@tokensapi/dsh-plugin-check 0.3.0 → 0.3.2

package/README.md

@@ -47,9 +47,21 @@ npx @tokensapi/dsh-plugin-check --package @scope/name@1.2.3 --runtime 0.1.3-alph
 | M9-license | warning | 建议声明 license | 分发合规 |
 | M10-secrets | error/warning | 发布内容不得包含 `.env`、私钥等凭据样式文件 | 凭据泄露 |
 | S1-pack | error | `npm pack --ignore-scripts` 必须成功 | 包本身发布不出来 |
-| S2-install | error | 按你声明的依赖必须装得出来 | 用户受控安装会同样失败 |
+| S2-install | error/warning | 按你声明的依赖必须装得出来;宿主内核包(`@deepseek-ai/*`)的内部版本在公开源取不到时降级为 warning 并跳过冒烟 | 用户受控安装会同样失败 |
 | S3/S4-apply | error | 每个补丁行:入口可解析、`import` 不抛、`ctx.plugin()` 应用不抛(声明 `inject` 等待服务注入属正常,不算失败) | **启动链击穿**——一行 import 失败会拖死整棵插件树 |
 
+## 会话内体检(装进 Cowork)
+
+本包同时是一个 Cowork 插件。装进宿主后会注册 `plugin_check` 工具,在会话里直接问"这个插件能装吗":
+
+```
+plugin_check(package="@scope/name", version="1.2.3")
+```
+
+会话内跑的是**清单规则 + 包内补丁行检查**:工具会把已发布的 tarball 取下来,解出 `cordis.patch.yml` 真读补丁行——只看 registry 清单会漏掉"补丁行 `name` 写成 cordis 插件名而不是 npm 包名"这类装上即让整棵插件树崩溃的缺陷。取不到包时如实标注补丁未检查(warning),不会因网络问题把插件判成不合格。
+
+隔离启动冒烟无法在宿主进程里执行,完整体检仍走 CLI 或 Plugin Check workflow。
+
 ## `dsh.engine` 字段
 
 在 package.json 声明你适配的 DSH 运行时范围:

