dsh-plugin-toolkit 0.9.5 → 0.9.7

package/CHANGELOG.md

@@ -1,3 +1,35 @@
+## 0.9.7
+
+- **The tab type is now reachable.** Registering a tab *type* is not enough: the
+  right sidebar's guide list is built from `tabs.guide()`, so a type with no
+  `guide` entry is registered, has a body slot, and is still impossible to open —
+  no tab appears anywhere. The type now contributes one guide entry
+  (`id: 'doctor'`, `order: 60`, localized title and description), which is what
+  puts "Plugin doctor" in the sidebar's guide.
+- The title and description come from the panel's own dictionary through a
+  module-level `translate()`, because the sidebar calls them from its guide list,
+  outside this component.
+- Regression test: mounting the bundle with a recording `sidebarRightTabs` now
+  asserts the registered definition carries a guide entry with a title and an
+  order.
+
+## 0.9.6
+
+- **The host half now survives a context it does not own.** `apply()` ended with
+  an unguarded `installRoutes(ctx)`, and cordis does not return `undefined` for
+  an undeclared service — it throws `cannot get property "webServer" without
+  inject`. So the whole `apply` failed, no route was registered, and the plugin
+  manager showed one red dot with no text: the exact symptom the 0.9.5 report
+  channel was built to explain, caused by the code next to it.
+- `verify` now calls the host face's `apply` with a context that throws on every
+  undeclared property, the way cordis does. A plain `{}` hid this: reading
+  `ctx.webServer` off it is just `undefined`. Message:
+  `apply() throws when a service it never declared is read, which fails the row: …`
+- The scaffold was never affected — its host half registers nothing.
+- Regression tests: `test/host.test.mjs` (activation, deferred web server,
+  method guard) and a `verify` case that builds a plugin whose `apply` reads
+  `ctx.webServer` unguarded.
+
 ## 0.9.5
 
 - The panel reports its own failures. When a row fails to activate the app shows

package/client.js

@@ -20,6 +20,7 @@ window.__ModuleLoader__.load({
         fail: 'This would not install cleanly.',
         noDir: 'Name the folder that holds the plugin\'s package.json.',
         failed: 'Could not run the checks',
+        guideDescription: 'Run the install checks on a plugin folder',
       },
       zh: {
         tabTitle: '插件体检',
@@ -32,9 +33,20 @@ window.__ModuleLoader__.load({
         fail: '这样装上去会出问题。',
         noDir: '请填写放着 package.json 的插件文件夹。',
         failed: '检查没能跑起来',
+        guideDescription: '对任意插件文件夹跑一遍安装前的检查',
       },
     };
 
+    /**
+     * The panel's copy, by the document language. Module scope because the tab
+     * type's `title`/`description` are called by the sidebar's guide list, not
+     * by this component, and they need the same strings.
+     */
+    const translate = (key) => {
+      const lang = typeof document === 'undefined' ? 'en' : (document.documentElement.lang === 'zh' ? 'zh' : 'en');
+      return COPY[lang][key] ?? key;
+    };
+
     const h = React.createElement;
 
     const CSS = [
@@ -89,10 +101,7 @@ window.__ModuleLoader__.load({
       const [result, setResult] = useState(null);
       const [busy, setBusy] = useState(false);
       const [failed, setFailed] = useState(null);
-      const tr = (key) => {
-        const language = COPY[document.documentElement.lang === 'zh' ? 'zh' : 'en'];
-        return language[key] ?? key;
-      };
+      const tr = translate;
 
       const check = useCallback(() => {
         if (dir.trim().length === 0) {
@@ -209,11 +218,20 @@ window.__ModuleLoader__.load({
               key: NS,
               locale: NS,
             }, Panel)));
+            // A tab *type* with no guide entry is registered but unreachable:
+            // the sidebar's guide list is built from `tabs.guide()`, so the
+            // type would never be offered and nothing would open it.
             tabCtx.effect(() => tabCtx.sidebarRightTabs.register({
               id: NS,
               kind: KIND,
               priority: 'extension',
-              title: () => 'Plugin doctor',
+              title: () => translate('tabTitle'),
+              guide: [{
+                id: 'doctor',
+                order: 60,
+                title: () => translate('tabTitle'),
+                description: () => translate('guideDescription'),
+              }],
             }));
             report('tab-registered', `kind=${KIND}`);
           } catch (error) {

