dsh-plugin-toolkit 0.8.5 → 0.8.7

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+## 0.8.7
+
+- `panel.aria(selector)` and `panel.expectAria(selector, expected)`: assert what a
+  screen reader reads, and get the attribute that differs named in the failure.
+  A missing attribute reports `nothing` rather than `""`.
+
+## 0.8.6
+
+- `release --publish`: run `npm publish` locally instead of waiting for a
+  publish workflow. Plenty of small plugins have no release pipeline; before
+  this, `release` tagged, pushed and then waited for a registry that would never
+  receive the version.
+- The publish failure reports the last line of npm's stderr, so a 403 reads like
+  a 403.
+
 ## 0.8.5
 
 - `release --market <dir>`: write the index entry into a checkout of the

package/README.md

@@ -135,10 +135,22 @@ First run writes nothing: it tells you to re-run with `UPDATE_SNAPSHOTS=1`, so a
 ### Check what assistive tech sees
 
 ```js
-assert.equal(panel.attributes('[role="tab"][aria-selected="true"]').id, 'tab-protection');
+panel.expectAria('[role="tab"][aria-selected="true"]', { label: 'Protection', selected: 'true' });
 assert.match(panel.must('[role="status"]').textContent, /Score moved 71 → 77/);
 ```
 
+`expectAria()` compares the attributes a screen reader actually reads — `role`,
+`label`, `live`, `selected`, `expanded`, `checked`, `pressed`, `disabled` — and
+names the one that differs:
+
+```
+[aria-live="polite"]: expected aria text to be "9", but it is "0"
+```
+
+A missing attribute is reported as `nothing`, not as an empty string, because
+those are different bugs. `panel.aria(selector)` returns the same object when you
+want to assert on it yourself.
+
 `must()` throws with the rendered markup when the selector misses, which is the difference between "the assertion failed" and "here is what the user actually got".
 
 Every example below is a file in this repository, run by CI, and the output shown is the output it prints:
@@ -320,6 +332,15 @@ merged
 
 Without `--pr` it prints the `git add` / `gh pr create` commands instead of running them; `--dry-run` prints the whole sequence before anything happens. A re-run after a failure is safe: the same version with the same publish time is a no-op.
 
+### When nothing publishes for you
+
+`release` assumes a tag starts a workflow that publishes. Repositories without
+one use `--publish`, which runs `npm publish` in the same step:
+
+```sh
+$ dsh-plugin release . --publish
+```
+
 ### When the index lives in someone else's repository
 
 Most plugins are listed in a central market repository, not their own. Point

package/lib/cli.mjs

@@ -38,6 +38,7 @@ Flags
   --dry-run                 show the steps without touching anything
   --index <path>            index file, default market/index.json
   --market <dir>            with release: a checkout of the repository that holds the index
+  --publish                 with release: run npm publish here, for repos without a publish workflow
   --tag-prefix <prefix>     default plugin-v
   --budget <seconds>        how long to wait for npm, default 480
   --pr                      commit the index on a branch, push it, open the pull request
@@ -72,6 +73,7 @@ function flags(argv) {
     else if (token === '--timeout') parsed.timeout = Number(argv[++index]);
     else if (token === '--pr') parsed.pr = true;
     else if (token === '--merge') parsed.merge = true;
+    else if (token === '--publish') parsed.publish = true;
     else if (token === '--base') parsed.base = argv[++index];
     else if (token === '--market') parsed.market = argv[++index];
     else if (token.startsWith('--') === true) throw new Error(`unknown flag ${token}`);
@@ -213,6 +215,7 @@ export async function run(argv, io = console) {
       dir,
       indexFile: options.index,
       marketDir: options.market,
+      publish: options.publish === true,
       tagPrefix: options.tagPrefix,
       budgetMs: options.budget === undefined ? undefined : options.budget * 1000,
       pr: options.pr === true,

package/lib/release.mjs

@@ -5,7 +5,7 @@
  * registry, then touch the index — the index entry carries the publish time the
  * registry reported, so writing it earlier would mean guessing.
  */
-import { run } from './exec.mjs';
+import { run as runCommand } from './exec.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 
@@ -14,11 +14,15 @@ import { addVersion, buildEntry, readIndex, writeIndex } from './index-file.mjs'
 import { publishedAt, waitForVersion } from './registry.mjs';
 import { defaultGh, mergePr, openIndexPr, waitForChecks } from './pr.mjs';
 
+function publishPackage(dir) {
+  runCommand('npm', ['publish'], { cwd: dir, stdio: 'pipe' });
+}
+
 function git(dir, args) {
   // stderr is dropped on purpose: `rev-parse` on a tag that does not exist yet is
   // an expected miss, and git prints "fatal: ambiguous argument" for it, which
   // reads like a failure in the middle of a successful release.
-  return run('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+  return runCommand('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
 }
 
 export function tagName(version, prefix = 'plugin-v') {
@@ -122,6 +126,17 @@ export async function release(options) {
   gitRun(['tag', tag]);
   gitRun(['push', 'origin', tag]);
 
+  // Not every plugin publishes from CI. `--publish` runs the publish here, so
+  // the same command covers both kinds of repository.
+  if (options.publish === true) {
+    try {
+      (options.publishPackage ?? publishPackage)(dir);
+    } catch (error) {
+      const detail = String(error.stderr ?? error.message).trim().split('\n').slice(-1)[0];
+      return { ok: false, stage: 'publish', failures: [{ check: 'publish', message: `npm publish failed: ${detail}` }] };
+    }
+  }
+
   const waited = await waitForVersion(name, version, {
     // Wait for the publish *time* as well: `versions` can appear a moment before
     // `time`, and an index entry with a null timestamp fails the market checker.

package/lib/testkit/mount.mjs

@@ -177,6 +177,35 @@ export async function mountClient(options) {
       const element = must(selector);
       return Object.fromEntries([...element.attributes].map((attribute) => [attribute.name, attribute.value]));
     },
+    // What a screen reader would report, in the same blunt vocabulary as the
+    // rest: the attributes, not a re-implementation of the accessibility tree.
+    aria: (selector) => {
+      const element = must(selector);
+      const read = (name) => element.getAttribute(name) ?? undefined;
+      return {
+        role: read('role'),
+        label: read('aria-label'),
+        labelledBy: read('aria-labelledby'),
+        describedBy: read('aria-describedby'),
+        live: read('aria-live'),
+        selected: read('aria-selected'),
+        expanded: read('aria-expanded'),
+        checked: read('aria-checked'),
+        pressed: read('aria-pressed'),
+        disabled: read('aria-disabled') ?? (element.disabled === true ? 'true' : undefined),
+        hidden: read('aria-hidden'),
+        text: element.textContent.replace(/\s+/g, ' ').trim(),
+      };
+    },
+    expectAria: (selector, expected) => {
+      const actual = helpers.aria(selector);
+      for (const [key, value] of Object.entries(expected)) {
+        if (actual[key] === value) continue;
+        const shown = actual[key] === undefined ? 'nothing' : `"${actual[key]}"`;
+        throw new Error(`${selector}: expected aria ${key} to be "${value}", but it is ${shown}`);
+      }
+      return actual;
+    },
     snapshot: (dir, name) => {
       const result = compare(dir, name, root.innerHTML);
       if (result.status === 'changed') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-toolkit",
-  "version": "0.8.5",
+  "version": "0.8.7",
   "description": "Preflight, release and test DeepSeek Harness plugins: checks what the host needs, waits for npm to actually serve the version, and keeps the market index honest.",
   "type": "module",
   "bin": {