null
-    try {
-      return JSON.parse(t.replace(/^\uFEFF/, ''))
-    } catch {
-      return null
-    }
-  })()
-  const name = pkgJson?.name
+  const name = readPkgJson(dir)?.name
 
   const lines = text.split('\n')
   const insertRows = []
@@ -337,14 +371,7 @@ export function checkDocs(dir) {
   if (!existsSync(join(dir, 'LICENSE'))) {
     out.push(F('no-license', 'error', 'LICENSE is missing', 'npm warns on publish and the market listing shows an unknown license.', 'Add a LICENSE file (MIT is the ecosystem norm).'))
   } else {
-    const json = (() => {
-      const t = safeText(join(dir, 'package.json'))
-      try {
-        return t ? JSON.parse(t.replace(/^\uFEFF/, '')) : null
-      } catch {
-        return null
-      }
-    })()
+    const json = readPkgJson(dir)
     if (json?.license && json.license !== 'SEE LICENSE IN LICENSE' && !safeText(join(dir, 'LICENSE'))?.includes(json.license)) {
       out.push(F('license-mismatch', 'warn', `package.json says "${json.license}" but the LICENSE text does not mention it`, 'A reviewer reads the mismatch as sloppiness at best.', 'Align them.'))
     }
@@ -356,16 +383,9 @@ export function checkDocs(dir) {
 // npm / GitHub / market state
 // =====================================================================
 
-export function checkNpmState(dir, { token, registry = 'https://registry.npmjs.org' } = {}) {
+export function checkNpmState(dir) {
   const out = []
-  const json = (() => {
-    const t = safeText(join(dir, 'package.json'))
-    try {
-      return t ? JSON.parse(t.replace(/^\uFEFF/, '')) : null
-    } catch {
-      return null
-    }
-  })()
+  const json = readPkgJson(dir)
   if (!json?.name) return out
 
   // unscoped + granular token = E403 on the PUT, discovered the hard way
@@ -381,11 +401,8 @@ export function checkNpmState(dir, { token, registry = 'https://registry.npmjs.o
     )
   }
 
-  // is the version already live? publishing the same version twice is a 403
-  if (token) {
-    const url = `${registry.replace(/\/$/, '')}/${json.name.replace('/', '%2f')}`
-    out.push(...[]) // filled asynchronously by the caller
-  }
+  // Whether the version is already live needs the network: that is
+  // checkVersionTaken / latestPublished. Nothing synchronous belongs here.
   return out
 }
 
@@ -519,7 +536,10 @@ export function checkEntrySource(dir) {
   if (!/export\s+(?:const|function)\s+apply/.test(text)) out.push(F('no-apply-export', 'error', 'lib/index.js does not export `apply`', 'cordis calls apply(ctx, config); without it nothing happens.', 'Add `export function apply(ctx, config) {}`.'))
   if (!/export\s+const\s+inject/.test(text)) out.push(F('no-inject', 'warn', 'lib/index.js does not export `inject`', 'Without an inject list the service is resolved late and `ctx.tools` may be undefined when apply runs.', 'Add `export const inject = [\'tools\']`.'))
   // require() in ESM blows up at load
-  if (/^\s*const\s+\w+\s*=\s*require\(/m.test(text)) {
+  // Any call form, including destructuring and a member access: `const {a} = require(…)`,
+  // `x = require(…)`, `require('node:fs').readFileSync`. A bare `require(` inside a
+  // string is not matched because the regex requires a call with a quote argument.
+  if (/\brequire\s*\(\s*['"`]/.test(text)) {
     out.push(
       F(
         'require-in-esm',
@@ -554,14 +574,7 @@ export function checkTests(dir) {
   })()
   const hasTest = testFiles.length > 0
   if (!hasTest) out.push(F('no-test-files', 'warn', 'test/ has no *.test.mjs or *.spec.mjs', 'Add at least an engine test so the rules are exercised.', 'Add test/engine.test.mjs.'))
-  const pkgJson = (() => {
-    const t = safeText(join(dir, 'package.json'))
-    try {
-      return t ? JSON.parse(t.replace(/^\uFEFF/, '')) : null
-    } catch {
-      return null
-    }
-  })()
+  const pkgJson = readPkgJson(dir)
   if (!pkgJson?.scripts?.test) out.push(F('no-test-script', 'info', 'package.json has no "test" script', 'npm test does nothing, so CI and reviewers cannot run your checks.', 'Add "scripts": { "test": "node --test" }.'))
   // Node 22+ loads a positional argument to --test as a module path instead of
   // globbing it, so `node --test test/` dies with MODULE_NOT_FOUND on every run
@@ -572,6 +585,430 @@ export function checkTests(dir) {
   return out
 }
 
+// =====================================================================
+// Artifact truth: what npm will actually put in the tarball
+// =====================================================================
+
+/**
+ * `npm pack --dry-run` is the only honest answer to "what ships?". Reading
+ * `files` from package.json is a guess: npm merges it with .npmignore, adds
+ * package.json/README/LICENSE whether or not you listed them, and honours
+ * nested .gitignore files. Every number below comes from npm itself.