package/bin/dsh-plugin-check.mjs

@@ -1,113 +1,113 @@
-#!/usr/bin/env node
-/* ============================================================
- * dsh-plugin-check:插件合格性体检 CLI
- * ============================================================
- * 用法:
- *   npx @tokensapi/dsh-plugin-check [插件目录] [选项]
- *
- * 选项:
- *   --runtime <version>  目标 DSH 运行时版本(启用 engine/peer 交集判定)
- *   --skip-smoke         只跑清单体检(离线、秒级)
- *   --keep-workspace     保留冒烟临时工作区供排查
- *   --strict             warning 也计入失败
- *   --json               机器可读输出(市场门禁用)
- *
- * 退出码:0 = 合格;1 = 存在 error(--strict 时含 warning)。
- * ============================================================ */
-import { resolve } from 'node:path'
-import { checkManifest } from '../lib/manifest-check.mjs'
-import { checkSmoke } from '../lib/smoke-check.mjs'
-import { fetchPackage } from '../lib/fetch-package.mjs'
-
-const args = process.argv.slice(2)
-const options = { dir: process.cwd(), package: undefined, runtime: undefined, skipSmoke: false, keepWorkspace: false, strict: false, json: false }
-for (let index = 0; index < args.length; index += 1) {
-  const arg = args[index]
-  if (arg === '--runtime') { options.runtime = args[++index]; continue }
-  if (arg === '--package') { options.package = args[++index]; continue }
-  if (arg === '--skip-smoke') { options.skipSmoke = true; continue }
-  if (arg === '--keep-workspace') { options.keepWorkspace = true; continue }
-  if (arg === '--strict') { options.strict = true; continue }
-  if (arg === '--json') { options.json = true; continue }
-  if (arg === '--help' || arg === '-h') {
-    process.stdout.write('用法: dsh-plugin-check [插件目录] [--package <name@version>] [--runtime <version>] [--skip-smoke] [--keep-workspace] [--strict] [--json]\n')
-    process.exit(0)
-  }
-  if (arg.startsWith('--')) {
-    process.stderr.write(`未知选项: ${arg}\n`)
-    process.exit(2)
-  }
-  options.dir = resolve(arg)
-}
-
-const findings = []
-const phases = []
-
-if (options.package !== undefined) {
-  const fetched = fetchPackage(options.package)
-  if ('error' in fetched) {
-    process.stderr.write(`无法获取 ${options.package}: ${fetched.error}
-`)
-    process.exit(1)
-  }
-  options.dir = fetched.dir
-}
-
-const manifestResult = checkManifest(options.dir, { runtime: options.runtime })
-findings.push(...manifestResult.findings)
-phases.push({ phase: 'manifest', findings: manifestResult.findings })
-
-let smokeSkipped = true
-if (!options.skipSmoke
-  && manifestResult.manifest !== undefined
-  && manifestResult.rows !== undefined
-  && !manifestResult.findings.some(finding => finding.level === 'error')) {
-  smokeSkipped = false
-  const smokeResult = checkSmoke(options.dir, manifestResult.manifest, manifestResult.rows, {
-    keepWorkspace: options.keepWorkspace,
-  })
-  findings.push(...smokeResult.findings)
-  phases.push({ phase: 'smoke', findings: smokeResult.findings, workspace: smokeResult.workspace })
-} else if (!options.skipSmoke) {
-  phases.push({ phase: 'smoke', skipped: '清单体检存在 error,冒烟不再执行' })
-}
-
-const errors = findings.filter(finding => finding.level === 'error')
-const warnings = findings.filter(finding => finding.level === 'warning')
-const infos = findings.filter(finding => finding.level === 'info')
-const failed = errors.length > 0 || (options.strict && warnings.length > 0)
-
-if (options.json) {
-  process.stdout.write(`${JSON.stringify({
-    ok: !failed,
-    plugin: manifestResult.manifest?.name,
-    version: manifestResult.manifest?.version,
-    runtime: options.runtime ?? null,
-    errors,
-    warnings,
-    phases,
-  }, undefined, 2)}\n`)
-  process.exit(failed ? 1 : 0)
-}
-
-const title = manifestResult.manifest?.name !== undefined
-  ? `${manifestResult.manifest.name}@${manifestResult.manifest.version ?? '?'}`
-  : options.dir
-process.stdout.write(`\ndsh-plugin-check · ${title}\n`)
-if (options.runtime !== undefined) process.stdout.write(`目标运行时: ${options.runtime}\n`)
-process.stdout.write('\n')
-for (const finding of errors) process.stdout.write(`  ❌ [${finding.rule}] ${finding.message}\n`)
-for (const finding of warnings) process.stdout.write(`  ⚠️  [${finding.rule}] ${finding.message}\n`)
-for (const finding of infos) process.stdout.write(`  ✅ ${finding.message}
-`)
-if (findings.length === 0) process.stdout.write('  全部规则通过\n')
-process.stdout.write('\n')
-if (smokeSkipped && !options.skipSmoke && errors.length > 0) {
-  process.stdout.write('清单存在 error,隔离冒烟未执行;修复后重跑。\n')
-} else if (options.skipSmoke) {
-  process.stdout.write('已按 --skip-smoke 跳过隔离冒烟。\n')
-}
-process.stdout.write(failed
-  ? `结论: 不合格(${errors.length} error / ${warnings.length} warning)\n`
-  : `结论: 合格(0 error / ${warnings.length} warning)\n`)
-process.exit(failed ? 1 : 0)
+#!/usr/bin/env node
+/* ============================================================
+ * dsh-plugin-check:插件合格性体检 CLI
+ * ============================================================
+ * 用法:
+ *   npx @tokensapi/dsh-plugin-check [插件目录] [选项]
+ *
+ * 选项:
+ *   --runtime <version>  目标 DSH 运行时版本(启用 engine/peer 交集判定)
+ *   --skip-smoke         只跑清单体检(离线、秒级)
+ *   --keep-workspace     保留冒烟临时工作区供排查
+ *   --strict             warning 也计入失败
+ *   --json               机器可读输出(市场门禁用)
+ *
+ * 退出码:0 = 合格;1 = 存在 error(--strict 时含 warning)。
+ * ============================================================ */
+import { resolve } from 'node:path'
+import { checkManifest } from '../lib/manifest-check.mjs'
+import { checkSmoke } from '../lib/smoke-check.mjs'
+import { fetchPackage } from '../lib/fetch-package.mjs'
+
+const args = process.argv.slice(2)
+const options = { dir: process.cwd(), package: undefined, runtime: undefined, skipSmoke: false, keepWorkspace: false, strict: false, json: false }
+for (let index = 0; index < args.length; index += 1) {
+  const arg = args[index]
+  if (arg === '--runtime') { options.runtime = args[++index]; continue }
+  if (arg === '--package') { options.package = args[++index]; continue }
+  if (arg === '--skip-smoke') { options.skipSmoke = true; continue }
+  if (arg === '--keep-workspace') { options.keepWorkspace = true; continue }
+  if (arg === '--strict') { options.strict = true; continue }
+  if (arg === '--json') { options.json = true; continue }
+  if (arg === '--help' || arg === '-h') {
+    process.stdout.write('用法: dsh-plugin-check [插件目录] [--package <name@version>] [--runtime <version>] [--skip-smoke] [--keep-workspace] [--strict] [--json]\n')
+    process.exit(0)
+  }
+  if (arg.startsWith('--')) {
+    process.stderr.write(`未知选项: ${arg}\n`)
+    process.exit(2)
+  }
+  options.dir = resolve(arg)
+}
+
+const findings = []
+const phases = []
+
+if (options.package !== undefined) {
+  const fetched = fetchPackage(options.package)
+  if ('error' in fetched) {
+    process.stderr.write(`无法获取 ${options.package}: ${fetched.error}
+`)
+    process.exit(1)
+  }
+  options.dir = fetched.dir
+}
+
+const manifestResult = checkManifest(options.dir, { runtime: options.runtime })
+findings.push(...manifestResult.findings)
+phases.push({ phase: 'manifest', findings: manifestResult.findings })
+
+let smokeSkipped = true
+if (!options.skipSmoke
+  && manifestResult.manifest !== undefined
+  && manifestResult.rows !== undefined
+  && !manifestResult.findings.some(finding => finding.level === 'error')) {
+  smokeSkipped = false
+  const smokeResult = checkSmoke(options.dir, manifestResult.manifest, manifestResult.rows, {
+    keepWorkspace: options.keepWorkspace,
+  })
+  findings.push(...smokeResult.findings)
+  phases.push({ phase: 'smoke', findings: smokeResult.findings, workspace: smokeResult.workspace })
+} else if (!options.skipSmoke) {
+  phases.push({ phase: 'smoke', skipped: '清单体检存在 error,冒烟不再执行' })
+}
+
+const errors = findings.filter(finding => finding.level === 'error')
+const warnings = findings.filter(finding => finding.level === 'warning')
+const infos = findings.filter(finding => finding.level === 'info')
+const failed = errors.length > 0 || (options.strict && warnings.length > 0)
+
+if (options.json) {
+  process.stdout.write(`${JSON.stringify({
+    ok: !failed,
+    plugin: manifestResult.manifest?.name,
+    version: manifestResult.manifest?.version,
+    runtime: options.runtime ?? null,
+    errors,
+    warnings,
+    phases,
+  }, undefined, 2)}\n`)
+  process.exit(failed ? 1 : 0)
+}
+
+const title = manifestResult.manifest?.name !== undefined
+  ? `${manifestResult.manifest.name}@${manifestResult.manifest.version ?? '?'}`
+  : options.dir
+process.stdout.write(`\ndsh-plugin-check · ${title}\n`)
+if (options.runtime !== undefined) process.stdout.write(`目标运行时: ${options.runtime}\n`)
+process.stdout.write('\n')
+for (const finding of errors) process.stdout.write(`  ❌ [${finding.rule}] ${finding.message}\n`)
+for (const finding of warnings) process.stdout.write(`  ⚠️  [${finding.rule}] ${finding.message}\n`)
+for (const finding of infos) process.stdout.write(`  ✅ ${finding.message}
+`)
+if (findings.length === 0) process.stdout.write('  全部规则通过\n')
+process.stdout.write('\n')
+if (smokeSkipped && !options.skipSmoke && errors.length > 0) {
+  process.stdout.write('清单存在 error,隔离冒烟未执行;修复后重跑。\n')
+} else if (options.skipSmoke) {
+  process.stdout.write('已按 --skip-smoke 跳过隔离冒烟。\n')
+}
+process.stdout.write(failed
+  ? `结论: 不合格(${errors.length} error / ${warnings.length} warning)\n`
+  : `结论: 合格(0 error / ${warnings.length} warning)\n`)
+process.exit(failed ? 1 : 0)

