dsh-plugin-toolkit 0.9.0 → 0.9.2

package/CHANGELOG.md

@@ -1,3 +1,25 @@
+## 0.9.2
+
+- `doctor` reports a shipped client bundle that no `dsh.client` declares. The host
+  serves `client.js` only for packages declaring `dsh.client`, so a plugin could
+  ship the bundle, mount it in `verify`, and still have no panel in the app — the
+  same silent failure as a tarball without it.
+- The toolkit's own manifest now declares `dsh.client` (`platform: web`,
+  `inject: ['@deepseek-ai/dsh-client-ui-sidebar-right']`), which is what makes the
+  Plugin doctor tab reachable at all.
+- The `not-shipped` fixture declares its client entry, so it keeps demonstrating
+  the `files` gap instead of tripping the new declaration check.
+
+## 0.9.1
+
+- `audit` separates problems from advisories. Running 0.9.0 on a real profile
+  said "17 of 19 installed plugin(s) have problems" — 13 of those load fine and
+  only lack `engines.dsh` or a README Requirements section, which the market index
+  needs and the loader does not. Those are now counted separately, so the plugins
+  that are actually broken stay visible.
+- `client entry` and `dev` resolve a `./client` export written as a conditions
+  object (`{ default: './lib/client.cjs' }`), not only as a string.
+
 ## 0.9.0
 
 - `audit`: every plugin installed in a profile, in one pass — version, whether the

