@bushizhanghan/dsh-publish-gate 0.7.0 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +104 -83
- package/README.md +224 -223
- package/lib/engine.js +2202 -2144
- package/lib/index.js +501 -473
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,83 +1,104 @@
|
|
|
1
|
-
# Changelog
|
|
2
|
-
|
|
3
|
-
## 0.
|
|
4
|
-
|
|
5
|
-
- `tool-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
## 0.3.
|
|
58
|
-
|
|
59
|
-
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
## 0.8.0
|
|
4
|
+
|
|
5
|
+
- `tool-input-throws` (error): `publish_gate_tools` gained `fuzz` and `skip`. With `fuzz: true` it drives
|
|
6
|
+
every declared parameter with a wrong-typed value and reports the tools that throw instead of answering.
|
|
7
|
+
The host never validates a call against `parameters`, so those values really arrive — this rule exists
|
|
8
|
+
because the same sweep found 12 real crashes across this workspace's own plugins (a number reaching
|
|
9
|
+
`path.join` via `session`, `profile`, `casePath` and `workspace`), all of which handed the caller a raw
|
|
10
|
+
Node TypeError. Only a throw counts: a filter that ignores a number and returns the unfiltered list still
|
|
11
|
+
answers, and every optional boolean treats any truthy value the same way.
|
|
12
|
+
- One finding per tool+parameter, not one per wrong value.
|
|
13
|
+
## 0.7.1
|
|
14
|
+
|
|
15
|
+
- Fixed: a non-string `dir` made every path tool throw a raw Node `TypeError`
|
|
16
|
+
(`The "path" argument must be of type string. Received type number (123)`).
|
|
17
|
+
The host never validates tool input against `parameters`, so a number or an
|
|
18
|
+
object really does reach `path.join`. A wrong type is now refused with a
|
|
19
|
+
message, and it deliberately does NOT fall back to the cwd — that would gate a
|
|
20
|
+
different plugin than the one that was asked for.
|
|
21
|
+
- Integration test added: every tool that takes `dir` is driven with `123`,
|
|
22
|
+
`true`, `{}` and `[]` and must answer with `ok: false`, never throw.
|
|
23
|
+
|
|
24
|
+
## 0.7.0
|
|
25
|
+
|
|
26
|
+
- `tool-output-invalid` (error): a tool result its own `output.schema` rejects. The host validates every
|
|
27
|
+
result and throws `ToolOutputError`, so the tool is unusable from the first call. Only checked when the
|
|
28
|
+
caller names the tool in `call`, because calling a tool can launch applications or write files.
|
|
29
|
+
- `npm-not-logged-in` (error) / `npm-scope-mismatch` (warn): ask npm who it is before spending a publish.
|
|
30
|
+
ENEEDAUTH and the 403 that names neither the token nor the scope both become a message instead of a loss.
|
|
31
|
+
- `readme-wrong-package` (error): the README install line names a different package — a README copied from
|
|
32
|
+
another plugin. Whoever follows it installs something else, and nothing fails because that package exists.
|
|
33
|
+
## 0.6.0
|
|
34
|
+
|
|
35
|
+
- New rule `tool-undeclared-param`: a tool whose `execute` reads `args.x` that
|
|
36
|
+
`parameters.properties` never declares. The host renders `parameters` into the
|
|
37
|
+
prompt and passes the model nothing else, so that value is undefined on every
|
|
38
|
+
real call — the code path exists and never runs, and nothing throws.
|
|
39
|
+
Covers `args.x`, `args['x']` and `const { x } = args`.
|
|
40
|
+
|
|
41
|
+
## 0.5.0
|
|
42
|
+
|
|
43
|
+
- New layer: traceability. `git-uncommitted` (files that ship in the tarball are
|
|
44
|
+
not committed), `git-tag-missing` (no `v<version>` tag on HEAD),
|
|
45
|
+
`git-tag-elsewhere` (the tag exists but points at another commit).
