dsh-plugin-toolkit 0.8.1 → 0.8.3

package/CHANGELOG.md

@@ -1,3 +1,25 @@
+## 0.8.3
+
+`verify` now imports the host half it just installed.
+
+- After installing the tarball, `verify` imports the module the loader will
+  import (`exports["."]`, else `main`) and requires an `apply` function. A root
+  module that throws on import — which `doctor`'s static read cannot see — is
+  now a failure: `the installed index.js does not import: boom`.
+- `--no-mount` skips the DOM, not the install, so the host half is checked in
+  both modes. The success line says which half ran.
+
+## 0.8.2
+
+`doctor` now refuses the failure that shipped in 0.8.0.
+
+- New check `root export`: when a package declares `dsh.bundle`, its root module
+  has to be the plugin. A root that is also a `bin` target — a CLI wearing a
+  plugin's clothes — is reported, and so is a root module with no `apply`.
+  pnpm reports success either way; the row just mounts nothing.
+- `test/doctor.test.mjs` covers both shapes, and a bundle with no root module
+  (a subpath plugin) stays legal.
+
 ## 0.8.1
 
 `0.8.0` installed and then did nothing: the loader starts a plugin by importing

package/lib/cli.mjs

@@ -108,7 +108,8 @@ export async function run(argv, io = console) {
   if (command === 'verify') {
     const result = await verify({ dir, mount: options.noMount !== true });
     if (result.ok === true) {
-      io.log(`ok  packed ${result.files.length} file(s), installed the tarball, mounted the panel`);
+      const what = result.stage === 'mount' ? 'installed the tarball, mounted the panel' : 'installed the tarball and imported its host half';
+      io.log(`ok  packed ${result.files.length} file(s), ${what}`);
       if (typeof result.text === 'string') io.log(`    ${result.text}`);
       return 0;
     }

package/lib/doctor.mjs

@@ -138,6 +138,40 @@ export function checkFilesList(manifest) {
   return null;
 }
 
+/**
+ * The loader starts a plugin by importing the bare package name. A package that
+ * ships both a CLI and a panel is one `exports` edit away from having its root
+ * point at the CLI — the row then mounts nothing, and pnpm reports success.
+ */
+/** The module the loader imports when it starts the bare package name. */
+export function rootEntry(manifest) {
+  const root = typeof manifest.exports === 'object' && manifest.exports !== null ? manifest.exports['.'] : undefined;
+  const entry = typeof root === 'string' ? root : manifest.main;
+  if (typeof entry !== 'string') return null;
+  return entry.replace(/^\.\//, '');
+}
+
+export function checkRootExport(dir, manifest) {
+  if (manifest.dsh === undefined || manifest.dsh === null) return null;
+  const target = rootEntry(manifest);
+  // A bundle that inserts a subpath plugin needs no root module at all.
+  if (target === null) return null;
+  const entry = target;
+  const bins = Object.values(manifest.bin ?? {}).filter((value) => typeof value === 'string');
+  if (bins.some((bin) => bin.replace(/^\.\//, '') === target) === true) {
+    return `exports["."] points at the CLI (${entry}), so the loader's row has no plugin to apply; point it at the module that exports apply`;
+  }
+
+  const file = path.resolve(dir, target);
+  if (fs.existsSync(file) === false) return null;
+  const source = fs.readFileSync(file, 'utf8');
+  const exported = /export\s+(?:async\s+)?function\s+apply\b|export\s+(?:const|let|var)\s+apply\b|export\s*\{[^}]*\bapply\b|\bapply\s*[:=]\s*(?:async\s*)?(?:function|\()/.test(source);
+  if (exported === false) {
+    return `the root export ${entry} does not export apply, so the loader imports the package and mounts nothing`;
+  }
+  return null;
+}
+
 /** Runs every check and returns `{ failures, notes }`. */
 export function doctor(dir) {
   const { manifest } = readManifest(dir);
@@ -149,6 +183,7 @@ export function doctor(dir) {
     ['patch file', checkPatchFile(dir, manifest)],
     ['client entry', checkClientEntry(dir, manifest)],
     ['files list', checkFilesList(manifest)],
+    ['root export', checkRootExport(dir, manifest)],
   ];
   const failures = checks.filter(([, result]) => result !== null && typeof result === 'string');
   return {

package/lib/verify.mjs

@@ -12,6 +12,7 @@ import path from 'node:path';
 
 import { doctor, declaredPaths } from './doctor.mjs';
 import { resolveEntry } from './dev.mjs';
+import { rootEntry } from './doctor.mjs';
 import { run } from './exec.mjs';
 
 function packJson(dir) {
@@ -78,7 +79,6 @@ export async function verify({ dir, mount = true }) {
 
   if (failures.length > 0) return { ok: false, stage: 'pack', failures, files: packed.files };
 
-  if (mount === false) return { ok: true, stage: 'pack', failures: [], files: packed.files, size: packed.size };
 
   const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'dsh-plugin-verify-'));
   let installed;
@@ -108,6 +108,46 @@ export async function verify({ dir, mount = true }) {
     };
   }
 
+  // The loader starts the host half by importing the bare package name. Doing
+  // the same import here is the only way to know the row will have an apply —
+  // 0.8.0 shipped a package whose root export was the CLI, installed cleanly,
+  // and mounted nothing.
+  const rootFile = rootEntry(report.manifest);
+  if (rootFile !== null) {
+    const absolute = path.join(installed, rootFile);
+    if (fs.existsSync(absolute) === false) {
+      return {
+        ok: false,
+        stage: 'install',
+        failures: [{ check: 'root export', message: `the tarball does not ship ${rootFile}, which package.json points the loader at` }],
+        files: packed.files,
+      };
+    }
+    try {
+      const { pathToFileURL } = await import('node:url');
+      const loaded = await import(pathToFileURL(absolute).href);
+      if (typeof loaded.apply !== 'function') {
+        return {
+          ok: false,
+          stage: 'install',
+          failures: [{ check: 'root export', message: `the installed ${rootFile} exports no apply, so the loader's row mounts nothing` }],
+          files: packed.files,
+        };
+      }
+    } catch (error) {
+      return {
+        ok: false,
+        stage: 'install',
+        failures: [{ check: 'root export', message: `the installed ${rootFile} does not import: ${error.message}` }],
+        files: packed.files,
+      };
+    }
+  }
+
+  // `--no-mount` skips the DOM, not the install: the host half is the half
+  // that silently fails, and importing it needs nothing but Node.
+  if (mount === false) return { ok: true, stage: 'pack', failures: [], files: packed.files, size: packed.size };
+
   // Same convention the host uses: dsh.client.entry, then client.js.
   const entryFile = resolveEntry(installed, report.manifest);
   if (entryFile !== null) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-toolkit",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "Preflight, release and test DeepSeek Harness plugins: checks what the host needs, waits for npm to actually serve the version, and keeps the market index honest.",
   "type": "module",
   "bin": {