@perrylink/dsh-plugin-doctor 0.2.1 → 0.2.3

package/lib/checks-package.mjs

@@ -1,188 +1,188 @@
-// 静态·包结构检查（R0–R8）
-// 依据：deepseek-harness publish.md / apps/cli/src/plugin.ts（2026-09-07 调研）+
-// PerryLink 工作区双基线约定（AGENTS.md）
-import path from 'node:path'
-import { readFileSync, existsSync } from 'node:fs'
-import { runStep, pass, fail, warn, skip, tail, findFiles } from './util.mjs'
-
-export const GROUP = '静态·包结构'
-
-const stripDot = (p) => String(p ?? '').replace(/^\.\//, '')
-const normalizeEntry = (pkg) => stripDot(pkg.main ?? (typeof pkg.exports === 'string' ? pkg.exports : pkg.exports?.default?.default ?? pkg.exports?.['.']?.default) ?? 'index.js')
-
-export function addChecks(doctor, ctx) {
-  const { repoPath, pkg, pkgName } = ctx
-
-  doctor.add(GROUP, 'R0 基础字段（name/version/license/README/type）', () => {
-    const problems = []
-    if (!pkg.name) problems.push('缺 name')
-    if (!pkg.version) problems.push('缺 version')
-    if (!pkg.license) problems.push('缺 license（SPDX）')
-    if (!existsSync(path.join(repoPath, 'README.md'))) problems.push('缺 README.md')
-    const hasLicenseFile = ['LICENSE', 'LICENSE.md', 'LICENSE.txt'].some((f) => existsSync(path.join(repoPath, f)))
-    if (!hasLicenseFile) problems.push('缺 LICENSE 文件')
-    if (!pkg.type) problems.push('未声明 type（官方范式 "module"）')
-    if (problems.length) return warn(problems.join('；'))
-    return pass('基础字段齐全')
-  })
-
-  doctor.add(GROUP, 'R1 激活门 dsh.bundle.patch', () => {
-    const patch = pkg.dsh?.bundle?.patch
-    if (typeof patch === 'string' && patch.length > 0) return pass(`dsh.bundle.patch = ${patch}`)
-    return fail(
-      'package.json 缺少 dsh.bundle.patch —— 该包安装后只会作为普通依赖，宿主永远不会把它加入 dsh.profile.bundles（最静默的失败模式）',
-    )
-  }, { critical: true })
-
-  doctor.add(GROUP, 'R2 tarball 完整性（npm pack --dry-run）', () => {
-    const r = runStep('r2-pack', 'npm', ['pack', '--dry-run', '--json', '--ignore-scripts'], { cwd: repoPath, logDir: ctx.logDir, timeout: 300_000 })
-    if (!r.ok) return fail(`npm pack 失败（exit ${r.code}）:\n${tail(r.err)}`)
-    let pack
-    try {
-      const json = r.out.replace(/^\uFEFF/, '').trim()
-      pack = JSON.parse(json.slice(json.indexOf('['), json.lastIndexOf(']') + 1))[0]
-    } catch {
-      return fail('npm pack --json 输出解析失败')
-    }
-    const files = pack.files ?? []
-    const paths = files.map((f) => f.path)
-    const problems = []
-    const patch = stripDot(pkg.dsh?.bundle?.patch ?? '')
-    const entry = normalizeEntry(pkg)
-    if (patch && !paths.includes(patch)) problems.push(`patch 文件 ${patch} 不在 tarball（files 白名单未覆盖？）`)
-    if (entry && !paths.some((f) => f === entry)) problems.push(`入口 ${entry} 不在 tarball`)
-    for (const need of [patch, entry]) {
-      const hit = files.find((f) => f.path === need)
-      if (hit && Number(hit.size ?? 0) === 0) problems.push(`${need} 为空文件`)
-    }
-    const expected = `${pkgName.replace(/^@/, '').replace('/', '-')}-${pkg.version}.tgz`
-    if (pack.filename && pack.filename !== expected) problems.push(`tarball 名 ${pack.filename} ≠ 期望 ${expected}`)
-    if (problems.length) return fail(problems.join('\n'))
-    return pass(`tarball ${pack.filename} 含入口与 patch（共 ${files.length} 个文件）`)
-  })
-
-  doctor.add(GROUP, 'R3 cordis.patch.yml 结构（启发式）', () => {
-    const patch = stripDot(pkg.dsh?.bundle?.patch ?? '')
-    if (!patch) return skip('无 dsh.bundle.patch')
-    const p = path.resolve(repoPath, patch)
-    if (!existsSync(p)) return fail(`patch 文件不存在: ${patch}`)
-    const text = readFileSync(p, 'utf8')
-    // YAML 注释行剔除后再做启发式（示例配置注释里常出现 name: xxx）
-    const active = text.split(/\r?\n/).filter((l) => !/^\s*#/.test(l)).join('\n')
-    const problems = []
-    if (!/-\s+insert\s*:/.test(active)) problems.push('未找到 "- insert:" 结构')
-    const ids = [...active.matchAll(/(?:^|\n)\s*-?\s*id:\s*["']?([^"'\s]+)/g)].map((m) => m[1])
-    if (!ids.length) problems.push('未找到 id 行（行 id 必须存在，供上层整行替换定位）')
-    const names = [...active.matchAll(/(?:^|\n)\s*name:\s*["']?([^"'\s,]+)|[,\s]name:\s*["']?([^"'\s,]+)/g)]
-      .map((m) => m[1] ?? m[2]).filter(Boolean)
-    const badNames = names.filter((n) => n !== pkgName && !n.startsWith(`${pkgName}/`))
-    if (names.length && badNames.length) problems.push(`行 name 与包名不一致: ${[...new Set(badNames)].join(', ')}（name 必须经 profile node_modules 解析，应为包名）`)
-    if (problems.length) return fail(problems.join('\n'))
-    return pass(`解析到 insert 结构、${ids.length} 个 id、name 与包名一致（启发式；以 D2 --dump-config 为准）`)
-  })
-
-  doctor.add(GROUP, 'R4 入口契约（name/apply 导出 + inject 字面量）', () => {
-    const entry = normalizeEntry(pkg)
-    const entryAbs = path.resolve(repoPath, entry)
-    if (!existsSync(entryAbs)) return fail(`入口文件 ${entry} 不存在（需先 pnpm run build）`)
-    const src = readFileSync(entryAbs, 'utf8')
-    const hasApply = /exports\s*\.\s*apply|module\.exports\s*=\s*\{[\s\S]{0,400}\bapply\b|export\s+(?:const|function)\s+apply/.test(src)
