dsh-plugin-cicd 0.5.0 → 0.5.1

package/tests/bilibili-check.mjs

@@ -40,6 +40,8 @@ import {
   parseLedger,
   recordLedgerEntry,
   replyFailure,
+  MAINTENANCE_NOTE,
+  summarizeCommits,
   summarizeRelease,
   withDeviceIds,
 } from '../lib/bilibili.mjs'
@@ -108,6 +110,56 @@ check('GitHub\'s own boilerplate is not the summary', autoNotes === 'Fix the thi
 check('an empty release still says something', summarizeRelease({ tag: 'v3' }, { fallback: '本次更新已发布。' }) === '本次更新已发布。')
 check('a long summary is cut, not dumped', summarizeRelease({ tag: 'v1', name: 'x'.repeat(300) }).length <= 90)
 
+/* What changed, out of the commits between two releases.
+   This is the ONLY source for these repositories: their release bodies are exactly
+   `**Full Changelog**: <url>`, because the release workflow creates them with no notes.
+   So "介绍这次更新" has to come from the history, and the filtering is what decides
+   whether a viewer reads news or bookkeeping. */
+const commit = (message) => ({ commit: { message } })
+check('commit subjects become the summary', summarizeCommits([commit('feat: 新增语音'), commit('fix: 音量')]) === '新功能：新增语音；修复：音量')
+check('the type becomes a word a viewer reads', summarizeCommits([commit('fix: 音量')]) === '修复：音量' && summarizeCommits([commit('perf: 启动更快')]) === '性能：启动更快')
+check('merge commits are bookkeeping, not news', summarizeCommits([commit('Merge pull request #7 from o/r'), commit('feat: a')]) === '新功能：a')
+check('a release chore is not news either', summarizeCommits([commit('chore(release): v1.0.1'), commit('feat: a')]) === '新功能：a')
+check('a build tweak is not news, which is most of these histories', summarizeCommits([commit('ci: also publish the installable tarball'), commit('feat: a')]) === '新功能：a')
+/* It put "文档：document the release procedure" FIRST in a comment under a demo video
+   before this rule: the reader came for the feature list. */
+check('release documentation is not news either', summarizeCommits([commit('docs: document the release procedure'), commit('fix: a')]) === '修复：a')
+check('a skip-ci marker is not news', summarizeCommits([commit('test: x [skip ci]'), commit('feat: a')]) === '新功能：a')
+check('only the first line of a message is used', summarizeCommits([commit('feat: a\n\nlong body nobody reads')]) === '新功能：a')
+check('the same subject is said once', summarizeCommits([commit('feat: a'), commit('feat: a'), commit('fix: b')]) === '新功能：a；修复：b')
+check('a pull-request number tail is stripped', summarizeCommits([commit('fix: a (#12)')]) === '修复：a')
+/* Order is a decision, and this one was made from a real comment: the compare API hands
+   commits oldest first, and taking the first three put a release's EARLIEST work in the
+   note — for v0.5.0, three npm details, while 提交, the Bilibili note and the one-page
+   settings were cut off the end. A version culminates in what it is for. */
+check('a feature outranks a fix, even when the fix is newer', summarizeCommits([commit('feat: a'), commit('fix: b')]) === '新功能：a；修复：b')
+check('within a kind, the newest comes first', summarizeCommits([commit('feat: older'), commit('feat: newer')]) === '新功能：newer；新功能：older')
+check('three at most, because this is a comment box', summarizeCommits([commit('feat: 1'), commit('fix: 2'), commit('perf: 3'), commit('refactor: 4')]) === '性能：3；新功能：1；重构：4')
+/* A type the repository invented is still a type: the scope belongs to its conventions,
+   not to the viewer reading a comment. */
+check('an unknown type loses its prefix rather than showing it', summarizeCommits([commit('polish(bilibili): size the code')]) === 'size the code')
+check('and is not mistaken for bookkeeping', summarizeCommits([commit('polish: tidy the row')]) === 'tidy the row')
+check('a subject in another language is passed through untouched', summarizeCommits([commit('fix: 音量包了一层')]) === '修复：音量包了一层')
+check('no history at all is an empty string, so the caller can fall back', summarizeCommits([]) === '' && summarizeCommits(null) === '')
+check('a range that is all bookkeeping says so instead of nothing', summarizeCommits([commit('ci: a'), commit('chore(release): v1')]) === MAINTENANCE_NOTE)
+check('plain strings work too, which is what the ledger already holds', summarizeCommits(['feat: a']) === '新功能：a')
+
+const silentRelease = { tag: 'v1.0.1', name: 'v1.0.1', body: '**Full Changelog**: https://github.com/o/r/compare/v1.0.0...v1.0.1' }
+const withCommits = summarizeRelease(silentRelease, { commits: [commit('feat: 这次真的改了东西')] })
+check('a release that says nothing falls back to the commits', withCommits === '新功能：这次真的改了东西', withCommits)
+check('a release that says something still wins over the commits', summarizeRelease({ tag: 'v1', name: 'v1', body: '手写的更新说明' }, { commits: [commit('feat: x')] }) === '手写的更新说明')
+/* The release workflow names every release `<repo> <tag>`, so that name is the tag
+   repeated — treating it as a description is what made every comment read
+   "【更新 v1.0.1】dsh-plugin-restart v1.0.1" and hid the changes behind it. */
+const namedLikeTheWorkflow = summarizeRelease({ tag: 'v1.0.1', name: 'dsh-plugin-restart v1.0.1', body: '' }, { names: ['dsh-plugin-restart'], commits: [commit('fix: 真的修了东西')] })
+check('a release named after its own repo and tag is not a description', namedLikeTheWorkflow === '修复：真的修了东西', namedLikeTheWorkflow)
+check('nor is the same name with a colon', summarizeRelease({ tag: 'v0.1.1', name: 'dsh-ui-sound: v0.1.1', body: '' }, { names: ['dsh-ui-sound'], commits: [commit('fix: x')] }) === '修复：x')
+check('but a real title still wins', summarizeRelease({ tag: 'v1', name: '发布台：B 站更新播报', body: '' }, { names: ['dsh-plugin-cicd'], commits: [commit('feat: x')] }) === '发布台：B 站更新播报')
+
+const changesOnly = composeComment({ tag: 'v2', release: silentRelease, template: '【{tag}】本版更新：{changes}', commits: [commit('feat: a'), commit('fix: b')] })
+check('{changes} is available to a template on its own', changesOnly.text === '【v2】本版更新：新功能：a；修复：b', changesOnly.text)
+check('and an unknown placeholder is still reported, not invented', changesOnly.unknown.length === 0)
+
 const composed = composeComment({
   label: '发布台',
   repo: 'dsh-plugin-cicd',