package/cordis.patch.yml

@@ -1,3 +1,3 @@
-- insert:
-    - id: tokens-plugin-check
-      name: '@tokensapi/dsh-plugin-check'
+- insert:
+    - id: tokens-plugin-check
+      name: '@tokensapi/dsh-plugin-check'

package/lib/cowork-plugin.mjs

@@ -2,12 +2,14 @@
  * Cowork 插件入口:会话内插件体检工具
  * ============================================================
  * 装进 TokensCowork 后注册 plugin_check 工具:对任意 npm 插件包
- * 跑清单规则(与 CLI 的清单阶段同源),模型或用户在会话里即可
- * 判断"这个插件装进来会不会有问题"。含隔离启动冒烟的完整体检
- * 仍走 CLI:npx @tokensapi/dsh-plugin-check --package <name@ver>。
+ * 跑清单规则 + 包内补丁行检查(与 CLI 的清单阶段同源),模型或
+ * 用户在会话里即可判断"这个插件装进来会不会有问题"。补丁行会
+ * 从 tarball 里真读出来 —— 只看 registry 清单会漏掉"补丁行 name
+ * 写成插件名"这类装上即崩的缺陷。含隔离启动冒烟的完整体检仍走
+ * CLI:npx @tokensapi/dsh-plugin-check --package <name@ver>。
  * ============================================================ */
 import { defineTool } from '@deepseek-ai/dsh-tools'
-import { checkPublishedManifest } from './registry-check.mjs'
+import { checkPublishedPackage } from './registry-check.mjs'
 
 /** 缺省比对的运行时版本;宿主升级后可通过插件配置覆盖。 */
 const DEFAULT_RUNTIME = '0.1.3-alpha.1'
@@ -64,14 +66,17 @@ export function apply(ctx, config = {}) {
     isConcurrencySafe: () => true,
     async execute(args) {
       const manifest = await fetchManifest(args.package, args.version ?? 'latest')
-      const findings = checkPublishedManifest(manifest, runtime)
+      const { findings, inspectedPatch } = await checkPublishedPackage(manifest, runtime)
       return {
         package: manifest.name,
         version: manifest.version,
         runtime,
         ok: !findings.some(finding => finding.level === 'error'),
+        inspectedPatch,
         findings,
-        note: '以上为清单规则;含隔离启动冒烟的完整体检请运行 npx @tokensapi/dsh-plugin-check --package <name@version>',
+        note: inspectedPatch
+          ? '以上为清单规则 + 包内补丁行检查;含隔离启动冒烟的完整体检请运行 npx @tokensapi/dsh-plugin-check --package <name@version>'
+          : '未读到包内补丁文件,补丁行未检查;请运行 npx @tokensapi/dsh-plugin-check --package <name@version> 做完整体检',
       }
     },
   }))

