dsh-hot-reload 0.1.2 → 0.1.3

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to `dsh-hot-reload` are documented here. This project
 follows [semantic versioning](https://semver.org/).
 
+## 0.1.3
+
+Code-review fixes (engine + CI):
+
+- Reload each changed package **once per module**, not once per plugin row —
+  rows sharing a specifier share a runtime, so per-row reloading double-applied
+  and leaked a module instance.
+- **Serialize reload cycles** so a change arriving mid-reload can't run a second
+  cycle concurrently against the registry.
+- Commit the tracked version **only after a successful reload/skip**, so a failed
+  reload can be retried by re-installing the same version.
+- **Validate the profile dir** (warn if no `pnpm-lock.yaml`), and prefer a
+  candidate dir that actually contains the lockfile.
+- Disposer now awaits `watcher.close()` and guards against in-flight reloads via
+  a `disposed` flag.
+- CI: add a `concurrency` group so a commit+tag push can't race to publish
+  (E403); publish only on a confirmed `E404` (not on transient `npm view`
+  failures).
+
 ## 0.1.2
 
 - Docs: add a **Compatibility** section (built/tested against dsh `0.1.0-rc.6`;

package/lib/index.js

@@ -20,7 +20,7 @@
 // crash dsh.
 
 import { watch } from "chokidar";
-import { readFileSync } from "node:fs";
+import { readFileSync, existsSync } from "node:fs";
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
@@ -55,6 +55,14 @@ export function apply(ctx, config = {}) {
   }
   const lockfile = join(profileDir, "pnpm-lock.yaml");
   const nodeModules = join(profileDir, "node_modules");
+  // Validate the auto-detected dir loudly: watching a wrong/nonexistent lockfile
+  // would silently track 0 packages and never fire.
+  if (!existsSync(lockfile)) {
+    log.warn?.(
+      `dsh-hot-reload: no pnpm-lock.yaml at ${lockfile} — is this the profile dir? ` +
+        "set config.profileDir to fix; the plugin will watch but detect nothing until it appears."
+    );
+  }
 
   // ---- package <-> loader-entry helpers ----
 
@@ -196,26 +204,44 @@ export function apply(ctx, config = {}) {
 
   // ---- change handling ----
 
+  /** Reload every plugin row of a changed package. Returns true if the new
+   *  version should be committed to the tracked snapshot (success, or a
+   *  terminal skip); false only when a reload was attempted and FAILED, so an
+   *  identical re-install can retry. */
   async function handlePackage(pkg) {
     const affected = entriesForPkg(pkg);
-    if (!affected.length) return; // not a loaded plugin (e.g. a fresh install) — out of scope
+    if (!affected.length) return true; // not a loaded plugin (fresh install) — out of scope
     const version = versionOf(pkg) ?? "?";
 
     if (optedOut(pkg)) {
       log.info?.(`dsh-hot-reload: ${pkg}@${version} sets dsh.hotReload:false — restart dsh to load the new version`);
-      return;
+      return true;
     }
     if (!internal) {
       log.info?.(`dsh-hot-reload: ${pkg}@${version} changed — restart dsh to load the new version`);
-      return;
+      return true;
     }
 
+    // De-duplicate by module specifier: rows sharing one specifier share one
+    // runtime, and reloadEntry swaps ALL of that runtime's fibers at once —
+    // reloading per-entry would re-import and double-apply. Distinct specifiers
+    // (e.g. a package with several host files) each still get reloaded.
+    const seen = new Set();
+    const modules = affected.filter((e) => {
+      const key = e?.options?.name;
+      if (!key || seen.has(key)) return false;
+      seen.add(key);
+      return true;
+    });
+
     try {
-      for (const entry of affected) await reloadEntry(entry);
-      log.info?.(`dsh-hot-reload: hot-reloaded ${pkg}@${version} (${affected.length} plugin row(s))`);
+      for (const entry of modules) await reloadEntry(entry);
+      log.info?.(`dsh-hot-reload: hot-reloaded ${pkg}@${version} (${modules.length} module(s))`);
+      return true;
     } catch (err) {
       log.warn?.(`dsh-hot-reload: could not hot-reload ${pkg}@${version} — restart dsh to load the new version`);
       log.warn?.(err);
+      return false;
     }
   }
 
