@chatcode/cco-market 1.45.1

package/lib/compatibility.js

@@ -0,0 +1,198 @@
+/**
+ * Host-contract compatibility preflight for #195.
+ *
+ * Pure evaluation of what `analyzeProfile()` already reports: a confirmed
+ * peer mismatch (`satisfied === false`) is translated into a directional
+ * verdict:
+ *
+ * - `belowMin`: the resolved version is older than every alternative's lower
+ *   bound — the environment is too old for the plugin's declared contract.
+ * - `aboveMax`: the resolved version is newer than every alternative's upper
+ *   bound (or the exact pin). This is only a risk when the author expressed
+ *   an explicit upper bound or exact pin; otherwise it is a warning, because
+ *   the ecosystem currently has many sloppy `^0.0.1`-style declarations that
+ *   work in practice.
+ *
+ * Everything else stays informational: `*`, prerelease-vs-`*` artifacts,
+ * unparseable ranges, and optional peers never produce a risk here.
+ */
+import { analyzeProfile, compareSemver } from './check.js';
+import { profileDir, readInstalledManifest } from './profile.js';
+const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+function parseComparator(part) {
+    const p = part.trim();
+    const m = /^(\^|~|>=|<=|>|<)?(.*)$/.exec(p);
+    if (m === null)
+        return null;
+    const target = (m[2] ?? '').trim();
+    if (!SEMVER.test(target))
+        return null;
+    const raw = m[1] ?? '';
+    return { op: raw === '' ? 'exact' : raw, target };
+}
+/** Next breaking bump for `^` / `~`, using `-0` so prereleases compare consistently. */
+function nextBound(target, kind) {
+    const m = /^(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?$/.exec(target);
+    if (m === null)
+        return null;
+    const major = Number(m[1]);
+    const minor = Number(m[2]);
+    const patch = Number(m[3]);
+    if (kind === '^') {
+        if (major > 0)
+            return `${major + 1}.0.0-0`;
+        if (minor > 0)
+            return `0.${minor + 1}.0-0`;
+        return `0.0.${patch + 1}-0`;
+    }
+    return `${major}.${minor + 1}.0-0`;
+}
+function boundsFor(range) {
+    const alternatives = [];
+    for (const rawAlternative of range.split('||')) {
+        const parts = rawAlternative.trim().split(/\s+/).filter(Boolean);
+        const parsed = parts.map(parseComparator);
+        if (parsed.some(part => part === null))
+            return null;
+        let lower = null;
+        let upper = null;
+        let explicitUpper = false;
+        let exact = null;
+        for (const part of parsed) {
+            const p = part;
+            if (p.op === 'exact') {
+                exact = p.target;
+                continue;
+            }
+            if (p.op === '^' || p.op === '~') {
+                const bound = nextBound(p.target, p.op);
+                if (bound === null)
+                    return null;
+                if (lower === null || compareSemver(p.target, lower.target) > 0)
+                    lower = p;
+                if (upper === null || compareSemver(bound, upper.target) < 0)
+                    upper = { op: '<=', target: bound };
+                continue;
+            }
+            if (p.op === '>=' || p.op === '>') {
+                if (lower === null || compareSemver(p.target, lower.target) > 0)
+                    lower = p;
+            }
+            else {
+                if (upper === null || compareSemver(p.target, upper.target) < 0)
+                    upper = p;
+                explicitUpper = true;
+            }
+        }
+        alternatives.push({ lower, upper, explicitUpper, exact });
+    }
+    return alternatives;
+}
+function belowAllMins(resolved, bounds) {
+    return bounds.every(alternative => {
+        if (alternative.exact !== null)
+            return compareSemver(resolved, alternative.exact) < 0;
+        if (alternative.lower === null)
+            return false;
+        const lower = alternative.lower;