+ *
+ * --ignore-scripts is deliberate. A `prepack` hook (tsdown, tsc, rollup) would
+ * run a real build here and overwrite hand-edited output; that case is
+ * reported as `pack-script-build` instead of being silently executed.
+ */
+export async function checkPack(dir, opts = {}) {
+  const out = []
+  const warnBytes = opts.warnUnpackedBytes ?? 1_000_000
+  const maxBytes = opts.maxUnpackedBytes ?? 5_000_000
+  const json = readPkgJson(dir)
+
+  let pack = null
+  try {
+    // On Windows npm is npm.cmd, which Node refuses to exec without a shell;
+    // the command string is a fixed literal, so cmd.exe adds no injection
+    // surface. Everywhere else npm is an ordinary executable.
+    const isWin = process.platform === 'win32'
+    const cmd = isWin ? process.env.ComSpec || 'cmd.exe' : 'npm'
+    const args = isWin ? ['/d', '/s', '/c', 'npm pack --dry-run --json --ignore-scripts'] : ['pack', '--dry-run', '--json', '--ignore-scripts']
+    const { stdout } = await runFile(cmd, args, {
+      cwd: dir,
+      timeout: opts.timeoutMs ?? 60_000,
+      maxBuffer: 8 * 1024 * 1024,
+      windowsHide: true,
+    })
+    const parsed = JSON.parse(stdout)
+    pack = Array.isArray(parsed) ? parsed[0] : parsed
+  } catch (error) {
+    out.push(
+      F(
+        'pack-unavailable',
+        'warn',
+        'npm pack --dry-run did not run',
+        `The tarball check did not run, so this is NOT a clean artifact report. ${String(error?.message || error).slice(0, 140)}`,
+        'Run `npm pack --dry-run` by hand in the plugin directory.',
+      ),
+    )
+    return { findings: out, pack: null }
+  }
+
+  const files = Array.isArray(pack.files) ? pack.files : []
+  const paths = files.map((f) => String(f.path))
+  const has = (prefix) => paths.some((p) => p === prefix || p.startsWith(`${prefix}/`))
+
+  if (!has('lib')) {
+    out.push(
+      F(
+        'pack-omits-lib',
+        'error',
+        'the tarball contains no lib/ files',
+        `npm packed ${files.length} file(s) and none are under lib/: the published plugin has no code at all.`,
+        'Add "lib" to files.',
+      ),
+    )
+  }
+  if (json?.dsh?.bundle?.patch && !paths.includes(String(json.dsh.bundle.patch).replace(/^\.\//, ''))) {
+    out.push(
+      F(
+        'pack-omits-patch',
+        'error',
+        `the tarball does not contain ${json.dsh.bundle.patch}`,
+        'dsh.bundle.patch names a file npm did not pack, so the installed plugin has nothing to mount.',
+        'Add it to files.',
+      ),
+    )
+  }
+  if (!paths.includes('README.md')) out.push(F('pack-omits-readme', 'warn', 'the tarball has no README.md', 'npm renders it as the package page and the market reviewer reads it.', 'Add "README.md" to files.'))
+  if (!paths.includes('LICENSE')) out.push(F('pack-omits-license', 'warn', 'the tarball has no LICENSE', 'npm warns on publish and consumers get an unlicensed package.', 'Add "LICENSE" to files.'))
+
+  const unpacked = Number(pack.unpackedSize ?? 0)
+  if (unpacked > warnBytes) {
+    const biggest = [...files]
+      .sort((a, b) => (b.size ?? 0) - (a.size ?? 0))
+      .slice(0, 3)
+      .map((f) => `${f.path} ${bytesHuman(f.size)}`)
+      .join(', ')
+    out.push(
+      F(
+        'pack-oversize',
+        unpacked > maxBytes ? 'error' : 'warn',
+        `the tarball unpacks to ${bytesHuman(unpacked)}`,
+        `Every install downloads that. Largest: ${biggest}. Test fixtures and case data are the usual cause — they belong in the repo, not the package.`,
+        'Move the data out of the package, or narrow "files".',
+      ),
+    )
+  }
+
+  for (const d of ['fixtures', 'test', 'tests', 'src']) {
+    if (has(d)) out.push(F('pack-unexpected-dir', 'warn', `the tarball includes ${d}/`, 'A development directory is being published: it bloats the install and ships code nobody runs.', `Add "!${d}" to files if it is not meant to ship.`))
+  }
+
+  const scripts = json?.scripts || {}
+  const buildHook = scripts.prepack ? 'prepack' : scripts.prepare ? 'prepare' : null
+  if (buildHook) {
+    out.push(
+      F(
+        'pack-script-build',
+        'warn',
+        `package.json runs "${buildHook}" on publish`,
+        'This dry run used --ignore-scripts, so it describes the directory as it is now, not what a real `npm publish` would build. If the hook rewrites lib/, the published files differ from the ones you just checked.',
+        'Run the build, then re-run this gate, then publish.',
+      ),
+    )
+  }
+
+  return { findings: out, pack }
+}
+
+// =====================================================================
+// Runtime truth: does the entry load, and what does it register?
