@bushizhanghan/dsh-publish-gate 0.8.2 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.10.0
+
+- `client-double-load` (warn): the client probe now evaluates the bundle a second time against the same
+  `window`, with a loader that throws on a repeated registration. A bundle inserted by two patches (its own,
+  plus any sidebar plugin that injects `dsh-client-modules`) aborted web boot this way. A window-level guard
+  makes it a no-op, which is what the recommended bundle shape now shows.
+## 0.9.0
+
+- `checkChangelog()`: `changelog-missing-version` (warn), `changelog-no-versions` (warn), `no-changelog` (info).
+  The changelog is the only place a user can learn what a version changed; a bump without an entry is silent
+  drift, because npm publishes it anyway and the release notes stay one version behind. Headings accept
+  `## 1.2.3`, `### [v1.2.3]` and `# v1.2.3`.
+- An `engines-missing` rule was written and then deleted: `no-engines` already existed. Two rules for one
+  condition would have reported the same gap twice.
 ## 0.8.2
 
 - `publish_gate_verify` now returns `pending: true` when the wait runs out with the version still invisible.

package/README.md

@@ -72,7 +72,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | `readme-wrong-package` | README 的安装命令写的是**另一个包名**（从别的插件抄过来没改）。照着装的人装到别的插件上，而且不会报错——那个包真的存在 |
 
 ### 值得在发布前知道的（warn / info）
-`npm-scope-mismatch`（登录的账号不是包 scope 的所有者，PUT 会 403，而错误里既不说 token 也不说 scope——我为一个 403 花了一小时）、`unscoped-name`（granular token 的 403）、`repo-missing`、`patch-name-unresolvable`（junction 放错层级）、`inject-unused-service`（`inject` 里写了个拼错的服务名，cordis 一直等它，插件静默不激活）、`no-publish-config-access`（scoped 包没写 `publishConfig.access`，只是提醒，因为命令里本来就带 `--access public`）、`publish-config-registry`（`publishConfig.registry` 指到内网 registry，版本发到别人装不到的地方）、`no-readme` / `readme-no-install` / `readme-no-profile`、`license-mismatch`、`no-tests` / `no-test-files` / `no-test-script`、`no-engines`、`bad-repo-url`、`no-git` / `no-gitignore`、`readme-tool-undocumented`（README 没提这个工具）/ `readme-test-count`（README 写的测试数和真实数不一致），以及市场条目的 `market-*` 全系列。
+`npm-scope-mismatch`（登录的账号不是包 scope 的所有者，PUT 会 403，而错误里既不说 token 也不说 scope——我为一个 403 花了一小时）、`unscoped-name`（granular token 的 403）、`repo-missing`、`patch-name-unresolvable`（junction 放错层级）、`inject-unused-service`（`inject` 里写了个拼错的服务名，cordis 一直等它，插件静默不激活）、`no-publish-config-access`（scoped 包没写 `publishConfig.access`，只是提醒，因为命令里本来就带 `--access public`）、`publish-config-registry`（`publishConfig.registry` 指到内网 registry，版本发到别人装不到的地方）、`no-readme` / `readme-no-install` / `readme-no-profile`、`license-mismatch`、`no-tests` / `no-test-files` / `no-test-script`、`no-engines`、`bad-repo-url`、`no-git` / `no-gitignore`、`readme-tool-undocumented`（README 没提这个工具）/ `readme-test-count`（README 写的测试数和真实数不一致）、`changelog-missing-version`（要发的这个版本号在 CHANGELOG 里没有对应标题，npm 照样发，发布说明就永远落后一版）、`changelog-no-versions`（CHANGELOG 里没有版本标题，读者对不上自己装的那版）、`no-changelog`（只是提醒），以及市场条目的 `market-*` 全系列。
 