-    const hasName = /exports\s*\.\s*name|module\.exports\s*=\s*\{[\s\S]{0,400}\bname\b|export\s+const\s+name/.test(src)
-    const problems = []
-    if (!hasApply) problems.push('入口未检出 apply 导出')
-    if (!hasName) problems.push('入口未检出 name 导出')
-    // TS 源兜底（入口是编译产物时）
-    const srcFiles = findFiles(repoPath, 'src', /\.(ts|mts|tsx|mjs|js)$/)
-    const srcText = srcFiles.map((f) => { try { return readFileSync(f, 'utf8') } catch { return '' } }).join('\n')
-    if (!hasApply && /export\s+(?:const|function)\s+apply|apply\s*\(ctx/.test(srcText)) {
-      problems.splice(problems.indexOf('入口未检出 apply 导出'), 1)
-    }
-    if (!hasName && /export\s+const\s+name\b/.test(srcText)) {
-      problems.splice(problems.indexOf('入口未检出 name 导出'), 1)
-    }
-    const injectDecl = srcText.match(/(?:export\s+)?(?:const\s+)?inject\s*[:=]\s*\[([^\]]*)\]/)
-    if (injectDecl) {
-      const inner = injectDecl[1].trim()
-      const junk = inner.replace(/['"][^'"]*['"]/g, '').replace(/[\s,]/g, '')
-      if (junk) problems.push(`inject 数组含非字符串字面量: [${inner}]`)
-    }
-    if (problems.length) return warn(problems.join('\n') + '\n（启发式扫描；若为 default 对象/class 形式请人工确认）')
-    return pass(`入口 ${entry} 检出 name/apply 导出${injectDecl ? '，inject 为字符串数组' : ''}`)
-  })
-
-  doctor.add(GROUP, 'R5 依赖口径（rescope cordis / 禁裸上游名）', () => {
-    const problems = []
-    for (const field of ['dependencies', 'peerDependencies', 'devDependencies']) {
-      const deps = pkg[field] ?? {}
-      if ('cordis' in deps) problems.push(`${field} 出现裸 cordis@${deps.cordis}（应使用 rescope @deepseek-ai/cordis）`)
-      if ('schemastery' in deps) problems.push(`${field} 出现裸 schemastery@${deps.schemastery}（应使用 @deepseek-ai/schemastery）`)
-    }
-    const peer = pkg.peerDependencies?.['@deepseek-ai/cordis']
-    const dep = pkg.dependencies?.['@deepseek-ai/cordis']
-    const srcFiles = findFiles(repoPath, 'src', /\.(ts|mts|tsx|mjs|js)$/)
-    const importsCordis = srcFiles.some((f) => { try { return /from\s+['"]@deepseek-ai\/cordis['"]|require\(['"]@deepseek-ai\/cordis['"]\)/.test(readFileSync(f, 'utf8')) } catch { return false } })
-    if (!peer && !dep) {
-      if (importsCordis) problems.push('源码 import @deepseek-ai/cordis 但未声明任何依赖')
-      // R-fix 0A / P7：无源文件时旧实现直接 pass（真·静默通过，连 skip 痕迹都不留），而 R5 属被门禁的 16 项之一。
-      else if (srcFiles.length) return pass('未声明 @deepseek-ai/cordis 且源码无 import（纯 JS 仓可无 cordis 运行时依赖）')
-      else return skip('无源文件可判（无 src/ 且未声明 @deepseek-ai/cordis）——不计 pass')
-    } else if (!peer) {
-      problems.push('@deepseek-ai/cordis 只在 dependencies（官方口径：peerDependencies + devDependencies 同时声明）')
-    }
-    if (pkg.dependencies?.['@deepseek-ai/dsh']) problems.push('dependencies 直接依赖 @deepseek-ai/dsh（宿主已提供，应走 peer/dev 口径）')
-    if (problems.length) return fail(problems.join('\n'))
-    return pass(`cordis 口径正确（${peer ?? dep}）`)
-  })
-
-  doctor.add(GROUP, 'R6 Node 引擎声明', () => {
-    const e = pkg.engines?.node
-    if (!e) return warn('未声明 engines.node（建议 "^22.19.0 || >=24.0.0"；npm 线宿主不强制，属建议门）')
-    const only23 = /23/.test(e) && !/22/.test(e) && !/24/.test(e) && !/>=\s*2[5-9]/.test(e)
-    if (only23) return fail(`engines.node=${e} 宣称 Node 23（官方整线排除 23，要求 ^22.19.0 || >=24.0.0）`)
-    if (/22\.19/.test(e) && /24/.test(e)) return pass(`engines.node=${e} 与官方 ^22.19.0 || >=24.0.0 一致`)
-    return warn(`engines.node=${e} 与官方 ^22.19.0 || >=24.0.0 的相交性请人工确认`)
-  })
-
-  doctor.add(GROUP, 'R7 预构建与 files 覆盖', () => {
-    const entry = normalizeEntry(pkg)
-    const problems = []
-    if (entry.includes('src/')) problems.push(`main 指向源码 ${entry}（npm 发布必须预构建，main 应指向 lib/ 产物）`)
-    const filesField = pkg.files
-    if (Array.isArray(filesField) && filesField.length) {
-      const covered = (f) => filesField.some((item) => {
-        const base = item.replace(/\/$/, '')
-        return f === item || f.startsWith(`${base}/`)
-      })
-      if (!covered(entry)) problems.push(`files 白名单未覆盖入口 ${entry}`)
-      const patch = stripDot(pkg.dsh?.bundle?.patch ?? '')
-      if (patch && !covered(patch)) problems.push('files 白名单未覆盖 cordis.patch.yml')
-    } else {
-      problems.push('未声明 files 白名单')
-    }
-    const note = pkg.scripts?.prepare ? '（含 prepare 脚本，支持 git 直装自构建）' : '（无 prepare，git 直装不可用，npm/tarball 不受影响）'
-    if (problems.length) return fail(problems.join('\n') + '\n' + note)
-    return pass(`main 指向构建产物且 files 覆盖入口与 patch ${note}`)
-  })
-
-  doctor.add(GROUP, 'R8 peer 范围旧 rc 残留（双基线教训）', () => {
-    const peers = Object.entries(pkg.peerDependencies ?? {})
-      .filter(([k]) => k.startsWith('@deepseek-ai/dsh') || k === 'cordis' || k.startsWith('@deepseek-ai/cordis'))
-    if (!peers.length) return skip('无 dsh 相关 peer 声明')
-    const problems = []
-    for (const [k, v] of peers) {
-      const s = String(v)
-      // Enumerating two literals (0.1.0-rc.8 / 0.1.1-rc.2) only caught the shapes
-      // that happened to exist on 2026-09-05; every other old line slipped through.
