@tokensapi/dsh-plugin-check 0.3.2 → 0.3.3

package/README.md

@@ -52,15 +52,19 @@ npx @tokensapi/dsh-plugin-check --package @scope/name@1.2.3 --runtime 0.1.3-alph
 
 ## 会话内体检(装进 Cowork)
 
-本包同时是一个 Cowork 插件。装进宿主后会注册 `plugin_check` 工具,在会话里直接问"这个插件能装吗":
+本包同时是一个 Cowork 插件。装进宿主后会注册 `plugin_check` 工具,在会话里直接问"这个插件能装吗",不必记命令行:
 
 ```
+# 正在开发、还没发布的插件 —— 直接读工作区
+plugin_check(path="D:/code/my-plugin")
+
+# 已经发布到 npm 的包
 plugin_check(package="@scope/name", version="1.2.3")
 ```
 
-会话内跑的是**清单规则 + 包内补丁行检查**:工具会把已发布的 tarball 取下来,解出 `cordis.patch.yml` 真读补丁行——只看 registry 清单会漏掉"补丁行 `name` 写成 cordis 插件名而不是 npm 包名"这类装上即让整棵插件树崩溃的缺陷。取不到包时如实标注补丁未检查(warning),不会因网络问题把插件判成不合格。
+**发版前用 `path`**:读的是你本地的 `package.json` 与 `cordis.patch.yml`,不需要先 `npm publish`,改一行问一次都行。已发布的包用 `package`,跑的是**清单规则 + 包内补丁行检查**:工具会把已发布的 tarball 取下来,解出 `cordis.patch.yml` 真读补丁行——只看 registry 清单会漏掉"补丁行 `name` 写成 cordis 插件名而不是 npm 包名"这类装上即让整棵插件树崩溃的缺陷。取不到包时如实标注补丁未检查(warning),不会因网络问题把插件判成不合格。
 
-隔离启动冒烟无法在宿主进程里执行,完整体检仍走 CLI 或 Plugin Check workflow。
+隔离启动冒烟要装依赖、起子进程,不在宿主进程里执行;完整体检仍走 CLI 或 Plugin Check workflow。
 
 ## `dsh.engine` 字段
 

package/lib/cowork-plugin.mjs

@@ -1,14 +1,17 @@
 /* ============================================================
  * Cowork 插件入口:会话内插件体检工具
  * ============================================================
- * 装进 TokensCowork 后注册 plugin_check 工具:对任意 npm 插件包
+ * 装进 TokensCowork 后注册 plugin_check 工具:对本地插件目录或
+ * 任意 npm 插件包
  * 跑清单规则 + 包内补丁行检查(与 CLI 的清单阶段同源),模型或
  * 用户在会话里即可判断"这个插件装进来会不会有问题"。补丁行会
  * 从 tarball 里真读出来 —— 只看 registry 清单会漏掉"补丁行 name
  * 写成插件名"这类装上即崩的缺陷。含隔离启动冒烟的完整体检仍走
  * CLI:npx @tokensapi/dsh-plugin-check --package <name@ver>。
  * ============================================================ */
+import { resolve } from 'node:path'
 import { defineTool } from '@deepseek-ai/dsh-tools'
+import { checkManifest } from './manifest-check.mjs'
 import { checkPublishedPackage } from './registry-check.mjs'
 
 /** 缺省比对的运行时版本;宿主升级后可通过插件配置覆盖。 */
@@ -44,19 +47,25 @@ export function apply(ctx, config = {}) {
   const runtime = typeof config.runtime === 'string' && config.runtime !== '' ? config.runtime : DEFAULT_RUNTIME
   ctx.tools.register(defineTool({
     name: 'plugin_check',
-    description: 'Check whether a published DSH/TokensCowork plugin npm package is safe to install: '
-      + 'forbidden lifecycle scripts, dual-kernel core dependencies, missing dsh bundle patch, '
-      + 'and runtime/peer compatibility against the current DSH runtime. '
-      + 'Returns ok=false with per-rule findings when the plugin would break the host.',
+    description: 'Check whether a DSH/TokensCowork plugin is safe to install: forbidden lifecycle '
+      + 'scripts, dual-kernel core dependencies, missing or out-of-scope cordis patch rows, and '
+      + 'runtime/peer compatibility against the current DSH runtime. Returns ok=false with per-rule '
+      + 'findings when the plugin would break the host. '
+      + 'Pass "path" for a plugin the user is developing locally (checks the working tree, no publish '
+      + 'needed) — prefer this whenever the user asks about their own plugin before releasing it. '
+      + 'Pass "package" for an already published npm package. Exactly one of the two is required.',
     parameters: {
+      path: {
+        type: 'string',
+        description: 'Local plugin directory containing package.json. Use for unpublished/in-development plugins.',
+      },
       package: {
         type: 'string',
-        required: true,
-        description: 'npm package name, e.g. "@tokensapi/dsh-progressive-tools".',
+        description: 'Published npm package name, e.g. "@tokensapi/dsh-progressive-tools".',
       },
       version: {
         type: 'string',
-        description: 'Exact version to check. Defaults to the latest dist-tag.',
+        description: 'Exact version to check with "package". Defaults to the latest dist-tag.',
       },
     },
     output: {
@@ -65,6 +74,27 @@ export function apply(ctx, config = {}) {
     },
     isConcurrencySafe: () => true,
     async execute(args) {
+      const hasPath = typeof args.path === 'string' && args.path !== ''
+      const hasPackage = typeof args.package === 'string' && args.package !== ''
+      if (hasPath === hasPackage) {
+        throw new Error('plugin_check 需要且只需要一个目标:本地目录传 path,已发布包传 package')
+      }
+      if (hasPath) {
+        // 本地工作区体检:发版前就能判,不需要先 publish。隔离冒烟要装
+        // 依赖起子进程,宿主进程里不做,如实告知走 CLI。
+        const local = checkManifest(resolve(args.path), { runtime })
+        return {
+          path: resolve(args.path),
+          package: local.manifest?.name,
+          version: local.manifest?.version,
+          runtime,
+          ok: !local.findings.some(finding => finding.level === 'error'),
+          inspectedPatch: true,
+          findings: local.findings,
+          note: '以上为清单规则 + 补丁行检查(读的是本地工作区);隔离启动冒烟请在插件目录运行 '
+            + 'npx @tokensapi/dsh-plugin-check --runtime ' + runtime,
+        }
+      }
       const manifest = await fetchManifest(args.package, args.version ?? 'latest')
       const { findings, inspectedPatch } = await checkPublishedPackage(manifest, runtime)
       return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokensapi/dsh-plugin-check",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "TokensCowork/DSH \u63d2\u4ef6\u5408\u683c\u6027\u4f53\u68c0:CLI \u4e00\u6761\u547d\u4ee4\u5224\u5b9a\u63d2\u4ef6\u80fd\u5426\u5b89\u5168\u88c5\u5165\u5bbf\u4e3b;\u88c5\u5165 Cowork \u540e\u63d0\u4f9b\u4f1a\u8bdd\u5185 plugin_check \u5de5\u5177\u3002",
   "type": "module",
   "bin": {