 ### 产物层：npm 到底会发出什么
 
@@ -124,6 +124,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | `client-apply-throws` | `apply(ctx)` 抛 |
 | `client-no-registration` | `apply` 跑完一次服务都没调用——面板不会出现 |
 | `client-inject-missing-<service>` | `apply` 用了 `ctx.sidebarRightTabs` 但 `inject` 数组里没写它。cordis 不会把没声明的服务给你，于是 `ctx.sidebarRightTabs` 是 `undefined`，`apply` 一碰就抛（或静默什么都没注册） |
+| `client-double-load` | 同一个 bundle 被注入了两次（它自己的 patch 一次，注入 `dsh-client-modules` 的侧边栏插件再一次）。loader 按 id 建工厂，第二次注册直接抛错，整个 Web 启动被中断——不是这个面板没了，是所有面板都没了。用 `if (window.__xLoaded) return; window.__xLoaded = true` 挡一下 |
 | `client-parse-failed` | 文件有语法错误。**单独判**：`SyntaxError` 说明 bundle 本身是坏的，别的报错说明是沙箱不够真，两者别混为一谈 |
 | `client-unavailable` | 子进程没跑起来（warn）——这一层没跑，别把它当干净 |
 
@@ -216,7 +217,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 ## 开发
 
 ```sh
-node --test                      # 93 个引擎单测
+node --test                      # 99 个引擎单测
 node test/integration.test.mjs   # 27 条集成断言（9 个真实插件作 fixture）
 ```
 