package/tests/bump-e2e.mjs

@@ -347,6 +347,85 @@ async function callRoutes(routes, path, body) {
   check('a repository with no checkout is refused here too', answer.status === 400 && answer.payload?.code === 'no-checkout', `${String(answer.status)} ${String(answer.payload?.code)}`)
 }
 
+/* -- 9. 克隆: a registered repository with no working tree ------------------- */
+/*
+ * Cloned from the fixture's own bare origin, so this is a real `git clone` with no
+ * network involved. It is the step that makes a registered repository usable at all:
+ * every action the console offers needs a working tree, and the address is derived
+ * rather than demanded.
+ */
+{
+  const checkout = makeCheckout()
+  const root = mkdtempSync(join(scratch, 'projects-'))
+  const configFile = join(scratch, 'repos-clone.json')
+  writeFileSync(configFile, JSON.stringify({
+    owner: 'octocat',
+    projectsRoot: root,
+    repos: [{ repo: 'octocat/fixture' }],
+  }), 'utf8')
+  const routes = new Map()
+  module.apply({
+    effect: (fn) => fn,
+    logger: { info: () => {} },
+    webServer: { register: ({ path, handler }) => { routes.set(path, handler); return () => {} } },
+    /* `projectsRoot` is ROW config, not a key of the managed file: writing it into
+       repos.json would look right and be ignored. */
+  }, { owner: 'octocat', configFile, projectsRoot: root })
+
+  const target = join(root, 'fixture')
+  const answer = await callRoutes(routes, '/api/dsh-cicd/clone', { repo: 'octocat/fixture', url: checkout.origin })
+  check('a repository with no checkout can be cloned', answer.status === 200 && answer.payload?.ok === true, JSON.stringify(answer.payload?.value ?? answer.payload))
+  check('it lands where the console looks for a checkout next', answer.payload?.value?.path === target, String(answer.payload?.value?.path))
+  check('the working tree really is a checkout', readFileSync(join(target, 'package.json'), 'utf8').includes('"fixture"'))
+  check('and the branch came with it', git(target, ['rev-parse', '--abbrev-ref', 'HEAD']) === 'main')
+  check('the config now records where it is', JSON.parse(readFileSync(configFile, 'utf8')).repos[0].localPath === target)
+
+  /* Idempotence matters more than it looks: this button sits next to 提交, and a second
+     press must not make a second copy of the repository somewhere else. */
+  const again = await callRoutes(routes, '/api/dsh-cicd/clone', { repo: 'octocat/fixture', url: checkout.origin })
+  check('cloning over an existing checkout is refused', again.status === 409 && again.payload?.code === 'already-cloned', `${String(again.status)} ${String(again.payload?.code)}`)
+
+  /* A second repository, never cloned, for the refusals that only make sense before a
+     working tree exists — `already-cloned` wins over everything else by design, since
+     with a checkout in place the rest of the request is moot. */
+  const configFile2 = join(scratch, 'repos-clone2.json')
+  writeFileSync(configFile2, JSON.stringify({ owner: 'octocat', repos: [{ repo: 'octocat/other' }] }), 'utf8')
+  const routes2 = new Map()
+  module.apply({
+    effect: (fn) => fn,
+    logger: { info: () => {} },
+    webServer: { register: ({ path, handler }) => { routes2.set(path, handler); return () => {} } },
+  }, { owner: 'octocat', configFile: configFile2, projectsRoot: root })
+
+  /* An address that is not an address is refused by name — before git is asked to fetch
+     something that could never be a repository. */
+  const nonsense = await callRoutes(routes2, '/api/dsh-cicd/clone', { repo: 'octocat/other', url: 'not a url' })
+  check('a nonsense address is refused by name', nonsense.status === 400 && nonsense.payload?.code === 'bad-url', `${String(nonsense.status)} ${String(nonsense.payload?.code)}`)
+
+  /* A clone that fails reports git's own reason and the address it tried. A local path
+     that does not exist, on purpose: the alternative is a test that reaches for
+     github.com, which would make CI depend on the network and on a repository that is
+     not this one. */
+  const missing = await callRoutes(routes2, '/api/dsh-cicd/clone', { repo: 'octocat/other', url: join(scratch, 'no-such-origin.git') })
+  check('a clone that fails says so, with git\'s own words', missing.status === 502 && missing.payload?.code === 'clone-failed', `${String(missing.status)} ${String(missing.payload?.code)}`)
+  check('and names the address it tried', String(missing.payload?.value?.url ?? '').includes('no-such-origin.git'), String(missing.payload?.value?.url))
+  check('nothing was recorded for a clone that did not happen', JSON.parse(readFileSync(configFile2, 'utf8')).repos[0].localPath === undefined)
+}
+
+/* A repository with nowhere to land says so, rather than failing obscurely. */
+{
+  const configFile = join(scratch, 'repos-clone3.json')
+  writeFileSync(configFile, JSON.stringify({ owner: 'octocat', repos: [{ repo: 'octocat/fixture' }] }), 'utf8')
+  const routes = new Map()
+  module.apply({
+    effect: (fn) => fn,
+    logger: { info: () => {} },
+    webServer: { register: ({ path, handler }) => { routes.set(path, handler); return () => {} } },
+  }, { owner: 'octocat', configFile })
+  const answer = await callRoutes(routes, '/api/dsh-cicd/clone', { repo: 'octocat/fixture' })
+  check('no projectsRoot is a named refusal, not a mystery', answer.status === 409 && answer.payload?.code === 'no-projects-root', `${String(answer.status)} ${String(answer.payload?.code)}`)
+}
+
 await new Promise((settle) => { rmSync(scratch, { recursive: true, force: true }); settle() })
 console.log(`\n${results.length - failed}/${results.length} checks passed`)
 if (failed > 0) process.exit(1)

