dsh-my-guardian 0.4.3 → 0.4.4

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.4] - 2026-09-25
+
+### 变更
+
+- fix(guardian): #407 依赖预检解析 profiles 根宿主包与子路径导出 (#412)
+- fix(dsh-my-guardian): 适配 0.1.7 HMR 重构，取证不绑包名并登记退役事件
+- fix(test): 补测试临时目录配对清理，加有界兜底清扫防陈旧残留
+
+## [Unreleased]
+
+### 变更
+
+- fix(guardian): 依赖预检解析 profiles 根 node_modules 的宿主包与子路径导出，消除「缺少依赖」误报
+
 ## [0.4.3] - 2026-09-25
 
 ### 变更

package/lib/dep-precheck.js

@@ -19,13 +19,28 @@ export function findModuleDir(nmRoot, packageName) {
     const dir = join(nmRoot, packageName);
     return existsSync(join(dir, 'package.json')) ? dir : null;
 }
-// Resolve a dependency from the plugin's nested node_modules or the profile
-// node_modules (hoisted installs). Returns the dir or null when absent.
+// Base package of a specifier: 'pkg' -> 'pkg', '@scope/pkg' -> '@scope/pkg',
+// 'pkg/sub' -> 'pkg', '@scope/pkg/sub' -> '@scope/pkg'. Peer specs are package
+// roots today, but resolving the base keeps the lookup correct for any spec.
+export function basePackage(spec) {
+    const parts = spec.split('/');
+    return spec.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
+}
+// Resolve a dependency from the plugin's nested node_modules, the profile
+// node_modules (hoisted installs), or the profiles-root node_modules where the
+// harness installs its host-provided @deepseek-ai/* packages. The pre-check
+// previously stopped at the profile dir, so every plugin declaring a host
+// package as a peer was reported as missing even though Node resolves it by
+// walking up to $DSH_HOME/profiles/node_modules. Returns the dir or null.
 function resolveDependencyDir(profileDir, pluginDir, dep) {
-    const nested = pluginDir === null ? null : findModuleDir(join(pluginDir, 'node_modules'), dep);
+    const base = basePackage(dep);
+    const nested = pluginDir === null ? null : findModuleDir(join(pluginDir, 'node_modules'), base);
     if (nested !== null)
         return nested;
-    return findModuleDir(join(profileDir, 'node_modules'), dep);
+    const inProfile = findModuleDir(join(profileDir, 'node_modules'), base);
+    if (inProfile !== null)
+        return inProfile;
+    return findModuleDir(join(profileDir, '..', 'node_modules'), base);
 }
 function readPackageJson(dir) {
     if (dir === null)
@@ -97,7 +112,7 @@ function skippedResult(reason) {
  * (ok: true) so an unusual install layout is never a false block.
  */
 export function checkPeerDependencies({ profileDir, pluginName, }) {
-    const pluginDir = findModuleDir(join(profileDir, 'node_modules'), pluginName);
+    const pluginDir = findModuleDir(join(profileDir, 'node_modules'), basePackage(pluginName));
     if (pluginDir === null)
         return skippedResult(`无法定位插件 ${pluginName}（未在 profile node_modules 找到 package.json）`);
     const pkg = readPackageJson(pluginDir);

package/lib/events.js

@@ -22,6 +22,10 @@ export function logEvent(shared, type, message) {
  * （test/fixtures/host-events.json，由 scripts/host-events.mjs 从宿主源码取证：
  * `interface Events` 声明 ∪ `ctx.<emit|parallel|...>` 派发），否则必须有
  * HOST_EVENT_FALLBACKS 降级信号。新增/删除 ctx.on 时必须同步本表。
+ *
+ * 0.1.7-rc.2 起：`loader/entry-init`、`loader/partial-dispose` 仍由宿主
+ * cordis-plugin-loader 派发（有效）；`hmr/config-update-failed` 已被删除，只剩
+ * "已退役 0.1.5-rc.1 兼容"意义，实际诊断走 HOST_EVENT_FALLBACKS 的日志通道。
  */
 export const LISTENED_HOST_EVENTS = [
     'loader/entry-init',
@@ -48,8 +52,14 @@ const PENDING_DETAIL = '(error detail logged by host)';
  * 替代可观测量（逐字取证，非猜测）：0.1.5-rc.1 的 cordis-plugin-hmr 与 0.1.7-rc.2 的
  * dsh-hmr **在同一个 catch 里先打同一对 warn、然后旧版才发事件**：
  *   ctx.logger.warn('config reload at %C failed', filename); ctx.logger.warn(error)
- * （旧：cordis-plugin-hmr/lib/index.js；新：dsh-hmr/src/watch-config.ts）
+ * （旧：cordis-plugin-hmr/lib/index.js；新：packages/boot/hmr/src/watch-config.ts，
+ *   已装宿主 0.1.7-rc.2 对应 node_modules/@deepseek-ai/dsh-hmr/lib/index.js）
  * 所以结构化日志是两个宿主共有的可观测面，用它接手被删事件的诊断职责。
+ *
+ * 宿主升级到 0.1.7-rc.2 之后：已装宿主也变成 0.1.7-rc.2，`hmr/config-update-failed`
+ * 在两个通道里都不存在——该 `ctx.on` 只剩"已退役 0.1.5-rc.1 兼容"意义（注册未知
+ * 事件不报错，回退宿主仍可诊断），因此 legacySource 转为 legacyRetired 退役登记。
+ * 新宿主的诊断职责全部由结构化 warn 通道承担（marker 在参考源与已装宿主双向取证）。
  */
 export const HOST_EVENT_FALLBACKS = [
     {
@@ -57,7 +67,11 @@ export const HOST_EVENT_FALLBACKS = [
         kind: 'logger-warn',
         marker: CONFIG_FAILURE_MARKER,
         targetSource: 'packages/boot/hmr/src/watch-config.ts',
-        legacySource: 'node_modules/@deepseek-ai/cordis-plugin-hmr/lib/index.js',
+        legacyRetired: {
+            version: '0.1.5-rc.1',
+            source: 'node_modules/@deepseek-ai/cordis-plugin-hmr/lib/index.js',
+            reason: '0.1.7-rc.2 以 @deepseek-ai/dsh-hmr 取代 cordis-plugin-hmr，旧包已从已装宿主移除，双通道并存的在场取证不可复现',
+        },
     },
 ];
 /** 失败原因文本：Error 取 message、其他字符串化、未配对到时给占位。 */
@@ -148,9 +162,9 @@ function attachConfigFailureLogFallback(ctx, failures) {
 /**
  * Register the loader/HMR diagnostic listeners (R9/R10)。
  *
- * 两条通道在**两个宿主上都注册**：`hmr/config-update-failed` 在 0.1.5-rc.1 上有效、
- * 在 0.1.7-rc.2 上永不触发（注册未知事件不报错），日志通道则两个宿主都有——
- * 靠 createConfigFailureTracker 去重合并成一条诊断。
+ * 两条通道都注册：`hmr/config-update-failed` 只对已退役的 0.1.5-rc.1 有效，在
+ * 0.1.7-rc.2（当前唯一在场宿主）上永不触发（注册未知事件不报错，回退宿主仍可诊断），
+ * 当前宿主的诊断完全由日志通道承担——靠 createConfigFailureTracker 去重合并成一条。
  */
 export function attachEventListeners(ctx, shared) {
     const failures = createConfigFailureTracker(ctx, shared);