package/lib/fetch-package.mjs

@@ -1,44 +1,44 @@
-/* ============================================================
- * 已发布包获取:npm pack 指定 spec 并解包,供市场门禁按
- * "包名@版本"体检(而不是本地目录)。
- * ============================================================ */
-import { mkdtempSync, mkdirSync, readdirSync } from 'node:fs'
-import { spawnSync } from 'node:child_process'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { runNpm } from './npm.mjs'
-
-const FETCH_TIMEOUT_MS = 180_000
-
-/**
- * 拉取并解包一个已发布的 npm 包。
- * @param {string} spec - 如 "@scope/name@1.2.3"(建议锁定精确版本)。
- * @returns {{ dir: string } | { error: string }} dir 为解出的包根目录
- *   (临时位置,由调用方决定何时清理)。
- */
-export function fetchPackage(spec) {
-  const workspace = mkdtempSync(join(tmpdir(), 'dsh-plugin-fetch-'))
-  const pack = runNpm(['pack', spec, '--pack-destination', workspace], workspace, FETCH_TIMEOUT_MS)
-  if (pack.status !== 0) {
-    return { error: `npm pack ${spec} 失败: ${(pack.stderr || pack.stdout || '').trim().split('\n').slice(-3).join(' ')}` }
-  }
-  const tarball = readdirSync(workspace).find(name => name.endsWith('.tgz'))
-  if (tarball === undefined) return { error: 'npm pack 未产出 tgz' }
-  const extractDir = join(workspace, 'extracted')
-  mkdirSync(extractDir)
-  // Windows 自带 bsdtar,macOS/Linux 自带 tar;相对路径调用避开
-  // MSYS tar 对盘符路径的误判。
-  const extract = spawnSync('tar', ['-xzf', tarball, '-C', 'extracted'], {
-    cwd: workspace,
-    encoding: 'utf8',
-    timeout: FETCH_TIMEOUT_MS,
-    shell: process.platform === 'win32',
-  })
-  if (extract.status !== 0) {
-    return { error: `解包失败: ${(extract.stderr || '').trim().split('\n').slice(-2).join(' ')}` }
-  }
-  // npm 打包约定顶层目录名为 package/。
-  const [root] = readdirSync(extractDir)
-  if (root === undefined) return { error: '解包结果为空' }
-  return { dir: join(extractDir, root) }
-}
+/* ============================================================
+ * 已发布包获取:npm pack 指定 spec 并解包,供市场门禁按
+ * "包名@版本"体检(而不是本地目录)。
+ * ============================================================ */
+import { mkdtempSync, mkdirSync, readdirSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { runNpm } from './npm.mjs'
+
+const FETCH_TIMEOUT_MS = 180_000
+
+/**
+ * 拉取并解包一个已发布的 npm 包。
+ * @param {string} spec - 如 "@scope/name@1.2.3"(建议锁定精确版本)。
+ * @returns {{ dir: string } | { error: string }} dir 为解出的包根目录
+ *   (临时位置,由调用方决定何时清理)。
+ */
+export function fetchPackage(spec) {
+  const workspace = mkdtempSync(join(tmpdir(), 'dsh-plugin-fetch-'))
+  const pack = runNpm(['pack', spec, '--pack-destination', workspace], workspace, FETCH_TIMEOUT_MS)
+  if (pack.status !== 0) {
+    return { error: `npm pack ${spec} 失败: ${(pack.stderr || pack.stdout || '').trim().split('\n').slice(-3).join(' ')}` }
+  }
+  const tarball = readdirSync(workspace).find(name => name.endsWith('.tgz'))
+  if (tarball === undefined) return { error: 'npm pack 未产出 tgz' }
+  const extractDir = join(workspace, 'extracted')
+  mkdirSync(extractDir)
+  // Windows 自带 bsdtar,macOS/Linux 自带 tar;相对路径调用避开
+  // MSYS tar 对盘符路径的误判。
+  const extract = spawnSync('tar', ['-xzf', tarball, '-C', 'extracted'], {
+    cwd: workspace,
+    encoding: 'utf8',
+    timeout: FETCH_TIMEOUT_MS,
+    shell: process.platform === 'win32',
+  })
+  if (extract.status !== 0) {
+    return { error: `解包失败: ${(extract.stderr || '').trim().split('\n').slice(-2).join(' ')}` }
+  }
+  // npm 打包约定顶层目录名为 package/。
+  const [root] = readdirSync(extractDir)
+  if (root === undefined) return { error: '解包结果为空' }
+  return { dir: join(extractDir, root) }
+}

package/lib/manifest-check.mjs

@@ -8,7 +8,7 @@
 import { existsSync, readFileSync, statSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import semver from 'semver'
-import { extractPatchRows } from './patch-rows.mjs'
+import { checkPatchContent } from './patch-rows.mjs'
 
 /** 安装即执行任意代码的脚本;市场受控安装的既有红线。 */
 const FORBIDDEN_LIFECYCLE = ['preinstall', 'install', 'postinstall', 'prepare']
@@ -83,18 +83,13 @@ export function checkManifest(pluginDir, options = {}) {
     if (!existsSync(patchPath)) {
       error('M4-bundle', `dsh.bundle.patch 指向的文件不存在: ${bundle.patch}`)
     } else {
-      const extracted = extractPatchRows(readFileSync(patchPath, 'utf8'))
-      for (const problem of extracted.problems) error('M4-bundle', `补丁行不合法: ${problem}`)
-      rows = extracted.rows
-      if (rows.length === 0 && extracted.problems.length === 0) {
-        error('M4-bundle', '补丁未声明任何插件行')
-      }
-      const packageName = typeof manifest.name === 'string' ? manifest.name : ''
-      for (const row of rows ?? []) {
-        if (packageName !== '' && row.name !== packageName && !row.name.startsWith(`${packageName}/`)) {
-          error('M5-row-scope', `补丁行 "${row.id ?? row.name}" 指向 ${row.name},超出本包命名空间(${packageName});插件只能挂载自己的入口`)
-        }
-      }
+      // M4/M5 与会话内体检共用同一份实现,避免两条路径判定漂移。
+      const checked = checkPatchContent(
+        typeof manifest.name === 'string' ? manifest.name : '',
+        readFileSync(patchPath, 'utf8'),
+      )
+      findings.push(...checked.findings)
+      rows = checked.rows
     }
   }
 