-      // Match the whole old-line family instead.
-      if (/(0\.1\.0-rc\.|0\.1\.1-rc\.|0\.1\.2-alpha\.|0\.1\.3-alpha\.)/.test(s)) problems.push(`${k}: ${s} 含旧 rc/alpha 版本（2026-09-05 起全仓统一为 >=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0）`)
-      // A single-arm prerelease-tuple range admits only the one prerelease it
-      // names: `>=0.1.2-rc.1 <0.2.0` (no `||`) rejects 0.1.5-rc.1 — exactly the
-      // false green the OR form exists to fix. Flag any bare arm.
-      if (!s.includes('||') && /^>=\s*0\.1\.\d+-[0-9A-Za-z.]+/.test(s) && /<\s*0\.2\.0/.test(s)) {
-        problems.push(`${k}: ${s} 是单臂 prerelease-tuple 区间，不会放行更新的宿主线（须写成 >=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0）`)
-      }
-    }
-    if (problems.length) return fail(problems.join('\n'))
-    return pass(peers.map(([k, v]) => `${k} ${v}`).join('；'))
-  })
-}
+// 静态·包结构检查（R0–R8）
+// 依据：deepseek-harness publish.md / apps/cli/src/plugin.ts（2026-09-07 调研）+
+// PerryLink 工作区双基线约定（AGENTS.md）
+import path from 'node:path'
+import { readFileSync, existsSync } from 'node:fs'
+import { runStep, pass, fail, warn, skip, tail, findFiles } from './util.mjs'
+
+export const GROUP = '静态·包结构'
+
+const stripDot = (p) => String(p ?? '').replace(/^\.\//, '')
+const normalizeEntry = (pkg) => stripDot(pkg.main ?? (typeof pkg.exports === 'string' ? pkg.exports : pkg.exports?.default?.default ?? pkg.exports?.['.']?.default) ?? 'index.js')
+
+export function addChecks(doctor, ctx) {
+  const { repoPath, pkg, pkgName } = ctx
+
+  doctor.add(GROUP, 'R0 基础字段（name/version/license/README/type）', () => {
+    const problems = []
+    if (!pkg.name) problems.push('缺 name')
+    if (!pkg.version) problems.push('缺 version')
+    if (!pkg.license) problems.push('缺 license（SPDX）')
+    if (!existsSync(path.join(repoPath, 'README.md'))) problems.push('缺 README.md')
+    const hasLicenseFile = ['LICENSE', 'LICENSE.md', 'LICENSE.txt'].some((f) => existsSync(path.join(repoPath, f)))
+    if (!hasLicenseFile) problems.push('缺 LICENSE 文件')
+    if (!pkg.type) problems.push('未声明 type（官方范式 "module"）')
+    if (problems.length) return warn(problems.join('；'))
+    return pass('基础字段齐全')
+  })
+
+  doctor.add(GROUP, 'R1 激活门 dsh.bundle.patch', () => {
+    const patch = pkg.dsh?.bundle?.patch
+    if (typeof patch === 'string' && patch.length > 0) return pass(`dsh.bundle.patch = ${patch}`)
+    return fail(
+      'package.json 缺少 dsh.bundle.patch —— 该包安装后只会作为普通依赖，宿主永远不会把它加入 dsh.profile.bundles（最静默的失败模式）',
+    )
+  }, { critical: true })
+
+  doctor.add(GROUP, 'R2 tarball 完整性（npm pack --dry-run）', () => {
+    const r = runStep('r2-pack', 'npm', ['pack', '--dry-run', '--json', '--ignore-scripts'], { cwd: repoPath, logDir: ctx.logDir, timeout: 300_000 })
+    if (!r.ok) return fail(`npm pack 失败（exit ${r.code}）:\n${tail(r.err)}`)
+    let pack
+    try {
+      const json = r.out.replace(/^\uFEFF/, '').trim()
+      pack = JSON.parse(json.slice(json.indexOf('['), json.lastIndexOf(']') + 1))[0]
+    } catch {
+      return fail('npm pack --json 输出解析失败')
+    }
+    const files = pack.files ?? []
+    const paths = files.map((f) => f.path)
+    const problems = []
+    const patch = stripDot(pkg.dsh?.bundle?.patch ?? '')
+    const entry = normalizeEntry(pkg)
+    if (patch && !paths.includes(patch)) problems.push(`patch 文件 ${patch} 不在 tarball（files 白名单未覆盖？）`)
+    if (entry && !paths.some((f) => f === entry)) problems.push(`入口 ${entry} 不在 tarball`)
+    for (const need of [patch, entry]) {
+      const hit = files.find((f) => f.path === need)
+      if (hit && Number(hit.size ?? 0) === 0) problems.push(`${need} 为空文件`)
+    }
+    const expected = `${pkgName.replace(/^@/, '').replace('/', '-')}-${pkg.version}.tgz`