package/tests/client-render.mjs

@@ -1106,7 +1106,13 @@ function inputValue(node, placeholderPart) {
   const { tree } = await expandFirstRow(panel)
   const rowText = textOf(tree)
   check('the row names the video it is bound to', rowText.includes('绑定的视频') && rowText.includes('一支视频'), rowText.replace(/\s+/g, ' ').slice(-320))
-  check('the binding is prefilled, so editing it does not start from nothing', inputValue(tree, 'BV') === 'BV1RopP6FEJp', inputValue(tree, 'BV'))
+  /* A bound video is a STATE, not a draft. Editing it in place would change which video
+     a repository announces under while the announcement history still points at the old
+     one, so the field is gone once something is bound and the only action left is 解绑. */
+  check('a bound video is shown, not offered for editing', textOf(tree).includes('BV1RopP6FEJp') && inputValue(tree, 'BV') === null, String(inputValue(tree, 'BV')))
+  check('and the way to change it is spelled out', textOf(tree).includes('要换视频先【解绑】'))
+  check('binding again is not on offer', hasButton(tree, '绑定') === false, textOf(tree).replace(/\s+/g, ' ').slice(-200))
+  check('unbinding is', hasButton(tree, '解绑'))
   check('the row offers the manual announcement', hasButton(tree, '发更新评论'))
 
   /* The preview is the Host's own composition — the sentence shown is the sentence
@@ -1263,5 +1269,215 @@ function previewFixture(overrides) {
   check('and the button says why', String(button?.props?.title ?? '').includes('没有可提交或推送的东西'), String(button?.props?.title))
 }
 
