dsh-hot-reload 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -3,6 +3,46 @@
 All notable changes to `dsh-hot-reload` are documented here. This project
 follows [semantic versioning](https://semver.org/).
 
+## 0.2.3
+
+A plugin that loads after `dsh-hot-reload` in the bundle order is now reloaded
+when it is upgraded, and every reload outcome — not just successes — reaches the
+terminal. Config and API unchanged.
+
+**Fixes**
+
+- **A plugin loaded after this one now hot-reloads when upgraded.** A first-seen
+  package used to be adopted at face value whatever its version, so a plugin that
+  appears later in the bundle order (for example `dsh-crew`) kept running old
+  code when it had already been upgraded before this plugin's first cycle — the
+  change was silently missed. A first-seen package that has a live fiber is now
+  reloaded instead of adopted; a first-seen package with no live fiber is still
+  adopted, because there is nothing running to replace.
+- **Every outcome now reaches the terminal.** `report()` used to write its stderr
+  line only for a successful reload. A failed or stale reload was then visible
+  only as a transient pop-up and a log line dsh never prints, so the "restart
+  dsh" instruction never reached anyone watching the terminal. stderr is now
+  written for every outcome — reloaded, failed, and stale.
+
+## 0.2.2
+
+Reloads now re-import a plugin's whole package, not just its entry module.
+Config and API unchanged.
+
+**Fixes**
+
+- **Multi-file plugins reload as one unit.** The reload used to invalidate only
+  the entry URL and re-import it. Under a hoisted linker (`nodeLinker: hoisted`)
+  a version bump rewrites the package's files in place, so the entry's relative
+  imports (`./routes.js` and friends) resolved to the same URLs and hit the
+  stale cache — the running plugin mixed new entry code with old dependency code,
+  which for a plugin like `dshmarket` surfaced as a crash looking for a file the
+  new version had deleted. The reload now invalidates every cached module under
+  the package's own directory (in both the ESM `loadCache` and the CJS
+  `require.cache`) before re-importing, so the entry and its in-package imports
+  come back together. Shared dependencies live outside that directory and are
+  left alone.
+
 ## 0.2.1
 
 Code-review fixes to the 0.2.0 notification surfaces. No config or API changes,

package/{README.zh.md → README-zh.md}

@@ -42,7 +42,7 @@ dsh 自带的热重载（`cordis-plugin-hmr`）刻意忽略 `node_modules`，所
 插件会把每个结果写进 dsh 的日志。但 dsh 不会把日志打印到你的终端，所以这些内容
 很容易被忽略。另有两个地方会告诉你发生了什么。
 
-**1. 每次重载成功，在你的终端里输出一行。** 任意 profile 都有：
+**1. 每种结果，在你的终端里输出一行。** 任意 profile 都有：
 
 ```
 dsh-hot-reload: hot-reloaded some-plugin@1.2.0 (1 module(s))
@@ -75,8 +75,9 @@ web 那一部分只在运行 web 服务器的 profile 中加载，并通过
 
 ### 如果你想在终端里看到全部内容
 
-上面那一行只覆盖成功的重载。若想看到本插件写进日志的全部内容（包括失败），请把
-dsh 的控制台日志插件加进你的 profile。它是一个独立的包：
+上面那一行覆盖每一种重载结果——成功、失败和 stale（未尝试、旧代码仍在运行）。若想
+看到本插件写进日志的其它内容（它的警告和诊断信息），请把 dsh 的控制台日志插件加进
+你的 profile。它是一个独立的包：
 
 ```sh
 dsh plugin --profile web add @deepseek-ai/cordis-plugin-logger-console
@@ -192,6 +193,12 @@ web 应用里的提示（且仅这一部分）还用到：
   这些内容，所以并没有多暴露什么秘密。但如果你把 dsh 绑定到 `0.0.0.0`，请把它
   算作局域网里任何人都能打开的又一个地址。
 
+- 在 bundle 顺序里排在 `dsh-hot-reload` **之后**加载的插件，会在启动后的第一次
+  lockfile 写入时被重载一次——重载到它当前的版本——即使那次写入针对的是另一个
+  包。在本插件跨过一轮循环、跟踪到该包之前，它无法分辨运行中的代码是旧版还是当前
+  版本，所以它选择重载，而不是采纳一个可能从未运行过的版本。对于 HMR 安全的插件，
+  这只是无害的单次多余重载。
+
 范围说明：本插件处理的是**已加载插件的升级**。安装一个**全新**插件是另一回事
 （把它的行加入 `cordis.patch.yml`，这个 dsh 本身已经会热应用）。
 

package/README.md

@@ -1,6 +1,6 @@
 # dsh-hot-reload
 
-English | [中文](README.zh.md)
+English | [中文](README-zh.md)
 
 Live-reload upgraded [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (dsh) plugins **without restarting dsh**.
 
@@ -50,7 +50,7 @@ The plugin writes every result to dsh's log. But dsh does not print its log to
 your terminal, so those lines are easy to miss. Two extra places show you what
 happened.
 