package/lib/npm.mjs

@@ -1,13 +1,13 @@
-/* npm 子进程调用:统一 --ignore-scripts,被检代码没有机会在检查器
- * 进程里执行安装钩子。 */
-import { spawnSync } from 'node:child_process'
-
-export function runNpm(args, cwd, timeout) {
-  return spawnSync(process.platform === 'win32' ? 'npm.cmd' : 'npm', args, {
-    cwd,
-    encoding: 'utf8',
-    timeout,
-    shell: process.platform === 'win32',
-    env: { ...process.env, npm_config_ignore_scripts: 'true' },
-  })
-}
+/* npm 子进程调用:统一 --ignore-scripts,被检代码没有机会在检查器
+ * 进程里执行安装钩子。 */
+import { spawnSync } from 'node:child_process'
+
+export function runNpm(args, cwd, timeout) {
+  return spawnSync(process.platform === 'win32' ? 'npm.cmd' : 'npm', args, {
+    cwd,
+    encoding: 'utf8',
+    timeout,
+    shell: process.platform === 'win32',
+    env: { ...process.env, npm_config_ignore_scripts: 'true' },
+  })
+}

package/lib/patch-rows.mjs

@@ -1,86 +1,108 @@
-/* ============================================================
- * cordis.patch.yml 行提取
- * ============================================================
- * 补丁文件由 cordis-plugin-loader 的方言消费,可能携带 !!js 等
- * 自定义标签。体检工具只做只读判定,解析必须永不因未知标签而死:
- * 未知标签统一收敛为占位对象,携带它的行照常提取,配置标记为
- * 不可静态求值(冒烟时跳过该行的 config)。
- * ============================================================ */
-import yaml from 'js-yaml'
-
-const JS_EXPR_PLACEHOLDER = Symbol('dsh-plugin-check:js-expr')
-
-const tolerantSchema = yaml.DEFAULT_SCHEMA.extend(
-  ['scalar', 'sequence', 'mapping'].map(kind => new yaml.Type('!', {
-    kind,
-    multi: true,
-    construct: () => ({ [JS_EXPR_PLACEHOLDER]: true }),
-  })),
-)
-
-/** 配置里是否携带无法静态求值的表达式(!!js 等自定义标签)。 */
-export function hasDynamicConfig(value) {
-  if (value === null || typeof value !== 'object') return false
-  if (value[JS_EXPR_PLACEHOLDER] === true) return true
-  const children = Array.isArray(value) ? value : Object.values(value)
-  return children.some(child => hasDynamicConfig(child))
-}
+/* ============================================================
+ * cordis.patch.yml 行提取
+ * ============================================================
+ * 补丁文件由 cordis-plugin-loader 的方言消费,可能携带 !!js 等
+ * 自定义标签。体检工具只做只读判定,解析必须永不因未知标签而死:
+ * 未知标签统一收敛为占位对象,携带它的行照常提取,配置标记为
+ * 不可静态求值(冒烟时跳过该行的 config)。
+ * ============================================================ */
+import yaml from 'js-yaml'
+
+const JS_EXPR_PLACEHOLDER = Symbol('dsh-plugin-check:js-expr')
+
+const tolerantSchema = yaml.DEFAULT_SCHEMA.extend(
+  ['scalar', 'sequence', 'mapping'].map(kind => new yaml.Type('!', {
+    kind,
+    multi: true,
+    construct: () => ({ [JS_EXPR_PLACEHOLDER]: true }),
+  })),
+)
+
+/** 配置里是否携带无法静态求值的表达式(!!js 等自定义标签)。 */
+export function hasDynamicConfig(value) {
+  if (value === null || typeof value !== 'object') return false
+  if (value[JS_EXPR_PLACEHOLDER] === true) return true
+  const children = Array.isArray(value) ? value : Object.values(value)
+  return children.some(child => hasDynamicConfig(child))
+}
+
+/**
+ * 从补丁内容提取全部插件行。
+ * 支持顶层两种形状:直接的行数组,或 { insert: [...] } 之类的
+ * 操作映射(取所有数组值展平)。行内的 group 嵌套按 config 递归。
+ * @param {string} content - cordis.patch.yml 的完整文本。
+ * @returns {{ rows: Array<{id?: string, name: string, config?: unknown, disabled?: boolean, dynamicConfig: boolean}>, problems: string[] }}
+ */
+export function extractPatchRows(content) {
+  const problems = []
+  let document
+  try {
+    document = yaml.load(content, { schema: tolerantSchema })
+  } catch (cause) {
+    return { rows: [], problems: [`补丁不是合法 YAML: ${cause instanceof Error ? cause.message.split('\n')[0] : String(cause)}`] }
+  }
+  const topLevel = []
+  if (Array.isArray(document)) {
+    topLevel.push(...document)
+  } else if (document !== null && typeof document === 'object') {
+    for (const value of Object.values(document)) {
+      if (Array.isArray(value)) topLevel.push(...value)
+    }
+  }
+  const candidates = []
+  for (const operation of topLevel) {
+    if (Array.isArray(operation)) candidates.push(...operation)
+    else if (operation !== null && typeof operation === 'object' && !('name' in operation)) {
+      for (const value of Object.values(operation)) {
+        if (Array.isArray(value)) candidates.push(...value)
+      }
+    } else candidates.push(operation)
+  }
+  const rows = []
+  const visit = (entry, at) => {
+    if (entry === null || typeof entry !== 'object') {
+      problems.push(`${at} 不是行对象`)
+      return
+    }
+    if (entry.group === true) {
+      const children = Array.isArray(entry.config) ? entry.config : []
+      children.forEach((child, index) => visit(child, `${at} group 第 ${index + 1} 行`))
+      return
+    }
+    if (typeof entry.name !== 'string' || entry.name === '') {
+      problems.push(`${at} 缺少 name`)
+      return
+    }
+    rows.push({
+      id: typeof entry.id === 'string' ? entry.id : undefined,
+      name: entry.name,
+      config: entry.config,
+      disabled: entry.disabled === true,
+      dynamicConfig: hasDynamicConfig(entry.config),
+    })
+  }
+  candidates.forEach((entry, index) => visit(entry, `第 ${index + 1} 行`))
+  return { rows, problems }
+}
 