+    if (pack.filename && pack.filename !== expected) problems.push(`tarball 名 ${pack.filename} ≠ 期望 ${expected}`)
+    if (problems.length) return fail(problems.join('\n'))
+    return pass(`tarball ${pack.filename} 含入口与 patch（共 ${files.length} 个文件）`)
+  })
+
+  doctor.add(GROUP, 'R3 cordis.patch.yml 结构（启发式）', () => {
+    const patch = stripDot(pkg.dsh?.bundle?.patch ?? '')
+    if (!patch) return skip('无 dsh.bundle.patch')
+    const p = path.resolve(repoPath, patch)
+    if (!existsSync(p)) return fail(`patch 文件不存在: ${patch}`)
+    const text = readFileSync(p, 'utf8')
+    // YAML 注释行剔除后再做启发式（示例配置注释里常出现 name: xxx）
+    const active = text.split(/\r?\n/).filter((l) => !/^\s*#/.test(l)).join('\n')
+    const problems = []
+    if (!/-\s+insert\s*:/.test(active)) problems.push('未找到 "- insert:" 结构')
+    const ids = [...active.matchAll(/(?:^|\n)\s*-?\s*id:\s*["']?([^"'\s]+)/g)].map((m) => m[1])
+    if (!ids.length) problems.push('未找到 id 行（行 id 必须存在，供上层整行替换定位）')
+    const names = [...active.matchAll(/(?:^|\n)\s*name:\s*["']?([^"'\s,]+)|[,\s]name:\s*["']?([^"'\s,]+)/g)]
+      .map((m) => m[1] ?? m[2]).filter(Boolean)
+    const badNames = names.filter((n) => n !== pkgName && !n.startsWith(`${pkgName}/`))
+    if (names.length && badNames.length) problems.push(`行 name 与包名不一致: ${[...new Set(badNames)].join(', ')}（name 必须经 profile node_modules 解析，应为包名）`)
+    if (problems.length) return fail(problems.join('\n'))
+    return pass(`解析到 insert 结构、${ids.length} 个 id、name 与包名一致（启发式；以 D2 --dump-config 为准）`)
+  })
+
+  doctor.add(GROUP, 'R4 入口契约（name/apply 导出 + inject 字面量）', () => {
+    const entry = normalizeEntry(pkg)
+    const entryAbs = path.resolve(repoPath, entry)
+    if (!existsSync(entryAbs)) return fail(`入口文件 ${entry} 不存在（需先 pnpm run build）`)
+    const src = readFileSync(entryAbs, 'utf8')
+    const hasApply = /exports\s*\.\s*apply|module\.exports\s*=\s*\{[\s\S]{0,400}\bapply\b|export\s+(?:const|function)\s+apply/.test(src)
+    const hasName = /exports\s*\.\s*name|module\.exports\s*=\s*\{[\s\S]{0,400}\bname\b|export\s+const\s+name/.test(src)
+    const problems = []
+    if (!hasApply) problems.push('入口未检出 apply 导出')
+    if (!hasName) problems.push('入口未检出 name 导出')
+    // TS 源兜底（入口是编译产物时）
+    const srcFiles = findFiles(repoPath, 'src', /\.(ts|mts|tsx|mjs|js)$/)
+    const srcText = srcFiles.map((f) => { try { return readFileSync(f, 'utf8') } catch { return '' } }).join('\n')
+    if (!hasApply && /export\s+(?:const|function)\s+apply|apply\s*\(ctx/.test(srcText)) {
+      problems.splice(problems.indexOf('入口未检出 apply 导出'), 1)
+    }
+    if (!hasName && /export\s+const\s+name\b/.test(srcText)) {
+      problems.splice(problems.indexOf('入口未检出 name 导出'), 1)
+    }
+    const injectDecl = srcText.match(/(?:export\s+)?(?:const\s+)?inject\s*[:=]\s*\[([^\]]*)\]/)
+    if (injectDecl) {
+      const inner = injectDecl[1].trim()
+      const junk = inner.replace(/['"][^'"]*['"]/g, '').replace(/[\s,]/g, '')
+      if (junk) problems.push(`inject 数组含非字符串字面量: [${inner}]`)
+    }
+    if (problems.length) return warn(problems.join('\n') + '\n（启发式扫描；若为 default 对象/class 形式请人工确认）')
+    return pass(`入口 ${entry} 检出 name/apply 导出${injectDecl ? '，inject 为字符串数组' : ''}`)
+  })
+
+  doctor.add(GROUP, 'R5 依赖口径（rescope cordis / 禁裸上游名）', () => {
+    const problems = []
+    for (const field of ['dependencies', 'peerDependencies', 'devDependencies']) {
+      const deps = pkg[field] ?? {}
+      if ('cordis' in deps) problems.push(`${field} 出现裸 cordis@${deps.cordis}（应使用 rescope @deepseek-ai/cordis）`)
+      if ('schemastery' in deps) problems.push(`${field} 出现裸 schemastery@${deps.schemastery}（应使用 @deepseek-ai/schemastery）`)
+    }
