dsh-plugin-toolkit 0.13.0 → 0.13.2

package/CHANGELOG.md

@@ -1,3 +1,23 @@
+## 0.13.2
+
+- **A table of the four ways a plugin installs and still does nothing** — red
+  dot with no panel, a row the host drops, an app that disables every plugin
+  after one unguarded `apply()`, and a tab type nothing can open. Each row is a
+  bug this toolkit shipped and then learned to catch, and each row names the
+  check that catches it now.
+- Both READMEs. Nothing in the code changed.
+
+## 0.13.1
+
+- **A badge you can put on a plugin that passes.** `docs/badge.svg` plus the
+  snippet in both READMEs. It is a claim, not a decoration: the README says to
+  add it only when `verify` exits 0.
+- **Every scaffolded plugin links back.** `init` now writes the badge into the
+  generated README, so a plugin created with the toolkit advertises the toolkit
+  it was checked with.
+- **README badges** for version, downloads, CI and license, and the repository
+  homepage now points at the npm page.
+
 ## 0.13.0
 
 Three more rounds of the panel, and one new thing to point it at.

package/README.md

@@ -1,5 +1,11 @@
 # dsh-plugin-toolkit
 
+[![npm](https://img.shields.io/npm/v/dsh-plugin-toolkit)](https://www.npmjs.com/package/dsh-plugin-toolkit)
+[![downloads](https://img.shields.io/npm/dw/dsh-plugin-toolkit)](https://www.npmjs.com/package/dsh-plugin-toolkit)
+[![CI](https://github.com/WJDdidi-1/dsh-plugin-toolkit/actions/workflows/ci.yml/badge.svg)](https://github.com/WJDdidi-1/dsh-plugin-toolkit/actions/workflows/ci.yml)
+[![license](https://img.shields.io/npm/l/dsh-plugin-toolkit)](LICENSE)
+
+
 ![dsh-plugin-toolkit](docs/card.png)
 
 English · [中文](./README.zh.md)
@@ -67,6 +73,19 @@ Releasing one plugin fifteen times taught me three things the ecosystem's toolin
 2. **The market index is a second release, done by hand.** Each version needs an entry carrying `publishTimestamp` from the registry and `engines.dsh` from the manifest. Forget the range and the index validator rejects the PR with `Engines mismatch` — after the tag is already public.
 3. **Reading a manifest is not the same as checking it.** A plugin can have a valid `package.json` and still be uninstallable: `files` that omit the entry the manifest points at, a bundle patch that does not exist, a README that never states the host range it declares.
 
+### Four ways a plugin installs and still does nothing
+
+Each of these shipped in a real version of this toolkit before the check below existed. A manifest check passes on all four.
+
+| What you see | What it was | Caught by |
+| --- | --- | --- |
+| The tab is a red dot and the panel never opens | `exports["."]` pointed at the CLI, so the loader's row had no plugin to apply | `root export` |
+| The plugin is installed, the app never serves it | `dsh.client` declared, `exports["./client"]` missing — the host drops the row | `client declaration` |
+| The app says the third-party plugin is unsupported and disables all of them | `apply()` read `ctx.webServer` without declaring it; cordis throws instead of returning `undefined` | `verify` (calls `apply` on a context that has no services) |
+| The tab registers, and nothing in the UI opens it | `sidebarRightTabs.register()` registers a *type*; the sidebar lists what `tabs.guide()` returns | a testkit test, not `doctor` |
+
+The first three are static: `doctor` and `verify` catch them without the app running. The fourth is a UI contract, so it needs the panel mounted and the registration inspected — that is what [`testkit`](#test-a-panel-without-a-browser) is for.
+
 ## Requirements
 
 - Node.js 18 or newer (the registry is read with `fetch`; no runtime dependencies)
@@ -210,6 +229,16 @@ $ npx dsh-plugin mount ../ai-context-doctor/plugin/client.js
 AIignore No workspace yet Could not read the report …
 ```
 
+## Put the badge on a plugin that passes
+
+If `verify` passes on your plugin, this badge says so and links back here:
+
+```md
+[![checked with dsh-plugin-toolkit](https://raw.githubusercontent.com/WJDdidi-1/dsh-plugin-toolkit/main/docs/badge.svg)](https://github.com/WJDdidi-1/dsh-plugin-toolkit)
+```
+
+It is a claim, not a decoration: add it only when `dsh-plugin verify .` exits 0.
+
 ## Start from the example
 
 [`dsh-plugin-example`](https://github.com/WJDdidi-1/dsh-plugin-example) is a ~70-line plugin: one sidebar tab, two languages, one behaviour test, CI that runs `verify` through the composite action. It is the shape this toolkit expects, so it is also the fastest way to see whether the toolkit fits your plugin. It is a GitHub template too: **Use this template** starts you on a plugin whose first publish already passes.

package/README.zh.md

@@ -31,11 +31,34 @@ npx dsh-plugin-toolkit@latest release --pr --merge              # 打 tag、等
 
 每一条都能在发布前被机器拦住，所以每一条现在都是一项检查。这些检查对着**宿主的解析代码**写，而不是对着文件约定写——差别就是 `verify` 报 `mounted the panel` 而真实宿主什么都不加载。
 
+### 插件装上了却什么都不做的四种样子
+
+下面每一条都真实发布过，而且**只看 manifest 一个都发现不了**。
+
+| 你会看到 | 真正的原因 | 现在由谁拦 |
+| --- | --- | --- |
+| 标签是个红点，面板永远打不开 | `exports["."]` 指向了 CLI，加载器那一行没有插件可挂 | `root export` |
+| 插件装上了，应用从不加载它 | 声明了 `dsh.client`，但 `exports["./client"]` 不存在——宿主直接丢掉这一行 | `client declaration` |
+| 应用提示「第三方插件不支持」，把所有插件都禁用 | `apply()` 读了没声明的 `ctx.webServer`，cordis 不是返回 `undefined` 而是抛错 | `verify`（在一个没有任何服务的 ctx 上调用 `apply`） |
+| 标签注册成功，界面里却没有任何入口 | `sidebarRightTabs.register()` 注册的是**类型**，侧栏列的是 `tabs.guide()` 的返回 | testkit 的测试，不是 `doctor` |
+
+前三条是静态的：`doctor` 和 `verify` 不用开应用就能抓到。第四条是 UI 契约，必须把面板挂起来、检查注册出去的参数——那是 [`testkit`](#不用浏览器测面板) 的活。
+
 ## 安装要求
 
 - Node.js 18 或更新（CI 在 18/20/22 × ubuntu/macos/windows 上跑）。
 - 要发布时需要一个能写 `market/index.json` 的仓库和 `gh`（已登录）。
 
+## 通过检查就挂个徽章
+
+`verify` 过了，可以用这个徽章，点回这里：
+
+```md
+[![checked with dsh-plugin-toolkit](https://raw.githubusercontent.com/WJDdidi-1/dsh-plugin-toolkit/main/docs/badge.svg)](https://github.com/WJDdidi-1/dsh-plugin-toolkit)
+```
+
+这是声明不是装饰：`dsh-plugin verify .` 退出码为 0 才挂。
+
 ## 从一个已经能通过检查的插件开始
 
