@bushizhanghan/dsh-publish-gate 0.14.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.16.0
+
+- `market-release-behind` (warn): the newest GitHub release is older (or newer) than package.json. A
+  catalogue entry may install `releases/latest/download/<asset>`, so a lagging release serves code the
+  description no longer describes — a reviewer blocked a submission for exactly that.
+- `straySeverities` + `internal-bad-severity`: a finding whose severity is not error/warn/info is counted
+  by nothing and reported nowhere, so the rule looks like it never fires. `publish_gate` now turns any such
+  finding into a loud error instead of dropping it.
+- The source scan added in 0.15.0 caught the same mistake again while building this version: a string
+  replace aimed at RULE_ORDER matched an earlier `F(...)` call and wrote the new rule name into a severity
+  slot. Fixed, and the fix now goes through the RULE_ORDER slice instead of a global replace.
+
+## 0.15.0
+
+- Three rules shipped with a *rule name* in their severity slot: `market-repo-too-new`,
+  `test-script-dir-arg` and `tool-missing-output-schema` were built as
+  `F(rule, "some-other-rule", "a-third-rule", "warn", title, ...)`, because a string replace aimed at
+  RULE_ORDER matched an earlier `F(...)` call instead and pushed the new names into its arguments.
+  Nothing failed: a finding whose severity is not error/warn/info falls out of every counter and never
+  reaches the report, so the rules looked like they simply never fired. Fixed all three, added the six
+  rule names that never made it into RULE_ORDER, and added a source scan that fails when any `F(...)`
+  call passes something other than an error/warn/info literal (or a ternary of two of them).
+
 ## 0.14.0
 
 - New test layer: `checkTestRun` runs `node --test` in the plugin directory and reports `tests-fail`

package/README.md

@@ -8,6 +8,10 @@
 
 门禁分三层：**清单层**看 package.json / patch / 入口源码，**产物层**真的跑一遍 `npm pack --dry-run` 看 npm 到底会发出什么，**运行时层**在独立子进程里 `import()` 入口并 `apply(ctx)` 一遍，看它到底注册了什么。
 
+### 自检：看不见的 finding
+
+`severity` 不是 `error`/`warn`/`info` 的 finding 会被所有计数器忽略，等于规则从没触发过。`publish_gate` 现在会把这类 finding 提升成一条 `internal-bad-severity` 的 error，测试里还有一条源码扫描盯着 `F(...)` 的第二个参数。这条网加上当天就抓到了我自己的同一个错误。
+
 ### 测试层：门禁真的会跑一遍你的测试
 
 `tests-fail` / `tests-timeout` / `tests-not-run` 三条规则会以 `node --test` 在插件目录里真跑一次（不经过 `npm test`，因为脚本内容由作者决定、可能 shell 出去）。子进程会去掉继承来的 `NODE_TEST_CONTEXT`——否则当门禁本身跑在 `node --test` 里时，子进程进入 test-child 模式、一个摘要都不打印，看起来像"没有测试"。
@@ -143,6 +147,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | 规则 | 抓什么 |
 |---|---|
 | `market-duplicate-entry` | 这个仓库**已经在目录里**。再提一个 PR 就是同一仓库的第二条条目，reviewer 会拒。版本升级根本不需要 PR——目录条目只存 `url` |
+| `market-release-behind` | warn | 最新 GitHub release 比 package.json 旧（或新） | 目录里写着 1.2.7、release 资产还是 1.2.6 时，市场条目装的是旧代码，而描述是新版写的——维护者正是以「描述与 tarball 不符」驳回过一次提交 |
 | `market-npm-name-collision` | 另一个条目也在发同一个 npm 包，安装路径会互相盖 |
 | `market-repo-too-new` | 仓库创建不满 24 小时。门禁会报 `0.0 days old` 然后**自己重跑**，PR 不会丢，但在那之前什么都不会合 |
 | `market-fork-of-listed` | 这个仓库是某个**已经在目录里**的仓库的 fork。两条条目装的代码抢同一批 id，两个都装就有一个被静默盖掉——而且 reviewer 会把"没写"当成"隐瞒 fork" |
@@ -227,7 +232,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 ## 开发
 
 ```sh
-node --test                      # 110 个引擎单测
+node --test                      # 115 个引擎单测
 node test/integration.test.mjs   # 27 条集成断言（9 个真实插件作 fixture）
 ```
 

package/lib/engine.js

@@ -27,7 +27,17 @@ const safeText = (p) => {
   return b === null ? null : b.toString('utf8')
 }
 