 /**
- * 从补丁内容提取全部插件行。
- * 支持顶层两种形状:直接的行数组,或 { insert: [...] } 之类的
- * 操作映射(取所有数组值展平)。行内的 group 嵌套按 config 递归。
- * @param {string} content - cordis.patch.yml 的完整文本。
- * @returns {{ rows: Array<{id?: string, name: string, config?: unknown, disabled?: boolean, dynamicConfig: boolean}>, problems: string[] }}
+ * 对补丁内容执行 M4/M5 判定。
+ * 目录体检与会话内体检共用这一份实现:两边曾经各写各的,结果
+ * 会话内看不到 M5,把装上即崩的插件判成合格。
+ * @param {string} packageName - 本包 npm 包名。
+ * @param {string} content - cordis.patch.yml 全文。
+ * @returns {{ findings: Array<{level: 'error', rule: string, message: string}>, rows: object[] }}
  */
-export function extractPatchRows(content) {
-  const problems = []
-  let document
-  try {
-    document = yaml.load(content, { schema: tolerantSchema })
-  } catch (cause) {
-    return { rows: [], problems: [`补丁不是合法 YAML: ${cause instanceof Error ? cause.message.split('\n')[0] : String(cause)}`] }
-  }
-  const topLevel = []
-  if (Array.isArray(document)) {
-    topLevel.push(...document)
-  } else if (document !== null && typeof document === 'object') {
-    for (const value of Object.values(document)) {
-      if (Array.isArray(value)) topLevel.push(...value)
-    }
-  }
-  const candidates = []
-  for (const operation of topLevel) {
-    if (Array.isArray(operation)) candidates.push(...operation)
-    else if (operation !== null && typeof operation === 'object' && !('name' in operation)) {
-      for (const value of Object.values(operation)) {
-        if (Array.isArray(value)) candidates.push(...value)
-      }
-    } else candidates.push(operation)
-  }
-  const rows = []
-  const visit = (entry, at) => {
-    if (entry === null || typeof entry !== 'object') {
-      problems.push(`${at} 不是行对象`)
-      return
-    }
-    if (entry.group === true) {
-      const children = Array.isArray(entry.config) ? entry.config : []
-      children.forEach((child, index) => visit(child, `${at} group 第 ${index + 1} 行`))
-      return
-    }
-    if (typeof entry.name !== 'string' || entry.name === '') {
-      problems.push(`${at} 缺少 name`)
-      return
+export function checkPatchContent(packageName, content) {
+  const findings = []
+  const error = (rule, message) => findings.push({ level: 'error', rule, message })
+  const { rows, problems } = extractPatchRows(content)
+  for (const problem of problems) error('M4-bundle', `补丁行不合法: ${problem}`)
+  if (rows.length === 0 && problems.length === 0) error('M4-bundle', '补丁未声明任何插件行')
+  for (const row of rows) {
+    if (packageName !== '' && row.name !== packageName && !row.name.startsWith(`${packageName}/`)) {
+      error('M5-row-scope', `补丁行 "${row.id ?? row.name}" 指向 ${row.name},超出本包命名空间(${packageName});插件只能挂载自己的入口`)
     }
-    rows.push({
-      id: typeof entry.id === 'string' ? entry.id : undefined,
-      name: entry.name,
-      config: entry.config,
-      disabled: entry.disabled === true,
-      dynamicConfig: hasDynamicConfig(entry.config),
-    })
   }
-  candidates.forEach((entry, index) => visit(entry, `第 ${index + 1} 行`))
-  return { rows, problems }
+  return { findings, rows }
 }

package/lib/registry-check.mjs

@@ -3,9 +3,17 @@
  * ============================================================
  * 对 npm registry 的版本文档跑清单规则,与目录体检(manifest-check)
  * 同一套语义,但不需要文件系统 —— 供 Cowork 插件进程内使用。
+ *
+ * 两个入口:
+ *  - checkPublishedManifest 纯同步零依赖,只看清单字段;
+ *  - checkPublishedPackage 额外取 tarball 读出 cordis.patch.yml,
+ *    补上 M4/M5 —— 只看清单会漏掉"补丁行 name 写成插件名"这类
+ *    装上即让整棵插件树崩溃的缺陷。
  * 冒烟阶段无法在宿主进程执行,完整体检走 CLI 或 Plugin Check
  * workflow。
  * ============================================================ */
+import { checkPatchContent } from './patch-rows.mjs'
+import { fetchTarEntry } from './tarball.mjs'
 
 const FORBIDDEN_LIFECYCLE = ['preinstall', 'install', 'postinstall', 'prepare']
 const isIdentityCore = (name) =>
@@ -156,3 +164,42 @@ export function checkPublishedManifest(manifest, runtime) {
 
