@bushizhanghan/dsh-publish-gate 0.19.0 → 0.21.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.21.0
+
+- The runtime layer no longer assumes the entry is `lib/index.js`. It resolves `exports["."]` →
+  `main` → `lib/index.js`. Measured against the thirty-one plugins installed in this profile, the
+  old guess produced **twenty false "entry throws when imported" errors**; two of those plugins ship
+  `index.mjs` with no `lib/` at all.
+- `entry-missing` (error): the manifest names no file that exists, so there is nothing to import.
+- `entry-import-unresolved` (warn): the entry imports a bare package that is not installed beside
+  it and is a host-provided peer (`@deepseek-ai/*` or a declared `peerDependencies` entry). That is
+  not a defect — but a bare import of something the host does *not* provide fails identically.
+- `lib-console-log` reports **once per file with a count**, and never for the client bundle. One
+  bundled plugin carried 459 `console.log` calls and produced 459 warnings, which is how a gate gets
+  ignored; in a browser bundle `console.log` is the debug channel, not host-log residue.
+- `unused-dependency` is skipped for packages that ship a client bundle: the bundler inlines those
+  dependencies, so the code is in the bundle and "lib/ never imports it" is true but not actionable.
+
+## 0.20.0
+
+- `publish_gate_commands` now agrees with the rules: a prerelease version gets `npm publish --tag next`
+  instead of a bare publish that would move `latest`.
+- New step `tag the shipped commit` (`git tag v<version> && git push origin v<version>`). The gate has
+  warned about a missing tag since 0.5.0 and the command list never mentioned tagging — I wrote a
+  separate script to do it because the instructions never said to.
+
 ## 0.19.0
 
 - `prerelease-published-as-latest` (warn): a `-beta` / `-rc` version with no `publishConfig.tag`.

package/README.md

@@ -45,7 +45,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | `publish_gate_market` | 校验市场条目 YAML（url/name/category/description 双语）；传 `dir` 则改查只有线上才能回答的三件事：这个仓库**已经在目录里**（再开 PR 就是重复条目）、另一个条目也在发同一个 npm 包、仓库还**不满 24 小时**（提交门禁会失败并自己重跑） |
 | `publish_gate_next_version` | 当前版本、是否已被 registry 占用、建议 bump 到多少（本地比 npm 旧时从 npm 的 latest 往上加，不会推荐一个已被占用的版本） |
 | `publish_gate_doctor` | 扫整个目录，按 blocker 数排序，附带每个插件的真实包体积，看哪个还不能发 |
-| `publish_gate_commands` | 按顺序列出发布命令，并标出这台机器已经走到哪一步。命令是**这台机器上真能跑的形式**：Windows 下 `npm publish` 走 `cmd /c`（PowerShell 的 `npm.ps1` 常被执行策略拦掉），`npm publish` 后面紧跟一条 `publish_gate_verify` |
+| `publish_gate_commands` | 按顺序列出发布命令，并标出这台机器已经走到哪一步。命令是**这台机器上真能跑的形式**：Windows 下 `npm publish` 走 `cmd /c`（PowerShell 的 `npm.ps1` 常被执行策略拦掉），`npm publish` 后面紧跟一条 `publish_gate_verify`；版本是预发版时命令自带 `--tag next`；最后一步是给发出去的 commit 打 tag |
 
 ## 检查清单
 
@@ -65,7 +65,8 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | `not-esm` | 没 `"type": "module"`，`import` 在加载时炸 |
 | `no-insert-row` | patch 里只有 override，永远不挂载（页面报的仍然是这条——顶层 `- id:` 是 patch 不是挂载） |
 | `bundle-patch-not-declared` | 有 `cordis.patch.yml` 但清单里没有 `dsh.bundle.patch`——patch 是死的，装了不挂载 |
-| `entry-path-missing` | `main` / `exports["."]` / `exports["./client"]` 指的文件不存在，宿主解析到空 |
+| `entry-path-missing` | `main` / `exports["."]` / `exports["./client"]` 指的文件不存在，宿主解析到空 |
+| `entry-missing` | 清单里没有任何一个存在的入口文件——连 `import` 的机会都没有 |
 | `inject-missing-*` | 用了 `ctx.tools` / `ctx.web` / `ctx.webServer` / `ctx.setInterval` 却没在 `inject` 里声明，cordis 永远不激活 |
 | `patch-not-mount` | info：这些顶层 `- id:` 是在覆盖已有条目，合法，但**不是**挂载 |
 | `insert-missing-name` / `insert-name-mismatch` | 挂载名缺失或与 package.json 不一致 |
@@ -103,11 +104,14 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 
 ### 运行时层：`apply` 之后到底注册了什么
 
