dsh-graft-plugin 0.1.0 → 0.1.2

package/README.md

@@ -1,6 +1,6 @@
 # dsh-graft-plugin
 
-![language](https://img.shields.io/badge/language-javascript-f7dc6f) ![style](https://img.shields.io/badge/style-vanilla-gray) ![license](https://img.shields.io/badge/license-MIT-blue) ![node](https://img.shields.io/badge/node-%E2%89%A5%2022-brightgreen) ![dsh](https://img.shields.io/badge/dsh-web%20profile-orange) ![runtime](https://img.shields.io/badge/runtime-offline_%C2%B7_100%25_local-brightgreen) ![tests](https://img.shields.io/badge/tests-91_passing-brightgreen)
+![language](https://img.shields.io/badge/language-javascript-f7dc6f) ![style](https://img.shields.io/badge/style-vanilla-gray) ![license](https://img.shields.io/badge/license-MIT-blue) ![node](https://img.shields.io/badge/node-%E2%89%A5%2022-brightgreen) ![dsh](https://img.shields.io/badge/dsh-web%20profile-orange) ![runtime](https://img.shields.io/badge/runtime-offline_%C2%B7_100%25_local-brightgreen) ![tests](https://img.shields.io/badge/tests-passing-brightgreen)
 
 A [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) plugin that puts [graft](https://github.com/trailhq/Graft) — a prebuilt graph of every symbol, its `file:line` span, and who calls what — in front of both you and the model.
 
@@ -18,12 +18,29 @@ dsh plugin --profile web add dsh-graft-plugin
 dsh --profile web
 ```
 
-The install also puts the graft CLI (`@nanonets/graft`) on your PATH — every tool here shells out to it, so a plugin without it can do nothing. If your global npm prefix needs elevation the postinstall says so and prints the one command to run by hand:
+**pnpm 10 and later block `postinstall` scripts from unapproved packages**, and dsh skips writing the plugin's bundle row whenever the install exits non-zero — the dependency lands, the plugin stays invisible, and dsh starts up cleanly with no error to search for. If `add` ends with `ERR_PNPM_IGNORED_BUILDS`, approve and re-run it:
+
+```sh
+cd ~/.dsh/profiles/web && pnpm approve-builds      # tick dsh-graft-plugin
+dsh plugin --profile web add dsh-graft-plugin      # re-run so the bundle row gets written
+```
+
+Confirm it mounted — the plugin must appear in **both** `dependencies` and `dsh.profile.bundles` in the profile's `package.json`:
+
+```sh
+cd ~/.dsh/profiles/web && node -e "const p=require('./package.json');
+  console.log(p.dependencies['dsh-graft-plugin'],
+              p.dsh.profile.bundles.includes('dsh-graft-plugin'))"
+```
+
+Every tool here shells out to the `graft` CLI, so it needs `@nanonets/graft` on PATH:
 
 ```sh
 npm install -g @nanonets/graft
 ```
 
+A `postinstall` does this for you **when your package manager runs lifecycle scripts** — under pnpm 10+ they are blocked by default, so treat the command above as the required step there, not a fallback. If your global npm prefix needs elevation, the postinstall says so and prints the one command to run by hand.
+
 Then index a repo once:
 
 ```sh
@@ -33,12 +50,14 @@ graft build
 
 ### The sidebar tab
 
-The `graft viz` button needs `dsh-better-sidebar` **mounted**. It ships as a dependency of this plugin, so it is already downloaded — but dsh only mounts what the profile lists:
+The `graft viz` button needs `dsh-better-sidebar` **mounted**. It ships as a dependency of this plugin (0.18.x), so it is already downloaded — but dsh only mounts what the profile lists:
 
 ```sh
 dsh plugin --profile web add dsh-better-sidebar
 ```
 
+> **Compatibility.** `dsh-better-sidebar` 0.18.x requires `@deepseek-ai/dsh-client-ui-primitives`, which dsh removed in `0.1.5-rc.2`. On that version or later the tab will not mount and the button reports the sidebar as unavailable. Everything else in this plugin — chip, tools, `/graft`, auto-rebuild — is unaffected.
+
 Skip it if you do not want the tab. The chip, the tools, `/graft` and the auto-rebuild all work without it; the button just reports that the sidebar is unavailable.
 