+        return lower.op === '>' ? compareSemver(resolved, lower.target) <= 0 : compareSemver(resolved, lower.target) < 0;
+    });
+}
+function aboveAllMaxes(resolved, bounds) {
+    return bounds.every(alternative => {
+        if (alternative.exact !== null)
+            return compareSemver(resolved, alternative.exact) > 0;
+        if (alternative.upper === null)
+            return false;
+        const upper = alternative.upper;
+        return upper.op === '<' ? compareSemver(resolved, upper.target) >= 0 : compareSemver(resolved, upper.target) > 0;
+    });
+}
+function hasExplicitUpperOrExact(bounds) {
+    return bounds.every(alternative => alternative.exact !== null || alternative.explicitUpper);
+}
+/** Translate one confirmed peer mismatch into a directional verdict. */
+export function classifyPeer(plugin, peer, range, resolved, optional) {
+    if (resolved === null)
+        return { kind: 'none' };
+    if (optional) {
+        return {
+            kind: 'warning',
+            warning: { plugin, peer, range, resolved, reason: 'optional' },
+        };
+    }
+    const bounds = boundsFor(range);
+    if (bounds === null)
+        return { kind: 'none' };
+    if (belowAllMins(resolved, bounds)) {
+        return {
+            kind: 'risk',
+            risk: { plugin, peer, range, resolved, direction: 'belowMin' },
+        };
+    }
+    if (aboveAllMaxes(resolved, bounds)) {
+        return hasExplicitUpperOrExact(bounds)
+            ? {
+                kind: 'risk',
+                risk: { plugin, peer, range, resolved, direction: 'aboveMax' },
+            }
+            : {
+                kind: 'warning',
+                warning: { plugin, peer, range, resolved, reason: 'aboveMax' },
+            };
+    }
+    return { kind: 'none' };
+}
+/** Whether a peer is declared optional in the installed plugin manifest. */
+export function isOptionalPeer(profileDirectory, plugin, peer) {
+    const manifest = readInstalledManifest('web', plugin, profileDirectory);
+    return manifest?.peerDependenciesMeta?.[peer]?.optional === true;
+}
+/** Evaluate the current profile with the same machinery `/dsh-market/check` uses. */
+export function assessCompatibility(profileDirectory, options) {
+    const report = analyzeProfile(profileDirectory, options);
+    const risks = [];
+    const warnings = [];
+    for (const mismatch of report.peerMismatches) {
+        if (mismatch.satisfied !== false)
+            continue;
+        const optional = isOptionalPeer(profileDirectory, mismatch.plugin, mismatch.name);
+        const verdict = classifyPeer(mismatch.plugin, mismatch.name, mismatch.range, mismatch.resolved, optional);
+        if (verdict.kind === 'risk')
+            risks.push(verdict.risk);
+        else if (verdict.kind === 'warning')
+            warnings.push(verdict.warning);
+    }
+    return { risks, warnings, duplicateNames: report.duplicateNames };
+}
+function riskId(risk) {
+    return `${risk.plugin}\u0000${risk.peer}\u0000${risk.direction}`;
+}
+/** Risks present after a mutation but absent before it. */
+export function introducedRisks(before, after) {
+    const seen = new Set(before.risks.map(riskId));
+    return after.risks.filter(risk => !seen.has(riskId(risk)));
+}
+/**
+ * Cross-layer name collisions present after a mutation but absent before it
+ * (#230 by @dxc-dxc).
+ *
+ * Keyed by NAME alone, not by the layer set: a collision the operation made
+ * worse — same name, now shadowing across one more layer — is still the same
+ * collision the profile already had, and re-reporting it would put the
+ * operator back in front of a problem they did not just cause.
+ *
+ * This is what makes surfacing these safe at all. The underlying
+ * `duplicateNames` is informational precisely because a healthy-but-messy
+ * profile can carry collisions indefinitely; only the newly introduced ones
+ * are attributable to the install that just ran, and therefore undoable by
+ * rolling it back.