+/* -- 19. The sign-in code is drawn, not merely linked -------------------------
+   The URL the sign-in hands back exists to be SCANNED, and the panel used to answer it
+   with a link while its own hint said "scan it with the phone" — nothing on screen to
+   scan. So the encoder that draws it is checked module for module against a matrix a
+   reference implementation produced, frozen here as a hash and one full row. A single
+   flipped module changes both: a code that looks right and does not scan is worse than
+   no code, because the person holding the phone is the one who finds out.
+   (The reference — `qrcode`, which another package in this profile happens to depend
+   on — is NOT a dependency of this plugin: it was the oracle while the encoder was
+   written, and what it produced is what is frozen below.) */
+{
+  /** The first `<svg>` in a tree, which is the code. */
+  function findSvg(node) {
+    if (node === null || typeof node !== 'object') return null
+    if (Array.isArray(node)) {
+      for (const child of node) {
+        const found = findSvg(child)
+        if (found !== null) return found
+      }
+      return null
+    }
+    if (node.type === 'svg') return node
+    return findSvg(node.children)
+  }
+
+  /** FNV-1a over the modules, row by row. */
+  function moduleHash(grid) {
+    let hash = 0x811c9dc5
+    for (const row of grid) {
+      for (const value of row) {
+        hash ^= value === 1 ? 49 : 48
+        hash = Math.imul(hash, 0x01000193) >>> 0
+      }
+    }
+    return hash
+  }
+
+  const rowText = (grid, index) => Array.from(grid[index]).join('')
+
+  /* Signed in — which the fixture is by default. Every control that exists to OBTAIN a
+     credential must be gone: the page said 已登录：<name> and then, directly under it,
+     invited the reader to sign in again. The block was gated on "is a sign-in running"
+     and never on the credential, so a successful sign-in changed the status line and
+     nothing else. */
+  fixture = {
+    '/status': { ok: true, value: baseStatus.value },
+    '/bilibili-status': { ok: true, value: biliValue() },
+  }
+  values.clear()
+  effectSlots.clear()
+  calls.length = 0
+  const signedIn = await renderSettings('bilibili')
+  check('a signed-in page says who is signed in', textOf(signedIn).includes('已登录 白衣为卿曲'), textOf(signedIn).replace(/\s+/g, ' ').slice(0, 200))
+  check('and offers no sign-in prompt', hasButton(signedIn, '登录 B 站') === false, textOf(signedIn).replace(/\s+/g, ' ').slice(0, 240))
+  check('and no hint inviting a scan', textOf(signedIn).includes('点一下会生成一个二维码') === false)
+  check('and no paste field, which is another way to obtain one', inputValue(signedIn, 'SESSDATA') === null && hasButton(signedIn, '保存并验证') === false)
+  check('the one action left is to stop being signed in', hasButton(signedIn, '退出 B 站登录'))
+
+  const url = 'https://account.bilibili.com/h5/account-h5/auth/scan-web?navhide=1&callback=close&qrcode_key=fda852ed16a061fae96dd764c797168f&from='
+  const signedOut = {
+    ...biliValue().credential,
+    state: 'none',
+    account: null,
+    hasSession: false,
+    hasCsrf: false,
+    message: '',
+  }
+  fixture = {
+    '/status': { ok: true, value: baseStatus.value },
+    '/bilibili-status': {
+      ok: true,
+      value: biliValue({
+        credential: signedOut,
+        login: { state: 'waiting', url, startedAt: '2026-10-08T01:00:00Z', expiresAt: '2026-10-08T01:03:00Z', scanned: false, message: '' },
+      }),
+    },
+  }
+  values.clear()
+  effectSlots.clear()
+  calls.length = 0
+  const waiting = await renderSettings('bilibili')
+  const svg = findSvg(waiting)
+
+  check('a waiting sign-in draws something to scan', svg !== null, textOf(waiting).replace(/\s+/g, ' ').slice(0, 200))
+  if (svg !== null) {
+    const size = Number(String(svg.props?.viewBox ?? '').split(' ')[2])
