@tokensapi/dsh-plugin-check 0.1.0 → 0.2.0

package/README.md

@@ -16,6 +16,9 @@ npx @tokensapi/dsh-plugin-check --skip-smoke
 
 # 机器可读输出(CI / 市场门禁)
 npx @tokensapi/dsh-plugin-check --json
+
+# 体检一个已发布的 npm 包(市场上架审核用)
+npx @tokensapi/dsh-plugin-check --package @scope/name@1.2.3 --runtime 0.1.3-alpha.1
 ```
 
 退出码:`0` 合格,`1` 存在 error(`--strict` 时 warning 也计入)。冒烟失败时加 `--keep-workspace` 保留临时工作区排查。
@@ -71,4 +74,6 @@ npx @tokensapi/dsh-plugin-check --json
 
 ## 上架流程中的位置
 
-市场上架要求本工具体检通过:提交插件版本后,门禁会以相同规则复检并记录"验证于运行时 x.y.z"。本地先跑一遍,提交即通过。
+1. 开发者:发布 npm 版本前本地跑体检,全绿再发。
+2. 管理员:在仓库 Actions 的 **Plugin Check** workflow 填「包名@版本」手动触发,体检报告生成在该次运行的 Summary。
+3. 上架:后台 publish 对话框把这次运行的链接填入「检查记录链接」——链接的红/绿即审核证据,`reviewed_version` 随上架落库。存在 error 的版本不满足上架条件。

package/bin/dsh-plugin-check.mjs

@@ -17,18 +17,20 @@
 import { resolve } from 'node:path'
 import { checkManifest } from '../lib/manifest-check.mjs'
 import { checkSmoke } from '../lib/smoke-check.mjs'
+import { fetchPackage } from '../lib/fetch-package.mjs'
 
 const args = process.argv.slice(2)
-const options = { dir: process.cwd(), runtime: undefined, skipSmoke: false, keepWorkspace: false, strict: false, json: false }
+const options = { dir: process.cwd(), package: undefined, runtime: undefined, skipSmoke: false, keepWorkspace: false, strict: false, json: false }
 for (let index = 0; index < args.length; index += 1) {
   const arg = args[index]
   if (arg === '--runtime') { options.runtime = args[++index]; continue }
+  if (arg === '--package') { options.package = args[++index]; continue }
   if (arg === '--skip-smoke') { options.skipSmoke = true; continue }
   if (arg === '--keep-workspace') { options.keepWorkspace = true; continue }
   if (arg === '--strict') { options.strict = true; continue }
   if (arg === '--json') { options.json = true; continue }
   if (arg === '--help' || arg === '-h') {
-    process.stdout.write('用法: dsh-plugin-check [插件目录] [--runtime <version>] [--skip-smoke] [--keep-workspace] [--strict] [--json]\n')
+    process.stdout.write('用法: dsh-plugin-check [插件目录] [--package <name@version>] [--runtime <version>] [--skip-smoke] [--keep-workspace] [--strict] [--json]\n')
     process.exit(0)
   }
   if (arg.startsWith('--')) {
@@ -41,6 +43,16 @@ for (let index = 0; index < args.length; index += 1) {
 const findings = []
 const phases = []
 
+if (options.package !== undefined) {
+  const fetched = fetchPackage(options.package)
+  if ('error' in fetched) {
+    process.stderr.write(`无法获取 ${options.package}: ${fetched.error}
+`)
+    process.exit(1)
+  }
+  options.dir = fetched.dir
+}
+
 const manifestResult = checkManifest(options.dir, { runtime: options.runtime })
 findings.push(...manifestResult.findings)
 phases.push({ phase: 'manifest', findings: manifestResult.findings })

package/lib/fetch-package.mjs

@@ -0,0 +1,44 @@
+/* ============================================================
+ * 已发布包获取:npm pack 指定 spec 并解包,供市场门禁按
+ * "包名@版本"体检(而不是本地目录)。
+ * ============================================================ */