@@ -223,17 +249,27 @@ export function apply(ctx, config = {}) {
 
   let versions = snapshotVersions();
   let timer = null;
+  let disposed = false;
+  let running = Promise.resolve(); // serializes reload cycles across debounce batches
+
+  async function runCycle() {
+    if (disposed) return;
+    const next = snapshotVersions();
+    for (const pkg in next) {
+      if (disposed) return;
+      if (versions[pkg] === next[pkg]) continue;
+      const commit = await handlePackage(pkg);
+      if (commit) versions[pkg] = next[pkg]; // commit only on success/skip (failed reload retries)
+    }
+    for (const pkg of Object.keys(versions)) if (!(pkg in next)) delete versions[pkg]; // drop uninstalled
+  }
+
   const trigger = () => {
+    if (disposed) return;
     if (timer) clearTimeout(timer);
-    timer = setTimeout(async () => {
+    timer = setTimeout(() => {
       timer = null;
-      const next = snapshotVersions();
-      const changed = [];
-      for (const pkg in next) {
-        if (versions[pkg] !== next[pkg]) changed.push(pkg);
-      }
-      versions = next;
-      for (const pkg of changed) await handlePackage(pkg);
+      running = running.then(runCycle).catch((e) => log.warn?.("dsh-hot-reload: reload cycle error", e));
     }, debounceMs);
   };
 
@@ -242,9 +278,13 @@ export function apply(ctx, config = {}) {
   watcher.on("add", trigger);
   watcher.on("error", (e) => log.warn?.("dsh-hot-reload: watcher error", e));
 
-  ctx.effect(() => () => {
+  ctx.effect(() => async () => {
+    disposed = true;
     if (timer) clearTimeout(timer);
-    watcher.close();
+    try {
+      await watcher.close();
+    } catch {}
+    await running.catch(() => {}); // let any in-flight cycle settle
   });
 
   log.info?.(
@@ -252,14 +292,16 @@ export function apply(ctx, config = {}) {
   );
 }
 
-/** Best-effort profile-dir resolution: explicit config, then the loader base URL. */
+/** Best-effort profile-dir resolution: explicit config, then the loader base URL.
+ *  Prefer a candidate that actually contains a pnpm-lock.yaml. */
 function resolveProfileDir(ctx, config) {
-  if (config.profileDir) return config.profileDir;
+  const candidates = [];
+  if (config.profileDir) candidates.push(config.profileDir);
   try {
-    if (ctx.baseUrl) {
-      const p = fileURLToPath(new URL(".", ctx.baseUrl));
-      return p.replace(/\/$/, "");
-    }
+    if (ctx.baseUrl) candidates.push(fileURLToPath(new URL(".", ctx.baseUrl)).replace(/\/$/, ""));
   } catch {}
-  return null;
+  for (const dir of candidates) {
+    if (existsSync(join(dir, "pnpm-lock.yaml"))) return dir;
+  }
+  return candidates[0] ?? null; // fall back (apply() warns if the lockfile is missing)
 }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "dsh-hot-reload",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
-  "description": "Live-reload upgraded DeepSeek Harness (dsh) plugins without restarting dsh — safe plugins are hot-reloaded in place; unsafe ones are flagged for a manual restart.",
+  "description": "Live-reload upgraded DeepSeek Harness (dsh) plugins without restarting dsh \u2014 safe plugins are hot-reloaded in place; unsafe ones are flagged for a manual restart.",
   "keywords": [
     "dsh",
     "dsh-plugin",