+    const grid = Array.from({ length: size }, () => new Uint8Array(size))
+    for (const rect of svg.children ?? []) {
+      const x = Number(rect.props?.x)
+      const y = Number(rect.props?.y)
+      const width = Number(rect.props?.width)
+      for (let k = 0; k < width; k += 1) grid[y][x + k] = 1
+    }
+    check('the code is the version the reference chose', size === 49, String(size))
+    check('every module matches the reference', moduleHash(grid) === 2409592449, String(moduleHash(grid)))
+    check('the first row matches as well, so a hash collision cannot hide a difference', rowText(grid, 0) === '1111111000101110111010010111110011011100101111111', rowText(grid, 0))
+    check('the code is announced as an image, for a screen reader', svg.props?.role === 'img' && svg.props?.['aria-label'] === 'B 站登录二维码', String(svg.props?.['aria-label']))
+  }
+
+  /* That URL is the H5 page for a PHONE: a desktop browser answers it with the
+     Bilibili app's APK, which is a download rather than a sign-in. The code is the way
+     through, and offering the page beside it is offering a dead end. */
+  check('nothing offers to open the sign-in page', hasButton(waiting, '打开登录页面') === false, textOf(waiting).replace(/\s+/g, ' ').slice(0, 220))
+
+  /* Longer than version 10 holds. The panel shows the fallback and says why, never a
+     code that encodes something else. */
+  fixture['/bilibili-status'] = {
+    ok: true,
+    value: biliValue({
+      credential: signedOut,
+      login: { state: 'waiting', url: `https://example.com/${'a'.repeat(260)}`, startedAt: '2026-10-08T01:00:00Z', expiresAt: '2026-10-08T01:03:00Z', scanned: false, message: '' },
+    }),
+  }
+  values.clear()
+  effectSlots.clear()
+  const tooLong = await renderSettings('bilibili')
+  check('a URL too long to encode draws no code', findSvg(tooLong) === null)
+  check('and says so, instead of drawing something wrong', textOf(tooLong).includes('画不成二维码'), textOf(tooLong).replace(/\s+/g, ' ').slice(-200))
+  /* The fallback is the paste field, not a browser page: that URL is the phone's H5
+     page, and a desktop browser answers it with the app's APK instead of a sign-in. */
+  check('the fallback offered is the paste field, not a browser page', hasButton(tooLong, '保存并验证') && hasButton(tooLong, '打开登录页面') === false, textOf(tooLong).replace(/\s+/g, ' ').slice(-260))
+}
+
+/* -- 20. A repository with no working tree can fetch one ----------------------
+   Registered but not cloned, every action on this page is unavailable: 提交 has nothing
+   to commit, 构建 and 发布 act on what is on GitHub rather than on this disk, and the
+   local column reads as broken. The panel answers the one question that unblocks all of
+   it — where is it, and shall I fetch it — with the address already filled in, because
+   the Host can derive it from the name it already has. */
+{
+  const cloneFixture = (overrides) => repoFixture({
+    localPath: '',
+    cloneUrl: 'https://github.com/SOH4C4759/dsh-plugin-restart.git',
+    checkoutRoot: 'F:\\CodeProj',
+    local: { available: false, reason: 'no localPath configured' },
+    ...overrides,
+  })
+
+  const panel = await renderPanel([cloneFixture({})])
+  const { tree } = await expandFirstRow(panel)
+  check('a repository with no checkout says so', textOf(tree).includes('还没有本地检出'), textOf(tree).replace(/\s+/g, ' ').slice(0, 200))
+  check('and offers the address already filled in', inputValue(tree, '仓库地址') === 'https://github.com/SOH4C4759/dsh-plugin-restart.git', String(inputValue(tree, '仓库地址')))
+  check('and says where it would land', textOf(tree).includes('将克隆到 F:\\CodeProj\\dsh-plugin-restart'), textOf(tree).replace(/\s+/g, ' ').slice(-200))
+  check('with a clone button', hasButton(tree, '克隆'))
+