+// =====================================================================
+
+/**
+ * The card kinds the host actually renders. Read out of the built-in tools in
+ * the DSH bundle, every one of which returns { card: "generic", title, kind }
+ * with kind in this set. A plugin that writes kind: "tool" still registers and
+ * still runs — only the transcript card renders wrong, which is why nobody
+ * notices until a user mentions it.
+ */
+export const CARD_KINDS = new Set(['other', 'execute', 'search', 'read', 'edit', 'delete', 'fetch'])
+
+// Runs in a child process: importing a plugin executes its module body, and a
+// top-level throw or an infinite loop must not take the gate down with it.
+const RUNNER = `
+import { pathToFileURL } from 'node:url'
+import { join } from 'node:path'
+const dir = process.argv[1]
+const registered = []
+const noopService = () => new Proxy(function () {}, {
+  get: (target, prop) => {
+    // Own properties win, or ctx.tools would resolve to another no-op proxy
+    // and every registration would vanish.
+    if (Reflect.has(target, prop)) return Reflect.get(target, prop)
+    if (prop === 'then') return undefined
+    if (prop === Symbol.toPrimitive) return () => ''
+    if (prop === 'toString') return () => '[ctx]'
+    return noopService()
+  },
+  apply: () => noopService(),
+})
+const ctx = noopService()
+ctx.tools = {
+  register: (def) => {
+    let card = null
+    if (def && typeof def.presentCall === 'function') {
+      try {
+        const c = def.presentCall({})
+        card = c && typeof c.kind === 'string' ? c.kind : null
+      } catch (error) {
+        card = { threw: String((error && error.message) || error) }
+      }
+    }
+    registered.push({
+      name: typeof def?.name === 'string' ? def.name : null,
+      hasExecute: typeof def?.execute === 'function',
+      hasOutputSchema: Boolean(def && def.output && def.output.schema),
+      cardKind: card,
+    })
+  },
+}
+const emit = (payload) => process.stdout.write('\\n@@PG@@' + JSON.stringify(payload) + '\\n')
+let stage = 'import'
+try {
+  const mod = await import(pathToFileURL(join(dir, 'lib', 'index.js')).href)
+  stage = 'apply'
+  if (typeof mod.apply !== 'function') throw new Error('lib/index.js does not export apply')
+  await mod.apply(ctx, {})
+  emit({ ok: true, tools: registered })
+} catch (error) {
+  emit({ ok: false, stage, error: String((error && error.message) || error) })
+}
+process.exit(0)
+`
+
+export async function checkToolRegistrations(dir, opts = {}) {
+  const out = []
+  let payload = null
+  try {
+    const { stdout } = await runFile(process.execPath, ['--input-type=module', '-e', RUNNER, dir], {
+      timeout: opts.timeoutMs ?? 20_000,
+      maxBuffer: 4 * 1024 * 1024,
+      windowsHide: true,
+    })
+    const line = String(stdout).split('\n').filter((l) => l.startsWith('@@PG@@')).pop()
+    if (!line) throw new Error('the child printed no result')
+    payload = JSON.parse(line.slice(6))
+  } catch (error) {
+    out.push(
+      F(
+        'tools-unavailable',
+        'warn',
+        'the isolated import did not finish',
+        `The runtime check did not run, so this is NOT a clean registration report. ${String(error?.message || error).slice(0, 140)}`,
+        'Load the plugin once in a profile and watch for a bundle error.',
+      ),
+    )
+    return { findings: out, tools: null }
+  }
+
+  if (!payload.ok) {
+    out.push(
+      F(
+        payload.stage === 'import' ? 'entry-import-failed' : 'apply-threw',
+        'error',
+        payload.stage === 'import' ? 'lib/index.js throws when imported' : 'apply(ctx) throws',
+        `Stage "${payload.stage}": ${payload.error}. The plugin installs and then fails to load; the host reports it as a bundle error with none of your own diagnostics.`,
+        'Fix the throw — this gate reproduces it in isolation.',
+      ),
+    )
+    return { findings: out, tools: null }
+  }
+
+  const tools = Array.isArray(payload.tools) ? payload.tools : []
+  if (tools.length === 0) {
+    out.push(
+      F(
+        'tool-none-registered',
+        'warn',
+        'apply() registered no tools',
+        'A plugin that registers nothing is only useful if it adds a client panel or a service. If you expected tools, ctx.tools was undefined when apply ran.',
+        "Check `export const inject = ['tools']`.",
+      ),
+    )
+  }
+
+  const seen = new Set()
+  for (const t of tools) {
+    const label = t.name || '(unnamed)'
+    if (!t.name) out.push(F('tool-missing-name', 'error', 'a registered tool has no name', 'The host cannot address a tool without a name.', 'Give it a name.'))