-export const F = (rule, severity, title, detail, fix) => ({ rule, severity, title, detail, fix })
+export const F = (rule, severity, title, detail, fix) => ({ rule, severity, title, detail, fix })
+
+/**
+ * A finding whose severity is not error/warn/info is invisible: the counters
+ * only count those three, so the rule silently never reports. Three of them
+ * shipped that way before this existed. The source scan in the test suite
+ * catches the literal forms; this catches whatever a future refactor builds.
+ */
+export const SEVERITIES = new Set(['error', 'warn', 'info'])
+export const straySeverities = (findings) =>
+  [...new Set((findings || []).filter((f) => !SEVERITIES.has(f?.severity)).map((f) => String(f?.rule || '<no rule>')))]
 
 /** package.json without the BOM trap. Null when it is missing or unparseable. */
 export function readPkgJson(dir) {
@@ -857,7 +867,8 @@ export async function checkMarketReadiness(dir, opts = {}) {
     return out
   }
   const json = readPkgJson(dir)
-  const pkgName = typeof json?.name === 'string' ? json.name : null
+  const pkgName = typeof json?.name === 'string' ? json.name : null
+  const pkgVersion = typeof json?.version === 'string' ? json.version : null
 
   let entries = Array.isArray(opts.entries) ? opts.entries : null
   try {
@@ -931,7 +942,7 @@ export async function checkMarketReadiness(dir, opts = {}) {
       if (hours < 24) {
         out.push(
           F(
-            'market-repo-too-new', 'market-fork-of-listed', 'market-fork-undisclosed',
+            'market-repo-too-new',
             'warn',
             `the repo is ${hours.toFixed(1)}h old; the submission gate needs 24h`,
             'The gate fails with a "repo too new" message and reruns on its own, so the PR is not lost — but nothing merges until it passes.',
@@ -972,6 +983,37 @@ export async function checkMarketReadiness(dir, opts = {}) {
         ),
       )
     }
+  }
+  // A catalogue entry can point at a GitHub release asset instead of npm. When
+  // the newest release is older than this directory, the entry serves code the
+  // description no longer matches — a reviewer blocked a submission for exactly
+  // that (the entry said 1.2.7, the asset was still 1.2.6).
+  let releaseInfo = opts.releaseInfo ?? null
+  if (releaseInfo === null) {
+    try {
+      const res = await fetch(`https://api.github.com/repos/${slug}/releases/latest`, {
+        signal: AbortSignal.timeout(timeoutMs),
+        headers: { 'user-agent': 'dsh-publish-gate', accept: 'application/vnd.github+json' },
+      })
+      if (res.ok) releaseInfo = await res.json()
+    } catch {
+      // no network, no releases, or a rate limit — the rule stays quiet
+    }
+  }
+  const releaseTag = typeof releaseInfo?.tag_name === 'string' ? releaseInfo.tag_name.replace(/^v/, '') : null
+  if (releaseTag && pkgVersion && releaseTag !== pkgVersion) {
+    const older = compareVersions(releaseTag, pkgVersion) < 0
+    out.push(
+      F(
+        'market-release-behind',
+        'warn',
+        `the newest GitHub release is ${releaseTag}, this directory says ${pkgVersion}`,
+        older
+          ? 'An entry that installs releases/latest/download/<asset> serves the older code while the description is written for the newer version — a reviewer reads that as a false claim.'
+          : `The release is ahead of package.json, so what the release ships is not what this directory builds.`,
+        `Cut a ${pkgVersion} release (asset name unchanged) or point the entry at npm.`,
+      ),
+    )
   }
   return out
 }
@@ -1044,10 +1086,7 @@ export function checkTests(dir) {
   // while the tests themselves are fine. Auto-discovery needs no argument.
   const testScript = pkgJson?.scripts?.test || ''
   const dirArg = testScript.match(/\bnode\s+--test\s+(?!-)(\S+)/)
-  if (dirArg) out.push(F('test-script-dir-arg',
-  'tests-fail',
-  'tests-timeout',
-  'tests-not-run', 'warn', `test script passes a path to node --test ("${dirArg[1]}")`, 'Node 22+ treats that argument as a module path, not a directory to glob: `node --test test/` throws MODULE_NOT_FOUND, so npm test can never pass even though the tests are fine.', 'Drop the path — "test": "node --test" auto-discovers test/**/*.test.mjs.'))
+  if (dirArg) out.push(F('test-script-dir-arg', 'warn', `test script passes a path to node --test ("${dirArg[1]}")`, 'Node 22+ treats that argument as a module path, not a directory to glob: `node --test test/` throws MODULE_NOT_FOUND, so npm test can never pass even though the tests are fine.', 'Drop the path — "test": "node --test" auto-discovers test/**/*.test.mjs.'))
   return out
 }
 