+  fixture['/clone'] = { ok: true, value: { repo: 'dsh-plugin-restart', path: 'F:\\CodeProj\\dsh-plugin-restart', url: 'https://github.com/SOH4C4759/dsh-plugin-restart.git' } }
+  const asked = clickButton(tree, '克隆')
+  const after = await rerender()
+  check('the clone is sent to the Host', asked === true && calls.includes('/clone'), calls.join(','))
+  check('and the panel says where it landed', textOf(after).includes('已克隆到 F:\\CodeProj\\dsh-plugin-restart'), textOf(after).replace(/\s+/g, ' ').slice(-200))
+
+  /* Nowhere to put it: a named refusal with the key that fixes it, rather than a button
+     whose only outcome is a refusal in English from the Host. */
+  const noRoot = await renderPanel([cloneFixture({ checkoutRoot: '' })])
+  const { tree: noRootTree } = await expandFirstRow(noRoot)
+  check('nowhere to clone into is explained', textOf(noRootTree).includes('还没设置检出根目录'), textOf(noRootTree).replace(/\s+/g, ' ').slice(-220))
+  check('and the key that fixes it is named', textOf(noRootTree).includes('projectsRoot'))
+}
+
+/* -- 21. "已发送" and "读得到" are two different facts ------------------------
+   Bilibili answers `code: 0` with an rpid for a comment the public listing may never
+   serve. Two of these were filed as announced and then answered `12006 没有该评论` when
+   looked up, and the panel showed "已播报" the whole time. The Host now reads the comment
+   back before answering, records what it found, and the panel says which of the two
+   happened. */
+{
+  const announcedEntry = (overrides) => ({
+    repo: 'dsh-plugin-restart',
+    tag: 'v1.0.1',
+    bvid: 'BV1RopP6FEJp',
+    at: '2026-10-08T02:00:00Z',
+    state: 'announced',
+    attempts: 0,
+    text: '【更新 v1.0.1】修复：x',
+    rpid: '316418818849',
+    code: 0,
+    message: '',
+    failure: null,
+    url: 'https://www.bilibili.com/video/BV1RopP6FEJp/#reply316418818849',
+    ...overrides,
+  })
+
+  const invisible = await renderPanel([repoFixture({ publishedTag: 'v1.0.1' })], baseStatus.value, {
+    '/bilibili-status': { ok: true, value: biliValue({ repos: [biliFixture({ announced: [announcedEntry({ visible: false, visibleCode: 12006 })] })] }) },
+  })
+  const { tree } = await expandFirstRow(invisible)
+  check('an announcement nobody can read is not shown as a success', textOf(tree).includes('已发送但读不到'), textOf(tree).replace(/\s+/g, ' ').slice(-260))
+
+  const visible = await renderPanel([repoFixture({ publishedTag: 'v1.0.1' })], baseStatus.value, {
+    '/bilibili-status': { ok: true, value: biliValue({ repos: [biliFixture({ announced: [announcedEntry({ visible: true, visibleCode: 0 })] })] }) },
+  })
+  const { tree: visibleTree } = await expandFirstRow(visible)
+  check('and one that reads back is not flagged', textOf(visibleTree).includes('已发送但读不到') === false)
+
+  /* The manual post reports what the Host found, rather than assuming the cheerful one. */
+  const posting = await renderPanel([repoFixture({ publishedTag: 'v1.0.1' })], baseStatus.value, {
+    '/bilibili-status': { ok: true, value: biliValue() },
+    '/bilibili-announce': { ok: true, value: { repo: 'dsh-plugin-restart', tag: 'v1.0.1', bvid: 'BV1RopP6FEJp', rpid: '1', url: 'u', text: 't', visible: false, note: '读不到' } },
+  })
+  const { tree: postingTree } = await expandFirstRow(posting)
+  clickButton(postingTree, '发更新评论')
+  const previewed = await rerender()
+  /* The fixture's binding wrote a baseline, so the Host's verdict is "already known" and
+     the panel offers the override: 【仍然发送】, which is also the path a person uses to
+     repost something that vanished. */
+  clickButton(previewed, '仍然发送')
+  const afterPost = await rerender()
+  check('a post that does not read back says so', textOf(afterPost).includes('但公开列表里读不到'), textOf(afterPost).replace(/\s+/g, ' ').slice(-260))
+}
+
 console.log(`\n${results.length - failed}/${results.length} checks passed`)
 if (failed > 0) process.exit(1)

