@ryuu-64/dsh-find-all 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,47 @@
+# Changelog
+
+## 0.1.1
+
+### Fixed
+
+- **The client bundle now registers under the package name.** `lib/client.js` called
+  `window.__ModuleLoader__.load({ id: "dsh-find-all", ... })` — the unscoped name — while the
+  package is `@ryuu-64/dsh-find-all`. The host composes the boot-graph row id from the package
+  name (`ClientModuleRegistry.reconcilePackage`), and `ClientModuleSystem.arrive()` rejects the
+  row when the executed bundle did not register a factory under exactly that key, so the plugin
+  loaded and then failed with:
+
+  ```text
+  failed to import loader entry <id>: client-modules: bundle /plugins/??...&rev=... 
+  loaded without registering "@ryuu-64/dsh-find-all" via __ModuleLoader__.load
+  ```
+
+  The GUI surfaced this as "Failed to load plugins / 部分插件加载失败", which reads like a DSH
+  version incompatibility; it was not.
+
+  Introduced by the 0.1.0 fork, which renamed every other `dsh-find-bar` identifier to
+  `dsh-find-all` but left the registration id unscoped. `id` is now `"@ryuu-64/dsh-find-all"`.
+
+### Added
+
+- `scripts/check-client-registration.mjs` (wired into `npm run check`): reads the expected id from
+  `package.json` and fails with a `file:line` diagnostic when the bundle registers anything else,
+  so the drift cannot come back unnoticed. It takes an optional package root, so it can inspect a
+  registry tarball or an installed profile instead of only this checkout.
+- `npm run verify:release`: packs the artifact `npm publish` would upload and checks the id inside
+  that tarball. This is the check that would have caught 0.1.0 before it reached the registry.
+- `npm run deploy:profile`: installs a published release into a DSH profile and refuses to finish
+  until the installed bundle is byte-identical to the registry artifact and registers correctly.
+  Rolls the profile manifests back on any failure.
+- Tests for the registration check itself (`test/client-registration-check.test.mjs`): they run it
+  against a mutated copy, which is how the check was caught silently falling back to the checkout
+  and reporting the defective registry 0.1.0 as clean.
+- `test/bundle-registration.test.mjs`: the invariant as a test, with the expected value read
+  from `package.json` rather than hardcoded.
+- README section on the "Failed to load plugins" symptom, why it is not a DSH version problem, and
+  the fork re-scope hazard behind it.
+
+## 0.1.0
+
+Initial release: a Ctrl+F find bar that searches the whole conversation, forked from
+[`secyborg/dsh-find-bar`](https://github.com/secyborg/dsh-find-bar) (MIT).

package/README.md

@@ -46,11 +46,62 @@ dsh plugin --profile desktop add @ryuu-64/dsh-find-all
 dsh plugin --profile desktop add link:/path/to/dsh-find-all
 ```
 
+### 不依赖 npm 的安装（profile 用本仓库打好的 tarball）
+
+当 registry 上还是旧版本（或发布被 2FA 卡住）时用这条：脚本把本仓库 `npm pack` 出来的
+tarball **拷进 profile 目录**，并把依赖改成 `file:./dsh-find-all-<版本>.tgz`。pnpm 从它安装，
+**以后再跑 `pnpm install` 也只会从这个 tarball 重装，不会去 registry 把旧版本拉回来**；
+tarball 放在 profile 里（而不是仓库里），所以仓库的 `git clean -xfd` 不会把它扫掉，
+锁文件里存的也是相对路径。
+
+```sh
+npm run install:local          # 打包 → 校验 tarball 里的注册 id → 装进 profile → 逐字节自证
+```
+
+换回 registry 版本（发布成功之后）：
+
+```sh
+npm run deploy:profile         # 把依赖改回 ^<版本>，并证明装出来的字节与 registry 产物一致
+```
+
+> `deploy:profile` 会先确认目标版本**确实已发布**（否则拒绝并保持 profile 不变），
+> 所以不会出现"依赖指向一个解析不到的版本、下次 install 直接崩"的情况。
+
 > 注意：它与 `dsh-find-bar` **都会抢 Ctrl+F**，请只保留一个：
 > ```sh
 > dsh plugin --profile desktop remove dsh-find-bar
 > ```
 
+## 排障：GUI 报「Failed to load plugins / 部分插件加载失败」
+
+如果报错长这样：
+
+```text
+failed to import loader entry <id>: client-modules: bundle /plugins/??...&rev=... 
+loaded without registering "@ryuu-64/dsh-find-all" via __ModuleLoader__.load
+```
+
+**这不是 DSH 版本不兼容，别去恢复模式卸载、也别新建 Profile。** 它只有一个含义：
+`lib/client.js` 里 `window.__ModuleLoader__.load({ id })` 的 id 与**包名**不一致。
+
+宿主（`@deepseek-ai/dsh-client-modules`）用「解析出的 package.json 包名」当浏览器模块身份
+（规范的 `WebBootEntry.id` 注释就是 *Entry name == package name*），
+`ClientModuleSystem.arrive()` 在脚本加载成功后按这个 key 查 factory 表，查不到就抛这一句。
+
+0.1.0 就是这个毛病：fork 自非 scoped 的 `dsh-find-bar` 时，包名改成 `@ryuu-64/dsh-find-all`，
+bundle 里的 id 却写成了裸名 `dsh-find-all`。0.1.1 已修，并加了门禁：
+
+```sh
+npm run check:registration   # 期望值从 package.json 读，比 bundle 实际注册值
+npm run verify:release       # 打包成 tarball 再验一遍（发布前跑）
+```
+
+> **Fork / 改名提醒**：给 scoped 包 fork 一个非 scoped 包时，危险的不是包名本身，
+> 而是散落在 bundle 里的**派生字面量**。官方工具链（`packages/client/tsdown.client.ts`
+> 的 `clientBundle(id, ...)`）把 id 当参数盖章，社区脚手架（`create-dsh-plugin`）用
+> `{{PKG_NAME}}` 模板变量注入——都是为了让这个字面量无法被手写错。
+> 本包的 bundle 是手写并入库的，所以用上面两条命令代替盖章。
+
 ## 卸载 / 回退
 
 ```sh

package/lib/client.js

@@ -42,7 +42,7 @@
 //   Esc         close and clear highlights
 
 window.__ModuleLoader__.load({
-	id: "dsh-find-all",
+	id: "@ryuu-64/dsh-find-all",
 	factory: () => {
 		var module = { exports: {} };
 		var exports = module.exports;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ryuu-64/dsh-find-all",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Ctrl+F find bar for the DSH desktop app: it searches the whole conversation, not just the messages already on screen.",
   "type": "module",
   "license": "MIT",
@@ -14,6 +14,7 @@
     "lib",
     "cordis.patch.yml",
     "README.md",
+    "CHANGELOG.md",
     "NOTICE.md",
     "LICENSE"
   ],
@@ -40,7 +41,11 @@
   },
   "scripts": {
     "test": "node --test \"test/**/*.test.mjs\"",
-    "check": "node --check lib/index.js && node --check lib/client.js && node --test \"test/**/*.test.mjs\""
+    "check:registration": "node scripts/check-client-registration.mjs",
+    "check": "node --check lib/index.js && node --check lib/client.js && npm run check:registration && node --test \"test/**/*.test.mjs\"",
+    "verify:release": "node scripts/verify-release.mjs",
+    "install:local": "node scripts/install-local.mjs",
+    "deploy:profile": "node scripts/deploy-profile.mjs"
   },
   "keywords": [
     "dsh",