-前两层都是读文件，读不出「装上能不能用」。这一层在独立子进程里 `import()` 入口、用假 ctx 调一次 `apply(ctx)`，把 `ctx.tools.register` 收到的每一条拿回来检查。20 秒超时，你的插件代码不在宿主进程里跑。
+前两层都是读文件，读不出「装上能不能用」。这一层在独立子进程里 `import()` 入口、用假 ctx 调一次 `apply(ctx)`，把 `ctx.tools.register` 收到的每一条拿回来检查。20 秒超时，你的插件代码不在宿主进程里跑。
+
+入口按 `exports["."]` → `main` → `lib/index.js` 的顺序解析。**早先写死 `lib/index.js`，拿三十一个真实已装插件一测，二十个报"入口抛异常"——其中两个的入口是 `index.mjs`，根本没有 `lib/`。**误报比漏报更贵：一个满屏假错误的门禁，第二次就没人跑了。
 
 | 规则 | 抓什么 |
 |---|---|
-| `entry-import-failed` | `import()` 入口就抛——装上必定不加载 |
+| `entry-import-failed` | `import()` 入口就抛——装上必定不加载 |
+| `entry-import-unresolved` | 入口 import 了一个没装在旁边的包（`@deepseek-ai/*` 这类宿主提供的 peer）——**warn**，不是缺陷 |
 | `apply-threw` | `apply(ctx)` 抛 |
 | `tool-none-registered` | 入口能加载，但一个工具都没注册 |
 | `tool-missing-execute` / `tool-missing-output-schema` | 注册项缺 `execute` / `output.schema`（宿主用 schema 校验返回值，缺了等于没校验） |
@@ -159,7 +163,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 
 ### 代码卫生
 
-`lib-debugger`（error）、`lib-console-log`、`lib-hardcoded-path`（`C:\Users\...` 硬编码）、`lib-url-pathname`（`new URL(...).pathname` 在中文路径上会百分号编码，得用 `fileURLToPath`）、`node-too-old`（`engines.node` 写着 `>=18`，`lib/` 里却用了 `Object.groupBy`（21）或 `Promise.withResolvers`（22）。npm 对 `engines` 只是警告，照样装上，然后在 import 那一刻抛——用户看到的是「插件坏了」，不是版本不匹配）。字符串和注释里的同名文字不算。
+`lib-debugger`（error）、`lib-console-log`（**每个文件一条，带次数**；浏览器半边豁免——那里 `console.log` 是调试通道，不是宿主日志残渣）、`lib-hardcoded-path`（`C:\Users\...` 硬编码）、`lib-url-pathname`（`new URL(...).pathname` 在中文路径上会百分号编码，得用 `fileURLToPath`）、`node-too-old`（`engines.node` 写着 `>=18`，`lib/` 里却用了 `Object.groupBy`（21）或 `Promise.withResolvers`（22）。npm 对 `engines` 只是警告，照样装上，然后在 import 那一刻抛——用户看到的是「插件坏了」，不是版本不匹配）。字符串和注释里的同名文字不算。
 
 ### 依赖真实性：`lib/` 里 import 的东西，消费者那边真的会装上吗
 
@@ -169,7 +173,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 |---|---|
 | `undeclared-import` | `lib/` 里 import 了某个包，`package.json` 三个依赖字段里都没有。它在你机器上能解析，只是因为别的包把它提升（hoist）到了 `node_modules` |
 | `dep-in-dev-only` | 只在 `devDependencies` 里声明。这是最常见的一种：写代码时 `npm i -D` 装上了，测试也全绿 |
-| `unused-dependency` | `dependencies` 里声明了，`lib/` 里从没 import。每个装你的人都白下一份（info，因为有些包是运行时动态加载的） |
+| `unused-dependency` | `dependencies` 里声明了，`lib/` 里从没 import。每个装你的人都白下一份（info，因为有些包是运行时动态加载的）。带浏览器半边的包**不查这条**：打包器已经把依赖内联进 bundle，代码就在里面，不是没用到 |
 
 内置模块（`node:fs`、`fs/promises`）、相对路径、以及浏览器半边从宿主 `require` 拿到的 `react` 都不算。工具描述里那句 `require("react")` 是散文，也不是依赖——这条规则最早就是被它自己误报出来的。
 
@@ -235,8 +239,8 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 ## 开发
 
 ```sh
-node --test                      # 120 个引擎单测
-node test/integration.test.mjs   # 27 条集成断言（9 个真实插件作 fixture）
+node --test                      # 125 个引擎单测
+node test/integration.test.mjs   # 28 条集成断言（9 个真实插件作 fixture）
 ```
 
 ## License

package/lib/engine.js

@@ -27,16 +27,16 @@ const safeText = (p) => {
   return b === null ? null : b.toString('utf8')
 }
 
