dsh-plugin-toolkit 0.9.1 → 0.9.2

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 0.9.2
+
+- `doctor` reports a shipped client bundle that no `dsh.client` declares. The host
+  serves `client.js` only for packages declaring `dsh.client`, so a plugin could
+  ship the bundle, mount it in `verify`, and still have no panel in the app — the
+  same silent failure as a tarball without it.
+- The toolkit's own manifest now declares `dsh.client` (`platform: web`,
+  `inject: ['@deepseek-ai/dsh-client-ui-sidebar-right']`), which is what makes the
+  Plugin doctor tab reachable at all.
+- The `not-shipped` fixture declares its client entry, so it keeps demonstrating
+  the `files` gap instead of tripping the new declaration check.
+
 ## 0.9.1
 
 - `audit` separates problems from advisories. Running 0.9.0 on a real profile

package/README.md

@@ -313,6 +313,12 @@ dsh-plugin verify: stopped at pack
 
 ## When the panel does not appear
 
+The first question is whether the host ever served your bundle. A package that
+ships `client.js` but declares no `dsh.client` loads its host half and shows no
+panel — `doctor` now fails that, because the host serves client bundles only for
+packages that declare one:
+
+
 The install reports success and nothing shows up. In this order:
 
 1. **Did the host restart?** Client bundles are read at startup. `dsh plugin add`

package/lib/doctor.mjs

@@ -110,6 +110,30 @@ export function checkClientEntry(dir, manifest) {
   return found ? null : `dsh.client is declared but none of ${entries.join(', ')} exists`;
 }
 
+/**
+ * A client bundle the harness will never serve is the same failure as a tarball
+ * without one: the plugin loads, the row mounts, and no panel appears. The host
+ * serves `client.js` only for packages declaring `dsh.client`, so shipping the
+ * file by convention is not enough.
+ */
+const CLIENT_FILES = ['client.js', 'lib/client.js', 'dist/client.js'];
+
+export function checkClientDeclaration(dir, manifest) {
+  const client = manifest.dsh?.client;
+  if (client !== undefined && client !== null) {
+    const platform = client.platform;
+    if (platform === undefined || platform === 'web') return null;
+    return `dsh.client.platform is ${JSON.stringify(platform)}, but the harness serves client bundles on web`;
+  }
+  const exported = manifest.exports;
+  const subpath = typeof exported === 'string' ? undefined : exportTarget(exported?.['./client']);
+  const shipped = [subpath, ...CLIENT_FILES].find(
+    (file) => typeof file === 'string' && fs.existsSync(path.join(dir, file.replace(/^\.\//u, ''))),
+  );
+  if (shipped === undefined) return null;
+  return `${shipped.replace(/^\.\//u, '')} ships but dsh.client is not declared, so the harness never serves the bundle and the panel cannot appear`;
+}
+
 /** Every path the manifest points at: exports, the bundle patch, the client entry. */
 export function declaredPaths(manifest) {
   const paths = new Set();
@@ -200,6 +224,7 @@ export function doctor(dir, { installed = false } = {}) {
     ['dsh field', checkDshField(manifest)],
     ['patch file', checkPatchFile(dir, manifest)],
     ['client entry', checkClientEntry(dir, manifest)],
+    ['client declaration', checkClientDeclaration(dir, manifest)],
     // After install the tarball is already unpacked, so `files` cannot be used to
     // decide what shipped: npm always ships package.json and the README.
     ['files list', installed === true ? null : checkFilesList(manifest)],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-toolkit",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Preflight, release and test DeepSeek Harness plugins: checks what the host needs, waits for npm to actually serve the version, and keeps the market index honest.",
   "type": "module",
   "bin": {
@@ -74,6 +74,13 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-sidebar-right"
+      ]
     }
   },
   "main": "index.js"