dsh-hot-reload 0.2.2 → 0.2.3

package/CHANGELOG.md

@@ -3,6 +3,27 @@
 All notable changes to `dsh-hot-reload` are documented here. This project
 follows [semantic versioning](https://semver.org/).
 
+## 0.2.3
+
+A plugin that loads after `dsh-hot-reload` in the bundle order is now reloaded
+when it is upgraded, and every reload outcome — not just successes — reaches the
+terminal. Config and API unchanged.
+
+**Fixes**
+
+- **A plugin loaded after this one now hot-reloads when upgraded.** A first-seen
+  package used to be adopted at face value whatever its version, so a plugin that
+  appears later in the bundle order (for example `dsh-crew`) kept running old
+  code when it had already been upgraded before this plugin's first cycle — the
+  change was silently missed. A first-seen package that has a live fiber is now
+  reloaded instead of adopted; a first-seen package with no live fiber is still
+  adopted, because there is nothing running to replace.
+- **Every outcome now reaches the terminal.** `report()` used to write its stderr
+  line only for a successful reload. A failed or stale reload was then visible
+  only as a transient pop-up and a log line dsh never prints, so the "restart
+  dsh" instruction never reached anyone watching the terminal. stderr is now
+  written for every outcome — reloaded, failed, and stale.
+
 ## 0.2.2
 
 Reloads now re-import a plugin's whole package, not just its entry module.

package/README-zh.md

@@ -42,7 +42,7 @@ dsh 自带的热重载（`cordis-plugin-hmr`）刻意忽略 `node_modules`，所
 插件会把每个结果写进 dsh 的日志。但 dsh 不会把日志打印到你的终端，所以这些内容
 很容易被忽略。另有两个地方会告诉你发生了什么。
 
-**1. 每次重载成功，在你的终端里输出一行。** 任意 profile 都有：
+**1. 每种结果，在你的终端里输出一行。** 任意 profile 都有：
 
 ```
 dsh-hot-reload: hot-reloaded some-plugin@1.2.0 (1 module(s))
@@ -75,8 +75,9 @@ web 那一部分只在运行 web 服务器的 profile 中加载，并通过
 
 ### 如果你想在终端里看到全部内容
 
-上面那一行只覆盖成功的重载。若想看到本插件写进日志的全部内容（包括失败），请把
-dsh 的控制台日志插件加进你的 profile。它是一个独立的包：
+上面那一行覆盖每一种重载结果——成功、失败和 stale（未尝试、旧代码仍在运行）。若想
+看到本插件写进日志的其它内容（它的警告和诊断信息），请把 dsh 的控制台日志插件加进
+你的 profile。它是一个独立的包：
 
 ```sh
 dsh plugin --profile web add @deepseek-ai/cordis-plugin-logger-console
@@ -192,6 +193,12 @@ web 应用里的提示（且仅这一部分）还用到：
   这些内容，所以并没有多暴露什么秘密。但如果你把 dsh 绑定到 `0.0.0.0`，请把它
   算作局域网里任何人都能打开的又一个地址。
 
+- 在 bundle 顺序里排在 `dsh-hot-reload` **之后**加载的插件，会在启动后的第一次
+  lockfile 写入时被重载一次——重载到它当前的版本——即使那次写入针对的是另一个
+  包。在本插件跨过一轮循环、跟踪到该包之前，它无法分辨运行中的代码是旧版还是当前
+  版本，所以它选择重载，而不是采纳一个可能从未运行过的版本。对于 HMR 安全的插件，
+  这只是无害的单次多余重载。
+
 范围说明：本插件处理的是**已加载插件的升级**。安装一个**全新**插件是另一回事
 （把它的行加入 `cordis.patch.yml`，这个 dsh 本身已经会热应用）。
 

package/README.md

@@ -50,7 +50,7 @@ The plugin writes every result to dsh's log. But dsh does not print its log to
 your terminal, so those lines are easy to miss. Two extra places show you what
 happened.
 
-**1. One line in your terminal, for each reload that worked.** You get this in
+**1. One line in your terminal, for every outcome.** You get this in
 every profile:
 
 ```
@@ -88,9 +88,10 @@ reload the page to start again.
 
 ### If you want every line in your terminal
 
-The terminal line above only covers reloads that worked. To see everything this
-plugin writes to the log, including failures, add dsh's console logger to your
-profile. It is a separate package:
+The terminal line above covers every reload outcome — reloaded, failed, and
+stale (not attempted — the old code is still running). To see everything else this plugin writes to the log (its warnings and
+diagnostics), add dsh's console logger to your profile. It is a separate
+package:
 
 ```sh
 dsh plugin --profile web add @deepseek-ai/cordis-plugin-logger-console
@@ -221,6 +222,14 @@ live fiber to swap). It does **not** detect *silent* leaks:
   secret. But if you bind dsh to `0.0.0.0`, count it as one more address that
   anyone on your network can open.
 