   return findings
 }
+
+/**
+ * 已发布包的完整清单侧体检:清单规则 + 包内补丁行检查。
+ * 取不到 tarball(离线、超时、体积过大)时降级为 warning 并如实
+ * 标注未检查,绝不因网络问题把插件判成不合格。
+ * @param {object} manifest - registry 版本文档(需含 dist.tarball)。
+ * @param {string} runtime - 目标 DSH 运行时版本。
+ * @param {{ maxBytes?: number, timeoutMs?: number }} [options]
+ * @returns {Promise<{ findings: object[], inspectedPatch: boolean }>}
+ */
+export async function checkPublishedPackage(manifest, runtime, options = {}) {
+  const findings = checkPublishedManifest(manifest, runtime)
+  const patch = typeof manifest.dsh?.bundle?.patch === 'string' ? manifest.dsh.bundle.patch : ''
+  const tarball = typeof manifest.dist?.tarball === 'string' ? manifest.dist.tarball : ''
+  // 补丁未声明时 M4 已在清单阶段报错,无需再取包。
+  if (patch === '' || tarball === '') return { findings, inspectedPatch: false }
+
+  const relative = patch.replace(/^\.?\//u, '')
+  const result = await fetchTarEntry(tarball, entry => entry === relative, options)
+  if (result.error !== undefined) {
+    findings.push({
+      level: 'warning',
+      rule: 'M4-bundle',
+      message: `未能读取包内 ${relative}(${result.error});本次跳过补丁行检查,完整体检请走 CLI`,
+    })
+    return { findings, inspectedPatch: false }
+  }
+  if (result.content === undefined) {
+    findings.push({
+      level: 'error',
+      rule: 'M4-bundle',
+      message: `dsh.bundle.patch 指向的文件不在发布内容里: ${patch};宿主取不到补丁就挂不上插件(检查 files 白名单)`,
+    })
+    return { findings, inspectedPatch: true }
+  }
+  const packageName = typeof manifest.name === 'string' ? manifest.name : ''
+  findings.push(...checkPatchContent(packageName, result.content).findings)
+  return { findings, inspectedPatch: true }
+}

package/lib/smoke-check.mjs

@@ -20,6 +20,7 @@ import { runNpm } from './npm.mjs'
 
 const RUNNER_TIMEOUT_MS = 90_000
 const INSTALL_TIMEOUT_MS = 300_000
+const PROBE_TIMEOUT_MS = 60_000
 
 /** 子进程执行的行级冒烟脚本;结果写文件,避开插件对 stdout 的污染。 */
 const RUNNER_SOURCE = `
@@ -78,6 +79,33 @@ process.exit(0)
 `
 
 
+/** 宿主内核作用域:这些包由宿主提供,私有版本本就不在公开源上。 */
+const CORE_SCOPE = '@deepseek-ai/'
+
+/**
+ * 找出「公开源上取不到、但不该算插件问题」的依赖。
+ * 宿主内核包(@deepseek-ai/*)的内部版本只发在私有源,检查器在
+ * 公网环境里必然解析不到 —— 据此判插件不合格是冤枉它。其它包
+ * 解析不到就是插件自己声明错了范围,仍按 error 处理。
+ * @param {Record<string, string>} dependencies - 工作区依赖表。
+ * @param {string} workspace - 探测执行目录。
+ * @returns {string[]} 取不到的内核包(带版本范围)。
+ */
+function findUnreachableCoreDependencies(dependencies, workspace) {
+  const missing = []
+  for (const [name, range] of Object.entries(dependencies)) {
+    if (!name.startsWith(CORE_SCOPE)) continue
+    if (typeof range !== 'string' || range.startsWith('file:')) continue
+    const view = runNpm(['view', `${name}@${range}`, 'version', '--json'], workspace, PROBE_TIMEOUT_MS)
+    const output = `${view.stderr}${view.stdout}`
+    // 版本存在时 npm view 会打印版本号;解析不到才算取不到。
+    if (view.status !== 0 || output.trim() === '' || output.trim() === '[]') {
+      missing.push(`${name}@${range}`)
+    }
+  }
+  return missing
+}
+
 /**
  * 对插件目录执行隔离冒烟。
  * @param {string} pluginDir - 插件根目录。
@@ -130,7 +158,16 @@ export function checkSmoke(pluginDir, manifest, rows, options = {}) {
       INSTALL_TIMEOUT_MS,
     )
     if (install.status !== 0) {
-      error('S2-install', `依赖装不出来(用户侧受控安装会同样失败): ${(install.stderr || '').trim().split('\n').slice(-4).join(' ')}`)
+      const detail = (install.stderr || '').trim().split('\n').slice(-4).join(' ')
+      // 区分「真装不出来」和「内核内部版本在公开源取不到」:后者是
+      // 检查环境的限制,判成不合格会冤枉插件,只如实标注冒烟未执行。
+      const unreachable = findUnreachableCoreDependencies(dependencies, workspace)
+      if (unreachable.length > 0) {
+        warning('S2-install', `宿主内核依赖 ${unreachable.join('、')} 在公开 npm 上取不到(内部版本),隔离冒烟无法执行,已跳过;`
+          + `清单规则仍已判定。如需完整冒烟,请在能访问这些包的环境里重跑。原始错误: ${detail}`)
+      } else {
+        error('S2-install', `依赖装不出来(用户侧受控安装会同样失败): ${detail}`)
+      }
       return { findings, workspace: options.keepWorkspace ? workspace : undefined }
     }
 

