dsh-plugin-toolkit 0.8.5 → 0.8.6

package/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 0.8.6
+
+- `release --publish`: run `npm publish` locally instead of waiting for a
+  publish workflow. Plenty of small plugins have no release pipeline; before
+  this, `release` tagged, pushed and then waited for a registry that would never
+  receive the version.
+- The publish failure reports the last line of npm's stderr, so a 403 reads like
+  a 403.
+
 ## 0.8.5
 
 - `release --market <dir>`: write the index entry into a checkout of the

package/README.md

@@ -320,6 +320,15 @@ merged
 
 Without `--pr` it prints the `git add` / `gh pr create` commands instead of running them; `--dry-run` prints the whole sequence before anything happens. A re-run after a failure is safe: the same version with the same publish time is a no-op.
 
+### When nothing publishes for you
+
+`release` assumes a tag starts a workflow that publishes. Repositories without
+one use `--publish`, which runs `npm publish` in the same step:
+
+```sh
+$ dsh-plugin release . --publish
+```
+
 ### When the index lives in someone else's repository
 
 Most plugins are listed in a central market repository, not their own. Point

package/lib/cli.mjs

@@ -38,6 +38,7 @@ Flags
   --dry-run                 show the steps without touching anything
   --index <path>            index file, default market/index.json
   --market <dir>            with release: a checkout of the repository that holds the index
+  --publish                 with release: run npm publish here, for repos without a publish workflow
   --tag-prefix <prefix>     default plugin-v
   --budget <seconds>        how long to wait for npm, default 480
   --pr                      commit the index on a branch, push it, open the pull request
@@ -72,6 +73,7 @@ function flags(argv) {
     else if (token === '--timeout') parsed.timeout = Number(argv[++index]);
     else if (token === '--pr') parsed.pr = true;
     else if (token === '--merge') parsed.merge = true;
+    else if (token === '--publish') parsed.publish = true;
     else if (token === '--base') parsed.base = argv[++index];
     else if (token === '--market') parsed.market = argv[++index];
     else if (token.startsWith('--') === true) throw new Error(`unknown flag ${token}`);
@@ -213,6 +215,7 @@ export async function run(argv, io = console) {
       dir,
       indexFile: options.index,
       marketDir: options.market,
+      publish: options.publish === true,
       tagPrefix: options.tagPrefix,
       budgetMs: options.budget === undefined ? undefined : options.budget * 1000,
       pr: options.pr === true,

package/lib/release.mjs

@@ -5,7 +5,7 @@
  * registry, then touch the index — the index entry carries the publish time the
  * registry reported, so writing it earlier would mean guessing.
  */
-import { run } from './exec.mjs';
+import { run as runCommand } from './exec.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 
@@ -14,11 +14,15 @@ import { addVersion, buildEntry, readIndex, writeIndex } from './index-file.mjs'
 import { publishedAt, waitForVersion } from './registry.mjs';
 import { defaultGh, mergePr, openIndexPr, waitForChecks } from './pr.mjs';
 
+function publishPackage(dir) {
+  runCommand('npm', ['publish'], { cwd: dir, stdio: 'pipe' });
+}
+
 function git(dir, args) {
   // stderr is dropped on purpose: `rev-parse` on a tag that does not exist yet is
   // an expected miss, and git prints "fatal: ambiguous argument" for it, which
   // reads like a failure in the middle of a successful release.
-  return run('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+  return runCommand('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
 }
 
 export function tagName(version, prefix = 'plugin-v') {
@@ -122,6 +126,17 @@ export async function release(options) {
   gitRun(['tag', tag]);
   gitRun(['push', 'origin', tag]);
 
+  // Not every plugin publishes from CI. `--publish` runs the publish here, so
+  // the same command covers both kinds of repository.
+  if (options.publish === true) {
+    try {
+      (options.publishPackage ?? publishPackage)(dir);
+    } catch (error) {
+      const detail = String(error.stderr ?? error.message).trim().split('\n').slice(-1)[0];
+      return { ok: false, stage: 'publish', failures: [{ check: 'publish', message: `npm publish failed: ${detail}` }] };
+    }
+  }
+
   const waited = await waitForVersion(name, version, {
     // Wait for the publish *time* as well: `versions` can appear a moment before
     // `time`, and an index entry with a null timestamp fails the market checker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-toolkit",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "description": "Preflight, release and test DeepSeek Harness plugins: checks what the host needs, waits for npm to actually serve the version, and keeps the market index honest.",
   "type": "module",
   "bin": {