package/index.js

@@ -143,11 +143,19 @@ export function apply(ctx) {
   let installed = false;
   const installRoutes = (serviceCtx) => {
     if (installed) return;
-    const server = serviceCtx !== null && serviceCtx !== undefined ? serviceCtx.webServer : undefined;
-    if (server === null || server === undefined || typeof server.register !== 'function') return;
-    server.register({ kind: 'exact', path: '/toolkit/check', handler: checkHandler });
-    server.register({ kind: 'exact', path: '/toolkit/report', handler: reportHandler });
-    installed = true;
+    // Reading `ctx.webServer` on a context that does not declare `inject` does
+    // not yield undefined: cordis throws "cannot get property ... without
+    // inject". An unguarded read here fails the whole apply, which is exactly
+    // the red dot with no message this panel exists to explain.
+    try {
+      const server = serviceCtx !== null && serviceCtx !== undefined ? serviceCtx.webServer : undefined;
+      if (server === null || server === undefined || typeof server.register !== 'function') return;
+      server.register({ kind: 'exact', path: '/toolkit/check', handler: checkHandler });
+      server.register({ kind: 'exact', path: '/toolkit/report', handler: reportHandler });
+      installed = true;
+    } catch {
+      // No web server on this context: the guard still runs, the panel does not.
+    }
   };
 
   const defer = (deps, callback) => {

package/lib/verify.mjs

@@ -35,6 +35,21 @@ function packTarball(dir, destination) {
   return path.join(destination, document.filename);
 }
 
+/**
+ * What cordis hands a plugin that declares no `inject`: every undeclared
+ * property read throws. A plain `{}` hides the bug this is looking for.
+ */
+function undeclaredContext() {
+  const base = { inject: undefined };
+  return new Proxy(base, {
+    get(target, key) {
+      if (key in target) return target[key];
+      if (typeof key === 'symbol') return undefined;
+      throw new Error(`cannot get property "${String(key)}" without inject`);
+    },
+  });
+}
+
 export async function verify({ dir, mount = true }) {
   const failures = [];
   const report = doctor(dir);
@@ -113,6 +128,7 @@ export async function verify({ dir, mount = true }) {
   // 0.8.0 shipped a package whose root export was the CLI, installed cleanly,
   // and mounted nothing.
   const rootFile = rootEntry(report.manifest);
+  let hostFace = null;
   if (rootFile !== null) {
     const absolute = path.join(installed, rootFile);
     if (fs.existsSync(absolute) === false) {
@@ -126,6 +142,7 @@ export async function verify({ dir, mount = true }) {
     try {
       const { pathToFileURL } = await import('node:url');
       const loaded = await import(pathToFileURL(absolute).href);
+      hostFace = loaded;
       if (typeof loaded.apply !== 'function') {
         return {
           ok: false,
@@ -144,6 +161,26 @@ export async function verify({ dir, mount = true }) {
     }
   }
 
+  // A host face that reads a service it never declared does not get undefined
+  // back: cordis throws "cannot get property ... without inject", the row fails,
+  // and the plugin manager shows one red dot. This cost a real user several
+  // restarts, so the activation itself is checked, not just the import.
+  if (hostFace !== null) {
+    try {
+      hostFace.apply(undeclaredContext());
+    } catch (error) {
+      return {
+        ok: false,
+        stage: 'install',
+        failures: [{
+          check: 'host apply',
+          message: `apply() throws when a service it never declared is read, which fails the row: ${error.message}`,
+        }],
+        files: packed.files,
+      };
+    }
+  }
+
   // `--no-mount` skips the DOM, not the install: the host half is the half
   // that silently fails, and importing it needs nothing but Node.
   if (mount === false) return { ok: true, stage: 'pack', failures: [], files: packed.files, size: packed.size };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-toolkit",
-  "version": "0.9.5",
+  "version": "0.9.7",
   "description": "Preflight, release and test DeepSeek Harness plugins: checks what the host needs, waits for npm to actually serve the version, and keeps the market index honest.",
   "type": "module",
   "bin": {