+- A plugin that loads **after** `dsh-hot-reload` in the bundle order is reloaded
+  once — to its current version — on the first lockfile write after boot, even
+  when that write was for an unrelated package. Until this plugin has tracked the
+  package across one cycle, it cannot tell whether the running code is the old or
+  the current version, so it reloads rather than adopting a version that may
+  never have run. For an HMR-safe plugin this is a harmless single redundant
+  reload.
+
 Scope note: this handles **upgrades of already-loaded plugins**. Installing a
 *brand-new* plugin is a separate concern (adding its row to `cordis.patch.yml`,
 which dsh already hot-applies).

package/lib/index.js

@@ -18,9 +18,9 @@
 // row with no fiber attached yet is reported and left for a later change.
 //
 // Outcomes are announced on two surfaces besides ctx.logger — one stderr line
-// per successful reload, and an SSE channel the browser half (lib/client.js)
-// turns into a transient toast. Both are additive and best-effort; see the
-// "notification surfaces" section in apply().
+// per outcome (reloaded, failed, or stale), and an SSE channel the browser half
+// (lib/client.js) turns into a transient toast. Both are additive and
+// best-effort; see the "notification surfaces" section in apply().
 //
 // NOTE: the reload path uses cordis/loader internals (loader.internal.loadCache,
 // registry.plugin/delete, fiber.entry) — the same ones HMR uses. If a future
@@ -87,10 +87,11 @@ export function apply(ctx, config = {}) {
   // and neither may throw into a reload cycle: a broken notification must never
   // turn a working reload into a failed one.
   //
-  //  - stderr, successful reloads only. cordis's logger fans messages out to
+  //  - stderr, every cycle outcome. cordis's logger fans messages out to
   //    registered exporters, and the dsh host process registers none (only the
   //    browser shell does), so nothing this plugin logs reaches the terminal dsh
-  //    runs in. One line per reload is the profile-independent baseline.
+  //    runs in. One line per outcome — reloaded, failed, or stale — is the
+  //    profile-independent baseline.
   //  - an SSE channel the web half subscribes to (lib/client.js) and renders as
   //    a transient toast. Registered only when a webServer service exists, so a
   //    profile without one — tui — behaves exactly as it does today.
@@ -112,17 +113,23 @@ export function apply(ctx, config = {}) {
    *
    *  `kind` is "reloaded" (it worked), "failed" (attempted and rolled back), or
    *  "stale" (not attempted; the old code is still running). It selects the log
-   *  level and the browser's icon, and only "reloaded" reaches stderr. Callers
-   *  pass the bare message — every surface adds its own prefix. */
+   *  level and the browser's icon. Every kind also reaches stderr — successes
+   *  and failures alike — because the dsh host registers no cordis logger
+   *  exporter, so the log.* line above never reaches the terminal on its own.
+   *  Callers pass the bare message — every surface adds its own prefix. */
   function report(kind, message) {
     if (kind === "reloaded") {
       log.info?.(`dsh-hot-reload: ${message}`);
-      try {
-        process.stderr.write(`dsh-hot-reload: ${message}\n`);
-      } catch {}
     } else {
       log.warn?.(`dsh-hot-reload: ${message}`);
     }
+    // One durable, profile-independent line per outcome, written for every kind.
+    // A failed/stale reload used to be visible only as a transient toast plus an
+    // invisible log line (dsh exports no logger), so "restart needed" never
+    // reached anyone looking at the terminal dsh runs in.
+    try {
+      process.stderr.write(`dsh-hot-reload: ${message}\n`);
+    } catch {}
     if (!connections.size) return;
     const line = `data: ${JSON.stringify({ type: "notice", kind, text: message })}\n\n`;
     for (const res of connections) {
@@ -511,8 +518,21 @@ export function apply(ctx, config = {}) {
         continue;
       }
       if (!(pkg in versions)) {
-        versions[pkg] = version; // newly loaded row: dsh just loaded it fresh, nothing to reload
-        continue;
+        // A package our boot snapshot never saw. Two cases:
+        //  - no live fiber: nothing is running yet (mid-import, or only disabled
+        //    rows), so there is no stale code to replace — dsh loads fresh code
+        //    itself. Adopt the version.
+        //  - has a live fiber: the package was already running before we first
+        //    saw it — it loaded after our boot snapshot, as a bundle entry
+        //    ordered after this plugin. Its running code may therefore predate
+        //    this version. Reload it rather than silently adopting a version
+        //    that never ran (otherwise a late-loaded plugin upgraded before the
+        //    first cycle keeps its old code forever, with no notice).
+        if (!snap[pkg].live.length) {
+          versions[pkg] = version;
+          continue;
+        }
+        // fall through: treat as changed and reload
       }
       if (versions[pkg] === version) continue;
       // A version whose reload failed is never re-attempted: each attempt tears

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-hot-reload",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "type": "module",
   "description": "Live-reload upgraded DeepSeek Harness (dsh) plugins without restarting dsh \u2014 the running plugin is swapped in place, and a reload that fails rolls back to the working old version and asks for a manual restart.",
   "keywords": [