@bushizhanghan/dsh-publish-gate 0.11.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.13.0
+
+- `market-fork-of-listed` / `market-fork-undisclosed` (warn): the repo is a GitHub fork whose parent is
+  already in the catalogue, and nothing says so. A submission was blocked for exactly this: the entry
+  described the fork as if it were original work, and both plugins claim the same provider id, so installing
+  both silently shadows one of them. The check uses the `fork` and `parent.full_name` fields of the repo
+  metadata the market layer already fetches.
+## 0.12.0
+
+- `pack-ships-junk` (warn): the tarball carries `.bak-*`, `.orig`, `.swp`, `.log`, `~` or `.DS_Store` debris.
+  Naming a directory in `files` takes everything inside it, so a `lib/client.js.bak-20261026` left behind
+  during a fix ships to every consumer and stays on npm permanently. Both weapp-loop and page-monitor had
+  exactly that file during this session; both were deleted by hand before this rule existed.
 ## 0.11.0
 
 - `tool-no-description` (error), `tool-description-thin` (warn), `tool-no-parameters` (error): the host

package/README.md

@@ -87,6 +87,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | `pack-oversize` | 解包 >5 MB 是 error、>1 MB 是 warn，并点名最大的三个文件。测试 fixture 是常见元凶——我的一个插件曾把 20 MB 的算例目录发上去，装了它的人每次都要下 20 MB |
 | `pack-ships-secret` | tarball 里有 `.env` / `.npmrc` / `*.pem` / `*.key` / `id_rsa`。没写 `files` 字段时 npm 会把 `.gitignore` 没排除的一切都打包，而包一发布就是公开的、npm 不会帮你撤回 |
 | `pack-unexpected-dir` | `fixtures` / `test` / `tests` / `src` 被打进包里 |
+| `pack-ships-junk` | 包里带上了 `.bak-20261026` 这类备份或编辑器残留。`files: ["lib"]` 会把 `lib/` 里所有东西都打进去——包括你自己源码的上一版，而且发上去就永久公开 |
 | `pack-script-build` | 有 `prepack` / `prepare`：dry run 用了 `--ignore-scripts`，这次清单**不代表**真正发布时的产物 |
 | `pack-unavailable` | npm 跑不起来（warn）——产物层没跑，别把它当干净 |
 
@@ -140,6 +141,8 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | `market-duplicate-entry` | 这个仓库**已经在目录里**。再提一个 PR 就是同一仓库的第二条条目，reviewer 会拒。版本升级根本不需要 PR——目录条目只存 `url` |
 | `market-npm-name-collision` | 另一个条目也在发同一个 npm 包，安装路径会互相盖 |
 | `market-repo-too-new` | 仓库创建不满 24 小时。门禁会报 `0.0 days old` 然后**自己重跑**，PR 不会丢，但在那之前什么都不会合 |
+| `market-fork-of-listed` | 这个仓库是某个**已经在目录里**的仓库的 fork。两条条目装的代码抢同一批 id，两个都装就有一个被静默盖掉——而且 reviewer 会把"没写"当成"隐瞒 fork" |
+| `market-fork-undisclosed` | 是 fork，但 README 和 package.json 里都没有上游的 `owner/repo` |
 | `market-no-repo` | `package.json` 里没有 GitHub 地址，没东西可提交 |
 | `market-unavailable` | 目录拉不到（warn）——这几条没跑，别把它当干净 |
 
@@ -220,7 +223,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 ## 开发
 
 ```sh
-node --test                      # 102 个引擎单测
+node --test                      # 107 个引擎单测
 node test/integration.test.mjs   # 27 条集成断言（9 个真实插件作 fixture）
 ```
 