+ */
+export function introducedDuplicateNames(before, after) {
+    const seen = new Set(before.duplicateNames.map(entry => entry.name));
+    return after.duplicateNames.filter(entry => !seen.has(entry.name));
+}
+/** Convenience wrapper matching the profile helper signature. */
+export function assessProfile(profile, explicitDir) {
+    return assessCompatibility(profileDir(profile, explicitDir));
+}

package/lib/diagnostics.js

@@ -0,0 +1,49 @@
+/** Versioned, read-only diagnostics shared by the host route and client. */
+export const DIAGNOSTIC_SCHEMA = 'dsh-market/diagnostics/v1';
+/** Conservative first set of known, identity-sensitive host contracts. */
+export const KNOWN_SHARED_HOST_PACKAGES = [
+    '@deepseek-ai/cordis',
+    '@deepseek-ai/dsh-attachment',
+    '@deepseek-ai/dsh-llm',
+    '@deepseek-ai/dsh-system-prompt',
+    '@deepseek-ai/dsh-tools',
+];
+const knownSharedHostPackages = new Set(KNOWN_SHARED_HOST_PACKAGES);
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/** Report exact manifest declarations; the resolved dependency tree is not inspected. */
+function inspectKnownHostDependencyDeclarations(packageName, manifest) {
+    if (!isRecord(manifest) || !isRecord(manifest.dependencies))
+        return [];
+    const findings = [];
+    for (const dependency of Object.keys(manifest.dependencies).sort()) {
+        const declaredRange = manifest.dependencies[dependency];
+        if (!knownSharedHostPackages.has(dependency) || typeof declaredRange !== 'string')
+            continue;
+        findings.push({
+            code: 'shared-host-package-dependency',
+            severity: 'warning',
+            subject: { kind: 'package', name: packageName },
+            evidence: {
+                basis: 'manifest-declaration',
+                dependency,
+                declaredRange,
+                declaredIn: 'dependencies',
+            },
+        });
+    }
+    return findings;
+}
+/** Build a stable diagnostic envelope from installed package manifests. */
+export function diagnosePackageManifests(packages) {
+    const sortedPackages = [...packages].sort((a, b) => a.packageName < b.packageName ? -1 : a.packageName > b.packageName ? 1 : 0);
+    return {
+        schema: DIAGNOSTIC_SCHEMA,
+        findings: sortedPackages.flatMap(({ packageName, manifest }) => {
+            if (!isRecord(manifest) || manifest.dsh === undefined)
+                return [];
+            return inspectKnownHostDependencyDeclarations(packageName, manifest);
+        }),
+    };
+}

package/lib/discovery-compatibility.js

@@ -0,0 +1,260 @@
+/**
+ * Discovery-time DSH compatibility metadata.
+ *
+ * The public catalog does not carry npm manifests. Fetching every manifest
+ * while the market opens would turn one catalog request into more than a
+ * thousand registry requests, so this module supplies a bounded, on-demand
+ * index. Successful public manifest facts are cached beside the market's
+ * profile state; conclusions are never cached because they depend on the DSH
+ * version of the process serving the page.
+ */
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { satisfiesRange } from './check.js';
+import { classifyPeer } from './compatibility.js';
+import { marketFetch } from './net.js';
+const CACHE_SCHEMA = 'dsh-market/discovery-compatibility-cache/v1';
+const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
+const FAILURE_COOLDOWN_MS = 5 * 60 * 1000;
+const OUTAGE_COOLDOWN_MS = 30 * 1000;
+const FETCH_TIMEOUT_MS = 8_000;
+const DEFAULT_CONCURRENCY = 8;
+const MAX_CACHE_ENTRIES = 5_000;
+const MAX_RANGE_LENGTH = 256;
+function range(value) {
+    if (typeof value !== 'string')
+        return null;
+    const trimmed = value.trim();
+    return trimmed !== '' && trimmed.length <= MAX_RANGE_LENGTH ? trimmed : null;
+}
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+/** Keep only the small public subset of an npm manifest needed by discovery. */
+export function manifestFacts(value) {
+    const manifest = record(value) ?? {};
+    const engines = record(manifest.engines);
+    const peers = record(manifest.peerDependencies);
+    const peerDependencies = {};
+    for (const [name, raw] of Object.entries(peers ?? {})) {
+        if (!name.startsWith('@deepseek-ai/'))
+            continue;
+        const declared = range(raw);
+        if (declared !== null)
+            peerDependencies[name] = declared;
+    }
+    return {
+        version: range(manifest.version),
+        enginesDsh: range(engines?.dsh),
+        peerDependencies,
+    };
+}
+function validFacts(value) {
+    const facts = record(value);
+    const peers = record(facts?.peerDependencies);
+    return facts !== null
+        && (facts.version === null || range(facts.version) === facts.version)
+        && (facts.enginesDsh === null || range(facts.enginesDsh) === facts.enginesDsh)
+        && peers !== null
+        && Object.entries(peers).every(([name, item]) => name.startsWith('@deepseek-ai/') && range(item) === item);
+}
+function displayRequirement(declarations) {
+    const unique = [...new Set(declarations.map(item => item.range))];
+    return unique.length === 0 ? null : unique.join(' ∩ ');
+}
+function rangeResult(hostVersion, declared) {
+    return satisfiesRange(hostVersion, declared, { includePrerelease: true });
+}
+/**
+ * Host peers imply the DSH release-line floor, but old ecosystem packages
+ * often carry caret ranges such as `^0.0.1` whose computed 0.x upper bound
+ * was never intended as a host ceiling. Reuse install preflight's directional
+ * policy: below-min and explicit upper/exact violations are definite; a
+ * newer host above an implicit caret/tilde ceiling remains compatible.