@@ -1069,12 +1108,12 @@ export async function checkTestRun(dir, opts = {}) {
   let stdout = ''
   let code = 0
   let timedOut = false
-  // NODE_TEST_CONTEXT is inherited from whoever called us: when this gate runs
-  // inside `node --test` itself, the child starts in test-child mode and prints
-  // no summary at all, which reads as "no tests" — a false alarm.
-  const env = { ...process.env }
-  delete env.NODE_TEST_CONTEXT
-  try {
+  // NODE_TEST_CONTEXT is inherited from whoever called us: when this gate runs
+  // inside `node --test` itself, the child starts in test-child mode and prints
+  // no summary at all, which reads as "no tests" — a false alarm.
+  const env = { ...process.env }
+  delete env.NODE_TEST_CONTEXT
+  try {
     const r = await runFile(process.execPath, ['--test'], { cwd: dir, env, timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024, windowsHide: true })
     stdout = String(r.stdout || '')
   } catch (error) {
@@ -1634,7 +1673,7 @@ export async function checkToolRegistrations(dir, opts = {}) {
         ),
       )
     }
-    if (!t.hasOutputSchema) out.push(F('tool-missing-output-schema', 'tool-no-description', 'tool-description-thin', 'tool-no-parameters', 'warn', `tool "${label}" declares no output.schema`, 'The host validates tool output against output.schema; without one the contract is implicit and a malformed result reaches the caller.', "Add output: { schema: { type: 'json' }, render }."))
+    if (!t.hasOutputSchema) out.push(F('tool-missing-output-schema', 'warn', `tool "${label}" declares no output.schema`, 'The host validates tool output against output.schema; without one the contract is implicit and a malformed result reaches the caller.', "Add output: { schema: { type: 'json' }, render }."))
     if (t.cardKind && typeof t.cardKind === 'object') {
       out.push(F('tool-present-call-throws', 'error', `tool "${label}" presentCall() throws`, `presentCall renders the transcript card and must be total: ${t.cardKind.threw}`, 'Do not read args fields that may be absent.'))
     } else if (typeof t.cardKind === 'string' && !CARD_KINDS.has(t.cardKind)) {
@@ -2471,12 +2510,12 @@ const RULE_ORDER = [
   'client-factory-throws', 'client-no-apply', 'client-apply-throws', 'client-no-registration', 'client-double-load',
   'client-inject-missing-slots', 'client-inject-missing-sidebarRightTabs', 'client-unavailable',
   'no-patch-file', 'no-insert-row', 'insert-missing-name', 'insert-name-mismatch',
-  'patch-name-unresolvable', 'no-name-export', 'no-apply-export', 'no-inject', 'require-in-esm',
+  'patch-name-unresolvable', 'tests-fail', 'tests-timeout', 'tests-not-run', 'no-name-export', 'no-apply-export', 'no-inject', 'require-in-esm',
   'entry-import-failed', 'apply-threw', 'tools-unavailable',
   'inject-missing-tools', 'inject-missing-web', 'inject-missing-webServer', 'inject-missing-timer',
   'inject-unused-service',
   'tool-missing-name', 'tool-duplicate-name', 'tool-missing-execute', 'tool-present-call-throws',
-  'tool-bad-card-kind', 'tool-missing-output-schema', 'tool-none-registered', 'tool-bad-parameter-type', 'tool-undeclared-param', 'tool-input-throws', 'tool-call-throws', 'tool-output-invalid', 'tool-call-slow',
+  'tool-bad-card-kind', 'tool-no-description', 'tool-description-thin', 'tool-no-parameters', 'tool-missing-output-schema', 'tool-none-registered', 'tool-bad-parameter-type', 'tool-undeclared-param', 'tool-input-throws', 'tool-call-throws', 'tool-output-invalid', 'tool-call-slow',
   'lib-debugger', 'lib-console-log', 'lib-hardcoded-path', 'lib-url-pathname', 'node-too-old', 'stale-build', 'hand-edited-build',
   'undeclared-import', 'dep-in-dev-only', 'unused-dependency',
   'pack-omits-lib', 'pack-omits-patch', 'pack-omits-client', 'pack-oversize', 'pack-omits-readme', 'pack-omits-license', 'pack-ships-secret',
@@ -2484,7 +2523,7 @@ const RULE_ORDER = [
   'no-license', 'license-mismatch', 'version-taken', 'version-behind-latest', 'npm-not-logged-in', 'npm-scope-mismatch', 'npm-whoami-unavailable', 'registry-unreachable', 'publish-not-served',
   'publish-served-mismatch', 'publish-served', 'market-empty', 'market-no-url', 'market-url-not-github',
   'market-no-name', 'market-name-shape', 'market-no-category', 'market-bad-category', 'market-no-desc', 'market-no-en', 'market-no-zh', 'unscoped-name', 'no-git', 'no-readme', 'readme-no-install', 'readme-no-profile', 'readme-wrong-package',
-  'market-no-repo', 'market-unavailable', 'market-duplicate-entry', 'market-npm-name-collision', 'market-repo-too-new',
+  'market-no-repo', 'market-unavailable', 'market-duplicate-entry', 'market-npm-name-collision', 'market-repo-too-new', 'market-release-behind',
   'no-changelog', 'changelog-no-versions', 'changelog-missing-version',
   'git-uncommitted', 'git-tag-missing', 'git-tag-elsewhere',
   'readme-tool-undocumented', 'readme-test-count',

