dsh-plugin-inspector 0.6.0 → 0.7.0

package/lib/types/syntax.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Readings of a syntax tree that both capability detection and readability
+ * detection need, and that must agree between them.
+ *
+ * Tier B matches a name; Tier C reports the names it could not match. If the
+ * two disagree about which expressions are constant, a package gets both a
+ * finding and a degrade for the same site, or neither. They agree because they
+ * ask the same function.
+ *
+ * Nothing here evaluates anything. {@link foldConstantString} reads literals
+ * out of an already-parsed tree and concatenates them; it never constructs a
+ * function, and it never touches an identifier's value.
+ * @module dsh-plugin-inspector/syntax
+ */
+import ts from 'typescript';
+/**
+ * The text a constant string expression holds, or `null` when the expression is
+ * not constant.
+ *
+ * Four forms, chosen because each one is a spelling of a name that a reader
+ * sees and a name-matching check does not: a literal, a `+` chain of them, a
+ * template whose every span is one, and `[…].join(…)` over an array of them.
+ * Anything reaching an identifier, a property, or any other call answers
+ * `null` — resolving those is value tracking, which this tool does not do and
+ * which Tier C exists to admit.
+ * @param node - the expression, or `undefined` for a missing argument.
+ * @returns the text, or `null`.
+ */
+export declare function foldConstantString(node: ts.Node | undefined): string | null;
+/**
+ * The Node API that hands back a builtin module without `require` and without
+ * an `import` declaration, added in Node 22.3.
+ *
+ * It reaches the same modules the harness sandbox's `require` trap covers,
+ * from a call that sandbox never sees: the sandbox leaves
+ * `process` `undefined`, so inside it this expression throws, and a mounted
+ * bundle layer is not inside it.
+ * @see https://nodejs.org/api/process.html#processgetbuiltinmoduleid
+ */
+export declare const BUILTIN_MODULE_GETTER = "getBuiltinModule";
+/**
+ * Whether a call is `process.getBuiltinModule(…)`.
+ *
+ * The receiver is required. `getBuiltinModule` pulled off `process` and bound
+ * to a bare name is not this — it is a detached member, which Tier C reports as
+ * dispatch it cannot follow.
+ * @param node - the call expression.
+ * @returns true when the call loads a builtin through `process`.
+ */
+export declare function isBuiltinModuleGetter(node: ts.CallExpression): boolean;
+//# sourceMappingURL=syntax.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-inspector",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Know what a DeepSeek Harness plugin does before you install it — static pre-install analysis of a plugin directory or tarball",
   "license": "MIT",
   "author": "Ivan Tyshchenko",
@@ -57,6 +57,7 @@
     "test:coverage": "vitest run --config vitest.config.ts --coverage",
     "inspect": "node --experimental-strip-types src/cli.ts",
     "sweep": "node --experimental-strip-types scripts/ecosystem-sweep.ts",
+    "sync": "node --experimental-strip-types scripts/harness-sync.ts",
     "test:e2e": "pnpm run build && vitest run --config vitest.e2e.config.ts"
   }
 }