+    const peer = pkg.peerDependencies?.['@deepseek-ai/cordis']
+    const dep = pkg.dependencies?.['@deepseek-ai/cordis']
+    const srcFiles = findFiles(repoPath, 'src', /\.(ts|mts|tsx|mjs|js)$/)
+    const importsCordis = srcFiles.some((f) => { try { return /from\s+['"]@deepseek-ai\/cordis['"]|require\(['"]@deepseek-ai\/cordis['"]\)/.test(readFileSync(f, 'utf8')) } catch { return false } })
+    if (!peer && !dep) {
+      if (importsCordis) problems.push('源码 import @deepseek-ai/cordis 但未声明任何依赖')
+      // R-fix 0A / P7：无源文件时旧实现直接 pass（真·静默通过，连 skip 痕迹都不留），而 R5 属被门禁的 16 项之一。
+      else if (srcFiles.length) return pass('未声明 @deepseek-ai/cordis 且源码无 import（纯 JS 仓可无 cordis 运行时依赖）')
+      else return skip('无源文件可判（无 src/ 且未声明 @deepseek-ai/cordis）——不计 pass')
+    } else if (!peer) {
+      problems.push('@deepseek-ai/cordis 只在 dependencies（官方口径：peerDependencies + devDependencies 同时声明）')
+    }
+    if (pkg.dependencies?.['@deepseek-ai/dsh']) problems.push('dependencies 直接依赖 @deepseek-ai/dsh（宿主已提供，应走 peer/dev 口径）')
+    if (problems.length) return fail(problems.join('\n'))
+    return pass(`cordis 口径正确（${peer ?? dep}）`)
+  })
+
+  doctor.add(GROUP, 'R6 Node 引擎声明', () => {
+    const e = pkg.engines?.node
+    if (!e) return warn('未声明 engines.node（建议 "^22.19.0 || >=24.0.0"；npm 线宿主不强制，属建议门）')
+    const only23 = /23/.test(e) && !/22/.test(e) && !/24/.test(e) && !/>=\s*2[5-9]/.test(e)
+    if (only23) return fail(`engines.node=${e} 宣称 Node 23（官方整线排除 23，要求 ^22.19.0 || >=24.0.0）`)
+    if (/22\.19/.test(e) && /24/.test(e)) return pass(`engines.node=${e} 与官方 ^22.19.0 || >=24.0.0 一致`)
+    return warn(`engines.node=${e} 与官方 ^22.19.0 || >=24.0.0 的相交性请人工确认`)
+  })
+
+  doctor.add(GROUP, 'R7 预构建与 files 覆盖', () => {
+    const entry = normalizeEntry(pkg)
+    const problems = []
+    if (entry.includes('src/')) problems.push(`main 指向源码 ${entry}（npm 发布必须预构建，main 应指向 lib/ 产物）`)
+    const filesField = pkg.files
+    if (Array.isArray(filesField) && filesField.length) {
+      const covered = (f) => filesField.some((item) => {
+        const base = item.replace(/\/$/, '')
+        return f === item || f.startsWith(`${base}/`)
+      })
+      if (!covered(entry)) problems.push(`files 白名单未覆盖入口 ${entry}`)
+      const patch = stripDot(pkg.dsh?.bundle?.patch ?? '')
+      if (patch && !covered(patch)) problems.push('files 白名单未覆盖 cordis.patch.yml')
+    } else {
+      problems.push('未声明 files 白名单')
+    }
+    const note = pkg.scripts?.prepare ? '（含 prepare 脚本，支持 git 直装自构建）' : '（无 prepare，git 直装不可用，npm/tarball 不受影响）'
+    if (problems.length) return fail(problems.join('\n') + '\n' + note)
+    return pass(`main 指向构建产物且 files 覆盖入口与 patch ${note}`)
+  })
+
+  doctor.add(GROUP, 'R8 peer 范围旧 rc 残留（双基线教训）', () => {
+    const peers = Object.entries(pkg.peerDependencies ?? {})
+      .filter(([k]) => k.startsWith('@deepseek-ai/dsh') || k === 'cordis' || k.startsWith('@deepseek-ai/cordis'))
+    if (!peers.length) return skip('无 dsh 相关 peer 声明')
+    const problems = []
+    for (const [k, v] of peers) {
+      const s = String(v)
+      // Enumerating two literals (0.1.0-rc.8 / 0.1.1-rc.2) only caught the shapes
+      // that happened to exist on 2026-09-05; every other old line slipped through.
+      // Match the whole old-line family instead.
+      if (/(0\.1\.0-rc\.|0\.1\.1-rc\.|0\.1\.2-alpha\.|0\.1\.3-alpha\.)/.test(s)) problems.push(`${k}: ${s} 含旧 rc/alpha 版本（2026-09-05 起全仓统一为 >=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0）`)
+      // A single-arm prerelease-tuple range admits only the one prerelease it
+      // names: `>=0.1.2-rc.1 <0.2.0` (no `||`) rejects 0.1.5-rc.1 — exactly the
+      // false green the OR form exists to fix. Flag any bare arm.