-export const F = (rule, severity, title, detail, fix) => ({ rule, severity, title, detail, fix })
-
-/**
- * A finding whose severity is not error/warn/info is invisible: the counters
- * only count those three, so the rule silently never reports. Three of them
- * shipped that way before this existed. The source scan in the test suite
- * catches the literal forms; this catches whatever a future refactor builds.
- */
-export const SEVERITIES = new Set(['error', 'warn', 'info'])
-export const straySeverities = (findings) =>
+export const F = (rule, severity, title, detail, fix) => ({ rule, severity, title, detail, fix })
+
+/**
+ * A finding whose severity is not error/warn/info is invisible: the counters
+ * only count those three, so the rule silently never reports. Three of them
+ * shipped that way before this existed. The source scan in the test suite
+ * catches the literal forms; this catches whatever a future refactor builds.
+ */
+export const SEVERITIES = new Set(['error', 'warn', 'info'])
+export const straySeverities = (findings) =>
   [...new Set((findings || []).filter((f) => !SEVERITIES.has(f?.severity)).map((f) => String(f?.rule || '<no rule>')))]
 
 /** package.json without the BOM trap. Null when it is missing or unparseable. */
@@ -191,20 +191,20 @@ export function checkPackageJson(dir) {
     out.push(F('invalid-version', 'error', `version "${json.version}" is not semver`, 'npm publish rejects it.', 'Use MAJOR.MINOR.PATCH.'))
   }
 
-
-  // npm publishes to `latest` unless told otherwise, and a prerelease version
-  // does not change that. `npm i <name>` then resolves to a beta and every user
-  // is on an unfinished build; nothing warns, and the author sees a green publish.
-  if (json.version && /^\d+\.\d+\.\d+-/.test(json.version) && (!json.publishConfig?.tag || json.publishConfig.tag === 'latest')) {
-    out.push(
-      F(
-        'prerelease-published-as-latest',
-        'warn',
-        `version "${json.version}" is a prerelease but it will be published to \`latest\``,
-        'npm publishes to `latest` by default and a `-beta`/`-rc` suffix does not change that, so `npm i <name>` starts handing everyone an unfinished build.',
-        'Publish with `npm publish --tag next`, or set publishConfig.tag to next.',
-      ),
-    )
+
+  // npm publishes to `latest` unless told otherwise, and a prerelease version
+  // does not change that. `npm i <name>` then resolves to a beta and every user
+  // is on an unfinished build; nothing warns, and the author sees a green publish.
+  if (json.version && /^\d+\.\d+\.\d+-/.test(json.version) && (!json.publishConfig?.tag || json.publishConfig.tag === 'latest')) {
+    out.push(
+      F(
+        'prerelease-published-as-latest',
+        'warn',
+        `version "${json.version}" is a prerelease but it will be published to \`latest\``,
+        'npm publishes to `latest` by default and a `-beta`/`-rc` suffix does not change that, so `npm i <name>` starts handing everyone an unfinished build.',
+        'Publish with `npm publish --tag next`, or set publishConfig.tag to next.',
+      ),
+    )
   }
   // type: module — the whole plugin surface is ESM
   if (json.type !== 'module') {
@@ -569,29 +569,29 @@ export function checkDocs(dir) {
         )
       }
     }
-    // A README that names files by path rots the moment one is renamed: the
-    // reader copies the command, gets ENOENT, and nothing in the repo notices.
-    // Only repo-relative paths in the directories a plugin actually owns, so a
-    // tutorial example does not turn into a finding.
-    if (text) {
-      const named = new Set()
-      for (const m of text.matchAll(/(?:^|[\s`'"(])((?:test|lib|scripts|bin|src)\/[\w./@-]+\.(?:mjs|cjs|js|json|yml|yaml|md))/g)) {
-        if (!existsSync(join(dir, m[1]))) named.add(m[1])
-      }
-      if (named.size) {
-        const list = [...named]
-        out.push(
-          F(
-            'readme-path-missing',
-            'warn',
-            `README names ${list.length} path(s) that do not exist`,
-            `Whoever copies them gets ENOENT: ${list.slice(0, 4).join(", ")}.`,
-            'Rename them in the README, or restore the files.',
-          ),
-        )
-      }
-    }
-  }
+    // A README that names files by path rots the moment one is renamed: the
+    // reader copies the command, gets ENOENT, and nothing in the repo notices.
+    // Only repo-relative paths in the directories a plugin actually owns, so a
+    // tutorial example does not turn into a finding.
+    if (text) {
+      const named = new Set()
+      for (const m of text.matchAll(/(?:^|[\s`'"(])((?:test|lib|scripts|bin|src)\/[\w./@-]+\.(?:mjs|cjs|js|json|yml|yaml|md))/g)) {
+        if (!existsSync(join(dir, m[1]))) named.add(m[1])
+      }
+      if (named.size) {
+        const list = [...named]
+        out.push(
+          F(
+            'readme-path-missing',
+            'warn',
+            `README names ${list.length} path(s) that do not exist`,
+            `Whoever copies them gets ENOENT: ${list.slice(0, 4).join(", ")}.`,
+            'Rename them in the README, or restore the files.',
+          ),
+        )
+      }
+    }
+  }
   if (!existsSync(join(dir, 'LICENSE'))) {
     out.push(F('no-license', 'error', 'LICENSE is missing', 'npm warns on publish and the market listing shows an unknown license.', 'Add a LICENSE file (MIT is the ecosystem norm).'))
   } else {
@@ -782,21 +782,21 @@ export async function checkVersionTaken(name, version, { registry = 'https://reg
       )
     }
 