|
|
46
|
+
- The incident behind it: a 1.2.7 went to npm while the GitHub release still
|
|
47
|
+
said 1.2.6 and the market entry still pointed at the old tarball.
|
|
48
|
+
|
|
49
|
+
## 0.4.0
|
|
50
|
+
|
|
51
|
+
- New layer: dependency truth. `undeclared-import` (lib/ imports a package
|
|
52
|
+
package.json never declares), `dep-in-dev-only` (only devDependencies satisfy
|
|
53
|
+
it — npm never installs those for the consumer), `unused-dependency` (info).
|
|
54
|
+
- New rule `version-behind-latest`: publishing under the live `latest` is
|
|
55
|
+
accepted by npm and reaches nobody.
|
|
56
|
+
|
|
57
|
+
## 0.3.4
|
|
58
|
+
|
|
59
|
+
- `tool-call-slow` split from `tool-call-throws`: a timeout is not a defect.
|
|
60
|
+
|
|
61
|
+
## 0.3.3
|
|
62
|
+
|
|
63
|
+
- `publish_gate_tools` accepts `call: ["name"]` to really invoke a tool, opt-in
|
|
64
|
+
because some tools open applications or write files.
|
|
65
|
+
|
|
66
|
+
## 0.3.2
|
|
67
|
+
|
|
68
|
+
- New rule `node-too-old`: `engines.node` says one thing, `lib/` uses an API from
|
|
69
|
+
a newer Node. npm only warns on `engines`, so the plugin installs and then
|
|
70
|
+
throws at import.
|
|
71
|
+
|
|
72
|
+
## 0.3.1
|
|
73
|
+
|
|
74
|
+
- `publish_gate_commands` emits commands that actually run on this machine
|
|
75
|
+
(`cmd /c "npm publish --access public"` on Windows) and pairs the publish step
|
|
76
|
+
with a `publish_gate_verify` shasum check.
|
|
77
|
+
|
|
78
|
+
## 0.3.0
|
|
79
|
+
|
|
80
|
+
- New layer: the browser half. `checkClientHalf` / `checkClientRuntime` load the
|
|
81
|
+
bundle against a fake `window.__ModuleLoader__` and report a bundle that never
|
|
82
|
+
loads, never returns `apply`, throws, registers nothing, or uses a service its
|
|
83
|
+
`inject` array does not declare.
|
|
84
|
+
- New layer: market readiness — the repo is already listed, another entry
|
|
85
|
+
publishes the same npm name, or the repo is under 24 hours old (the gate fails
|
|
86
|
+
and reruns itself).
|
|
87
|
+
- New rules: `client-without-platform`, `pack-omits-client`, `pack-ships-secret`,
|
|
88
|
+
`private-field-set`, `publish-config-registry`, `tool-bad-parameter-type`,
|
|
89
|
+
`entry-path-missing`, `bundle-patch-not-declared`, `inject-unused-service`.
|
|
90
|
+
- New tool `publish_gate_client` (9 tools).
|
|
91
|
+
|
|
92
|
+
## 0.2.0
|
|
93
|
+
|
|
94
|
+
- New layers: artifact (`npm pack --dry-run` — what npm will really ship) and
|
|
95
|
+
runtime (import the entry in an isolated child process, call `apply`, report a
|
|
96
|
+
throwing import, a throwing apply, missing execute, duplicate tool names, a
|
|
97
|
+
throwing `presentCall`, and card kinds the host does not render).
|
|
98
|
+
- New tools `publish_gate_tools` and `publish_gate_verify`.
|
|
99
|
+
- Fixed: `bad-repo-url` never fired for the object form of `repository`.
|
|
100
|
+
|
|
101
|
+
## 0.1.0
|
|
102
|
+
|
|
103
|
+
- First release: manifest rules, `cordis.patch.yml` insert checks, README and
|
|
104
|
+
test presence, npm name and registry state.
|