 > This plugin does **not** insert a `dsh-better-sidebar` row itself, on purpose. That package's own bundle row carries a guard that disables it when another enabled row already mounts the same package. A second row with a different id makes that guard circular, and the losing outcome is *your existing sidebar silently disabling itself*. One explicit command is worth more than that risk.
@@ -110,9 +129,15 @@ All optional, all on the plugin's row in your profile's `cordis.patch.yml`:
 
 ## Requirements
 
-- dsh `0.1.2-rc.1` or newer, web profile
+| dsh | status |
+|---|---|
+| `0.1.2-rc.1` – `0.1.0-rc.7` | tested, full feature set |
+| `0.1.5-rc.2` | tested — chip, tools, `/graft` and auto-rebuild all work; the `graft viz` tab does not mount (see the sidebar note above) |
+
 - Node 22+
-- the `graft` CLI on PATH (installed for you; see above)
+- the `graft` CLI on PATH (`npm install -g @nanonets/graft`)
+
+The client bundle requires only `react`, which is why it survives the dsh `0.1.5-rc.2` client-package removals that broke several neighbouring plugins.
 
 ## Development
 
@@ -124,6 +149,25 @@ npm run test:live  # drives the real graft CLI against a real repo
 
 `npm test` needs no graft index and no graft install anywhere on the machine. The one suite that does build a real index skips itself, loudly, when graft is absent — a missing CLI is a setup state, not a defect.
 
+### Two identifiers, deliberately different
+
+The cordis row `id` (`graft-status`) is this plugin's own handle — it keys the storage file, the prompt section and every effect label, and is stable across renames.
+
+The client bundle's `__ModuleLoader__.load({ id })` is **not** that handle. It must be the published package name: dsh builds each client row from `entry.options.name` — the `name:` in `cordis.patch.yml` — serves the bundle at `/plugins/<name>/client.js`, then asserts that a factory registered under that same name. Using the row id there fails every boot with:
+
+```
+bundle /plugins/dsh-graft-plugin/client.js loaded without
+registering "dsh-graft-plugin" via __ModuleLoader__.load
+```
+
+`npm test` guards this both ways (the guard was added with the 0.1.1 fix).
+
+## Troubleshooting
+
+**No chip appears and dsh started without errors.** The plugin is in the profile's `package.json` `dependencies` but not in `dsh.profile.bundles` — which happens under pnpm 10+ when the `add` ends non-zero on `ERR_PNPM_IGNORED_BUILDS`; dsh skips the bundle row in that case and starts up looking healthy. Fix: `pnpm approve-builds` in the profile directory (tick `dsh-graft-plugin`), then re-run `dsh plugin --profile web add dsh-graft-plugin`. If `pnpm approve-builds` reports nothing awaiting approval, check `pnpm-workspace.yaml` for an unanswered `dsh-graft-plugin` entry (pnpm's approval placeholder) and set its value to `true` first.
+
+**`/graft` says the graft CLI is not on PATH.** The postinstall was blocked or skipped (see Install): `npm install -g @nanonets/graft`.
+
 ## Licence
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-graft-plugin",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Shows which graft index a dsh session is serving and whether it still matches the code, and gives the model graft_ask, graft_grep, graft_callers, graft_skeleton and graft_map as native tools.",
   "type": "module",
   "main": "src/index.js",
@@ -41,7 +41,6 @@
     "client": {
       "platform": "web",
       "inject": [
-        "@deepseek-ai/dsh-client-runtime",
         "@deepseek-ai/dsh-api-remotes"
       ]
     }

package/scripts/test-harness.mjs

@@ -215,6 +215,20 @@ check('the tab is opened exactly once', opens.length === 1, opens.join(' | '))
 check('and never with noopener', opens.every((call) => !call.includes('noopener')), opens.join(' | '))
 check('and opened blank, to be navigated later', (opens[0] ?? '').includes('"", "_blank"'), opens[0])
 
+console.log('\n--- the client module key ---')
+// The client loader keys bundles by the package name — entry.options.name in
+// cordis.patch.yml — and arrive() asserts factories.has(that name). The row id
+// `graft-status` is a DIFFERENT namespace (storage keys, prompt section,
+// effect labels) and must stay put there. When the two were conflated, the
+// factory landed under the row id and the assert fired on every boot with the
+// chip and tab missing. That shipped as 0.1.0; this guard is the reason it
+// will not ship again.
+check(
+  'registers under the package name, not the row id',
+  /__ModuleLoader__\.load\(\{\s*\r?\n\s*id:\s*"dsh-graft-plugin"/.test(clientSource),
+)
+check('and never under the row id', !/__ModuleLoader__\.load\(\{\s*\r?\n\s*id:\s*"graft-status"/.test(clientSource))
+
 console.log('\n--- the sidebar tab is a consumer, not a patch ---')
 // dsh-better-sidebar is never edited by this plugin: the tab is contributed
 // through its documented `ctx.betterSidebar` service, which its README states

package/src/client.js

@@ -1,5 +1,5 @@
 window.__ModuleLoader__.load({
-  id: "graft-status",
+  id: "dsh-graft-plugin",
   factory: (require) => {
     var module = { exports: {} };
     var exports = module.exports;