-
-    // A publish with `--tag next` leaves `latest` where it was: the new version
-    // is on the registry, `npm i <name>` still gets the old one, and nothing
-    // fails. The release looks shipped and is not what anyone installs.
-    const latestTag = json?.['dist-tags']?.latest
-    if (json?.versions?.[version] && latestTag && latestTag !== version) {
-      out.push(
-        F(
-          'publish-tag-not-latest',
-          'warn',
-          `${name}@${version} is published but \`latest\` still points at ${latestTag}`,
-          'Installing by name keeps getting the old version. This is what `--tag next` (or publishConfig.tag) does when you meant to release.',
-          `Move it: npm dist-tag add ${name}@${version} latest`,
-        ),
-      )
+
+    // A publish with `--tag next` leaves `latest` where it was: the new version
+    // is on the registry, `npm i <name>` still gets the old one, and nothing
+    // fails. The release looks shipped and is not what anyone installs.
+    const latestTag = json?.['dist-tags']?.latest
+    if (json?.versions?.[version] && latestTag && latestTag !== version) {
+      out.push(
+        F(
+          'publish-tag-not-latest',
+          'warn',
+          `${name}@${version} is published but \`latest\` still points at ${latestTag}`,
+          'Installing by name keeps getting the old version. This is what `--tag next` (or publishConfig.tag) does when you meant to release.',
+          `Move it: npm dist-tag add ${name}@${version} latest`,
+        ),
+      )
     }
     // npm accepts a publish of an OLDER version without a word. It lands in
     // `versions`, but `dist-tags.latest` keeps pointing at the newer one, so
@@ -920,7 +920,7 @@ export async function checkMarketReadiness(dir, opts = {}) {
     return out
   }
   const json = readPkgJson(dir)
-  const pkgName = typeof json?.name === 'string' ? json.name : null
+  const pkgName = typeof json?.name === 'string' ? json.name : null
   const pkgVersion = typeof json?.version === 'string' ? json.version : null
 