-**1. One line in your terminal, for each reload that worked.** You get this in
+**1. One line in your terminal, for every outcome.** You get this in
 every profile:
 
 ```
@@ -88,9 +88,10 @@ reload the page to start again.
 
 ### If you want every line in your terminal
 
-The terminal line above only covers reloads that worked. To see everything this
-plugin writes to the log, including failures, add dsh's console logger to your
-profile. It is a separate package:
+The terminal line above covers every reload outcome — reloaded, failed, and
+stale (not attempted — the old code is still running). To see everything else this plugin writes to the log (its warnings and
+diagnostics), add dsh's console logger to your profile. It is a separate
+package:
 
 ```sh
 dsh plugin --profile web add @deepseek-ai/cordis-plugin-logger-console
@@ -221,6 +222,14 @@ live fiber to swap). It does **not** detect *silent* leaks:
   secret. But if you bind dsh to `0.0.0.0`, count it as one more address that
   anyone on your network can open.
 
+- A plugin that loads **after** `dsh-hot-reload` in the bundle order is reloaded
+  once — to its current version — on the first lockfile write after boot, even
+  when that write was for an unrelated package. Until this plugin has tracked the
+  package across one cycle, it cannot tell whether the running code is the old or
+  the current version, so it reloads rather than adopting a version that may
+  never have run. For an HMR-safe plugin this is a harmless single redundant
+  reload.
+
 Scope note: this handles **upgrades of already-loaded plugins**. Installing a
 *brand-new* plugin is a separate concern (adding its row to `cordis.patch.yml`,
 which dsh already hot-applies).

package/lib/index.js

@@ -1,8 +1,9 @@
 // dsh-hot-reload — live-reload upgraded dsh plugins without restarting dsh.
 //
 // It watches the profile's pnpm-lock.yaml; when an already-loaded plugin
-// package's version changes, it invalidates that module's caches, re-imports
-// the new code, and swaps the running plugin fiber in place — the same
+// package's version changes, it invalidates that package's cached modules
+// (entry plus in-package imports), re-imports the new code, and swaps the
+// running plugin fiber in place — the same
 // technique cordis-plugin-hmr uses, but reaching into node_modules (which HMR
 // deliberately ignores).
 //
@@ -17,9 +18,9 @@
 // row with no fiber attached yet is reported and left for a later change.
 //
 // Outcomes are announced on two surfaces besides ctx.logger — one stderr line
-// per successful reload, and an SSE channel the browser half (lib/client.js)
-// turns into a transient toast. Both are additive and best-effort; see the
-// "notification surfaces" section in apply().
+// per outcome (reloaded, failed, or stale), and an SSE channel the browser half
+// (lib/client.js) turns into a transient toast. Both are additive and
+// best-effort; see the "notification surfaces" section in apply().
 //
 // NOTE: the reload path uses cordis/loader internals (loader.internal.loadCache,
 // registry.plugin/delete, fiber.entry) — the same ones HMR uses. If a future
@@ -29,8 +30,8 @@
 import { watch } from "chokidar";
 import { readFileSync, existsSync } from "node:fs";
 import { createRequire } from "node:module";
-import { fileURLToPath } from "node:url";
-import { join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { dirname, join } from "node:path";
 
 export const name = "dsh-hot-reload";
 
@@ -86,10 +87,11 @@ export function apply(ctx, config = {}) {
   // and neither may throw into a reload cycle: a broken notification must never
   // turn a working reload into a failed one.
   //
-  //  - stderr, successful reloads only. cordis's logger fans messages out to
+  //  - stderr, every cycle outcome. cordis's logger fans messages out to
   //    registered exporters, and the dsh host process registers none (only the
   //    browser shell does), so nothing this plugin logs reaches the terminal dsh
-  //    runs in. One line per reload is the profile-independent baseline.
+  //    runs in. One line per outcome — reloaded, failed, or stale — is the
+  //    profile-independent baseline.
   //  - an SSE channel the web half subscribes to (lib/client.js) and renders as
   //    a transient toast. Registered only when a webServer service exists, so a
   //    profile without one — tui — behaves exactly as it does today.
@@ -111,17 +113,23 @@ export function apply(ctx, config = {}) {
    *
    *  `kind` is "reloaded" (it worked), "failed" (attempted and rolled back), or
    *  "stale" (not attempted; the old code is still running). It selects the log
-   *  level and the browser's icon, and only "reloaded" reaches stderr. Callers
-   *  pass the bare message — every surface adds its own prefix. */
+   *  level and the browser's icon. Every kind also reaches stderr — successes
+   *  and failures alike — because the dsh host registers no cordis logger
+   *  exporter, so the log.* line above never reaches the terminal on its own.
+   *  Callers pass the bare message — every surface adds its own prefix. */
   function report(kind, message) {
     if (kind === "reloaded") {
       log.info?.(`dsh-hot-reload: ${message}`);
-      try {
-        process.stderr.write(`dsh-hot-reload: ${message}\n`);
-      } catch {}
     } else {
       log.warn?.(`dsh-hot-reload: ${message}`);
     }
+    // One durable, profile-independent line per outcome, written for every kind.
+    // A failed/stale reload used to be visible only as a transient toast plus an
+    // invisible log line (dsh exports no logger), so "restart needed" never
+    // reached anyone looking at the terminal dsh runs in.
+    try {
+      process.stderr.write(`dsh-hot-reload: ${message}\n`);
+    } catch {}
     if (!connections.size) return;
     const line = `data: ${JSON.stringify({ type: "notice", kind, text: message })}\n\n`;
     for (const res of connections) {
@@ -272,6 +280,49 @@ export function apply(ctx, config = {}) {
     } catch {}
   }
 
