dsh-plugin-toolkit 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+## 0.7.1
+
+The action now checks the tarball, which is the only thing a user installs.
+
+- `uses: WJDdidi-1/dsh-plugin-toolkit@v1` defaults to `command: verify` instead
+  of `doctor`. `doctor` reads the working copy, so a `files` list that omits
+  `client.js` passes it and the plugin installs without a panel.
+- The action fetches the published package with `npx` rather than shipping
+  `node_modules` in the repository — `verify` mounts the panel, which needs
+  jsdom and React, and those belong to the caller's dev dependencies.
+- New `version` input (default `latest`) so a workflow can pin the tool.
+- `test/action.test.mjs` guards the three things that break silently: the
+  default command, the commands it offers existing in the CLI, and the README
+  showing the action the way a consumer writes it.
+
 # Changelog
 
 ## 0.7.0

package/README.md

@@ -215,9 +215,17 @@ The same checks run as a GitHub Action, so a tag cannot go out on a plugin that
 - uses: WJDdidi-1/dsh-plugin-toolkit@v1
   with:
     dir: plugin        # the folder holding the plugin's package.json
+    command: verify    # pack it, install the tarball, mount the panel
 ```
 
-`command: index` audits `market/index.json` instead, and fails on any version that cannot state a host range.
+`verify` is the default because it is the only check that reads what a user
+actually installs: `doctor` reads the working copy, so a `files` list that
+forgets `client.js` passes it and fails only after `npm i`.
+
+`command: doctor` stops at the manifest checks (fast, no install), and
+`command: index` audits `market/index.json` instead, failing on any version that
+cannot state a host range. Pin `version:` if you would rather not track the
+latest release.
 
 ## What `doctor` checks
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-toolkit",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Preflight, release and test DeepSeek Harness plugins: checks what the host needs, waits for npm to actually serve the version, and keeps the market index honest.",
   "type": "module",
   "bin": {