@bushizhanghan/dsh-publish-gate 0.12.0 → 0.13.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.13.1
+
+- The tag check now asks `git ls-remote origin` instead of `git tag --points-at HEAD`. When the commit is pushed
+  through the GitHub API the local HEAD is not the remote one, so the local form reported `git-tag-missing` on
+  seven of my nine plugins whose tag existed all along. It now compares the tag against the shipped branch
+  head and stays silent when the remote cannot be reached — a check that cannot see the truth must not claim
+  a defect.
+## 0.13.0
+
+- `market-fork-of-listed` / `market-fork-undisclosed` (warn): the repo is a GitHub fork whose parent is
+  already in the catalogue, and nothing says so. A submission was blocked for exactly this: the entry
+  described the fork as if it were original work, and both plugins claim the same provider id, so installing
+  both silently shadows one of them. The check uses the `fork` and `parent.full_name` fields of the repo
+  metadata the market layer already fetches.
 ## 0.12.0
 
 - `pack-ships-junk` (warn): the tarball carries `.bak-*`, `.orig`, `.swp`, `.log`, `~` or `.DS_Store` debris.

package/README.md

@@ -141,6 +141,8 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | `market-duplicate-entry` | 这个仓库**已经在目录里**。再提一个 PR 就是同一仓库的第二条条目，reviewer 会拒。版本升级根本不需要 PR——目录条目只存 `url` |
 | `market-npm-name-collision` | 另一个条目也在发同一个 npm 包，安装路径会互相盖 |
 | `market-repo-too-new` | 仓库创建不满 24 小时。门禁会报 `0.0 days old` 然后**自己重跑**，PR 不会丢，但在那之前什么都不会合 |
+| `market-fork-of-listed` | 这个仓库是某个**已经在目录里**的仓库的 fork。两条条目装的代码抢同一批 id，两个都装就有一个被静默盖掉——而且 reviewer 会把"没写"当成"隐瞒 fork" |
+| `market-fork-undisclosed` | 是 fork，但 README 和 package.json 里都没有上游的 `owner/repo` |
 | `market-no-repo` | `package.json` 里没有 GitHub 地址，没东西可提交 |
 | `market-unavailable` | 目录拉不到（warn）——这几条没跑，别把它当干净 |
 
@@ -221,7 +223,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 ## 开发
 
 ```sh
-node --test                      # 104 个引擎单测
+node --test                      # 108 个引擎单测
 node test/integration.test.mjs   # 27 条集成断言（9 个真实插件作 fixture）
 ```
 

package/lib/engine.js

@@ -931,7 +931,7 @@ export async function checkMarketReadiness(dir, opts = {}) {
       if (hours < 24) {
         out.push(
           F(
-            'market-repo-too-new',
+            'market-repo-too-new', 'market-fork-of-listed', 'market-fork-undisclosed',
             'warn',
             `the repo is ${hours.toFixed(1)}h old; the submission gate needs 24h`,
             'The gate fails with a "repo too new" message and reruns on its own, so the PR is not lost — but nothing merges until it passes.',
@@ -941,12 +941,45 @@ export async function checkMarketReadiness(dir, opts = {}) {
       }
     }
   }
+  // A fork of a repo that is already listed collides with its own upstream:
+  // both register the same provider or tool names, and whichever loads second
+  // wins or throws. A reviewer blocked a submission for exactly this and the
+  // description said nothing about it.
+  const parentSlug = typeof repoInfo?.parent?.full_name === 'string' ? repoInfo.parent.full_name : null
+  if (repoInfo?.fork === true && parentSlug) {
+    const parentListed = entries.some((e) => typeof e?.url === 'string' && e.url.toLowerCase().includes(parentSlug.toLowerCase()))
+    if (parentListed) {
+      out.push(
+        F(
+          'market-fork-of-listed',
+          'warn',
+          `this repo is a fork of ${parentSlug}, which is already in the catalogue`,
+          'Both entries install code that claims the same ids, so a user who installs both gets one silently shadowing the other — and a reviewer reads the missing note as an undisclosed fork.',
+          `Say in the entry description that it is a fork of ${parentSlug} and that the two must not be installed together.`,
+        ),
+      )
+    }
+    const readme = safeText(join(dir, 'README.md')) || ''
+    const desc = typeof json?.description === 'string' ? json.description : ''
+    if (!readme.includes(parentSlug) && !desc.includes(parentSlug)) {
+      out.push(
+        F(
+          'market-fork-undisclosed',
+          'warn',
+          `nothing in README or package.json names the upstream ${parentSlug}`,
+          'A fork that does not say what it forked from looks like original work until someone diffs it, and the upstream author finds out from a collision report.',
+          `Mention ${parentSlug} in the README and in the market entry description.`,
+        ),
+      )
+    }
+  }
   return out
 }
 