package/tests/host-checks.mjs

@@ -20,7 +20,7 @@
 import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { classifyPublishFailure, classifySpec, collectRepo, commandFailureLine, compareVersions, describeInstall, effectiveConfig, firstMeaningfulLine, fullSha, ghJson, hasNpmToken, nextVersion, normalizeRegistry, normalizeRepoEntry, npmAuthState, npmPackageState, npmPublishVerdict, npmrcAuthKey, packumentUrl, parseAuthStatus, parseReposFile, pickInstallableRelease, readDirtyCount, readLocalState, readLocalVersion, readManifest, readProfileInstall, releasePreflight, resolveConfig, resolveConfigFilePath, resolveGhPath, resolveNpmrcPath, resolvePackageManagerInvocation, resolveProfileDir, resolveSlug, rewriteVersion, runTool, statusPath, updateState, upsertAuthToken, versionFromTag } from '../index.js'
+import { classifyPublishFailure, classifySpec, collectRepo, commandFailureLine, compareVersions, confirmVisible, defaultCloneUrl, describeInstall, effectiveConfig, firstMeaningfulLine, fullSha, ghJson, hasNpmToken, nextVersion, normalizeRegistry, normalizeRepoEntry, npmAuthState, npmPackageState, npmPublishVerdict, npmrcAuthKey, packumentUrl, parseAuthStatus, parseReposFile, pickInstallableRelease, readDirtyCount, readLocalState, readLocalVersion, readManifest, readProfileInstall, releasePreflight, resolveConfig, resolveConfigFilePath, resolveGhPath, resolveNpmrcPath, resolvePackageManagerInvocation, resolveProfileDir, resolveSlug, rewriteVersion, runTool, statusPath, updateState, upsertAuthToken, versionFromTag } from '../index.js'
 
 const results = []
 let failed = 0
@@ -463,6 +463,61 @@ check('a rename is passed through as git spelled it', statusPath('R  old.md -> n
 check('a line too short to hold a path is not sliced into nonsense', statusPath('??') === '??')
 check('a registry that already carries a query keeps the name out of it', packumentUrl('https://r.example/npm/?a=1', 'x') === 'https://r.example/npm/x?a=1&write=true')
 