package/lib/engine.js

@@ -931,7 +931,7 @@ export async function checkMarketReadiness(dir, opts = {}) {
       if (hours < 24) {
         out.push(
           F(
-            'market-repo-too-new',
+            'market-repo-too-new', 'market-fork-of-listed', 'market-fork-undisclosed',
             'warn',
             `the repo is ${hours.toFixed(1)}h old; the submission gate needs 24h`,
             'The gate fails with a "repo too new" message and reruns on its own, so the PR is not lost — but nothing merges until it passes.',
@@ -941,12 +941,45 @@ export async function checkMarketReadiness(dir, opts = {}) {
       }
     }
   }
+  // A fork of a repo that is already listed collides with its own upstream:
+  // both register the same provider or tool names, and whichever loads second
+  // wins or throws. A reviewer blocked a submission for exactly this and the
+  // description said nothing about it.
+  const parentSlug = typeof repoInfo?.parent?.full_name === 'string' ? repoInfo.parent.full_name : null
+  if (repoInfo?.fork === true && parentSlug) {
+    const parentListed = entries.some((e) => typeof e?.url === 'string' && e.url.toLowerCase().includes(parentSlug.toLowerCase()))
+    if (parentListed) {
+      out.push(
+        F(
+          'market-fork-of-listed',
+          'warn',
+          `this repo is a fork of ${parentSlug}, which is already in the catalogue`,
+          'Both entries install code that claims the same ids, so a user who installs both gets one silently shadowing the other — and a reviewer reads the missing note as an undisclosed fork.',
+          `Say in the entry description that it is a fork of ${parentSlug} and that the two must not be installed together.`,
+        ),
+      )
+    }
+    const readme = safeText(join(dir, 'README.md')) || ''
+    const desc = typeof json?.description === 'string' ? json.description : ''
+    if (!readme.includes(parentSlug) && !desc.includes(parentSlug)) {
+      out.push(
+        F(
+          'market-fork-undisclosed',
+          'warn',
+          `nothing in README or package.json names the upstream ${parentSlug}`,
+          'A fork that does not say what it forked from looks like original work until someone diffs it, and the upstream author finds out from a collision report.',
+          `Mention ${parentSlug} in the README and in the market entry description.`,
+        ),
+      )
+    }
+  }
   return out
 }
 
 // =====================================================================
 // Source sanity: the entry protocol
 // =====================================================================
+
 export function checkEntrySource(dir) {
   const out = []
   const path = join(dir, 'lib', 'index.js')
@@ -1145,6 +1178,22 @@ export async function checkPack(dir, opts = {}) {
     if (has(d)) out.push(F('pack-unexpected-dir', 'warn', `the tarball includes ${d}/`, 'A development directory is being published: it bloats the install and ships code nobody runs.', `Add "!${d}" to files if it is not meant to ship.`))
   }
 
+  // Editor and backup debris rides along whenever "files" names a directory:
+  // `files: ["lib"]` ships lib/client.js.bak-20261026 without asking. npm keeps
+  // it forever, and it is the previous version of your code, in public.
+  const junk = files.map((f) => f.path).filter((p) => /\.(?:bak|orig|rej|swp|tmp|log)$|\.bak[-.]|~$|(?:^|\/)\.DS_Store$|(?:^|\/)node_modules\//i.test(p))
+  if (junk.length > 0) {
+    out.push(
+      F(
+        'pack-ships-junk',
+        'warn',
+        `the tarball contains ${junk.length} backup or editor file(s)`,
+        `${junk.slice(0, 3).join(', ')} — naming a directory in "files" takes everything in it, so a .bak copy of your own source ships to every consumer and stays on npm forever.`,
+        'Delete the backups, or add "!lib/**/*.bak*" to files.',
+      ),
+    )
+  }
+
   const scripts = json?.scripts || {}
   const buildHook = scripts.prepack ? 'prepack' : scripts.prepare ? 'prepare' : null
   if (buildHook) {
@@ -2320,7 +2369,7 @@ const RULE_ORDER = [
   'lib-debugger', 'lib-console-log', 'lib-hardcoded-path', 'lib-url-pathname', 'node-too-old', 'stale-build', 'hand-edited-build',
   'undeclared-import', 'dep-in-dev-only', 'unused-dependency',
   'pack-omits-lib', 'pack-omits-patch', 'pack-omits-client', 'pack-oversize', 'pack-omits-readme', 'pack-omits-license', 'pack-ships-secret',
-  'pack-unexpected-dir', 'pack-script-build', 'pack-unavailable',
+  'pack-unexpected-dir', 'pack-ships-junk', 'pack-script-build', 'pack-unavailable',
   'no-license', 'license-mismatch', 'version-taken', 'version-behind-latest', 'npm-not-logged-in', 'npm-scope-mismatch', 'npm-whoami-unavailable', 'registry-unreachable', 'publish-not-served',
   'publish-served-mismatch', 'publish-served', 'market-empty', 'market-no-url', 'market-url-not-github',
   'market-no-name', 'market-name-shape', 'market-no-category', 'market-bad-category', 'market-no-desc', 'market-no-en', 'market-no-zh', 'unscoped-name', 'no-git', 'no-readme', 'readme-no-install', 'readme-no-profile', 'readme-wrong-package',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bushizhanghan/dsh-publish-gate",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Pre-publish gate for DSH plugins: manifest, dependencies, artifact, runtime, browser half, traceability and market readiness — plus an input fuzzer that drives every declared parameter with the wrong type. 发布前的七层门禁 + 入参模糊测试。",
   "type": "module",
   "main": "lib/index.js",