@bushizhanghan/dsh-publish-gate 0.3.0 → 0.3.2

package/README.md

@@ -37,7 +37,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | `publish_gate_market` | 校验市场条目 YAML（url/name/category/description 双语）；传 `dir` 则改查只有线上才能回答的三件事：这个仓库**已经在目录里**（再开 PR 就是重复条目）、另一个条目也在发同一个 npm 包、仓库还**不满 24 小时**（提交门禁会失败并自己重跑） |
 | `publish_gate_next_version` | 当前版本、是否已被 registry 占用、建议 bump 到多少（本地比 npm 旧时从 npm 的 latest 往上加，不会推荐一个已被占用的版本） |
 | `publish_gate_doctor` | 扫整个目录，按 blocker 数排序，附带每个插件的真实包体积，看哪个还不能发 |
-| `publish_gate_commands` | 按顺序列出发布命令，并标出这台机器已经走到哪一步 |
+| `publish_gate_commands` | 按顺序列出发布命令，并标出这台机器已经走到哪一步。命令是**这台机器上真能跑的形式**：Windows 下 `npm publish` 走 `cmd /c`（PowerShell 的 `npm.ps1` 常被执行策略拦掉），`npm publish` 后面紧跟一条 `publish_gate_verify` |
 
 ## 检查清单
 
@@ -135,7 +135,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 
 ### 代码卫生
 
-`lib-debugger`（error）、`lib-console-log`、`lib-hardcoded-path`（`C:\Users\...` 硬编码）、`lib-url-pathname`（`new URL(...).pathname` 在中文路径上会百分号编码，得用 `fileURLToPath`）。
+`lib-debugger`（error）、`lib-console-log`、`lib-hardcoded-path`（`C:\Users\...` 硬编码）、`lib-url-pathname`（`new URL(...).pathname` 在中文路径上会百分号编码，得用 `fileURLToPath`）、`node-too-old`（`engines.node` 写着 `>=18`，`lib/` 里却用了 `Object.groupBy`（21）或 `Promise.withResolvers`（22）。npm 对 `engines` 只是警告，照样装上，然后在 import 那一刻抛——用户看到的是「插件坏了」，不是版本不匹配）。字符串和注释里的同名文字不算。
 
 ### 构建产物：`src/` 和 `lib/` 谁更新
 
@@ -183,8 +183,8 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 ## 开发
 
 ```sh
-node --test                      # 64 个引擎单测
-node test/integration.test.mjs   # 24 条集成断言（9 个真实插件作 fixture）
+node --test                      # 65 个引擎单测
+node test/integration.test.mjs   # 26 条集成断言（9 个真实插件作 fixture）
 ```
 
 ## License

package/lib/engine.js

@@ -1202,6 +1202,63 @@ export function checkLibHygiene(dir) {
   return out
 }
 
+/**
+ * Features that need a newer Node than the manifest promises.
+ *
+ * `engines.node` is only advisory — npm warns and installs anyway — so a plugin
+ * that says `>=20` and uses `Object.groupBy` (21) breaks on exactly the Node it
+ * advertised. Each entry is [name, regex, minimum major], newest evidence only.
+ */
+const NODE_FEATURES = [
+  ['Object.groupBy / Map.groupBy', /\b(?:Object|Map)\.groupBy\b/, 21],
+  ['Array.fromAsync', /\bArray\.fromAsync\b/, 22],
+  ['Promise.withResolvers', /\bPromise\.withResolvers\b/, 22],
+  ['import.meta.dirname', /\bimport\.meta\.dirname\b/, 21],
+  ['Array.prototype.toSorted / toReversed / toSpliced / with', /\.(?:toSorted|toReversed|toSpliced)\(|\.with\(/, 20],
+  ['structuredClone', /\bstructuredClone\s*\(/, 17],
+]
+
+/** `>=22.1.0`, `^20`, `>=18 <21` -> the first major it allows. */
+const minNodeMajor = (range) => {
+  if (typeof range !== 'string') return null
+  const m = /(\d+)/.exec(range)
+  return m ? Number(m[1]) : null
+}
+
+export function checkNodeVersion(dir) {
+  const declared = minNodeMajor(readPkgJson(dir)?.engines?.node)
+  if (declared === null) return []
+  const out = []
+  const seen = new Set()
+  for (const file of walkFiles(join(dir, 'lib'), /\.(?:js|mjs|cjs)$/)) {
+    const text = safeText(file)
+    if (text === null) continue
+    // Strings are stripped first: a tool description that names a feature is
+    // prose, not a call (the same false positive require-in-esm had).
+    const code = text
+      .split('\n')
+      .map(stripComment)
+      .join('\n')
+      .replace(/'(?:[^'\\\n]|\\.)*'/g, "''")
+      .replace(/"(?:[^"\\\n]|\\.)*"/g, '""')
+      .replace(/`(?:[^`\\]|\\.)*`/g, '``')
+    for (const [name, re, needs] of NODE_FEATURES) {
+      if (needs <= declared || seen.has(name) || !re.test(code)) continue
+      seen.add(name)
+      out.push(
+        F(
+          'node-too-old',
+          'warn',
+          `engines.node says ${JSON.stringify(readPkgJson(dir).engines.node)} but lib/ uses ${name} (needs >=${needs})`,
+          'npm only warns about engines, so it installs on the older Node and throws at import time — the consumer sees a broken plugin, not a version mismatch.',
+          `Raise engines.node to >=${needs}, or stop using ${name}.`,
+        ),
+      )
+    }
+  }
+  return out
+}
+
 const INJECT_HINTS = [
   ['tools', /ctx\.tools\b/],
   ['web', /ctx\.web\b/],
@@ -1564,6 +1621,7 @@ export function runStaticChecks(dir) {
     ...checkInjectCoverage(dir),
     ...checkClientHalf(dir),
     ...checkLibHygiene(dir),
+    ...checkNodeVersion(dir),
     ...checkBuildFreshness(dir),
     ...checkDocs(dir),
     ...checkTests(dir),
@@ -1586,7 +1644,7 @@ const RULE_ORDER = [
   'inject-unused-service',
   'tool-missing-name', 'tool-duplicate-name', 'tool-missing-execute', 'tool-present-call-throws',
   'tool-bad-card-kind', 'tool-missing-output-schema', 'tool-none-registered', 'tool-bad-parameter-type',
-  'lib-debugger', 'lib-console-log', 'lib-hardcoded-path', 'lib-url-pathname', 'stale-build', 'hand-edited-build',
+  'lib-debugger', 'lib-console-log', 'lib-hardcoded-path', 'lib-url-pathname', 'node-too-old', 'stale-build', 'hand-edited-build',
   'pack-omits-lib', 'pack-omits-patch', 'pack-omits-client', 'pack-oversize', 'pack-omits-readme', 'pack-omits-license', 'pack-ships-secret',
   'pack-unexpected-dir', 'pack-script-build', 'pack-unavailable',
   'no-license', 'license-mismatch', 'version-taken', 'registry-unreachable', 'publish-not-served',