   let entries = Array.isArray(opts.entries) ? opts.entries : null
@@ -1036,37 +1036,37 @@ export async function checkMarketReadiness(dir, opts = {}) {
         ),
       )
     }
-  }
-  // A catalogue entry can point at a GitHub release asset instead of npm. When
-  // the newest release is older than this directory, the entry serves code the
-  // description no longer matches — a reviewer blocked a submission for exactly
-  // that (the entry said 1.2.7, the asset was still 1.2.6).
-  let releaseInfo = opts.releaseInfo ?? null
-  if (releaseInfo === null) {
-    try {
-      const res = await fetch(`https://api.github.com/repos/${slug}/releases/latest`, {
-        signal: AbortSignal.timeout(timeoutMs),
-        headers: { 'user-agent': 'dsh-publish-gate', accept: 'application/vnd.github+json' },
-      })
-      if (res.ok) releaseInfo = await res.json()
-    } catch {
-      // no network, no releases, or a rate limit — the rule stays quiet
-    }
-  }
-  const releaseTag = typeof releaseInfo?.tag_name === 'string' ? releaseInfo.tag_name.replace(/^v/, '') : null
-  if (releaseTag && pkgVersion && releaseTag !== pkgVersion) {
-    const older = compareVersions(releaseTag, pkgVersion) < 0
-    out.push(
-      F(
-        'market-release-behind',
-        'warn',
-        `the newest GitHub release is ${releaseTag}, this directory says ${pkgVersion}`,
-        older
-          ? 'An entry that installs releases/latest/download/<asset> serves the older code while the description is written for the newer version — a reviewer reads that as a false claim.'
-          : `The release is ahead of package.json, so what the release ships is not what this directory builds.`,
-        `Cut a ${pkgVersion} release (asset name unchanged) or point the entry at npm.`,
-      ),
-    )
+  }
+  // A catalogue entry can point at a GitHub release asset instead of npm. When
+  // the newest release is older than this directory, the entry serves code the
+  // description no longer matches — a reviewer blocked a submission for exactly
+  // that (the entry said 1.2.7, the asset was still 1.2.6).
+  let releaseInfo = opts.releaseInfo ?? null
+  if (releaseInfo === null) {
+    try {
+      const res = await fetch(`https://api.github.com/repos/${slug}/releases/latest`, {
+        signal: AbortSignal.timeout(timeoutMs),
+        headers: { 'user-agent': 'dsh-publish-gate', accept: 'application/vnd.github+json' },
+      })
+      if (res.ok) releaseInfo = await res.json()
+    } catch {
+      // no network, no releases, or a rate limit — the rule stays quiet
+    }
+  }
+  const releaseTag = typeof releaseInfo?.tag_name === 'string' ? releaseInfo.tag_name.replace(/^v/, '') : null
+  if (releaseTag && pkgVersion && releaseTag !== pkgVersion) {
+    const older = compareVersions(releaseTag, pkgVersion) < 0
+    out.push(
+      F(
+        'market-release-behind',
+        'warn',
+        `the newest GitHub release is ${releaseTag}, this directory says ${pkgVersion}`,
+        older
+          ? 'An entry that installs releases/latest/download/<asset> serves the older code while the description is written for the newer version — a reviewer reads that as a false claim.'
+          : `The release is ahead of package.json, so what the release ships is not what this directory builds.`,
+        `Cut a ${pkgVersion} release (asset name unchanged) or point the entry at npm.`,
+      ),
+    )
   }
   return out
 }
@@ -1266,22 +1266,22 @@ export async function checkPack(dir, opts = {}) {
         'Add "lib" to files.',
       ),
     )
-  }
-  // npm does not force-include a changelog the way it does README and LICENSE,
-  // so a CHANGELOG.md that is not listed in `files` never reaches the registry
-  // page — the file exists, the author updates it, and nobody installing the
-  // package can see it. I hit this the first time I added one.
-  const changelogOnDisk = ['CHANGELOG.md', 'CHANGELOG', 'HISTORY.md'].find((f) => existsSync(join(dir, f)))
-  if (changelogOnDisk && !paths.includes(changelogOnDisk)) {
-    out.push(
-      F(
-        'changelog-not-shipped',
-        'warn',
-        `${changelogOnDisk} is not in the tarball`,
-        'npm force-includes README and LICENSE but not the changelog, so the file you keep updating is invisible on the package page.',
-        `Add "${changelogOnDisk}" to files.`,
-      ),
-    )
+  }
+  // npm does not force-include a changelog the way it does README and LICENSE,
+  // so a CHANGELOG.md that is not listed in `files` never reaches the registry
+  // page — the file exists, the author updates it, and nobody installing the
+  // package can see it. I hit this the first time I added one.
+  const changelogOnDisk = ['CHANGELOG.md', 'CHANGELOG', 'HISTORY.md'].find((f) => existsSync(join(dir, f)))
+  if (changelogOnDisk && !paths.includes(changelogOnDisk)) {
+    out.push(
+      F(
+        'changelog-not-shipped',
+        'warn',
+        `${changelogOnDisk} is not in the tarball`,
+        'npm force-includes README and LICENSE but not the changelog, so the file you keep updating is invisible on the package page.',
+        `Add "${changelogOnDisk}" to files.`,
+      ),
+    )
   }
   if (json?.dsh?.bundle?.patch && !paths.includes(String(json.dsh.bundle.patch).replace(/^\.\//, ''))) {
     out.push(
@@ -1401,6 +1401,10 @@ const RUNNER = `
 import { pathToFileURL } from 'node:url'
 import { join } from 'node:path'
 const dir = process.argv[1]
+// The entry is whatever package.json says it is. Assuming lib/index.js
+// reported a hard load failure for every plugin that ships index.mjs or a
+// dsh/ folder instead - two of the thirty-one installed plugins.
+const entryPath = process.argv[2] || join(dir, 'lib', 'index.js')
 const registered = []
 // The host renders \`parameters\` into the prompt and never validates the value
 // against it, so a typo like "strin" silently removes the type hint.
@@ -1528,7 +1532,7 @@ const validateValue = (schema, value, path) => {
 const emit = (payload) => process.stdout.write('\\n@@PG@@' + JSON.stringify(payload) + '\\n')
 let stage = 'import'
 try {
-  const mod = await import(pathToFileURL(join(dir, 'lib', 'index.js')).href)
+  const mod = await import(pathToFileURL(entryPath).href)
   stage = 'apply'
   if (typeof mod.apply !== 'function') throw new Error('lib/index.js does not export apply')
   await mod.apply(ctx, {})
@@ -1594,16 +1598,51 @@ try {
   }
   emit({ ok: true, tools: registered.map(({ run, ...rest }) => rest), badParamTypes, calls, fuzzIssues })
 } catch (error) {
-  emit({ ok: false, stage, error: String((error && error.message) || error) })
+  emit({ ok: false, stage, error: String((error && error.message) || error), code: String((error && error.code) || '') })
 }
 process.exit(0)
 `
 