package/lib/engine.js

@@ -556,6 +556,56 @@ export function checkDocs(dir) {
   return out
 }
 
+/**
+ * The changelog is the only place a user can learn what a version changed, and
+ * a version bump without an entry is invisible drift: `npm publish` says
+ * nothing, and the release notes stay one version behind forever.
+ */
+export function checkChangelog(dir) {
+  const out = []
+  const json = readPkgJson(dir)
+  if (!json?.version) return out
+  const file = ['CHANGELOG.md', 'CHANGELOG', 'HISTORY.md'].find((name) => existsSync(join(dir, name)))
+  if (!file) {
+    out.push(
+      F(
+        'no-changelog',
+        'info',
+        'no CHANGELOG.md',
+        'Every published version is permanent, so users need a place to read what changed. This is a nudge, not a defect.',
+        'Add CHANGELOG.md with one `## <version>` heading per release, and put it in `files`.',
+      ),
+    )
+    return out
+  }
+  const text = safeText(join(dir, file)) || ''
+  const headings = [...text.matchAll(/^#{1,3}\s*\[?v?(\d+\.\d+\.\d+)/gm)].map((m) => m[1])
+  if (!headings.length) {
+    out.push(
+      F(
+        'changelog-no-versions',
+        'warn',
+        `${file} has no version headings`,
+        'A changelog without `## 1.2.3` headings cannot be matched to a release, so a reader cannot tell which entry belongs to the version they installed.',
+        'Give every release a `## <version>` heading.',
+      ),
+    )
+    return out
+  }
+  if (!headings.includes(json.version)) {
+    out.push(
+      F(
+        'changelog-missing-version',
+        'warn',
+        `${file} has no entry for ${json.version} (newest heading is ${headings[0]})`,
+        'The version you are about to publish has no changelog entry. npm publishes it anyway, and the notes now describe an older release.',
+        `Add a \`## ${json.version}\` section at the top of ${file}.`,
+      ),
+    )
+  }
+  return out
+}
+
 // =====================================================================
 // npm / GitHub / market state
 // =====================================================================
@@ -1736,6 +1786,24 @@ if (!records.parseError) {
     else records.evalError = text
   }
 }
+// The same bundle can reach the page twice: its own patch inserts it, and any
+// sidebar-style plugin that injects dsh-client-modules inserts it again. The
+// loader keys factories by id and throws on the second registration, which
+// aborts web boot. Evaluate a second time against the same window and see
+// whether load() is called again; a window-level guard makes it a no-op.
+records.doubleLoad = null
+if (!records.parseError && records.loaded > 0) {
+  let second = 0
+  const first = globalThis.window.__ModuleLoader__.load
+  globalThis.window.__ModuleLoader__.load = (spec) => {
+    second += 1
+    throw new Error('duplicate factory registration: ' + String(spec && spec.id))
+  }
+  try { new Function(source)() } catch (e) {
+    records.doubleLoad = second > 0 ? String(e && e.message || e) : null
+  }
+  globalThis.window.__ModuleLoader__.load = first
+}
 process.stdout.write('\\n@@PG@@' + JSON.stringify(records))
 process.exit(0)
 `
@@ -1797,6 +1865,17 @@ export async function checkClientRuntime(dir, opts = {}) {
   if (r.applyError) {
     out.push(F('client-apply-throws', 'error', `apply() in ${target} throws: ${String(r.applyError).slice(0, 160)}`, 'Registration happens inside apply(); a throw there leaves the panel unregistered while the host half keeps working.', 'Wrap the failing registration, or fix the cause.'))
   }
+  if (r.doubleLoad) {
+    out.push(
+      F(
+        'client-double-load',
+        'warn',
+        `${target} registers a factory again when evaluated a second time (${String(r.doubleLoad).slice(0, 120)})`,
+        'A client bundle can reach the page twice: its own patch inserts it, and any sidebar-style plugin that injects dsh-client-modules inserts it again. The loader keys factories by id and throws on the second registration, which aborts web boot — the whole panel disappears, not just this one.',
+        'Guard the load call with a window-level flag: if (window.__myPluginLoaded) return; window.__myPluginLoaded = true.',
+      ),
+    )
+  }
   if (r.hasApply && !r.applyError && r.registrations.length === 0) {
     out.push(
       F(
@@ -2172,6 +2251,7 @@ export function runStaticChecks(dir) {
     ...checkBuildFreshness(dir),
     ...checkDependencies(dir),
     ...checkDocs(dir),
+    ...checkChangelog(dir),
     ...checkTests(dir),
     ...checkNpmState(dir),
     ...checkGitState(dir),
@@ -2183,7 +2263,7 @@ const RULE_ORDER = [
   'missing-field', 'not-esm', 'files-omits-lib', 'files-omits-patch', 'no-exports', 'client-without-export', 'client-without-platform',
   'entry-path-missing', 'bundle-patch-not-declared', 'no-publish-config-access', 'private-field-set', 'publish-config-registry',
   'client-file-missing', 'client-no-module-loader', 'client-parse-failed', 'client-load-not-called',
-  'client-factory-throws', 'client-no-apply', 'client-apply-throws', 'client-no-registration',
+  'client-factory-throws', 'client-no-apply', 'client-apply-throws', 'client-no-registration', 'client-double-load',
   'client-inject-missing-slots', 'client-inject-missing-sidebarRightTabs', 'client-unavailable',
   'no-patch-file', 'no-insert-row', 'insert-missing-name', 'insert-name-mismatch',
   'patch-name-unresolvable', 'no-name-export', 'no-apply-export', 'no-inject', 'require-in-esm',
@@ -2200,6 +2280,7 @@ const RULE_ORDER = [
   'publish-served-mismatch', 'publish-served', 'market-empty', 'market-no-url', 'market-url-not-github',
   'market-no-name', 'market-name-shape', 'market-no-category', 'market-bad-category', 'market-no-desc', 'market-no-en', 'market-no-zh', 'unscoped-name', 'no-git', 'no-readme', 'readme-no-install', 'readme-no-profile', 'readme-wrong-package',
   'market-no-repo', 'market-unavailable', 'market-duplicate-entry', 'market-npm-name-collision', 'market-repo-too-new',
+  'no-changelog', 'changelog-no-versions', 'changelog-missing-version',
   'git-uncommitted', 'git-tag-missing', 'git-tag-elsewhere',
   'readme-tool-undocumented', 'readme-test-count',
   'no-tests', 'no-test-files', 'no-test-script', 'no-engines', 'bad-repo-url', 'no-gitignore',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bushizhanghan/dsh-publish-gate",
-  "version": "0.8.2",
+  "version": "0.10.0",
   "description": "Pre-publish gate for DSH plugins: manifest, dependencies, artifact, runtime, browser half, traceability and market readiness — plus an input fuzzer that drives every declared parameter with the wrong type. 发布前的七层门禁 + 入参模糊测试。",
   "type": "module",
   "main": "lib/index.js",