+      if (!s.includes('||') && /^>=\s*0\.1\.\d+-[0-9A-Za-z.]+/.test(s) && /<\s*0\.2\.0/.test(s)) {
+        problems.push(`${k}: ${s} 是单臂 prerelease-tuple 区间，不会放行更新的宿主线（须写成 >=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0）`)
+      }
+    }
+    if (problems.length) return fail(problems.join('\n'))
+    return pass(peers.map(([k, v]) => `${k} ${v}`).join('；'))
+  })
+}

package/lib/checks-smoke.mjs

@@ -1,117 +1,117 @@
-// 动态·沙箱冒烟（D0–D3 + D9）
-// 依据：dsh compat.yml 正典配方（MISSING_CREDENTIAL 判据）+ 2026-09-07 harness 调研 +
-// 工作区红线 3（一切测试全沙箱）
-//
-// 本轮（R-fix 6/7）两处硬化：
-//   1. `dsh plugin add` 显式传 --ignore-scripts —— 被测包的 install/prepare 脚本不得在宿主执行；
-//      pnpm 的 ignored-builds 阻断归类为 environment（不计 pass、不计插件缺陷）。
-//   2. D9 由「直接 rmSync」改为「隔离不删除」（红线 4）；D0 的 tarball 落进沙箱而非被检仓。
-import path from 'node:path'
-import { makeSandbox, quarantineSandbox, runStep, pass, fail, skip, envskip, tail, readJson, writeJson, exists } from './util.mjs'
-
-export const GROUP = '动态·沙箱冒烟'
-
-export function addSmokeChecks(doctor, ctx, opts = {}) {
-  const { repoPath, pkgName, logDir } = ctx
-  const dshVersion = opts.dshVersion ?? '0.1.2-rc.1'
-  const state = {}
-
-  doctor.add(GROUP, 'D0 打包 tarball（npm pack，禁止生命周期脚本）', () => {
-    state.sb = makeSandbox('smoke')
-    ctx.sandboxRoots.push(state.sb.root)
-    // --pack-destination 指向沙箱：旧实现把 .tgz 直接落在被检仓里且从不清理（实测 8 仓遗留 17 个 stray .tgz）
-    const r = runStep('d0-pack', 'npm', ['pack', '--json', '--ignore-scripts', '--pack-destination', state.sb.root], { cwd: repoPath, logDir, timeout: 300_000 })
-    if (!r.ok) return fail(`npm pack 失败（exit ${r.code}）:\n${tail(r.err)}`)
-    let pack
-    try {
-      const json = r.out.replace(/^\uFEFF/, '').trim()
-      pack = JSON.parse(json.slice(json.indexOf('['), json.lastIndexOf(']') + 1))[0]
-    } catch {
-      return fail('npm pack --json 解析失败')
-    }
-    state.tgz = path.join(state.sb.root, pack.filename)
-    if (!exists(state.tgz)) return fail(`tarball 未生成: ${pack.filename}`)
-    return pass(`已打包 ${pack.filename}（${pack.files?.length ?? '?'} 文件，落沙箱）`)
-  })
-
-  doctor.add(GROUP, 'D1 安装冒烟（plugin add + bundles 断言）', () => {
-    if (!state.tgz) return skip('D0 未通过')
-    writeJson(path.join(state.sb.root, 'package.json'), { name: 'dsh-doctor-runtime', version: '0.0.0', private: true })
-    const i = runStep('d1-host', 'npm', ['install', '--no-audit', '--no-fund', '--loglevel=error', `@deepseek-ai/dsh@${dshVersion}`], {
-      cwd: state.sb.root, logDir, timeout: 900_000,
-    })
-    if (i.spawnError || i.code === 127) {
-      return { status: 'fail', message: `环境不可用：找不到 npm/node（${i.spawnError ?? 'exit 127'}）:\n${tail(i.err)}`, category: 'infrastructure' }
-    }
-    if (!i.ok) {
-      // 宿主安装失败 ≠ 插件缺陷：归类 unsupported-host（退出码 4）
-      return { status: 'fail', message: `安装 @deepseek-ai/dsh@${dshVersion} 失败（exit ${i.code}）—— 宿主版本不可用，不判插件:\n${tail(i.err)}`, category: 'unsupported-host' }
-    }
-    const hostPkgPath = path.join(state.sb.root, 'node_modules', '@deepseek-ai', 'dsh', 'package.json')
-    if (!exists(hostPkgPath)) return { status: 'fail', message: '@deepseek-ai/dsh 未安装成功', category: 'unsupported-host' }
-    const host = readJson(hostPkgPath)
-    const rel = host.bin?.dsh
-    const bin = rel ? path.resolve(state.sb.root, 'node_modules', '@deepseek-ai', 'dsh', rel) : null
-    if (!bin || !exists(bin)) return { status: 'fail', message: `未找到 dsh bin（package.json bin=${JSON.stringify(host.bin)}）`, category: 'infrastructure' }
-    state.bin = bin
-    const dsh = (label, args, o = {}) => runStep(label, process.execPath, [bin, ...args], {
-      env: { DSH_HOME: state.sb.home, DSH_AGENTS_HOME: path.join(state.sb.home, '.agents'), ...(o.env ?? {}) },
-      cwd: state.sb.root, logDir, timeout: o.timeout ?? 120_000, shell: false,
-    })
-    state.dsh = dsh
-    // --ignore-scripts 透传给 pnpm（dsh plugin 是 pnpm 的透明转发器）
-    const a = dsh('d1-add', ['plugin', '--profile', 'headless', 'add', state.tgz, '--ignore-scripts'], { timeout: 900_000 })
-    const envBlock = /ERR_PNPM_IGNORED_BUILDS|approve-builds|ignored builds/i.test(a.err)
-    const pnpmMissing = /pnpm not found on PATH|ENOENT/i.test(a.err) || a.code === 127
-    if (pnpmMissing) {
-      return { status: 'fail', message: `环境不可用：PATH 上找不到 pnpm（dsh plugin 是 pnpm 转发器）:\n${tail(a.err)}`, category: 'infrastructure' }
-    }
-    if (!a.ok) {
-      if (envBlock) {
-        // 环境配方问题（pnpm 阻断 build scripts）→ environment，不计 pass、不计插件缺陷
-        return envskip(`pnpm approve-builds/ignored-builds 环境门阻断（属环境配方问题，非插件缺陷，参照 compat.yml allowBuilds 配方）:\n${tail(a.err)}`)
-      }
-      return fail(`plugin add 失败（exit ${a.code}）:\n${tail(a.err)}`)
-    }