+import { mkdtempSync, mkdirSync, readdirSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { runNpm } from './npm.mjs'
+
+const FETCH_TIMEOUT_MS = 180_000
+
+/**
+ * 拉取并解包一个已发布的 npm 包。
+ * @param {string} spec - 如 "@scope/name@1.2.3"(建议锁定精确版本)。
+ * @returns {{ dir: string } | { error: string }} dir 为解出的包根目录
+ *   (临时位置,由调用方决定何时清理)。
+ */
+export function fetchPackage(spec) {
+  const workspace = mkdtempSync(join(tmpdir(), 'dsh-plugin-fetch-'))
+  const pack = runNpm(['pack', spec, '--pack-destination', workspace], workspace, FETCH_TIMEOUT_MS)
+  if (pack.status !== 0) {
+    return { error: `npm pack ${spec} 失败: ${(pack.stderr || pack.stdout || '').trim().split('\n').slice(-3).join(' ')}` }
+  }
+  const tarball = readdirSync(workspace).find(name => name.endsWith('.tgz'))
+  if (tarball === undefined) return { error: 'npm pack 未产出 tgz' }
+  const extractDir = join(workspace, 'extracted')
+  mkdirSync(extractDir)
+  // Windows 自带 bsdtar,macOS/Linux 自带 tar;相对路径调用避开
+  // MSYS tar 对盘符路径的误判。
+  const extract = spawnSync('tar', ['-xzf', tarball, '-C', 'extracted'], {
+    cwd: workspace,
+    encoding: 'utf8',
+    timeout: FETCH_TIMEOUT_MS,
+    shell: process.platform === 'win32',
+  })
+  if (extract.status !== 0) {
+    return { error: `解包失败: ${(extract.stderr || '').trim().split('\n').slice(-2).join(' ')}` }
+  }
+  // npm 打包约定顶层目录名为 package/。
+  const [root] = readdirSync(extractDir)
+  if (root === undefined) return { error: '解包结果为空' }
+  return { dir: join(extractDir, root) }
+}

package/lib/npm.mjs

@@ -0,0 +1,13 @@
+/* npm 子进程调用:统一 --ignore-scripts,被检代码没有机会在检查器
+ * 进程里执行安装钩子。 */
+import { spawnSync } from 'node:child_process'
+
+export function runNpm(args, cwd, timeout) {
+  return spawnSync(process.platform === 'win32' ? 'npm.cmd' : 'npm', args, {
+    cwd,
+    encoding: 'utf8',
+    timeout,
+    shell: process.platform === 'win32',
+    env: { ...process.env, npm_config_ignore_scripts: 'true' },
+  })
+}

package/lib/smoke-check.mjs

@@ -16,6 +16,7 @@ import { spawnSync } from 'node:child_process'
 import { mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync, readdirSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
+import { runNpm } from './npm.mjs'
 
 const RUNNER_TIMEOUT_MS = 90_000
 const INSTALL_TIMEOUT_MS = 300_000
@@ -76,15 +77,6 @@ writeFileSync(resultPath, JSON.stringify(results))
 process.exit(0)
 `
 
-function runNpm(args, cwd, timeout) {
-  return spawnSync(process.platform === 'win32' ? 'npm.cmd' : 'npm', args, {
-    cwd,
-    encoding: 'utf8',
-    timeout,
-    shell: process.platform === 'win32',
-    env: { ...process.env, npm_config_ignore_scripts: 'true' },
-  })
-}
 
 /**
  * 对插件目录执行隔离冒烟。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokensapi/dsh-plugin-check",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "TokensCowork/DSH \u63d2\u4ef6\u5408\u683c\u6027\u4f53\u68c0:\u4e00\u6761\u547d\u4ee4\u5224\u65ad\u63d2\u4ef6\u80fd\u5426\u5b89\u5168\u88c5\u5165\u5bbf\u4e3b,\u4e0d\u628a Cowork \u641e\u5d29\u3002",
   "type": "module",
   "bin": {