+    else if (seen.has(t.name)) out.push(F('tool-duplicate-name', 'error', `two tools are registered as "${t.name}"`, 'One registration is dropped or shadows the other, and which one wins is not something you control.', 'Rename one.'))
+    else seen.add(t.name)
+
+    if (!t.hasExecute) out.push(F('tool-missing-execute', 'error', `tool "${label}" has no execute function`, "It appears in the model's tool list and throws the moment it is called.", 'Add execute(args, exec).'))
+    if (!t.hasOutputSchema) out.push(F('tool-missing-output-schema', 'warn', `tool "${label}" declares no output.schema`, 'The host validates tool output against output.schema; without one the contract is implicit and a malformed result reaches the caller.', "Add output: { schema: { type: 'json' }, render }."))
+    if (t.cardKind && typeof t.cardKind === 'object') {
+      out.push(F('tool-present-call-throws', 'error', `tool "${label}" presentCall() throws`, `presentCall renders the transcript card and must be total: ${t.cardKind.threw}`, 'Do not read args fields that may be absent.'))
+    } else if (typeof t.cardKind === 'string' && !CARD_KINDS.has(t.cardKind)) {
+      out.push(
+        F(
+          'tool-bad-card-kind',
+          'error',
+          `tool "${label}" renders card kind "${t.cardKind}", which the host does not know`,
+          `The host only understands ${[...CARD_KINDS].join(', ')}. An unknown kind does not throw at registration — the card just renders wrong, which is why it survives to release.`,
+          "Use kind: 'read' for a read-only tool.",
+        ),
+      )
+    }
+  }
+  return { findings: out, tools }
+}
+
+// =====================================================================
+// Source hygiene and service wiring
+// =====================================================================
+
+export function checkLibHygiene(dir) {
+  const out = []
+  for (const file of walkFiles(join(dir, 'lib'), /\.(?:js|mjs|cjs)$/)) {
+    const text = safeText(file)
+    if (text === null) continue
+    const rel = relative(dir, file).replace(/\\/g, '/')
+    const lines = text.split('\n')
+    for (let i = 0; i < lines.length; i++) {
+      const code = stripComment(lines[i])
+      const at = `${rel}:${i + 1}`
+      if (/\bconsole\.log\s*\(/.test(code)) out.push(F('lib-console-log', 'warn', `${at} calls console.log`, 'Tool output is the channel; a stray console.log lands in the host log and never reaches the model. Harmless, but it is debug residue in a published file.', 'Delete it, or use console.error if it is a real warning.'))
+      if (/(?:^|[;{}\s])debugger\s*;?\s*$/.test(code)) out.push(F('lib-debugger', 'error', `${at} has a debugger statement`, 'In a published package a debugger statement stops every consumer who reaches that path.', 'Remove it.'))
+      if (/(?:[A-Za-z]:[\\/]{1,2}Users[\\/]|\/Users\/)/.test(code)) out.push(F('lib-hardcoded-path', 'warn', `${at} contains an absolute path from this machine`, "It does not exist on the consumer's machine, so that code path silently fails there.", 'Resolve it from homedir() or ctx instead.'))
+    }
+    if (/new\s+URL\s*\([\s\S]{0,240}?\)\s*\.pathname/.test(text)) {
+      out.push(
+        F(
+          'lib-url-pathname',
+          'warn',
+          `${rel} reads .pathname from a URL`,
+          'pathname percent-encodes non-ASCII, so a plugin directory under a Chinese path becomes %E6%8F%92... and every path derived from it is wrong. This cost a test suite a day.',
+          'Use fileURLToPath(new URL(...)) instead.',
+        ),
+      )
+    }
+  }
+  return out
+}
+
+const INJECT_HINTS = [
+  ['tools', /ctx\.tools\b/],
+  ['web', /ctx\.web\b/],
+  ['webServer', /ctx\.webServer\b/],
+  ['timer', /ctx\.(?:setInterval|setTimeout|clearInterval|clearTimeout)\b/],
+]
+
+export function checkInjectCoverage(dir) {
+  const out = []
+  const text = safeText(join(dir, 'lib', 'index.js'))
+  if (text === null) return out
+  const code = text.split('\n').map(stripComment).join('\n')
+  const declared = /export\s+const\s+inject\s*=\s*\[([^\]]*)\]/.exec(code)
+  if (!declared) return out // checkEntrySource already reports a missing inject
+  const names = new Set([...declared[1].matchAll(/['"`]([^'"`]+)['"`]/g)].map((m) => m[1]))
+  for (const [service, re] of INJECT_HINTS) {
+    if (!re.test(code) || names.has(service)) continue
+    out.push(
+      F(
+        `inject-missing-${service}`,
+        'error',
+        `lib/index.js uses ctx.${service} but does not inject "${service}"`,
+        'cordis resolves injected services before apply runs. Without the inject entry the property may still be undefined at that moment, so the plugin throws or silently registers nothing — and it works on your machine only if another plugin happened to pull the service in first.',
+        `Add "${service}" to export const inject.`,
+      ),
+    )
+  }
+  return out
+}
+
+export function checkReadmeTruth(dir, toolNames = null) {
+  const out = []
+  const text = safeText(join(dir, 'README.md'))
+  if (text === null) return out
+
+  if (Array.isArray(toolNames) && toolNames.length > 0) {
+    const missing = toolNames.filter((n) => n && !text.includes(n))
+    if (missing.length > 0) {
+      out.push(
+        F(
+          'readme-tool-undocumented',
+          'warn',
+          `README does not name ${missing.length} registered tool(s)`,
+          `Registered but never mentioned: ${missing.join(', ')}. A reader cannot discover them, and the market reviewer reads the README, not the source.`,
+          'Add them to the tool table.',
+        ),
+      )
+    }
+  }
+
+  // The boundary belongs to the English form only: a Chinese character is not
+  // a word character, so `单测\b` never matches and "27 个单测。" was invisible.
