dsh-plugin-toolkit 0.3.4 → 0.3.5

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.3.5
+
+Four bugs found by running `release` for real against a throwaway package, instead of only `--dry-run`:
+
+- The index entry came out with `publishTimestamp: null`. The registry was asked for the abbreviated packument (`application/vnd.npm.install-v1+json`), which has no `time` field at all — so the tool could see the version and still have no publish date. It now asks for the full document, and waits for `time[version]` before writing the entry.
+- `git rev-parse` on a tag that does not exist yet printed `fatal: ambiguous argument …` in the middle of a successful release; stderr is now dropped for that call.
+- "the working tree has uncommitted changes" now names up to three paths.
+- A folder without `package.json` raised a stack trace instead of returning a preflight failure.
+
 ## 0.3.4
 
 - CI now runs on Windows as well as Linux and macOS; two tests assumed a POSIX temp path (`/tmp/…`) and were rewritten with `path.join`.

package/lib/registry.mjs

@@ -11,8 +11,12 @@ export const REGISTRY = 'https://registry.npmjs.org';
 export async function packument(name, options = {}) {
   const base = options.registry ?? REGISTRY;
   const request = options.fetch ?? fetch;
+  // The full document, not the abbreviated install one: the index entry needs
+  // `time[version]`, and `application/vnd.npm.install-v1+json` omits `time`
+  // entirely — which is why an abbreviated fetch can see a version and still
+  // have no publish date to write.
   const response = await request(`${base}/${name.replace('/', '%2F')}`, {
-    headers: { accept: 'application/vnd.npm.install-v1+json' },
+    headers: { accept: 'application/json' },
   });
   if (response.status === 404) return null;
   if (response.ok === false) {
@@ -40,6 +44,12 @@ export function hasVersion(document, version) {
  * `onWait` is called after each miss so the CLI can report progress.
  */
 export async function waitForVersion(name, version, options = {}) {
+  // `requireTime` matters for the market index: `versions` can list a version
+  // before the registry has written its `time` entry, and an index entry with a
+  // null timestamp is rejected by the checker.
+  const ready = options.requireTime === true
+    ? (document) => hasVersion(document, version) === true && publishedAt(document, version) !== null
+    : (document) => hasVersion(document, version) === true;
   const budgetMs = options.budgetMs ?? 8 * 60 * 1000;
   const intervalMs = options.intervalMs ?? 10 * 1000;
   const now = options.now ?? Date.now;
@@ -50,7 +60,7 @@ export async function waitForVersion(name, version, options = {}) {
   for (;;) {
     attempts += 1;
     const document = await packument(name, options);
-    if (hasVersion(document, version) === true) {
+    if (ready(document) === true) {
       return { document, attempts, waitedMs: now() - started };
     }
     if (now() - started >= budgetMs) {

package/lib/release.mjs

@@ -14,7 +14,10 @@ import { addVersion, buildEntry, readIndex, writeIndex } from './index-file.mjs'
 import { publishedAt, waitForVersion } from './registry.mjs';
 
 function git(dir, args) {
-  return execFileSync('git', args, { cwd: dir, encoding: 'utf8' }).trim();
+  // stderr is dropped on purpose: `rev-parse` on a tag that does not exist yet is
+  // an expected miss, and git prints "fatal: ambiguous argument" for it, which
+  // reads like a failure in the middle of a successful release.
+  return execFileSync('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
 }
 
 export function tagName(version, prefix = 'plugin-v') {
@@ -34,6 +37,14 @@ export function workingTreeIsClean(dir) {
   return git(dir, ['status', '--porcelain']) === '';
 }
 
+/** The paths git would carry into the tag, so the message can name them. */
+export function dirtyPaths(dir, limit = 3) {
+  const status = git(dir, ['status', '--porcelain']);
+  if (status === '') return [];
+  const paths = status.split('\n').map((line) => line.slice(3).trim()).filter((line) => line !== '');
+  return paths.slice(0, limit);
+}
+
 /**
  * Steps a human must do, and steps the tool can do. Returning this list before
  * anything runs is what makes `--dry-run` useful: it shows the whole sequence
@@ -69,7 +80,14 @@ export async function release(options) {
     onChange,
   } = options;
 
-  const report = doctor(dir);
+  let report;
+  try {
+    report = doctor(dir);
+  } catch (error) {
+    // A folder without package.json is a preflight failure, not a crash: the
+    // command's job is to say what is wrong, and a stack trace is not an answer.
+    return { ok: false, stage: 'preflight', failures: [{ check: 'manifest', message: error.message }] };
+  }
   if (report.failures.length > 0) {
     return { ok: false, stage: 'preflight', failures: report.failures };
   }
@@ -82,10 +100,12 @@ export async function release(options) {
     return { ok: false, stage: 'tag', failures: [{ check: 'tag', message: `${tag} already exists` }] };
   }
   if (workingTreeIsClean(dir) === false) {
+    const dirty = dirtyPaths(dir);
+    const listed = dirty.length > 0 ? ` (${dirty.join(', ')})` : '';
     return {
       ok: false,
       stage: 'git',
-      failures: [{ check: 'git', message: 'the working tree has uncommitted changes' }],
+      failures: [{ check: 'git', message: `the working tree has uncommitted changes${listed}` }],
     };
   }
 
@@ -93,6 +113,9 @@ export async function release(options) {
   git(dir, ['push', 'origin', tag]);
 
   const waited = await waitForVersion(name, version, {
+    // Wait for the publish *time* as well: `versions` can appear a moment before
+    // `time`, and an index entry with a null timestamp fails the market checker.
+    requireTime: true,
     registry,
     budgetMs,
     intervalMs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-toolkit",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Preflight, release and test DeepSeek Harness plugins: checks what the host needs, waits for npm to actually serve the version, and keeps the market index honest.",
   "type": "module",
   "bin": {