+  /** Directory, as a trailing-slash file:// URL, of the nearest ancestor that
+   *  has a package.json — the package this module belongs to. A version bump
+   *  rewrites every file inside it in place under a hoisted linker, so a reload
+   *  must drop the whole directory, not just the entry. Returns null when no
+   *  package.json is found (defensive; a node_modules package always has one). */
+  function packageRootUrlOf(url) {
+    let dir = dirname(fileURLToPath(url));
+    for (;;) {
+      if (existsSync(join(dir, "package.json"))) {
+        const href = pathToFileURL(dir).href;
+        return href.endsWith("/") ? href : `${href}/`;
+      }
+      const parent = dirname(dir);
+      if (parent === dir) return null;
+      dir = parent;
+    }
+  }
+
+  /** Invalidate every cached module under one package directory — the entry and
+   *  its transitive in-package imports. Re-importing only the entry would leave
+   *  `./routes.js` and friends on their stale cache entries (the URLs are
+   *  unchanged under a hoisted linker), so the running plugin would mix old and
+   *  new code. Shared dependencies live OUTSIDE this directory and are left
+   *  alone: re-importing them would be wasteful and would fork shared classes. */
+  function invalidateTree(rootUrl) {
+    if (!rootUrl) return;
+    // ESM loadCache.
+    try {
+      for (const u of Map.prototype.keys.call(internal.loadCache)) {
+        if (typeof u === "string" && u.startsWith(rootUrl)) {
+          Map.prototype.delete.call(internal.loadCache, u);
+        }
+      }
+    } catch {}
+    // CJS: modules imported via import() also land in the require cache on Node 24.
+    try {
+      const rootPath = fileURLToPath(rootUrl);
+      for (const fp of Object.keys(cjsRequire.cache)) {
+        if (fp.startsWith(rootPath)) delete cjsRequire.cache[fp];
+      }
+    } catch {}
+  }
+
   /** Reload one loaded entry's module in place. Throws on failure, after rolling
    *  the old plugin back — except when teardown began mid-reload, where it drops
    *  the new plugin and does NOT roll back (the dying context disposes what is
@@ -290,7 +341,14 @@ export function apply(ctx, config = {}) {
     const url = await resolveUrl(specifier, parentURL);
     if (!url) throw new Error(`could not resolve ${specifier}`);
 
-    invalidate(url); // matters for in-place edits; harmless no-op for a version bump (new realpath)
+    // Drop the whole package directory, not just the entry: under a hoisted
+    // linker a version bump rewrites files in place (same URLs), so the entry's
+    // relative imports would otherwise re-hit the stale cache and mix old and
+    // new code. Falls back to the single-URL invalidation only when no
+    // package.json is found.
+    const rootUrl = packageRootUrlOf(url);
+    if (rootUrl) invalidateTree(rootUrl);
+    else invalidate(url);
 
     // Read the version as close to the import as possible: this is what the
     // fresh module actually is, and the only value safe to commit.
@@ -460,8 +518,21 @@ export function apply(ctx, config = {}) {
         continue;
       }
       if (!(pkg in versions)) {
-        versions[pkg] = version; // newly loaded row: dsh just loaded it fresh, nothing to reload
-        continue;
+        // A package our boot snapshot never saw. Two cases:
+        //  - no live fiber: nothing is running yet (mid-import, or only disabled
+        //    rows), so there is no stale code to replace — dsh loads fresh code
+        //    itself. Adopt the version.
+        //  - has a live fiber: the package was already running before we first
+        //    saw it — it loaded after our boot snapshot, as a bundle entry
+        //    ordered after this plugin. Its running code may therefore predate
+        //    this version. Reload it rather than silently adopting a version
+        //    that never ran (otherwise a late-loaded plugin upgraded before the
+        //    first cycle keeps its old code forever, with no notice).
+        if (!snap[pkg].live.length) {
+          versions[pkg] = version;
+          continue;
+        }
+        // fall through: treat as changed and reload
       }
       if (versions[pkg] === version) continue;
       // A version whose reload failed is never re-attempted: each attempt tears

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-hot-reload",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "type": "module",
   "description": "Live-reload upgraded DeepSeek Harness (dsh) plugins without restarting dsh \u2014 the running plugin is swapped in place, and a reload that fails rolls back to the working old version and asks for a manual restart.",
   "keywords": [
@@ -36,7 +36,7 @@
     "lib",
     "cordis.patch.yml",
     "README.md",
-    "README.zh.md",
+    "README-zh.md",
     "CHANGELOG.md",
     "LICENSE"
   ],