-    if (/declares no dsh\.bundle|not activated/i.test(a.err)) return fail('宿主 stderr 出现未激活警告（dsh.bundle 声明未被识别）')
-    const profilePkgPath = path.join(state.sb.home, 'profiles', 'headless', 'package.json')
-    if (!exists(profilePkgPath)) return fail('profile package.json 未生成')
-    const profilePkg = readJson(profilePkgPath)
-    const bundles = profilePkg?.dsh?.profile?.bundles ?? []
-    if (!bundles.includes(pkgName)) return fail(`dsh.profile.bundles 不含 ${pkgName}（实际: ${JSON.stringify(bundles)}）`)
-    return pass(`已加入 dsh.profile.bundles: ${bundles.join(', ')}`)
-  })
-
-  doctor.add(GROUP, 'D2 层验证（--dump-config，不 boot）', () => {
-    if (!state.dsh) return skip('D1 未通过')
-    const r = state.dsh('d2-dump', ['--profile', 'headless', '--dump-config'], { timeout: 120_000 })
-    if (r.signal) return { status: 'fail', message: `--dump-config 被信号终止（${r.signal}）—— 结果不稳定`, category: 'unstable' }
-    if (!r.ok) return fail(`--dump-config 失败（exit ${r.code}）:\n${tail(r.err)}`)
-    if (!r.out.includes(`# == ${pkgName}`)) return fail(`dump-config 未见层标记 "# == ${pkgName}"`)
-    return pass(`层标记 "# == ${pkgName}" 出现（patch 已进入组合层）`)
-  })
-
-  doctor.add(GROUP, 'D3 keyless headless 冒烟（MISSING_CREDENTIAL 判据）', () => {
-    if (!state.dsh) return skip('D1 未通过')
-    const r = state.dsh('d3-run', ['--profile', 'headless', 'Reply with exactly: ok'], { timeout: 90_000 })
-    const combined = `${r.out}\n${r.err}`
-    if (r.signal) return { status: 'fail', message: `进程异常终止（signal=${r.signal}）—— 结果不稳定`, category: 'unstable' }
-    if (r.spawnError) return { status: 'fail', message: `子进程未启动（${r.spawnError}）—— 环境不可用`, category: 'infrastructure' }
-    const bad = combined.match(/.*(NO_ADAPTER|ERR_MODULE_NOT_FOUND|SyntaxError|TypeError|ReferenceError|Cannot find module).*/g)
-    if (bad) return fail(`组合未 boot 到请求阶段，出现致命错误:\n${bad.slice(0, 5).join('\n')}`)
-    if (r.code === 1 && /dsh:\s*MISSING_CREDENTIAL/.test(combined)) {
-      return pass('exit 1 + dsh: MISSING_CREDENTIAL —— bundle 层生效、插件 apply 成功、组合到达模型请求阶段（严格匹配 code，防正则假阳性）')
-    }
-    if (r.code === 0) return pass('exit 0（环境中存在凭据，完整跑通）')
-    return fail(`期望 exit 1 + MISSING_CREDENTIAL，实际 exit ${r.code}:\n${tail(combined)}`)
-  })
-
-  doctor.add(GROUP, 'D9 沙箱隔离（三段式：只隔离不删除）', () => {
-    const before = state.sb?.root ?? null
-    const moved = quarantineSandbox(state.sb)
-    state.sb = null
-    if (!before) return pass('未创建沙箱（无需隔离）')
-    if (!moved) return fail(`沙箱隔离失败：${before}（请人工检查后清理）`)
-    return pass(`沙箱已隔离到 ${moved}（未删除；人工确认后用 --purge 清理）`)
-  })
-}
+// 动态·沙箱冒烟（D0–D3 + D9）
+// 依据：dsh compat.yml 正典配方（MISSING_CREDENTIAL 判据）+ 2026-09-07 harness 调研 +
+// 工作区红线 3（一切测试全沙箱）
+//
+// 本轮（R-fix 6/7）两处硬化：
+//   1. `dsh plugin add` 显式传 --ignore-scripts —— 被测包的 install/prepare 脚本不得在宿主执行；
+//      pnpm 的 ignored-builds 阻断归类为 environment（不计 pass、不计插件缺陷）。
+//   2. D9 由「直接 rmSync」改为「隔离不删除」（红线 4）；D0 的 tarball 落进沙箱而非被检仓。
+import path from 'node:path'
+import { makeSandbox, quarantineSandbox, runStep, pass, fail, skip, envskip, tail, readJson, writeJson, exists } from './util.mjs'
+
+export const GROUP = '动态·沙箱冒烟'
+
+export function addSmokeChecks(doctor, ctx, opts = {}) {
+  const { repoPath, pkgName, logDir } = ctx
+  const dshVersion = opts.dshVersion ?? '0.1.2-rc.1'
+  const state = {}
+
+  doctor.add(GROUP, 'D0 打包 tarball（npm pack，禁止生命周期脚本）', () => {
+    state.sb = makeSandbox('smoke')
+    ctx.sandboxRoots.push(state.sb.root)
+    // --pack-destination 指向沙箱：旧实现把 .tgz 直接落在被检仓里且从不清理（实测 8 仓遗留 17 个 stray .tgz）
+    const r = runStep('d0-pack', 'npm', ['pack', '--json', '--ignore-scripts', '--pack-destination', state.sb.root], { cwd: repoPath, logDir, timeout: 300_000 })
+    if (!r.ok) return fail(`npm pack 失败（exit ${r.code}）:\n${tail(r.err)}`)
+    let pack
+    try {
+      const json = r.out.replace(/^\uFEFF/, '').trim()
+      pack = JSON.parse(json.slice(json.indexOf('['), json.lastIndexOf(']') + 1))[0]
+    } catch {
+      return fail('npm pack --json 解析失败')
+    }
+    state.tgz = path.join(state.sb.root, pack.filename)
+    if (!exists(state.tgz)) return fail(`tarball 未生成: ${pack.filename}`)
+    return pass(`已打包 ${pack.filename}（${pack.files?.length ?? '?'} 文件，落沙箱）`)
+  })
+
+  doctor.add(GROUP, 'D1 安装冒烟（plugin add + bundles 断言）', () => {
+    if (!state.tgz) return skip('D0 未通过')
+    writeJson(path.join(state.sb.root, 'package.json'), { name: 'dsh-doctor-runtime', version: '0.0.0', private: true })
+    const i = runStep('d1-host', 'npm', ['install', '--no-audit', '--no-fund', '--loglevel=error', `@deepseek-ai/dsh@${dshVersion}`], {
+      cwd: state.sb.root, logDir, timeout: 900_000,
+    })
+    if (i.spawnError || i.code === 127) {