package/lib/index.js

@@ -379,11 +379,21 @@ export function apply(ctx, config = {}) {
           },
           {
             name: 'npm publish',
-            command: `npm publish --access public`,
+            command: process.platform === 'win32' ? 'cmd /c "npm publish --access public"' : 'npm publish --access public',
             done: false,
-            note: `a bare (unscoped) name can return 403 with a granular token — "${json.name}" is ${json.name.startsWith('@') ? 'scoped, fine' : 'UNSCOPED, rename it'}`,
+            note:
+              `a bare (unscoped) name can return 403 with a granular token — "${json.name}" is ${json.name.startsWith('@') ? 'scoped, fine' : 'UNSCOPED, rename it'}` +
+              (process.platform === 'win32'
+                ? '. On Windows the bare form fails under PowerShell when npm.ps1 is blocked by execution policy, so it is wrapped in cmd /c'
+                : '') +
+              '. Run `npm publish --dry-run` first if you want to see the file list without spending the version.',
           },
           {
+            name: 'verify the published bytes',
+            command: `publish_gate_verify({ dir: "${dir.replace(/\\/g, '\\\\')}" })`,
+            done: false,
+            note: 'the registry answers 202 and then 404s for about a minute, so a mismatch right after publish is normal; the shasum comparison is exact once it settles',
+          },          {
             name: 'market entry',
             command: `write data/plugins/${owner}__${repo}.yml with url / name / category / description{en,zh}`,
             done: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bushizhanghan/dsh-publish-gate",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Helps DSH plugin AUTHORS publish their plugins: a gate that turns every silent failure in the publish path into a deterministic check. Manifest layer — package.json completeness, BOM, YAML/JSON parseability, entry paths that point at no file, a patch the manifest never declares, patch insert correctness, a build whose lib/ is older than src/, inject services that are missing or misspelled, npm scope permissions, GitHub repo and token state, market entry format, LICENSE/README, tests. Artifact layer — runs `npm pack --dry-run` and reads what npm will really ship: code missing from the tarball, an unpacked patch, oversize packages, dev directories. Runtime layer — imports the entry in an isolated child process, calls apply(ctx), and reports tools that never register, missing execute, duplicate names, throwing presentCall and card kinds the host does not render. Browser half — loads the client bundle against a fake window.__ModuleLoader__ and reports a bundle that never loads, returns no apply, throws, registers nothing, or uses a service its own inject array omits, because a panel that never appears looks like a UI bug, not a packaging one. Then GitHub + npm + market, and a post-publish shasum check that proves the registry holds these exact bytes. 帮助插件作者一键发布：写完插件后跑一遍门禁（清单 / 产物 / 运行时 / 浏览器半边），把发布链路上的每个静默坑变成确定性检查，然后 GitHub + npm + 市场一键三连。",
   "type": "module",
   "main": "lib/index.js",