package/lib/tarball.mjs

@@ -0,0 +1,98 @@
+/* ============================================================
+ * npm tarball 单文件读取(零依赖)
+ * ============================================================
+ * registry 的版本清单里没有包内文件内容,而 M4/M5 这类规则必须
+ * 读到 cordis.patch.yml 本身 —— 曾有插件把补丁行的 name 写成
+ * cordis 插件名而非包名,清单看不出任何异常,装上却让整棵插件树
+ * 加载失败。会话内体检没有 npm 子进程可用,因此这里直接取
+ * dist.tarball,用 node:zlib 解 gzip 后自行走 tar 头,只取需要的
+ * 那一个文件。
+ * ============================================================ */
+import { gunzipSync } from 'node:zlib'
+
+const BLOCK = 512
+const DEFAULT_MAX_BYTES = 25 * 1024 * 1024
+const DEFAULT_TIMEOUT_MS = 20_000
+
+const readString = (buffer, offset, length) => {
+  const slice = buffer.subarray(offset, offset + length)
+  const end = slice.indexOf(0)
+  return slice.subarray(0, end === -1 ? slice.length : end).toString('utf8')
+}
+
+/** tar 头里的数值字段是补零的八进制字符串;空字段按 0 处理。 */
+const readOctal = (buffer, offset, length) => {
+  const raw = readString(buffer, offset, length).trim()
+  if (raw === '') return 0
+  const value = Number.parseInt(raw, 8)
+  return Number.isFinite(value) ? value : 0
+}
+
+/**
+ * 遍历 tar,返回首个匹配的条目内容。
+ * 处理 ustar 的 prefix 拼接与 pax(typeflag 'x')的路径覆盖,
+ * 因此长路径与非 ASCII 路径同样可取。
+ * @param {Buffer} tar - 解压后的 tar 字节。
+ * @param {(path: string) => boolean} match - 路径判定(已剥掉顶层 package/)。
+ * @returns {string | undefined}
+ */
+export function readTarEntry(tar, match) {
+  let offset = 0
+  let paxPath
+  while (offset + BLOCK <= tar.length) {
+    const header = tar.subarray(offset, offset + BLOCK)
+    if (header.every(byte => byte === 0)) break
+    const name = readString(header, 0, 100)
+    const size = readOctal(header, 124, 12)
+    const typeflag = readString(header, 156, 1)
+    const prefix = readString(header, 345, 155)
+    const dataOffset = offset + BLOCK
+    const padded = Math.ceil(size / BLOCK) * BLOCK
+    if (typeflag === 'x' || typeflag === 'X') {
+      // pax 扩展头:形如 "<len> path=<value>\n",覆盖紧随其后的条目路径。
+      const record = tar.subarray(dataOffset, dataOffset + size).toString('utf8')
+      const found = /(?:^|\n)\d+ path=([^\n]*)\n/u.exec(record)
+      paxPath = found === null ? undefined : found[1]
+      offset = dataOffset + padded
+      continue
+    }
+    const full = paxPath ?? (prefix === '' ? name : `${prefix}/${name}`)
+    paxPath = undefined
+    if (typeflag === '' || typeflag === '0') {
+      // npm 打包约定顶层统一为 package/。
+      const relative = full.replace(/^[^/]+\//u, '')
+      if (match(relative)) return tar.subarray(dataOffset, dataOffset + size).toString('utf8')
+    }
+    offset = dataOffset + padded
+  }
+  return undefined
+}
+
+/**
+ * 下载并解出 tarball 中的一个文件。
+ * 任何取不到的情形都以 { error } 返回,由调用方降级成提示而不是判定
+ * 插件不合格 —— 网络问题不是插件的过错。
+ * @param {string} url - registry 的 dist.tarball。
+ * @param {(path: string) => boolean} match
+ * @param {{ maxBytes?: number, timeoutMs?: number }} [options]
+ * @returns {Promise<{ content?: string } | { error: string }>}
+ */
+export async function fetchTarEntry(url, match, options = {}) {
+  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+  try {
+    const response = await fetch(url, { signal: controller.signal })
+    if (!response.ok) return { error: `下载 tarball 失败(HTTP ${response.status})` }
+    const declared = Number(response.headers.get('content-length') ?? '0')
+    if (declared > maxBytes) return { error: `tarball 超过 ${Math.round(maxBytes / 1024 / 1024)}MB,跳过包内检查` }
+    const raw = Buffer.from(await response.arrayBuffer())
+    if (raw.length > maxBytes) return { error: `tarball 超过 ${Math.round(maxBytes / 1024 / 1024)}MB,跳过包内检查` }
+    return { content: readTarEntry(gunzipSync(raw), match) }
+  } catch (cause) {
+    const reason = cause instanceof Error ? cause.message : String(cause)
+    return { error: cause?.name === 'AbortError' ? '下载 tarball 超时' : `读取 tarball 失败: ${reason}` }
+  } finally {
+    clearTimeout(timer)
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokensapi/dsh-plugin-check",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "TokensCowork/DSH \u63d2\u4ef6\u5408\u683c\u6027\u4f53\u68c0:CLI \u4e00\u6761\u547d\u4ee4\u5224\u5b9a\u63d2\u4ef6\u80fd\u5426\u5b89\u5168\u88c5\u5165\u5bbf\u4e3b;\u88c5\u5165 Cowork \u540e\u63d0\u4f9b\u4f1a\u8bdd\u5185 plugin_check \u5de5\u5177\u3002",
   "type": "module",
   "bin": {
@@ -25,8 +25,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/TokensAPI/TokensCowork.git",
-    "directory": "plugin-check"
+    "url": "https://github.com/TokensAPI/tokens_DshPluginCheck_code.git"
   },
   "main": "lib/cowork-plugin.mjs",
   "exports": {