+  const claimed = /(\d+)\s*(?:个单测|unit tests|tests\b)/.exec(text)
+  if (claimed) {
+    const actual = countTests(dir)
+    if (actual > 0 && Number(claimed[1]) !== actual) {
+      out.push(F('readme-test-count', 'info', `README claims ${claimed[1]} tests but test/ defines ${actual}`, 'A stale count is the first thing a careful reader checks, and being wrong there makes them distrust everything else.', `Update the README to ${actual}.`))
+    }
+  }
+  return out
+}
+
+function countTests(dir) {
+  let n = 0
+  for (const file of walkFiles(join(dir, 'test'), /\.(?:test|spec)\.(?:mjs|js|cjs)$/)) {
+    const text = safeText(file)
+    if (!text) continue
+    n += (text.match(/^\s*(?:test|it)\s*\(/gm) || []).length
+  }
+  return n
+}
+
+// =====================================================================
+// Post-publish: is the tarball on the registry the one you gated?
+// =====================================================================
+
+/**
+ * `npm pack --dry-run` and the registry's dist.shasum are directly
+ * comparable — verified against a real publish. So "did the thing I checked
+ * actually ship?" is an exact comparison, not a version-number guess.
+ */
+export async function checkPublishedMatches(name, version, localPack, { registry = 'https://registry.npmjs.org', timeoutMs = 8000 } = {}) {
+  const out = []
+  if (!name || !version) return out
+
+  let json = null
+  try {
+    const res = await fetch(`${registry.replace(/\/$/, '')}/${name.replace('/', '%2f')}`, {
+      headers: { accept: 'application/vnd.npm.install-v1+json' },
+      signal: AbortSignal.timeout(timeoutMs),
+    })
+    if (res.status === 404) return [F('publish-not-served', 'warn', `${name} is not on the registry`, 'Nothing has been published under this name yet.', 'npm publish --access public')]
+    if (!res.ok) return out // unreachable is unknown, not a failure
+    json = await res.json()
+  } catch {
+    return out
+  }
+
+  const dist = json?.versions?.[version]?.dist
+  if (!dist) {
+    return [F('publish-not-served', 'warn', `${name}@${version} is not on the registry`, `The live latest is ${json?.['dist-tags']?.latest ?? 'unknown'}. Either it was never published, or the registry has not finished processing it (a 202 then a 404 for a minute or two is normal).`, 'npm publish --access public')]
+  }
+
+  if (localPack?.shasum && dist.shasum && localPack.shasum !== dist.shasum) {
+    out.push(
+      F(
+        'publish-served-mismatch',
+        'error',
+        `${name}@${version} is published, but its tarball is not this directory`,
+        `registry shasum ${dist.shasum} (${bytesHuman(dist.unpackedSize)}, ${dist.fileCount} files) vs local ${localPack.shasum} (${bytesHuman(localPack.unpackedSize)}, ${(localPack.files || []).length} files). The version number is spent: npm will not let you overwrite it, and every install gets the older bytes.`,
+        `Bump to ${bumpPatch(version)} and publish again.`,
+      ),
+    )
+  } else {
+    out.push(F('publish-served', 'info', `${name}@${version} on the registry matches this directory`, `shasum ${dist.shasum}, ${bytesHuman(dist.unpackedSize)}, ${dist.fileCount} files — the tarball you gated is the one that shipped.`, null))
+  }
+  return out
+}
+
+/** The async half of the gate: everything that needs a subprocess or the network. */
+export async function runArtifactChecks(dir, opts = {}) {
+  const packResult = opts.skipPack ? { findings: [], pack: null } : await checkPack(dir, opts)
+  const toolResult = opts.skipTools ? { findings: [], tools: null } : await checkToolRegistrations(dir, opts)
+  const names = toolResult.tools ? toolResult.tools.map((t) => t.name).filter(Boolean) : null
+  return {
+    findings: [...packResult.findings, ...toolResult.findings, ...checkReadmeTruth(dir, names)],
+    pack: packResult.pack,
+    tools: toolResult.tools,
+  }
+}
+
 // =====================================================================
 // Orchestration
 // =====================================================================
@@ -580,6 +1017,8 @@ export function runStaticChecks(dir) {
     ...checkPackageJson(dir),
     ...checkPatchYml(dir),
     ...checkEntrySource(dir),
+    ...checkInjectCoverage(dir),
+    ...checkLibHygiene(dir),
     ...checkDocs(dir),
     ...checkTests(dir),
     ...checkNpmState(dir),
@@ -590,11 +1029,20 @@ export function runStaticChecks(dir) {
 const RULE_ORDER = [
   'missing-file', 'unreadable', 'utf8-bom', 'json-parse', 'yaml-bom', 'invalid-name', 'invalid-version',