+/* The address a 克隆 would use, derived rather than demanded: being asked to paste the
+   clone URL of a repository the Host can already name is exactly the kind of step this
+   console exists to remove. */
+check('an owner/repo id gives its own address', defaultCloneUrl('', 'SOH4C4759/dsh-ui-sound') === 'https://github.com/SOH4C4759/dsh-ui-sound.git')
+check('a bare name uses the configured owner', defaultCloneUrl('octocat', 'Hello-World') === 'https://github.com/octocat/Hello-World.git')
+check('a bare name with no owner has no address to guess at', defaultCloneUrl('', 'Hello-World') === '')
+check('no repository, no address', defaultCloneUrl('octocat', '') === '' && defaultCloneUrl(undefined, undefined) === '')
+check('a stray slash is tidied rather than doubled', defaultCloneUrl('', '/octocat/Hello-World/') === 'https://github.com/octocat/Hello-World.git')
+
+/* Accepted is not the same as readable. Bilibili answers `code: 0` with an rpid for a
+   comment the public listing may never serve, and two of these were filed as announced
+   and then answered `12006 没有该评论` when looked up.
+   The waiting is measured, not superstition: a fresh comment answers 12006 immediately
+   and reads back from about four seconds, so a single check would libel a good comment. */
+{
+  const scripted = (answers) => {
+    let calls = 0
+    return {
+      read: async () => {
+        const answer = answers[Math.min(calls, answers.length - 1)]
+        calls += 1
+        return answer
+      },
+      calls: () => calls,
+    }
+  }
+  const waits = []
+  const wait = async (ms) => { waits.push(ms) }
+
+  const delayed = scripted([
+    { ok: true, visible: false, code: 12006, message: '没有该评论' },
+    { ok: true, visible: false, code: 12006, message: '没有该评论' },
+    { ok: true, visible: true, code: 0, message: '' },
+  ])
+  const late = await confirmVisible({ read: delayed.read, aid: 1, rpid: '2', attempts: 3, delayMs: 3000, wait })
+  check('a comment that appears late is still confirmed', late.visible === true && late.attempts === 3, JSON.stringify(late))
+  check('and it waited between the asks rather than hammering', waits.length === 2 && waits[0] === 3000, JSON.stringify(waits))
+
+  const never = scripted([{ ok: true, visible: false, code: 12006, message: '没有该评论' }])
+  const missing = await confirmVisible({ read: never.read, aid: 1, rpid: '2', attempts: 3, delayMs: 0, wait })
+  check('a comment that never appears is reported as not visible', missing.visible === false && missing.attempts === 3, JSON.stringify(missing))
+  check('and Bilibili\'s own reason comes with it', missing.code === 12006 && missing.message === '没有该评论', JSON.stringify(missing))
+
+  const first = scripted([{ ok: true, visible: true, code: 0, message: '' }])
+  const immediate = await confirmVisible({ read: first.read, aid: 1, rpid: '2', attempts: 3, delayMs: 3000, wait })
+  check('a comment that is already readable costs one call', immediate.visible === true && first.calls() === 1, String(first.calls()))
+
+  /* A transport failure is not a verdict: it is asked again like any other miss. */
+  const broken = scripted([{ ok: false, visible: false, code: null, message: 'HTTP 500' }])
+  const failed = await confirmVisible({ read: broken.read, aid: 1, rpid: '2', attempts: 2, delayMs: 0, wait })
+  check('a transport failure is retried and then reported honestly', failed.visible === false && broken.calls() === 2, JSON.stringify(failed))
+  const tolerated = await confirmVisible({ read: async () => undefined, aid: 1, rpid: '2', attempts: 2, delayMs: 0, wait })
+  check('a reader that answers nothing at all does not crash the check', tolerated.visible === false, JSON.stringify(tolerated))
+}
+
 /* The line the panel shows. Captured from a real `pnpm publish` of an
    already-published version: every byte goes to STDOUT (measured: stderr = 0), the
    first line is the progress line, the rest is a stack trace, and node's own

package/tests/mount-check.mjs

@@ -87,6 +87,9 @@ const EXPECTED = [
   '/api/dsh-cicd/npm-status',
   '/api/dsh-cicd/npm-login',
   '/api/dsh-cicd/npm-publish',
+  // A registered repository with no working tree cannot be released from here, so the
+  // console fetches one: the address is derivable from the name it already has.
+  '/api/dsh-cicd/clone',
   // Setup without a terminal: the browser sign-in and the repository list are
   // routes, not instructions to go and run something elsewhere.
   '/api/dsh-cicd/auth-start',