 ```sh

package/docs/badge.svg

@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="196" height="20" role="img" aria-label="dsh plugin: verify passed">
+  <title>dsh plugin: verify passed</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset="1" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r"><rect width="196" height="20" rx="3" fill="#fff"/></clipPath>
+  <g clip-path="url(#r)">
+    <rect width="82" height="20" fill="#2f3542"/>
+    <rect x="82" width="114" height="20" fill="#1a7f37"/>
+    <rect width="196" height="20" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" font-size="11">
+    <text x="41" y="15" fill="#010101" fill-opacity=".3">dsh plugin</text>
+    <text x="41" y="14">dsh plugin</text>
+    <text x="139" y="15" fill="#010101" fill-opacity=".3">✓ verify passed</text>
+    <text x="139" y="14">✓ verify passed</text>
+  </g>
+</svg>

package/lib/init.mjs

@@ -150,7 +150,7 @@ export function files({ name, title = 'My panel', version = '0.1.0' }) {
     'index.js': `export const name = '${name}';\n\n// The host half runs in Node. Most panels need nothing here.\nexport function apply() {}\n`,
     'client.js': client({ name, title }),
     'test/panel.test.mjs': test({ name, title }),
-    'README.md': `# ${slug}\n\n${title} — a panel for DeepSeek Harness.\n\n## Requirements\n\n| What | Version | Why |\n| --- | --- | --- |\n| DeepSeek Harness | >= 0.2.0 | provides \`sidebarRightTabs\` |\n| Node | >= 18 | the host half |\n\n## Develop\n\n\`\`\`sh\nnpm install\nnpm test            # mounts client.js in Node\nnpm run doctor      # checks the manifest before you publish\n\`\`\`\n\n## Install\n\n\`\`\`sh\ndsh plugin add ${name}\n\`\`\`\n`,
+    'README.md': `# ${slug}\n\n${title} — a panel for DeepSeek Harness.\n\n[![checked with dsh-plugin-toolkit](https://raw.githubusercontent.com/WJDdidi-1/dsh-plugin-toolkit/main/docs/badge.svg)](https://github.com/WJDdidi-1/dsh-plugin-toolkit)\n\n## Requirements\n\n| What | Version | Why |\n| --- | --- | --- |\n| DeepSeek Harness | >= 0.2.0 | provides \`sidebarRightTabs\` |\n| Node | >= 18 | the host half |\n\n## Develop\n\n\`\`\`sh\nnpm install\nnpm test            # mounts client.js in Node\nnpm run doctor      # checks the manifest before you publish\n\`\`\`\n\n## Install\n\n\`\`\`sh\ndsh plugin add ${name}\n\`\`\`\n`,
     '.gitignore': 'node_modules/\n',
     '.github/workflows/ci.yml': `name: ci\n\non:\n  push:\n    branches: [main]\n  pull_request:\n\njobs:\n  test:\n    runs-on: ubuntu-latest\n    strategy:\n      matrix:\n        node: [18, 20, 22]\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: \${{ matrix.node }}\n      - run: npm install\n      - run: npm test\n      # verify, not doctor: doctor reads the working copy, so a \`files\` list\n      # that forgets client.js passes it and the installed plugin has no panel.\n      - uses: WJDdidi-1/dsh-plugin-toolkit@v1\n        with:\n          dir: .\n          version: ${VERSION}\n`,
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-toolkit",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "Preflight, release and test DeepSeek Harness plugins: check a folder or any GitHub repository, wait for npm to actually serve the version, and keep the market index honest.",
   "type": "module",
   "bin": {
@@ -21,7 +21,8 @@
     "README.md",
     "README.zh.md",
     "LICENSE",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "docs/badge.svg"
   ],
   "engines": {
     "node": ">=18",