 // =====================================================================
 // Source sanity: the entry protocol
 // =====================================================================
+
 export function checkEntrySource(dir) {
   const out = []
   const path = join(dir, 'lib', 'index.js')
@@ -2270,11 +2303,43 @@ export async function checkTraceability(dir, opts = {}) {
     }
   }
 
-  // 2. No tag on HEAD: nothing points at these bytes afterwards.
+  // 2. A tag on the bytes that actually shipped. When the commit was pushed
+  // through the GitHub API the local HEAD is not the remote one, so a local
+  // `git tag --points-at HEAD` reports a missing tag that exists — ask the
+  // remote instead, and say nothing when it cannot be reached.
+  const remote = opts.remote === undefined ? await readRemoteRefs(dir) : opts.remote
   const atHead = opts.atHead === undefined ? await gitOut(dir, ['tag', '--points-at', 'HEAD']) : opts.atHead
-  const tags = typeof atHead === 'string' ? atHead.split('\n').map((t) => t.trim()).filter(Boolean) : []
+  const localTags = typeof atHead === 'string' ? atHead.split('\n').map((t) => t.trim()).filter(Boolean) : []
   const wanted = [`v${version}`, version]
-  if (typeof atHead === 'string' && !wanted.some((t) => tags.includes(t))) {
+  const tagOnRemote = remote ? remote.tags[`v${version}`] || remote.tags[version] || null : null
+  const tagIsOnShipped = Boolean(remote && tagOnRemote && tagOnRemote === remote.head)
+  const localHasIt = wanted.some((t) => localTags.includes(t))
+
+  if (remote) {
+    // The remote is the truth: the tag either points at the shipped commit or not.
+    if (tagIsOnShipped) return out
+    const exists = Boolean(tagOnRemote) || (opts.tagExists !== undefined ? Boolean(opts.tagExists) : Boolean(await gitOut(dir, ['rev-parse', '--verify', '--quiet', `refs/tags/v${version}`])))
+    out.push(
+      exists
+        ? F(
+            'git-tag-elsewhere',
+            'warn',
+            `tag v${version} does not point at the shipped commit`,
+            `The tag is on ${String(tagOnRemote || 'another commit').slice(0, 12)} but the branch head is ${String(remote.head).slice(0, 12)}. A release built from that tag is not what you just published.`,
+            `Move it: git tag -f v${version} <shipped-sha> && git push -f origin v${version}`,
+          )
+        : F(
+            'git-tag-missing',
+            'warn',
+            `no git tag v${version} on the shipped commit`,
+            'After publishing, the only record of these bytes is the registry. A GitHub release, a changelog entry or a market listing cannot point at a commit that was never tagged.',
+            `git tag v${version} && git push origin v${version}`,
+          ),
+    )
+    return out
+  }
+
+  if (typeof atHead === 'string' && !localHasIt) {
     const exists = opts.tagExists === undefined ? await gitOut(dir, ['rev-parse', '--verify', '--quiet', `refs/tags/v${version}`]) : opts.tagExists ? 'sha' : null
     out.push(
       exists
@@ -2297,6 +2362,22 @@ export async function checkTraceability(dir, opts = {}) {
   return out
 }
 
+/** `{ head, tags }` from one `git ls-remote`, or null when it cannot be read. */
+async function readRemoteRefs(dir) {
+  const raw = await gitOut(dir, ['ls-remote', '--heads', '--tags', 'origin'])
+  if (typeof raw !== 'string' || raw.length === 0) return null
+  const tags = {}
+  let head = null
+  for (const line of raw.split('\n')) {
+    const [sha, ref] = line.split('\t')
+    if (!sha || !ref) continue
+    if (ref === 'refs/heads/main' || ref === 'refs/heads/master') head = sha
+    const m = /^refs\/tags\/(.+?)(?:\^\{\})?$/.exec(ref)
+    if (m) tags[m[1]] = sha // a dereferenced annotated tag overwrites the tag object, which is what we want
+  }
+  return head ? { head, tags } : null
+}
+
 // =====================================================================
 // Orchestration
 // =====================================================================

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bushizhanghan/dsh-publish-gate",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "description": "Pre-publish gate for DSH plugins: manifest, dependencies, artifact, runtime, browser half, traceability and market readiness — plus an input fuzzer that drives every declared parameter with the wrong type. 发布前的七层门禁 + 入参模糊测试。",
   "type": "module",
   "main": "lib/index.js",