   'missing-field', 'not-esm', 'files-omits-lib', 'files-omits-patch', 'no-exports', 'client-without-export',
-  'no-patch-file', 'no-insert-row', 'insert-wrong-indent', 'insert-missing-name', 'insert-name-mismatch',
+  'no-patch-file', 'no-insert-row', 'insert-missing-name', 'insert-name-mismatch',
   'patch-name-unresolvable', 'no-name-export', 'no-apply-export', 'no-inject', 'require-in-esm',
-  'no-license', 'license-mismatch', 'version-taken', 'registry-unreachable', 'market-empty', 'market-no-url', 'market-url-not-github',
+  'entry-import-failed', 'apply-threw', 'tools-unavailable',
+  'inject-missing-tools', 'inject-missing-web', 'inject-missing-webServer', 'inject-missing-timer',
+  'tool-missing-name', 'tool-duplicate-name', 'tool-missing-execute', 'tool-present-call-throws',
+  'tool-bad-card-kind', 'tool-missing-output-schema', 'tool-none-registered',
+  'lib-debugger', 'lib-console-log', 'lib-hardcoded-path', 'lib-url-pathname',
+  'pack-omits-lib', 'pack-omits-patch', 'pack-oversize', 'pack-omits-readme', 'pack-omits-license',
+  'pack-unexpected-dir', 'pack-script-build', 'pack-unavailable',
+  'no-license', 'license-mismatch', 'version-taken', 'registry-unreachable', 'publish-not-served',
+  'publish-served-mismatch', 'publish-served', 'market-empty', 'market-no-url', 'market-url-not-github',
   'market-no-name', 'market-name-shape', 'market-no-category', 'market-bad-category', 'market-no-desc',
   'market-no-en', 'market-no-zh', 'unscoped-name', 'no-git', 'no-readme', 'readme-no-install', 'readme-no-profile',
+  'readme-tool-undocumented', 'readme-test-count',
   'no-tests', 'no-test-files', 'no-test-script', 'no-engines', 'bad-repo-url', 'no-gitignore',
 ]
 

package/lib/index.js

@@ -15,12 +15,16 @@ import {
   checkMarketEntry,
   checkNpmState,
   checkPackageJson,
+  checkPack,
   checkPatchYml,
+  checkPublishedMatches,
   checkTests,
+  checkToolRegistrations,
   checkVersionTaken,
   compareVersions,
   latestPublished,
   renderReport,
+  runArtifactChecks,
   runStaticChecks,
 } from './engine.js'
 
@@ -85,18 +89,22 @@ export function apply(ctx, config = {}) {
     {
       name: 'publish_gate',
       description:
-        'Run the full pre-publish gate over a DSH plugin directory and report every blocker: package.json completeness (missing exports["."], files omitting lib/, no "type": "module"), UTF-8 BOM, JSON/YAML parse errors, cordis.patch.yml insert rows written at the wrong indent (the bug that makes a plugin install and never mount), insert name mismatches, missing entry exports, missing LICENSE or README install line, missing tests, unscoped npm names (the 403 you cannot diagnose), and — with network — versions already on the registry and missing GitHub repos. Deterministic: every rule is a file or API check, no LLM. Returns {ok, report, findings:[{rule,severity,title,detail,fix}], counts}.',
+        'Run the full pre-publish gate over a DSH plugin directory. Three layers. (1) Manifest: missing exports["."], files omitting lib/, no "type": "module", UTF-8 BOM, JSON/YAML parse errors, cordis.patch.yml insert rows at the wrong indent (the bug that makes a plugin install and never mount), insert name mismatches, missing entry exports, missing LICENSE or README install line, missing tests, unscoped npm names (the 403 you cannot diagnose). (2) Artifact: runs `npm pack --dry-run` and reads what npm will actually ship — lib/ missing from the tarball, a dsh.bundle.patch that never gets packed, oversize tarballs (test fixtures are the usual cause), dev directories shipping, and a prepack hook that means the dry run did not build. (3) Runtime: imports the entry in an isolated child process, calls apply(ctx) with a fake ctx, and reports a throwing import, a throwing apply, tools with no execute, duplicate tool names, a presentCall that throws, and card kinds the host does not render. Deterministic: every rule is a file, subprocess or API check, no LLM. Returns {ok, report, findings:[{rule,severity,title,detail,fix}], counts}.',
       parameters: {
         type: 'object',
         properties: {
           dir: { type: 'string', description: 'Plugin directory to gate. Defaults to the current working directory.' },
           skipNetwork: { type: 'boolean', description: 'Skip the npm registry and GitHub checks (default false).' },
+          skipPack: { type: 'boolean', description: 'Skip `npm pack --dry-run` (default false). Faster, but says nothing about the real tarball.' },
+          skipTools: { type: 'boolean', description: 'Skip the isolated import of the plugin entry (default false).' },