+      return { status: 'fail', message: `环境不可用：找不到 npm/node（${i.spawnError ?? 'exit 127'}）:\n${tail(i.err)}`, category: 'infrastructure' }
+    }
+    if (!i.ok) {
+      // 宿主安装失败 ≠ 插件缺陷：归类 unsupported-host（退出码 4）
+      return { status: 'fail', message: `安装 @deepseek-ai/dsh@${dshVersion} 失败（exit ${i.code}）—— 宿主版本不可用，不判插件:\n${tail(i.err)}`, category: 'unsupported-host' }
+    }
+    const hostPkgPath = path.join(state.sb.root, 'node_modules', '@deepseek-ai', 'dsh', 'package.json')
+    if (!exists(hostPkgPath)) return { status: 'fail', message: '@deepseek-ai/dsh 未安装成功', category: 'unsupported-host' }
+    const host = readJson(hostPkgPath)
+    const rel = host.bin?.dsh
+    const bin = rel ? path.resolve(state.sb.root, 'node_modules', '@deepseek-ai', 'dsh', rel) : null
+    if (!bin || !exists(bin)) return { status: 'fail', message: `未找到 dsh bin（package.json bin=${JSON.stringify(host.bin)}）`, category: 'infrastructure' }
+    state.bin = bin
+    const dsh = (label, args, o = {}) => runStep(label, process.execPath, [bin, ...args], {
+      env: { DSH_HOME: state.sb.home, DSH_AGENTS_HOME: path.join(state.sb.home, '.agents'), ...(o.env ?? {}) },
+      cwd: state.sb.root, logDir, timeout: o.timeout ?? 120_000, shell: false,
+    })
+    state.dsh = dsh
+    // --ignore-scripts 透传给 pnpm（dsh plugin 是 pnpm 的透明转发器）
+    const a = dsh('d1-add', ['plugin', '--profile', 'headless', 'add', state.tgz, '--ignore-scripts'], { timeout: 900_000 })
+    const envBlock = /ERR_PNPM_IGNORED_BUILDS|approve-builds|ignored builds/i.test(a.err)
+    const pnpmMissing = /pnpm not found on PATH|ENOENT/i.test(a.err) || a.code === 127
+    if (pnpmMissing) {
+      return { status: 'fail', message: `环境不可用：PATH 上找不到 pnpm（dsh plugin 是 pnpm 转发器）:\n${tail(a.err)}`, category: 'infrastructure' }
+    }
+    if (!a.ok) {
+      if (envBlock) {
+        // 环境配方问题（pnpm 阻断 build scripts）→ environment，不计 pass、不计插件缺陷
+        return envskip(`pnpm approve-builds/ignored-builds 环境门阻断（属环境配方问题，非插件缺陷，参照 compat.yml allowBuilds 配方）:\n${tail(a.err)}`)
+      }
+      return fail(`plugin add 失败（exit ${a.code}）:\n${tail(a.err)}`)
+    }
+    if (/declares no dsh\.bundle|not activated/i.test(a.err)) return fail('宿主 stderr 出现未激活警告（dsh.bundle 声明未被识别）')
+    const profilePkgPath = path.join(state.sb.home, 'profiles', 'headless', 'package.json')
+    if (!exists(profilePkgPath)) return fail('profile package.json 未生成')
+    const profilePkg = readJson(profilePkgPath)
+    const bundles = profilePkg?.dsh?.profile?.bundles ?? []
+    if (!bundles.includes(pkgName)) return fail(`dsh.profile.bundles 不含 ${pkgName}（实际: ${JSON.stringify(bundles)}）`)
+    return pass(`已加入 dsh.profile.bundles: ${bundles.join(', ')}`)
+  })
+
+  doctor.add(GROUP, 'D2 层验证（--dump-config，不 boot）', () => {
+    if (!state.dsh) return skip('D1 未通过')
+    const r = state.dsh('d2-dump', ['--profile', 'headless', '--dump-config'], { timeout: 120_000 })
+    if (r.signal) return { status: 'fail', message: `--dump-config 被信号终止（${r.signal}）—— 结果不稳定`, category: 'unstable' }
+    if (!r.ok) return fail(`--dump-config 失败（exit ${r.code}）:\n${tail(r.err)}`)
+    if (!r.out.includes(`# == ${pkgName}`)) return fail(`dump-config 未见层标记 "# == ${pkgName}"`)
+    return pass(`层标记 "# == ${pkgName}" 出现（patch 已进入组合层）`)
+  })
+
+  doctor.add(GROUP, 'D3 keyless headless 冒烟（MISSING_CREDENTIAL 判据）', () => {
+    if (!state.dsh) return skip('D1 未通过')
+    const r = state.dsh('d3-run', ['--profile', 'headless', 'Reply with exactly: ok'], { timeout: 90_000 })
+    const combined = `${r.out}\n${r.err}`
+    if (r.signal) return { status: 'fail', message: `进程异常终止（signal=${r.signal}）—— 结果不稳定`, category: 'unstable' }
+    if (r.spawnError) return { status: 'fail', message: `子进程未启动（${r.spawnError}）—— 环境不可用`, category: 'infrastructure' }
+    const bad = combined.match(/.*(NO_ADAPTER|ERR_MODULE_NOT_FOUND|SyntaxError|TypeError|ReferenceError|Cannot find module).*/g)
+    if (bad) return fail(`组合未 boot 到请求阶段，出现致命错误:\n${bad.slice(0, 5).join('\n')}`)
+    if (r.code === 1 && /dsh:\s*MISSING_CREDENTIAL/.test(combined)) {
+      return pass('exit 1 + dsh: MISSING_CREDENTIAL —— bundle 层生效、插件 apply 成功、组合到达模型请求阶段（严格匹配 code，防正则假阳性）')
+    }
+    if (r.code === 0) return pass('exit 0（环境中存在凭据，完整跑通）')
+    return fail(`期望 exit 1 + MISSING_CREDENTIAL，实际 exit ${r.code}:\n${tail(combined)}`)
+  })
+
+  doctor.add(GROUP, 'D9 沙箱隔离（三段式：只隔离不删除）', () => {
+    const before = state.sb?.root ?? null
+    const moved = quarantineSandbox(state.sb)
+    state.sb = null
+    if (!before) return pass('未创建沙箱（无需隔离）')
+    if (!moved) return fail(`沙箱隔离失败：${before}（请人工检查后清理）`)
+    return pass(`沙箱已隔离到 ${moved}（未删除；人工确认后用 --purge 清理）`)
+  })
+}