+export function entryFile(dir) {
+  const json = readPkgJson(dir)
+  if (!json) return null
+  const pick = (value) => {
+    if (typeof value === 'string') return value
+    if (value && typeof value === 'object') {
+      for (const key of ['import', 'node', 'default', 'require']) {
+        const got = pick(value[key])
+        if (got) return got
+      }
+    }
+    return null
+  }
+  const candidates = [pick(json.exports?.['.']), pick(json.exports), pick(json.main), 'lib/index.js', 'index.js']
+  for (const rel of candidates) {
+    if (typeof rel !== 'string' || !rel || rel.includes('*')) continue
+    const abs = join(dir, rel.replace(/^\.\//, ''))
+    if (existsSync(abs)) return abs
+  }
+  return null
+}
+
 export async function checkToolRegistrations(dir, opts = {}) {
   const out = []
+  const entry = entryFile(dir)
+  if (!entry) {
+    out.push(
+      F(
+        'entry-missing',
+        'error',
+        'no entry file could be resolved',
+        'package.json names no file that exists, so the host cannot import anything.',
+        'Point main or exports["."] at the file you ship.',
+      ),
+    )
+    return { findings: out, tools: null }
+  }
   let payload = null
   try {
-    const { stdout } = await runFile(process.execPath, ['--input-type=module', '-e', RUNNER, dir], {
+    const { stdout } = await runFile(process.execPath, ['--input-type=module', '-e', RUNNER, dir, entry], {
       timeout: opts.timeoutMs ?? 20_000,
       maxBuffer: 4 * 1024 * 1024,
       windowsHide: true,
@@ -1632,6 +1671,26 @@ export async function checkToolRegistrations(dir, opts = {}) {
   }
 
   if (!payload.ok) {
+    // A bare specifier that is not installed beside the plugin may still be
+    // provided by the host: every plugin importing @deepseek-ai/* peers failed
+    // this way, and calling that a defect makes the whole runtime layer noise.
+    const missing = /Cannot find package '([^']+)'/.exec(String(payload.error || ''))
+    if (payload.stage === 'import' && payload.code === 'ERR_MODULE_NOT_FOUND' && missing) {
+      const spec = missing[1]
+      const peers = readPkgJson(dir)?.peerDependencies || {}
+      if (spec.startsWith('@deepseek-ai/') || Object.prototype.hasOwnProperty.call(peers, spec)) {
+        out.push(
+          F(
+            'entry-import-unresolved',
+            'warn',
+            `imports "${spec}", which is not installed next to the plugin`,
+            'That package is a peer the host provides, so this is not a defect — but a bare import of something the host does not provide fails at load time with the same message.',
+            'Confirm the host really supplies it, or declare it in dependencies.',
+          ),
+        )
+        return { findings: out, tools: null }
+      }
+    }
     out.push(
       F(
         payload.stage === 'import' ? 'entry-import-failed' : 'apply-threw',
@@ -1810,18 +1869,40 @@ export async function checkToolRegistrations(dir, opts = {}) {
 
 export function checkLibHygiene(dir) {
   const out = []
+  const clientRel = String(clientTarget(readPkgJson(dir)) || '').replace(/^\.\//, '')
   for (const file of walkFiles(join(dir, 'lib'), /\.(?:js|mjs|cjs)$/)) {
     const text = safeText(file)
     if (text === null) continue
     const rel = relative(dir, file).replace(/\\/g, '/')
     const lines = text.split('\n')
+    let logCount = 0
+    let logFirst = 0
     for (let i = 0; i < lines.length; i++) {
       const code = stripComment(lines[i])
       const at = `${rel}:${i + 1}`
-      if (/\bconsole\.log\s*\(/.test(code)) out.push(F('lib-console-log', 'warn', `${at} calls console.log`, 'Tool output is the channel; a stray console.log lands in the host log and never reaches the model. Harmless, but it is debug residue in a published file.', 'Delete it, or use console.error if it is a real warning.'))
+      const logSeen = code.match(/\bconsole\.log\s*\(/g)
+      if (logSeen) {
+        if (!logFirst) logFirst = i + 1
+        logCount += logSeen.length
+      }
       if (/(?:^|[;{}\s])debugger\s*;?\s*$/.test(code)) out.push(F('lib-debugger', 'error', `${at} has a debugger statement`, 'In a published package a debugger statement stops every consumer who reaches that path.', 'Remove it.'))
       if (/(?:[A-Za-z]:[\\/]{1,2}Users[\\/]|\/Users\/)/.test(code)) out.push(F('lib-hardcoded-path', 'warn', `${at} contains an absolute path from this machine`, "It does not exist on the consumer's machine, so that code path silently fails there.", 'Resolve it from homedir() or ctx instead.'))
     }
+    // One line per file, not per call. A bundled client carried 459
+    // console.log calls and reported 459 warnings - that is how a gate gets
+    // ignored. The client bundle is exempt: there, console.log is the debug
+    // channel, not residue in the host log.
+    if (logCount && rel !== clientRel) {
+      out.push(
+        F(
+          'lib-console-log',
+          'warn',
+          `${rel} calls console.log ${logCount} time(s), first at line ${logFirst}`,
+          'Tool output is the channel; a stray console.log lands in the host log and never reaches the model. Harmless, but it is debug residue in a published file.',
+          'Delete it, or use console.error if it is a real warning.',
+        ),
+      )
+    }
     if (/new\s+URL\s*\([\s\S]{0,240}?\)\s*\.pathname/.test(text)) {
       out.push(
         F(
@@ -2403,6 +2484,11 @@ export function checkDependencies(dir) {
     )
   }
 