         },
       },
       async execute(args) {
         const dir = resolveDir(args.dir)
         if (!dir) return { ok: false, error: 'no plugin directory given and cwd has no package.json' }
         const findings = runStaticChecks(dir)
+        const artifact = await runArtifactChecks(dir, { skipPack: args.skipPack, skipTools: args.skipTools })
+        findings.push(...artifact.findings)
         if (!args.skipNetwork) findings.push(...(await networkGate(dir)))
         const counts = {
           error: findings.filter((f) => f.severity === 'error').length,
@@ -108,11 +116,66 @@ export function apply(ctx, config = {}) {
           blockers: counts.error,
           counts,
           findings,
+          tools: artifact.tools,
+          unpackedSize: artifact.pack?.unpackedSize ?? null,
           report: renderReport(findings, { title: `publish gate · ${dir}` }),
           safeToPublish: counts.error === 0,
         }
       },
     },
+    {
+      name: 'publish_gate_tools',
+      description:
+        'Import a plugin entry in an isolated child process, call apply(ctx) with a no-op context, and report what it actually registered. Catches the failures the manifest cannot show: the entry throws when imported, apply throws, a tool has no execute function, two tools share a name, presentCall throws, and a card kind the host does not render (the host only knows other/execute/search/read/edit/delete/fetch — anything else registers fine and renders a broken card). 20 s timeout, plugin code never runs in the host process. Returns {ok, tools:[{name,hasExecute,hasOutputSchema,cardKind}], findings, report}.',
+      parameters: {
+        type: 'object',
+        properties: {
+          dir: { type: 'string', description: 'Plugin directory.' },
+          timeoutMs: { type: 'number', description: 'Kill the child after this long (default 20000).' },
+        },
+      },
+      async execute(args) {
+        const dir = resolveDir(args.dir)
+        if (!dir) return { ok: false, error: 'no plugin directory given' }
+        const { findings, tools } = await checkToolRegistrations(dir, { timeoutMs: args.timeoutMs })
+        return { ok: true, tools, findings, report: renderReport(findings, { title: `runtime gate · ${dir}` }) }
+      },
+    },
+    {
+      name: 'publish_gate_verify',
+      description:
+        'Check that the tarball on the npm registry is the one in this directory. Runs `npm pack --dry-run` and compares its shasum with the registry dist.shasum — an exact comparison, not a version-number guess, so it catches "I bumped and forgot to publish" and "I published, then edited lib/". Reports publish-served (match), publish-served-mismatch (the version is spent and the registry holds different bytes), or publish-not-served (not published, or still inside the registry\'s one-minute 202-then-404 window). Run it after `npm publish`. Returns {ok, name, version, published, shasumMatch, localShasum, unpackedSize, files, findings, report}.',
+      parameters: {
+        type: 'object',
+        properties: {
+          dir: { type: 'string', description: 'Plugin directory.' },
+          version: { type: 'string', description: 'Version to verify (defaults to package.json version).' },
+        },
+      },
+      async execute(args) {
+        const dir = resolveDir(args.dir)
+        if (!dir) return { ok: false, error: 'no plugin directory given' }
+        const json = readJson(join(dir, 'package.json'))
+        if (!json?.name) return { ok: false, error: 'no package.json' }
+        const version = args.version || json.version
+        const { pack, findings: packFindings } = await checkPack(dir)
+        if (!pack) return { ok: false, error: `npm pack --dry-run did not run, so there is nothing to compare: ${packFindings.map((f) => f.title).join('; ')}` }
+        const findings = await checkPublishedMatches(json.name, version, pack, { registry: cfg.registry, timeoutMs: cfg.networkTimeoutMs })
+        const served = findings.some((f) => f.rule === 'publish-served')
+        return {
+          ok: true,
+          name: json.name,
+          version,
+          published: served || findings.some((f) => f.rule === 'publish-served-mismatch'),
+          shasumMatch: served,
+          localShasum: pack.shasum,
+          unpackedSize: pack.unpackedSize,
+          files: (pack.files || []).length,
+          findings,
+          report: renderReport(findings, { title: `publish verify · ${json.name}@${version}` }),