package/README.md

@@ -212,6 +212,10 @@ demo-panel             0.3.0     not loaded   1 problem: root export
 1 installed plugin(s) are not in the running app; restart the app once after installing.
 ```
 
+Advisories (`engines.dsh`, README Requirements) are counted apart from problems:
+the market index needs them, the loader does not, so they should not bury a plugin
+that is actually broken.
+
 Without `--host` the loaded column is `?`, because guessing would be worse than
 saying nothing. Only packages that declare a `dsh` field are audited — the rest of
 `node_modules` is ordinary dependencies, and auditing those is noise.
@@ -309,6 +313,12 @@ dsh-plugin verify: stopped at pack
 
 ## When the panel does not appear
 
+The first question is whether the host ever served your bundle. A package that
+ships `client.js` but declares no `dsh.client` loads its host half and shows no
+panel — `doctor` now fails that, because the host serves client bundles only for
+packages that declare one:
+
+
 The install reports success and nothing shows up. In this order:
 
 1. **Did the host restart?** Client bundles are read at startup. `dsh plugin add`

package/lib/audit.mjs

@@ -48,9 +48,26 @@ export function listInstalled({ home = path.join(os.homedir(), '.dsh') } = {}) {
   return found;
 }
 
-function describe({ failures }) {
-  if (failures.length === 0) return 'ok';
-  return `${failures.length} problem${failures.length === 1 ? '' : 's'}: ${failures[0].check}`;
+/**
+ * `engines.dsh` and the README Requirements section are what the market index
+ * needs. The loader does not read either, so a plugin without them still loads —
+ * calling that "a problem" would bury the plugins that are actually broken.
+ */
+const ADVISORY = new Set(['engines.dsh', 'readme']);
+
+function split(failures) {
+  return {
+    hard: failures.filter((failure) => ADVISORY.has(failure.check) === false),
+    advisory: failures.filter((failure) => ADVISORY.has(failure.check) === true),
+  };
+}
+
+function describe({ hard, advisory }) {
+  if (hard.length === 0 && advisory.length === 0) return 'ok';
+  const parts = [];
+  if (hard.length > 0) parts.push(`${hard.length} problem${hard.length === 1 ? '' : 's'}: ${hard[0].check}`);
+  if (advisory.length > 0) parts.push(`${advisory.length} advisor${advisory.length === 1 ? 'y' : 'ies'}`);
+  return parts.join(', ');
 }
 
 export async function audit({ home, host, io = console, fetchImpl, timeoutMs = 3000 } = {}) {
@@ -74,7 +91,7 @@ export async function audit({ home, host, io = console, fetchImpl, timeoutMs = 3
       failures = [{ check: 'manifest', message: error.message }];
     }
     const loaded = graph?.ok === true ? graph.ids.has(manifest.name) : null;
-    return { name: manifest.name, version: manifest.version ?? '?', profile, dir, failures, loaded };
+    return { name: manifest.name, version: manifest.version ?? '?', profile, dir, failures, ...split(failures), loaded };
   });
 
   const width = Math.max(...rows.map((row) => row.name.length), 6);
@@ -84,12 +101,17 @@ export async function audit({ home, host, io = console, fetchImpl, timeoutMs = 3
     for (const failure of row.failures) io.log(`${' '.repeat(width + 22)}${failure.check}: ${failure.message}`);
   }
 
-  const failed = rows.filter((row) => row.failures.length > 0);
+  const failed = rows.filter((row) => row.hard.length > 0);
+  const advised = rows.filter((row) => row.hard.length === 0 && row.advisory.length > 0);
   const notLoaded = rows.filter((row) => row.loaded === false);
   if (notLoaded.length > 0) {
     io.log('');
     io.log(`${notLoaded.length} installed plugin(s) are not in the running app; restart the app once after installing.`);
   }
+  if (advised.length > 0) {
+    io.log('');
+    io.log(`${advised.length} plugin(s) load but are not ready for the market index (engines.dsh, README Requirements).`);
+  }
   if (failed.length > 0) {
     io.log('');
     io.log(`${failed.length} of ${rows.length} installed plugin(s) have problems.`);

package/lib/dev.mjs

@@ -12,12 +12,14 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 
+import { exportTarget } from './doctor.mjs';
+
 const IGNORED = new Set(['node_modules', '.git', 'docs', 'test', 'tests', 'coverage', 'fixtures']);
 
 export function resolveEntry(dir, manifest) {
   const declared = manifest?.dsh?.client?.entry;
   const exported = manifest?.exports;
-  const subpath = typeof exported === 'string' ? undefined : exported?.['./client'];
+  const subpath = typeof exported === 'string' ? undefined : exportTarget(exported?.['./client']);
   const candidates = [declared, subpath, 'client.js', 'lib/client.js', 'dist/client.js'].filter((value) => typeof value === 'string');
   for (const candidate of candidates) {
     const absolute = path.resolve(dir, candidate);

package/lib/doctor.mjs

@@ -84,6 +84,17 @@ export function checkPatchFile(dir, manifest) {
   return `dsh.bundle.patch points at ${bundle.patch}, which does not exist`;
 }
 
+/** `exports['./client']` is a string in some packages and a conditions object in others. */
+export function exportTarget(value) {
+  if (typeof value === 'string') return value;
+  if (value !== null && typeof value === 'object') {
+    for (const key of ['default', 'import', 'require']) {
+      if (typeof value[key] === 'string') return value[key];
+    }
+  }
+  return undefined;
+}
+
 export function checkClientEntry(dir, manifest) {
   const client = manifest.dsh?.client;
   if (client === undefined || client === null) return null;
@@ -91,7 +102,7 @@ export function checkClientEntry(dir, manifest) {
   // with a `dsh/` folder names its bundle), then the plain file names. A plugin
   // that ships `dsh/client.js` is not wrong for failing to also ship `client.js`.
   const exported = manifest.exports;
-  const subpath = typeof exported === 'string' ? undefined : exported?.['./client'];
+  const subpath = typeof exported === 'string' ? undefined : exportTarget(exported?.['./client']);
   const entries = [client.entry, subpath, 'client.js', 'lib/client.js', 'dist/client.js']
     .filter((entry) => typeof entry === 'string' && entry.length > 0)
     .map((entry) => entry.replace(/^\.\//u, ''));
@@ -99,6 +110,30 @@ export function checkClientEntry(dir, manifest) {
   return found ? null : `dsh.client is declared but none of ${entries.join(', ')} exists`;
 }
 
+/**
+ * A client bundle the harness will never serve is the same failure as a tarball
+ * without one: the plugin loads, the row mounts, and no panel appears. The host
+ * serves `client.js` only for packages declaring `dsh.client`, so shipping the
+ * file by convention is not enough.
+ */
+const CLIENT_FILES = ['client.js', 'lib/client.js', 'dist/client.js'];
+
+export function checkClientDeclaration(dir, manifest) {
+  const client = manifest.dsh?.client;
+  if (client !== undefined && client !== null) {
+    const platform = client.platform;
+    if (platform === undefined || platform === 'web') return null;
+    return `dsh.client.platform is ${JSON.stringify(platform)}, but the harness serves client bundles on web`;
+  }
+  const exported = manifest.exports;
+  const subpath = typeof exported === 'string' ? undefined : exportTarget(exported?.['./client']);
+  const shipped = [subpath, ...CLIENT_FILES].find(
+    (file) => typeof file === 'string' && fs.existsSync(path.join(dir, file.replace(/^\.\//u, ''))),
+  );
+  if (shipped === undefined) return null;
+  return `${shipped.replace(/^\.\//u, '')} ships but dsh.client is not declared, so the harness never serves the bundle and the panel cannot appear`;
+}
+
 /** Every path the manifest points at: exports, the bundle patch, the client entry. */
 export function declaredPaths(manifest) {
   const paths = new Set();
@@ -189,6 +224,7 @@ export function doctor(dir, { installed = false } = {}) {
     ['dsh field', checkDshField(manifest)],
     ['patch file', checkPatchFile(dir, manifest)],
     ['client entry', checkClientEntry(dir, manifest)],
+    ['client declaration', checkClientDeclaration(dir, manifest)],
     // After install the tarball is already unpacked, so `files` cannot be used to
     // decide what shipped: npm always ships package.json and the README.
     ['files list', installed === true ? null : checkFilesList(manifest)],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-toolkit",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Preflight, release and test DeepSeek Harness plugins: checks what the host needs, waits for npm to actually serve the version, and keeps the market index honest.",
   "type": "module",
   "bin": {
@@ -74,6 +74,13 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-sidebar-right"
+      ]
     }
   },
   "main": "index.js"