@ran-sh/dsh-crew 2.0.13 → 2.0.14

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-crew",
-  "version": "2.0.13",
+  "version": "2.0.14",
   "description": "Dispatch subtasks to DeepSeek Harness (DSH) agents as native subagents with live progress",
   "author": {
     "name": "ZSeven-W"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "2.0.13",
+  "version": "2.0.14",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/src/install/install-legacy.mjs

@@ -4,7 +4,7 @@
 
 import { readFileSync, writeFileSync, mkdirSync, copyFileSync, existsSync, readdirSync, rmSync, statSync, lstatSync, opendirSync } from 'node:fs';
 import { createHash } from 'node:crypto';
-import { createRequire } from 'node:module';
+import { createRequire, isBuiltin } from 'node:module';
 import { spawnSync } from 'node:child_process';
 import { dirname, join, resolve, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -593,25 +593,58 @@ export function claudeSnapshotSettleMs(err) {
  * present is what *it* imports. The manifest is not a substitute: it declares 28
  * dependencies, including meta-packages the server never imports from here, and
  * requiring all of them to resolve read a working install as broken. Resolution
- * is asked from the entry itself, and subpath specifiers are kept as they are —
+ * follows local modules from the entry, and subpath specifiers are kept as they are —
  * `@modelcontextprotocol/sdk/server/mcp.js` resolves through its package's
  * `exports`, which the bare package name does not.
  */
 function claudeSnapshotResolvable(snapshotRoot) {
   if (typeof snapshotRoot !== 'string' || !snapshotRoot.trim()) return false;
-  const entry = join(snapshotRoot, 'src', 'server.mjs');
-  if (!existsSync(entry)) return false;
-  let source;
-  try { source = readFileSync(entry, 'utf8'); } catch { return false; }
-  const specifiers = [...source.matchAll(/(?:from|import)\s*\(?\s*['"]([^'"]+)['"]/g)]
-    .map((match) => match[1])
-    .filter((specifier) => !specifier.startsWith('.') && !specifier.startsWith('node:'));
-  if (!specifiers.length) return true;
-  let fromEntry;
-  try { fromEntry = createRequire(entry); } catch { return false; }
-  return specifiers.every((specifier) => {
-    try { return existsSync(fromEntry.resolve(specifier)); } catch { return false; }
-  });
+  const root = resolve(snapshotRoot);
+  const visited = new Set();
+  let bytes = 0;
+  const inspect = (entry) => {
+    if (visited.has(entry)) return true;
+    if (visited.size >= 512) return false;
+    const local = relative(root, entry);
+    if (local.startsWith('..') || resolve(root, local) !== entry) return false;
+    visited.add(entry);
+    try {
+      const info = lstatSync(entry);
+      if (!info.isFile() || info.isSymbolicLink() || bytes + info.size > 8 * 1024 * 1024) return false;
+      bytes += info.size;
+      if (!/\.[cm]?js$/i.test(entry)) return true;
+      const source = readFileSync(entry, 'utf8');
+      const fromEntry = createRequire(entry);
+      // Consume comments and literals as complete tokens before recognizing declarations.
+      const tokens = (source.match(/\/\*[\s\S]*?\*\/|\/\/[^\r\n]*|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|`(?:\\.|[^`\\])*`|[A-Za-z_$][\w$]*|[^\s]/g) ?? []).filter((token) => !token.startsWith('/*') && !token.startsWith('//'));
+      const specifiers = [];
+      const literal = (token) => token && /^['"]/.test(token);
+      for (let i = 0; i < tokens.length; i += 1) {
+        if (!['import', 'export', 'require'].includes(tokens[i])) continue;
+        if (tokens[i - 1] === '.') continue;
+        let next = i + 1;
+        while (tokens[next]?.startsWith('/*') || tokens[next]?.startsWith('//')) next += 1;
+        if (['import', 'require'].includes(tokens[i]) && tokens[next] === '(') {
+          if (literal(tokens[next + 1])) specifiers.push(tokens[next + 1].slice(1, -1));
+          continue;
+        }
+        if (tokens[i] === 'require') continue;
+        if (literal(tokens[next])) { specifiers.push(tokens[next].slice(1, -1)); continue; }
+        // Only import/export declarations can introduce a `from` clause.
+        if (tokens[next] === '.' || tokens[next] === '(' || ['const', 'let', 'var', 'function', 'class', 'default', 'async'].includes(tokens[next])) continue;
+        for (let j = next; j < tokens.length && tokens[j] !== ';'; j += 1) {
+          if (tokens[j] === 'from' && literal(tokens[j + 1])) { specifiers.push(tokens[j + 1].slice(1, -1)); break; }
+        }
+      }
+      return specifiers.every((specifier) => {
+        if (isBuiltin(specifier)) return true;
+        const target = fromEntry.resolve(specifier);
+        if (!existsSync(target)) return false;
+        return specifier.startsWith('.') ? inspect(target) : true;
+      });
+    } catch { return false; }
+  };
+  return inspect(join(root, 'src', 'server.mjs'));
 }
 
 /**

package/src/install/npx-lifecycle.mjs

@@ -1181,9 +1181,15 @@ export function defaultPayloadSmoke(dir, { nodePath = process.execPath, runner =
 // Keyword boundaries reject identifiers containing the keywords
 // ('legacy-import') and member calls (.from); captures stay on one line and
 // bounded — real specifiers never span lines.
-const IMPORT_SPECIFIER_RE = /(?<![\w.\-])(?:from|import|require)\b\s*\(?\s*["']([^"'\n]{1,200})["']/g;
-
-function collectExternalSpecifiers(dir) {
+//
+// A quote before the keyword is rejected too. Writing the keyword as a string —
+// `['import', 'export', 'require'].includes(word)` — is ordinary JavaScript, and
+// without this the closing quote of `'import'` was taken for the opening quote of
+// a specifier: it captured the text between two keywords and the payload failed to
+// stage on code that imports nothing at all.
+const IMPORT_SPECIFIER_RE = /(?<![\w.\-'"`])(?:from|import|require)\b\s*\(?\s*["']([^"'\n]{1,200})["']/g;
+
+export function collectExternalSpecifiers(dir) {
   const specifiers = new Set();
   const walk = (root) => {
     if (!existsSync(root)) return;

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '2.0.13';
+export const RUNTIME_VERSION = '2.0.14';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([