+        }
+      },
+    },
     {
       name: 'publish_gate_patch',
       description:
@@ -195,11 +258,12 @@ export function apply(ctx, config = {}) {
     {
       name: 'publish_gate_doctor',
       description:
-        'Run the gate over every plugin in a directory tree (e.g. a workspace holding several plugin checkouts) and rank them by blocker count, so you can see which one is not ready to ship before you start a publish session. Static checks only — no registry or GitHub calls, so it is fast and works offline. Returns {ok, plugins:[{dir,blockers,warns,notes,top}], totals}.',
+        'Run the gate over every plugin in a directory tree (e.g. a workspace holding several plugin checkouts) and rank them by blocker count, so you can see which one is not ready to ship before you start a publish session. No registry or GitHub calls, so it is fast and works offline; each row also carries the real tarball size from `npm pack --dry-run` (pass skipPack to skip that and stay purely static). Returns {ok, plugins:[{dir,name,version,blockers,warns,notes,unpackedSize,files,top}], totals}.',
       parameters: {
         type: 'object',
         properties: {
           root: { type: 'string', description: 'Directory containing plugin checkouts.' },
+          skipPack: { type: 'boolean', description: 'Skip `npm pack --dry-run` per plugin (default false).' },
         },
       },
       async execute(args) {
@@ -219,6 +283,7 @@ export function apply(ctx, config = {}) {
           if (!json?.name || !existsSync(join(dir, 'lib'))) continue
           const findings = runStaticChecks(dir)
           const top = findings.find((f) => f.severity === 'error')
+          const pack = args.skipPack ? null : (await checkPack(dir)).pack
           plugins.push({
             dir,
             name: json.name,
@@ -226,13 +291,20 @@ export function apply(ctx, config = {}) {
             blockers: findings.filter((f) => f.severity === 'error').length,
             warns: findings.filter((f) => f.severity === 'warn').length,
             notes: findings.filter((f) => f.severity === 'info').length,
+            unpackedSize: pack?.unpackedSize ?? null,
+            files: pack?.files?.length ?? null,
             top: top ? `${top.rule}: ${top.title}` : null,
           })
         }
         plugins.sort((a, b) => b.blockers - a.blockers || b.warns - a.warns)
         const totals = plugins.reduce(
-          (acc, p) => ({ blockers: acc.blockers + p.blockers, warns: acc.warns + p.warns, notes: acc.notes + p.notes }),
-          { blockers: 0, warns: 0, notes: 0 },
+          (acc, p) => ({
+            blockers: acc.blockers + p.blockers,
+            warns: acc.warns + p.warns,
+            notes: acc.notes + p.notes,
+            unpackedBytes: acc.unpackedBytes + (p.unpackedSize || 0),
+          }),
+          { blockers: 0, warns: 0, notes: 0, unpackedBytes: 0 },
         )
         return { ok: true, plugins, totals }
       },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bushizhanghan/dsh-publish-gate",
-  "version": "0.1.5",
-  "description": "Helps DSH plugin AUTHORS publish their plugins: a one-command gate that turns every silent failure in the publish path into a deterministic check — package.json completeness, BOM, YAML/JSON parseability, junction and patch insert correctness, npm scope permissions, GitHub repo and token state, market entry format, LICENSE/README, test suite. 帮助插件作者一键发布：写完插件后跑一遍门禁，把发布链路上的每个静默坑变成确定性检查，然后 GitHub + npm + 市场一键三连。",
+  "version": "0.2.0",
+  "description": "Helps DSH plugin AUTHORS publish their plugins: a three-layer gate that turns every silent failure in the publish path into a deterministic check. Manifest layer — package.json completeness, BOM, YAML/JSON parseability, patch insert correctness, npm scope permissions, GitHub repo and token state, market entry format, LICENSE/README, tests. Artifact layer — runs `npm pack --dry-run` and reads what npm will really ship: code missing from the tarball, an unpacked patch, oversize packages, dev directories. Runtime layer — imports the entry in an isolated child process, calls apply(ctx), and reports tools that never register, missing execute, duplicate names, throwing presentCall and card kinds the host does not render. Then GitHub + npm + market, and a post-publish shasum check that proves the registry holds these exact bytes. 帮助插件作者一键发布：写完插件后跑一遍三层门禁（清单 / 产物 / 运行时），把发布链路上的每个静默坑变成确定性检查，然后 GitHub + npm + 市场一键三连。",
   "type": "module",
   "main": "lib/index.js",
   "exports": {