dsh-plugin-toolkit 0.7.0 → 0.7.2

package/CHANGELOG.md

@@ -1,3 +1,31 @@
+## 0.7.2
+
+`verify` runs from npx's cache, so it has to find jsdom and React where the
+plugin is, not where the tool is.
+
+- `testkit` resolves `jsdom`, `react` and `react-dom` from the plugin folder
+  first, then the working directory, then the tool's own dependencies.
+- `verify` passes the plugin folder through, so
+  `uses: WJDdidi-1/dsh-plugin-toolkit@v1` works in a workflow that ran `npm ci`
+  in the plugin: before this, the action failed with
+  `testkit needs a DOM: npm install --save-dev jsdom react react-dom` even
+  though the plugin declared them.
+
+## 0.7.1
+
+The action now checks the tarball, which is the only thing a user installs.
+
+- `uses: WJDdidi-1/dsh-plugin-toolkit@v1` defaults to `command: verify` instead
+  of `doctor`. `doctor` reads the working copy, so a `files` list that omits
+  `client.js` passes it and the plugin installs without a panel.
+- The action fetches the published package with `npx` rather than shipping
+  `node_modules` in the repository — `verify` mounts the panel, which needs
+  jsdom and React, and those belong to the caller's dev dependencies.
+- New `version` input (default `latest`) so a workflow can pin the tool.
+- `test/action.test.mjs` guards the three things that break silently: the
+  default command, the commands it offers existing in the CLI, and the README
+  showing the action the way a consumer writes it.
+
 # Changelog
 
 ## 0.7.0

package/README.md

@@ -215,9 +215,17 @@ The same checks run as a GitHub Action, so a tag cannot go out on a plugin that
 - uses: WJDdidi-1/dsh-plugin-toolkit@v1
   with:
     dir: plugin        # the folder holding the plugin's package.json
+    command: verify    # pack it, install the tarball, mount the panel
 ```
 
-`command: index` audits `market/index.json` instead, and fails on any version that cannot state a host range.
+`verify` is the default because it is the only check that reads what a user
+actually installs: `doctor` reads the working copy, so a `files` list that
+forgets `client.js` passes it and fails only after `npm i`.
+
+`command: doctor` stops at the manifest checks (fast, no install), and
+`command: index` audits `market/index.json` instead, failing on any version that
+cannot state a host range. Pin `version:` if you would rather not track the
+latest release.
 
 ## What `doctor` checks
 

package/lib/testkit/env.mjs

@@ -6,15 +6,34 @@
  * jsdom plus the real React gives us the same arrangement in Node, which is what
  * makes panel behaviour assertable in CI instead of by hand.
  */
-let JSDOM;
-let VirtualConsole;
-try {
-  ({ JSDOM, VirtualConsole } = await import('jsdom'));
-} catch {
-  throw new Error('testkit needs a DOM: npm install --save-dev jsdom react react-dom');
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/**
+ * Resolve a dependency the way the *plugin under test* would.
+ *
+ * `npx dsh-plugin-toolkit verify` installs the tool in npx's own cache, so a
+ * bare `import('jsdom')` looks there and not in the project that declared it.
+ * The plugin folder is the authority on what is installed.
+ */
+export function requireFrom(name, resolveFrom) {
+  const anchors = [resolveFrom, process.cwd(), path.dirname(fileURLToPath(import.meta.url))]
+    .filter((anchor) => typeof anchor === 'string' && anchor !== '');
+  for (const anchor of anchors) {
+    try {
+      return createRequire(path.join(anchor, 'noop.js'))(name);
+    } catch {
+      // Try the next place a dependency could legitimately live.
+    }
+  }
+  throw new Error(
+    `testkit needs ${name} where the plugin is installed: cd ${anchors[0]} && npm install --save-dev jsdom react react-dom`,
+  );
 }
 
-export function createDom({ html = '<!doctype html><html><body><div id="root"></div></body></html>' } = {}) {
+export function createDom({ html = '<!doctype html><html><body><div id="root"></div></body></html>', resolveFrom } = {}) {
+  const { JSDOM, VirtualConsole } = requireFrom('jsdom', resolveFrom);
   // jsdom's CSS parser predates nesting and `:has()`, so it complains about
   // stylesheets it cannot parse. That is a jsdom limit, not a panel bug.
   const virtualConsole = new VirtualConsole();

package/lib/testkit/mount.mjs

@@ -4,7 +4,7 @@
  * The helpers are deliberately blunt — click, type, press — because that is the
  * vocabulary a bug report uses. Anything cleverer hides which selector was hit.
  */
-import { createDom, installGlobals } from './env.mjs';
+import { createDom, installGlobals, requireFrom } from './env.mjs';
 import { createHost } from './host.mjs';
 import { loadBundle } from './load.mjs';
 import { compare, write } from './snapshot.mjs';
@@ -37,24 +37,29 @@ export async function mountClient(options) {
     container = 'root',
   } = options;
 
-  const { dom, window, document } = createDom();
+  // React is resolved from the plugin's folder too: when the tool runs from
+  // npx's cache, its own dependencies are not the ones the panel was written
+  // against.
+  const resolveFrom = options.resolveFrom ?? process.cwd();
+  const need = (name) => requireFrom(name, resolveFrom);
+
+  const { dom, window, document } = createDom({ resolveFrom });
   const restoreGlobals = installGlobals(window, document);
 
-  const need = async (name) => {
+  const React = need('react');
+  const reactDom = need('react-dom/client');
+  const jsxRuntime = need('react/jsx-runtime');
+  const jsxDevRuntime = (() => {
     try {
-      return await import(name);
+      return need('react/jsx-dev-runtime');
     } catch {
-      throw new Error(`testkit needs ${name}: npm install --save-dev jsdom react react-dom`);
+      return jsxRuntime;
     }
-  };
-  const React = await need('react');
-  const reactDom = await need('react-dom/client');
-  const jsxRuntime = await need('react/jsx-runtime');
-  const jsxDevRuntime = await import('react/jsx-dev-runtime').catch(() => jsxRuntime);
+  })();
 
   const modules = {
     react: React.default ?? React,
-    'react-dom': await import('react-dom'),
+    'react-dom': need('react-dom'),
     'react-dom/client': reactDom.default ?? reactDom,
     'react/jsx-runtime': jsxRuntime,
     'react/jsx-dev-runtime': jsxDevRuntime,

package/lib/verify.mjs

@@ -121,7 +121,9 @@ export async function verify({ dir, mount = true }) {
     }
     try {
       const { mountClient } = await import('./testkit/index.mjs');
-      const panel = await mountClient({ file: entryFile });
+      // Resolve jsdom/React from the plugin's own folder: `verify` may be
+      // running out of npx's cache, whose dependencies are not the panel's.
+      const panel = await mountClient({ file: entryFile, resolveFrom: dir });
       const text = panel.text();
       await panel.unmount();
       return { ok: true, stage: 'mount', failures: [], files: packed.files, size: packed.size, installed, text };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-toolkit",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Preflight, release and test DeepSeek Harness plugins: checks what the host needs, waits for npm to actually serve the version, and keeps the market index honest.",
   "type": "module",
   "bin": {