+ */
+function declarationResult(declaration, hostVersion) {
+    const satisfied = rangeResult(hostVersion, declaration.range);
+    if (declaration.kind === 'engine' || satisfied !== false)
+        return satisfied;
+    const verdict = classifyPeer('discovery', declaration.package ?? '@deepseek-ai/dsh', declaration.range, hostVersion, false);
+    if (verdict.kind === 'risk')
+        return false;
+    if (verdict.kind === 'warning' && verdict.warning.reason === 'aboveMax')
+        return true;
+    return null;
+}
+/**
+ * Derive the current host verdict from raw manifest facts.
+ *
+ * Every valid declaration is conjunctive: an explicit `engines.dsh` and all
+ * host peers must agree. A malformed declaration keeps a passing result
+ * unknown, but cannot erase a definite mismatch from another declaration.
+ */
+export function deriveHostCompatibility(facts, hostVersion, hostPackages) {
+    if (facts === null) {
+        return { status: 'unknown', basis: 'unavailable', requirement: null, declarations: [] };
+    }
+    const declarations = [];
+    if (facts.enginesDsh !== null) {
+        declarations.push({ kind: 'engine', range: facts.enginesDsh });
+    }
+    for (const [name, declared] of Object.entries(facts.peerDependencies)) {
+        // Cordis (4.x) and schemastery (3.x) are host packages, but are not on
+        // DSH's lockstep 0.x release line and therefore say nothing about the
+        // DSH version. `hostPackages` is the local install inventory plus its
+        // curated fallback, so future lockstep DSH packages are picked up too.
+        if (!hostPackages.has(name) || !/^@deepseek-ai\/dsh(?:-|$)/.test(name))
+            continue;
+        declarations.push({ kind: 'peer', package: name, range: declared });
+    }
+    const requirement = displayRequirement(declarations);
+    if (declarations.length === 0) {
+        return { status: 'unknown', basis: 'undeclared', requirement: null, declarations: [] };
+    }
+    if (hostVersion === null) {
+        return { status: 'unknown', basis: 'manifest', requirement, declarations };
+    }
+    const outcomes = declarations.map(item => declarationResult(item, hostVersion));
+    const status = outcomes.some(item => item === false)
+        ? 'incompatible'
+        : outcomes.every(item => item === true)
+            ? 'compatible'
+            : 'unknown';
+    return { status, basis: 'manifest', requirement, declarations };
+}
+/**
+ * Durable, bounded lookup of npm `latest` manifests.
+ *
+ * Failed requests are intentionally memory-only and short-lived: a mirror
+ * outage must not become a day-long false "undeclared" result on disk.