package/lib/index.js

@@ -29,7 +29,8 @@ import {
   latestPublished,
   renderReport,
   runArtifactChecks,
-  checkTestRun,
+  checkTestRun,
+  straySeverities,
   runStaticChecks,
 } from './engine.js'
 
@@ -116,6 +117,18 @@ export function apply(ctx, config = {}) {
         const tests = args.skipTests ? null : await checkTestRun(dir, { timeoutMs: cfg.testTimeoutMs })
         if (tests) findings.push(...tests)
         if (!args.skipNetwork) findings.push(...(await networkGate(dir)))
+        // A finding with an unexpected severity is invisible to the counters
+        // below, so the rule silently never reports. Make that loud instead.
+        const stray = straySeverities(findings)
+        if (stray.length > 0) {
+          findings.push({
+            rule: 'internal-bad-severity',
+            severity: 'error',
+            title: `these rules built a finding with an unknown severity: ${stray.join(", ")}`,
+            detail: 'The gate counted them as nothing, so they never appeared in a report. This is a bug in publish-gate, not in the plugin being gated.',
+            fix: 'Report it: the severity slot of F(...) took something other than error/warn/info.',
+          })
+        }
         const counts = {
           error: findings.filter((f) => f.severity === 'error').length,
           warn: findings.filter((f) => f.severity === 'warn').length,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bushizhanghan/dsh-publish-gate",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Pre-publish gate for DSH plugins: manifest, dependencies, artifact, runtime, browser half, traceability and market readiness — plus an input fuzzer that drives every declared parameter with the wrong type. 发布前的七层门禁 + 入参模糊测试。",
   "type": "module",
   "main": "lib/index.js",