@bushizhanghan/dsh-publish-gate 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.18.0
+
+- `readme-path-missing` (warn): a README that names `test/…`, `lib/…`, `scripts/…` files that no longer
+  exist. Rename a file and the README keeps telling people to run something that returns ENOENT;
+  nothing else in the repo notices. Only repo-relative paths under directories a plugin owns, so a
+  tutorial example is not a finding.
+- Verified over all nine plugins in this workspace: no false positives, all nine still `e0 w0`.
+
 ## 0.17.0
 
 - `changelog-not-shipped` (warn): a CHANGELOG.md that exists on disk but is not in the tarball. npm

package/README.md

@@ -80,7 +80,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | `readme-wrong-package` | README 的安装命令写的是**另一个包名**（从别的插件抄过来没改）。照着装的人装到别的插件上，而且不会报错——那个包真的存在 |
 
 ### 值得在发布前知道的（warn / info）
-`npm-scope-mismatch`（登录的账号不是包 scope 的所有者，PUT 会 403，而错误里既不说 token 也不说 scope——我为一个 403 花了一小时）、`unscoped-name`（granular token 的 403）、`repo-missing`、`patch-name-unresolvable`（junction 放错层级）、`inject-unused-service`（`inject` 里写了个拼错的服务名，cordis 一直等它，插件静默不激活）、`no-publish-config-access`（scoped 包没写 `publishConfig.access`，只是提醒，因为命令里本来就带 `--access public`）、`publish-config-registry`（`publishConfig.registry` 指到内网 registry，版本发到别人装不到的地方）、`no-readme` / `readme-no-install` / `readme-no-profile`、`license-mismatch`、`no-tests` / `no-test-files` / `no-test-script`、`no-engines`、`bad-repo-url`、`no-git` / `no-gitignore`、`readme-tool-undocumented`（README 没提这个工具）/ `readme-test-count`（README 写的测试数和真实数不一致）、`changelog-missing-version`（要发的这个版本号在 CHANGELOG 里没有对应标题，npm 照样发，发布说明就永远落后一版）、`changelog-no-versions`（CHANGELOG 里没有版本标题，读者对不上自己装的那版）、`no-changelog`（只是提醒）、`changelog-not-shipped`（CHANGELOG 在本地但没进 tarball——npm 只强制带 README 和 LICENSE，你一直更新的那份文件在 registry 页面上看不见），以及市场条目的 `market-*` 全系列。
+`npm-scope-mismatch`（登录的账号不是包 scope 的所有者，PUT 会 403，而错误里既不说 token 也不说 scope——我为一个 403 花了一小时）、`unscoped-name`（granular token 的 403）、`repo-missing`、`patch-name-unresolvable`（junction 放错层级）、`inject-unused-service`（`inject` 里写了个拼错的服务名，cordis 一直等它，插件静默不激活）、`no-publish-config-access`（scoped 包没写 `publishConfig.access`，只是提醒，因为命令里本来就带 `--access public`）、`publish-config-registry`（`publishConfig.registry` 指到内网 registry，版本发到别人装不到的地方）、`no-readme` / `readme-no-install` / `readme-no-profile`、`license-mismatch`、`no-tests` / `no-test-files` / `no-test-script`、`no-engines`、`bad-repo-url`、`no-git` / `no-gitignore`、`readme-path-missing`（README 里写的 `test/xxx.mjs` 这类路径已经不存在了，照着敲就是 ENOENT）、`readme-tool-undocumented`（README 没提这个工具）/ `readme-test-count`（README 写的测试数和真实数不一致）、`changelog-missing-version`（要发的这个版本号在 CHANGELOG 里没有对应标题，npm 照样发，发布说明就永远落后一版）、`changelog-no-versions`（CHANGELOG 里没有版本标题，读者对不上自己装的那版）、`no-changelog`（只是提醒）、`changelog-not-shipped`（CHANGELOG 在本地但没进 tarball——npm 只强制带 README 和 LICENSE，你一直更新的那份文件在 registry 页面上看不见），以及市场条目的 `market-*` 全系列。
 
 ### 产物层：npm 到底会发出什么
 
@@ -233,7 +233,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 ## 开发
 
 ```sh
-node --test                      # 117 个引擎单测
+node --test                      # 118 个引擎单测
 node test/integration.test.mjs   # 27 条集成断言（9 个真实插件作 fixture）
 ```
 

package/lib/engine.js

@@ -554,7 +554,29 @@ export function checkDocs(dir) {
         )
       }
     }
-  }
+    // A README that names files by path rots the moment one is renamed: the
+    // reader copies the command, gets ENOENT, and nothing in the repo notices.
+    // Only repo-relative paths in the directories a plugin actually owns, so a
+    // tutorial example does not turn into a finding.
+    if (text) {
+      const named = new Set()
+      for (const m of text.matchAll(/(?:^|[\s`'"(])((?:test|lib|scripts|bin|src)\/[\w./@-]+\.(?:mjs|cjs|js|json|yml|yaml|md))/g)) {
+        if (!existsSync(join(dir, m[1]))) named.add(m[1])
+      }
+      if (named.size) {
+        const list = [...named]
+        out.push(
+          F(
+            'readme-path-missing',
+            'warn',
+            `README names ${list.length} path(s) that do not exist`,
+            `Whoever copies them gets ENOENT: ${list.slice(0, 4).join(", ")}.`,
+            'Rename them in the README, or restore the files.',
+          ),
+        )
+      }
+    }
+  }
   if (!existsSync(join(dir, 'LICENSE'))) {
     out.push(F('no-license', 'error', 'LICENSE is missing', 'npm warns on publish and the market listing shows an unknown license.', 'Add a LICENSE file (MIT is the ecosystem norm).'))
   } else {
@@ -2561,7 +2583,7 @@ const RULE_ORDER = [
   'pack-unexpected-dir', 'pack-ships-junk', 'pack-script-build', 'pack-unavailable',
   'no-license', 'license-mismatch', 'version-taken', 'version-behind-latest', 'npm-not-logged-in', 'npm-scope-mismatch', 'npm-whoami-unavailable', 'registry-unreachable', 'publish-not-served',
   'publish-served-mismatch', 'publish-served', 'market-empty', 'market-no-url', 'market-url-not-github',
-  'market-no-name', 'market-name-shape', 'market-no-category', 'market-bad-category', 'market-no-desc', 'market-no-en', 'market-no-zh', 'unscoped-name', 'no-git', 'no-readme', 'readme-no-install', 'readme-no-profile', 'readme-wrong-package',
+  'market-no-name', 'market-name-shape', 'market-no-category', 'market-bad-category', 'market-no-desc', 'market-no-en', 'market-no-zh', 'unscoped-name', 'no-git', 'no-readme', 'readme-no-install', 'readme-no-profile', 'readme-wrong-package', 'readme-path-missing',
   'market-no-repo', 'market-unavailable', 'market-duplicate-entry', 'market-npm-name-collision', 'market-repo-too-new', 'market-release-behind',
   'no-changelog', 'changelog-no-versions', 'changelog-missing-version', 'changelog-not-shipped',
   'git-uncommitted', 'git-tag-missing', 'git-tag-unverified', 'git-tag-elsewhere',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bushizhanghan/dsh-publish-gate",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Pre-publish gate for DSH plugins: manifest, dependencies, artifact, runtime, browser half, traceability and market readiness — plus an input fuzzer that drives every declared parameter with the wrong type. 发布前的七层门禁 + 入参模糊测试。",
   "type": "module",
   "main": "lib/index.js",