+  // A package that ships a client bundle inlines its dependencies at build
+  // time, so "lib/ never imports it" is true and not actionable: the code is
+  // already inside the bundle. Six of the thirty-one installed plugins are
+  // built this way and produced fifty-nine of these notes between them.
+  if (clientRel) return out
   for (const name of deps) {
     if (used.has(name)) continue
     out.push(
@@ -2510,29 +2596,29 @@ export async function checkTraceability(dir, opts = {}) {
     return out
   }
 
-  // No answer from the remote. Two very different situations hide here: a repo
-  // with no `origin` at all, where the local tag is the only truth and a missing
-  // one is real; and a repo whose `origin` simply could not be reached, where
-  // local HEAD is not the shipped commit (the API pusher builds its own commit)
-  // and the tag usually exists. A check that cannot see the truth must not claim
-  // a defect — this reported six false positives on a day GitHub was down.
-  const remotes = opts.remotes === undefined ? await gitOut(dir, ['remote']) : opts.remotes
-  const hasOrigin = typeof remotes === 'string' && remotes.split('\n').map((r) => r.trim()).includes('origin')
-  if (hasOrigin) {
-    if (!localHasIt) {
-      out.push(
-        F(
-          'git-tag-unverified',
-          'info',
-          `could not check whether v${version} is tagged on the remote`,
-          'origin could not be read, and with an API-pushed commit the local HEAD is not the commit that shipped, so the local tag list proves nothing either way.',
-          'Re-run when the network is back — the tag may well exist.',
-        ),
-      )
-    }
-    return out
-  }
-
+  // No answer from the remote. Two very different situations hide here: a repo
+  // with no `origin` at all, where the local tag is the only truth and a missing
+  // one is real; and a repo whose `origin` simply could not be reached, where
+  // local HEAD is not the shipped commit (the API pusher builds its own commit)
+  // and the tag usually exists. A check that cannot see the truth must not claim
+  // a defect — this reported six false positives on a day GitHub was down.
+  const remotes = opts.remotes === undefined ? await gitOut(dir, ['remote']) : opts.remotes
+  const hasOrigin = typeof remotes === 'string' && remotes.split('\n').map((r) => r.trim()).includes('origin')
+  if (hasOrigin) {
+    if (!localHasIt) {
+      out.push(
+        F(
+          'git-tag-unverified',
+          'info',
+          `could not check whether v${version} is tagged on the remote`,
+          'origin could not be read, and with an API-pushed commit the local HEAD is not the commit that shipped, so the local tag list proves nothing either way.',
+          'Re-run when the network is back — the tag may well exist.',
+        ),
+      )
+    }
+    return out
+  }
+
   if (typeof atHead === 'string' && !localHasIt) {
     const exists = opts.tagExists === undefined ? await gitOut(dir, ['rev-parse', '--verify', '--quiet', `refs/tags/v${version}`]) : opts.tagExists ? 'sha' : null
     out.push(
@@ -2603,7 +2689,7 @@ const RULE_ORDER = [
   'client-inject-missing-slots', 'client-inject-missing-sidebarRightTabs', 'client-unavailable',
   'no-patch-file', 'no-insert-row', 'insert-missing-name', 'insert-name-mismatch',
   'patch-name-unresolvable', 'tests-fail', 'tests-timeout', 'tests-not-run', 'no-name-export', 'no-apply-export', 'no-inject', 'require-in-esm',
-  'entry-import-failed', 'apply-threw', 'tools-unavailable',
+  'entry-missing', 'entry-import-failed', 'entry-import-unresolved', 'apply-threw', 'tools-unavailable',
   'inject-missing-tools', 'inject-missing-web', 'inject-missing-webServer', 'inject-missing-timer',
   'inject-unused-service',
   'tool-missing-name', 'tool-duplicate-name', 'tool-missing-execute', 'tool-present-call-throws',