package/lib/startup-check.js

@@ -14,7 +14,7 @@
  * tree simply yields no roster and an empty report.
  */
 import { join } from 'node:path';
-import { findModuleDir, checkPeerDependencies, buildDependencyMessage } from './dep-precheck.js';
+import { findModuleDir, checkPeerDependencies, buildDependencyMessage, basePackage } from './dep-precheck.js';
 import { writeStartupIssuesFile } from './state.js';
 import { logEvent } from './events.js';
 /** Profile-node_modules root used for roster resolvability checks. */
@@ -83,19 +83,21 @@ export function isDisabledEntry(entry) {
 }
 /** Removal hint shared by every issue kind (guardian never rewrites YAML). */
 const REMOVE_HINT = '从启动名册（cordis.patch.yml / profile）中删除该条目行，或标记 disabled: true 暂缓加载';
-/** Build an unresolvable-package issue (import stage would fail). */
-function unresolvedIssue(id, name) {
+/** Build an unresolvable-package issue (import stage would fail). `installTarget`
+ * is the base package: a roster row may name a subpath export, and
+ * `dsh plugin add pkg/sub` would install the wrong thing. */
+function unresolvedIssue(id, name, installTarget) {
     return {
         type: 'unresolvable',
         entryId: id,
         name,
         message: `插件包 ${name} 无法解析（profile node_modules 中不存在），启动 import 将失败`,
-        fix: `dsh plugin add ${name}`,
+        fix: `dsh plugin add ${installTarget}`,
         remove: REMOVE_HINT,
     };
 }
 /** Build a dependency issue reusing the staged-mount pre-check result. */
-function dependencyIssue(id, name, precheck) {
+function dependencyIssue(id, name, precheck, installTarget) {
     return {
         type: 'dependency',
         entryId: id,
@@ -103,7 +105,7 @@ function dependencyIssue(id, name, precheck) {
         message: buildDependencyMessage(precheck),
         missingDeps: [...precheck.missing, ...precheck.mismatched.map((item) => item.name)],
         installHint: precheck.suggestions[0] ?? null,
-        fix: precheck.suggestions[0] ?? `dsh plugin add ${name}`,
+        fix: precheck.suggestions[0] ?? `dsh plugin add ${installTarget}`,
         remove: REMOVE_HINT,
     };
 }
@@ -133,14 +135,19 @@ function checkPluginItem(issues, item, nmRoot, profileDir) {
     const label = name !== '' ? name : id;
     if (label === '' || !label.startsWith('dsh-'))
         return;
-    const pluginDir = findModuleDir(nmRoot, label);
+    // A row may name a subpath export ('dsh-openwrite/bridge'), which is not a
+    // directory under node_modules; the installable package is the base and the
+    // export map resolves the subpath at import time. Treating the whole name
+    // as a directory produced a false "unresolvable" for every subpath row.
+    const base = basePackage(label);
+    const pluginDir = findModuleDir(nmRoot, base);
     if (pluginDir === null) {
-        issues.push(unresolvedIssue(id, label));
+        issues.push(unresolvedIssue(id, label, base));
         return;
     }
-    const precheck = checkPeerDependencies({ profileDir, pluginName: label });
+    const precheck = checkPeerDependencies({ profileDir, pluginName: base });
     if (!precheck.ok)
-        issues.push(dependencyIssue(id, label, precheck));
+        issues.push(dependencyIssue(id, label, precheck, base));
 }
 /** Append one duplicate-id issue per id seen in more than one roster row. */
 function collectDuplicateIssues(issues, byId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-my-guardian",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "DSH 插件治理守护：新装/更新插件先进候选区，启动后热挂载——成功转正、失败自动禁用、连续失败冻结，一键安全模式，侧边栏诊断面板。DSH web plugin: staged plugin loading with auto-disable on failure, freeze, safe mode and a sidebar panel.",
   "type": "module",
   "main": "lib/index.js",