@bushizhanghan/dsh-publish-gate 0.3.0 → 0.3.1

package/README.md

@@ -37,7 +37,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | `publish_gate_market` | 校验市场条目 YAML（url/name/category/description 双语）；传 `dir` 则改查只有线上才能回答的三件事：这个仓库**已经在目录里**（再开 PR 就是重复条目）、另一个条目也在发同一个 npm 包、仓库还**不满 24 小时**（提交门禁会失败并自己重跑） |
 | `publish_gate_next_version` | 当前版本、是否已被 registry 占用、建议 bump 到多少（本地比 npm 旧时从 npm 的 latest 往上加，不会推荐一个已被占用的版本） |
 | `publish_gate_doctor` | 扫整个目录，按 blocker 数排序，附带每个插件的真实包体积，看哪个还不能发 |
-| `publish_gate_commands` | 按顺序列出发布命令，并标出这台机器已经走到哪一步 |
+| `publish_gate_commands` | 按顺序列出发布命令，并标出这台机器已经走到哪一步。命令是**这台机器上真能跑的形式**：Windows 下 `npm publish` 走 `cmd /c`（PowerShell 的 `npm.ps1` 常被执行策略拦掉），`npm publish` 后面紧跟一条 `publish_gate_verify` |
 
 ## 检查清单
 
@@ -184,7 +184,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 
 ```sh
 node --test                      # 64 个引擎单测
-node test/integration.test.mjs   # 24 条集成断言（9 个真实插件作 fixture）
+node test/integration.test.mjs   # 26 条集成断言（9 个真实插件作 fixture）
 ```
 
 ## License

package/lib/index.js

@@ -379,11 +379,21 @@ export function apply(ctx, config = {}) {
           },
           {
             name: 'npm publish',
-            command: `npm publish --access public`,
+            command: process.platform === 'win32' ? 'cmd /c "npm publish --access public"' : 'npm publish --access public',
             done: false,
-            note: `a bare (unscoped) name can return 403 with a granular token — "${json.name}" is ${json.name.startsWith('@') ? 'scoped, fine' : 'UNSCOPED, rename it'}`,
+            note:
+              `a bare (unscoped) name can return 403 with a granular token — "${json.name}" is ${json.name.startsWith('@') ? 'scoped, fine' : 'UNSCOPED, rename it'}` +
+              (process.platform === 'win32'
+                ? '. On Windows the bare form fails under PowerShell when npm.ps1 is blocked by execution policy, so it is wrapped in cmd /c'
+                : '') +
+              '. Run `npm publish --dry-run` first if you want to see the file list without spending the version.',
           },
           {
+            name: 'verify the published bytes',
+            command: `publish_gate_verify({ dir: "${dir.replace(/\\/g, '\\\\')}" })`,
+            done: false,
+            note: 'the registry answers 202 and then 404s for about a minute, so a mismatch right after publish is normal; the shasum comparison is exact once it settles',
+          },          {
             name: 'market entry',
             command: `write data/plugins/${owner}__${repo}.yml with url / name / category / description{en,zh}`,
             done: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bushizhanghan/dsh-publish-gate",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Helps DSH plugin AUTHORS publish their plugins: a gate that turns every silent failure in the publish path into a deterministic check. Manifest layer — package.json completeness, BOM, YAML/JSON parseability, entry paths that point at no file, a patch the manifest never declares, patch insert correctness, a build whose lib/ is older than src/, inject services that are missing or misspelled, npm scope permissions, GitHub repo and token state, market entry format, LICENSE/README, tests. Artifact layer — runs `npm pack --dry-run` and reads what npm will really ship: code missing from the tarball, an unpacked patch, oversize packages, dev directories. Runtime layer — imports the entry in an isolated child process, calls apply(ctx), and reports tools that never register, missing execute, duplicate names, throwing presentCall and card kinds the host does not render. Browser half — loads the client bundle against a fake window.__ModuleLoader__ and reports a bundle that never loads, returns no apply, throws, registers nothing, or uses a service its own inject array omits, because a panel that never appears looks like a UI bug, not a packaging one. Then GitHub + npm + market, and a post-publish shasum check that proves the registry holds these exact bytes. 帮助插件作者一键发布：写完插件后跑一遍门禁（清单 / 产物 / 运行时 / 浏览器半边），把发布链路上的每个静默坑变成确定性检查，然后 GitHub + npm + 市场一键三连。",
   "type": "module",
   "main": "lib/index.js",