package/lib/index.js

@@ -28,8 +28,8 @@ import {
   compareVersions,
   latestPublished,
   renderReport,
-  runArtifactChecks,
-  checkTestRun,
+  runArtifactChecks,
+  checkTestRun,
   straySeverities,
   runStaticChecks,
 } from './engine.js'
@@ -104,7 +104,7 @@ export function apply(ctx, config = {}) {
           skipNetwork: { type: 'boolean', description: 'Skip the npm registry and GitHub checks (default false).' },
           skipPack: { type: 'boolean', description: 'Skip `npm pack --dry-run` (default false). Faster, but says nothing about the real tarball.' },
           skipTools: { type: 'boolean', description: 'Skip the isolated import of the plugin entry (default false).' },
-          skipClient: { type: 'boolean', description: 'Skip the isolated load of the browser bundle (default false).' },
+          skipClient: { type: 'boolean', description: 'Skip the isolated load of the browser bundle (default false).' },
           skipTests: { type: 'boolean', description: 'Skip running the test suite (default false). The suite is the only check that reads the code rather than the paperwork.' },
         },
       },
@@ -114,21 +114,21 @@ export function apply(ctx, config = {}) {
         const findings = runStaticChecks(dir)
         const artifact = await runArtifactChecks(dir, { skipPack: args.skipPack, skipTools: args.skipTools, skipClient: args.skipClient })
         findings.push(...artifact.findings)
-        const tests = args.skipTests ? null : await checkTestRun(dir, { timeoutMs: cfg.testTimeoutMs })
-        if (tests) findings.push(...tests)
+        const tests = args.skipTests ? null : await checkTestRun(dir, { timeoutMs: cfg.testTimeoutMs })
+        if (tests) findings.push(...tests)
         if (!args.skipNetwork) findings.push(...(await networkGate(dir)))
-        // A finding with an unexpected severity is invisible to the counters
-        // below, so the rule silently never reports. Make that loud instead.
-        const stray = straySeverities(findings)
-        if (stray.length > 0) {
-          findings.push({
-            rule: 'internal-bad-severity',
-            severity: 'error',
-            title: `these rules built a finding with an unknown severity: ${stray.join(", ")}`,
-            detail: 'The gate counted them as nothing, so they never appeared in a report. This is a bug in publish-gate, not in the plugin being gated.',
-            fix: 'Report it: the severity slot of F(...) took something other than error/warn/info.',
-          })
-        }
+        // A finding with an unexpected severity is invisible to the counters
+        // below, so the rule silently never reports. Make that loud instead.
+        const stray = straySeverities(findings)
+        if (stray.length > 0) {
+          findings.push({
+            rule: 'internal-bad-severity',
+            severity: 'error',
+            title: `these rules built a finding with an unknown severity: ${stray.join(", ")}`,
+            detail: 'The gate counted them as nothing, so they never appeared in a report. This is a bug in publish-gate, not in the plugin being gated.',
+            fix: 'Report it: the severity slot of F(...) took something other than error/warn/info.',
+          })
+        }
         const counts = {
           error: findings.filter((f) => f.severity === 'error').length,
           warn: findings.filter((f) => f.severity === 'warn').length,
@@ -412,6 +412,11 @@ export function apply(ctx, config = {}) {
         const repo = json.repository?.url?.match(/github\.com[:/]([^/]+)\/([^/.]+)/)?.[2] || json.name.replace(/^@[^/]+\//, '')
         const { existsSync } = await import('node:fs')
         const hasGit = existsSync(join(dir, '.git'))
+        // npm publishes to `latest` whatever the version suffix says, so a
+        // prerelease needs an explicit tag or it goes out to everyone.
+        const preTag = /^\d+\.\d+\.\d+-/.test(json.version || '')
+        const tag = preTag ? (json.publishConfig?.tag && json.publishConfig.tag !== 'latest' ? json.publishConfig.tag : 'next') : null
+        const publishCmd = `npm publish --access public${tag ? ` --tag ${tag}` : ''}`
         const steps = [
           {
             name: 'git init and commit',
@@ -433,7 +438,7 @@ export function apply(ctx, config = {}) {
           },
           {
             name: 'npm publish',
-            command: process.platform === 'win32' ? 'cmd /c "npm publish --access public"' : 'npm publish --access public',
+            command: process.platform === 'win32' ? `cmd /c "${publishCmd}"` : publishCmd,
             done: false,
             note:
               `a bare (unscoped) name can return 403 with a granular token — "${json.name}" is ${json.name.startsWith('@') ? 'scoped, fine' : 'UNSCOPED, rename it'}` +
@@ -447,7 +452,14 @@ export function apply(ctx, config = {}) {
             command: `publish_gate_verify({ dir: "${dir.replace(/\\/g, '\\\\')}" })`,
             done: false,
             note: 'the registry answers 202 and then 404s for about a minute, so a mismatch right after publish is normal; the shasum comparison is exact once it settles',
-          },          {
+          },
+          {
+            name: 'tag the shipped commit',
+            command: `git tag v${json.version} && git push origin v${json.version}`,
+            done: false,
+            note: 'a GitHub release, a changelog entry and the market listing all point at a commit — none of them can point at one that was never tagged',
+          },
+          {
             name: 'market entry',
             command: `write data/plugins/${owner}__${repo}.yml with url / name / category / description{en,zh}`,
             done: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bushizhanghan/dsh-publish-gate",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Pre-publish gate for DSH plugins: manifest, dependencies, artifact, runtime, browser half, traceability and market readiness — plus an input fuzzer that drives every declared parameter with the wrong type. 发布前的七层门禁 + 入参模糊测试。",
   "type": "module",
   "main": "lib/index.js",