+ */
+export class DiscoveryManifestIndex {
+    cacheFile;
+    entries = new Map();
+    failures = new Map();
+    inflight = new Map();
+    fetcher;
+    now;
+    ttlMs;
+    concurrency;
+    loaded = false;
+    consecutiveFailures = 0;
+    unavailableUntil = 0;
+    dirty = false;
+    activeFetches = 0;
+    fetchWaiters = [];
+    constructor(cacheFile, options = {}) {
+        this.cacheFile = cacheFile;
+        this.fetcher = options.fetcher ?? marketFetch;
+        this.now = options.now ?? Date.now;
+        this.ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+        this.concurrency = Math.max(1, Math.floor(options.concurrency ?? DEFAULT_CONCURRENCY));
+    }
+    load() {
+        if (this.loaded)
+            return;
+        this.loaded = true;
+        try {
+            const parsed = JSON.parse(readFileSync(this.cacheFile, 'utf8'));
+            if (parsed.schema !== CACHE_SCHEMA || record(parsed.entries) === null)
+                return;
+            for (const [name, raw] of Object.entries(parsed.entries)) {
+                const entry = record(raw);
+                if (entry === null || typeof entry.checkedAt !== 'number' || !validFacts(entry.facts))
+                    continue;
+                this.entries.set(name, { checkedAt: entry.checkedAt, facts: entry.facts });
+            }
+        }
+        catch { /* first run or a truncated cache — fetch fresh */ }
+    }
+    persist() {
+        try {
+            mkdirSync(dirname(this.cacheFile), { recursive: true, mode: 0o700 });
+            const newest = [...this.entries.entries()]
+                .sort(([, a], [, b]) => b.checkedAt - a.checkedAt)
+                .slice(0, MAX_CACHE_ENTRIES);
+            this.entries.clear();
+            for (const [name, entry] of newest)
+                this.entries.set(name, entry);
+            const data = { schema: CACHE_SCHEMA, entries: Object.fromEntries(newest) };
+            writeFileSync(this.cacheFile, JSON.stringify(data), { mode: 0o600 });
+        }
+        catch { /* cache failure degrades to in-memory lookups */ }
+    }
+    /** One semaphore for the whole index, including overlapping HTTP batches. */
+    async withFetchPermit(operation) {
+        if (this.activeFetches >= this.concurrency) {
+            await new Promise(resolve => this.fetchWaiters.push(resolve));
+        }
+        this.activeFetches += 1;
+        try {
+            return await operation();
+        }
+        finally {
+            this.activeFetches -= 1;
+            this.fetchWaiters.shift()?.();
+        }
+    }
+    async fetchOne(name, registry) {
+        this.load();
+        const now = this.now();
+        const cached = this.entries.get(name);
+        if (cached !== undefined && now - cached.checkedAt < this.ttlMs)
+            return cached.facts;
+        if ((this.failures.get(name) ?? 0) > now || this.unavailableUntil > now)
+            return null;
+        const pending = this.inflight.get(name);
+        if (pending !== undefined)
+            return await pending;
+        const request = (async () => {
+            try {
+                const response = await this.withFetchPermit(async () => await this.fetcher(`${registry}/${encodeURIComponent(name)}/latest`, {
+                    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+                    headers: { accept: 'application/json', 'user-agent': 'dsh-market' },
+                }));
+                if (!response.ok)
+                    throw new Error(`HTTP ${String(response.status)}`);
+                const facts = manifestFacts(await response.json());
+                this.entries.set(name, { checkedAt: this.now(), facts });
+                this.dirty = true;
+                this.failures.delete(name);
+                this.consecutiveFailures = 0;
+                return facts;
+            }
+            catch {
+                const failedAt = this.now();
+                this.failures.set(name, failedAt + FAILURE_COOLDOWN_MS);
+                this.consecutiveFailures += 1;
+                if (this.consecutiveFailures >= this.concurrency) {
+                    this.unavailableUntil = failedAt + OUTAGE_COOLDOWN_MS;
+                }
+                return null;
+            }
+            finally {
+                this.inflight.delete(name);
+            }
+        })();
+        this.inflight.set(name, request);
+        return await request;
+    }
+    /** Look up a bounded batch while never exceeding the configured fan-out. */
+    async lookup(names, registry) {
+        const unique = [...new Set(names)];
+        const result = {};
+        let next = 0;
+        const worker = async () => {
+            while (next < unique.length) {
+                const name = unique[next++];
+                result[name] = await this.fetchOne(name, registry);
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(this.concurrency, unique.length) }, worker));
+        if (this.dirty) {
+            this.dirty = false;
+            this.persist();
+        }
+        return result;
+    }
+}