dsh-standards 1.0.1 → 1.0.2

package/40-checker/scripts/runtime-child.mjs

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+// Runs L1-L3 in a disposable child process so a plugin cannot block or take over
+// the checker. Input: JSON on stdin. Output: JSON { checks } on stdout.
+import { runRuntimeChecks } from '../src/runtime.mjs'
+import { readSources } from '../src/util.mjs'
+
+const chunks = []
+for await (const chunk of process.stdin) chunks.push(chunk)
+const input = JSON.parse(Buffer.concat(chunks).toString('utf8'))
+let sources = []
+try { sources = readSources(input.dir) } catch { sources = [] }
+const checks = await runRuntimeChecks({ ...input, sources })
+process.stdout.write(JSON.stringify({ checks }))

package/40-checker/src/cli.mjs

@@ -4,7 +4,7 @@ import { fileURLToPath } from 'node:url'
 import { runManifestChecks, DEFAULT_RUNTIME_VERSION } from './manifest.mjs'
 import { checkCapabilities, checkCredentials, checkImportTimeAdvisory, checkLabels } from './declarations.mjs'
 import { runRuntimeChecks } from './runtime.mjs'
-import { spawnSync } from 'node:child_process'
+import { spawn, spawnSync } from 'node:child_process'
 import { readSources } from './util.mjs'
 import { buildReport, writeReport } from './report.mjs'
 
@@ -133,6 +133,51 @@ function parseArgs(argv) {
   return options
 }
 
+function runtimeNotRun(reason) {
+  const meta = {
+    'DSC-04': ['C-4', 'L1'], 'DSC-05': ['C-5', 'L1'], 'DSC-06': ['C-6', 'L1+L2'],
+    'DSC-07': ['C-7', 'L2'], 'DSC-08': ['C-8', 'L3'], 'DSC-09': ['C-9', 'L1'],
+  }
+  return Object.entries(meta).map(([id, [clause, layer]]) => ({
+    id, clause, layer, result: 'ERROR', coverage: 'not-run', reason,
+    details: [], evidence: [], method: 'M', advisory: false,
+  }))
+}
+
+/**
+ * L1-L3 run in a child process so that a plugin cannot block the event loop,
+ * read the checker's environment, or kill the process. The child is hard-killed
+ * after timeoutMs + 3s; a kill is reported as not-run, never as a pass.
+ */
+function isolatedRuntimeChecks(input) {
+  return new Promise((resolve) => {
+    const script = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'scripts', 'runtime-child.mjs')
+    const child = spawn(process.execPath, [script], { stdio: ['pipe', 'pipe', 'pipe'] })
+    let out = ''
+    let err = ''
+    const timer = setTimeout(() => { try { child.kill('SIGKILL') } catch {} }, input.timeoutMs + 3000)
+    child.stdout.on('data', (chunk) => { out += chunk })
+    child.stderr.on('data', (chunk) => { err += chunk })
+    child.on('error', (error) => {
+      clearTimeout(timer)
+      resolve(runtimeNotRun(`L1 child failed to start: ${error.message}`))
+    })
+    child.on('exit', (code, signal) => {
+      clearTimeout(timer)
+      if (signal === 'SIGKILL' || signal === 'SIGTERM') {
+        return resolve(runtimeNotRun(`L1 killed after ${input.timeoutMs}ms; plugin blocked the event loop`))
+      }
+      try {
+        const parsed = JSON.parse(out)
+        resolve(parsed.checks)
+      } catch {
+        resolve(runtimeNotRun(`L1 child produced no JSON (exit ${code}): ${String(err).slice(0, 200)}`))
+      }
+    })
+    child.stdin.end(JSON.stringify(input))
+  })
+}
+
 async function entryRunCheck(kind, runtimeChecks, options, dir) {
   const byId = new Map(runtimeChecks.map(item => [item.id, item]))
   const c4 = byId.get('DSC-04')
@@ -204,6 +249,10 @@ export async function main(argv = process.argv.slice(2)) {
     process.stderr.write(`dsh-plugin-verify: target must be a package directory (tarball support is not in the MVP): ${dir}\n`)
     return 3
   }
+  if (!fs.existsSync(path.join(dir, 'package.json'))) {
+    process.stderr.write(`dsh-plugin-verify: not a package directory (no package.json): ${dir}\n`)
+    return 3
+  }
 
   const { manifest, kind, kindInferred, entry, patch, g4, checks: manifestChecks } = runManifestChecks(dir, {
     runtimeVersion: options.runtimeVersion,
@@ -223,6 +272,7 @@ export async function main(argv = process.argv.slice(2)) {
     { id: 'DSC-12', clause: 'C-12', layer: 'L0', result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [], method: 'M', advisory: false },
     { id: 'DSC-13', clause: 'C-13', layer: 'L0', result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [], method: 'M', advisory: false },
   ]
+  const declarationAdjusted = declarationChecks.map(item => (item.result === 'WARN' && ['DSC-11', 'DSC-13'].includes(item.id) ? { ...item, advisory: true } : item))
   const advisoryChecks = [checkImportTimeAdvisory(sources)]
 
   if (options.scope === 'entry' && options.entryRuntime === 'server-entry' && kind !== 'plugin') options.treatAsPlugin = true
@@ -248,9 +298,9 @@ export async function main(argv = process.argv.slice(2)) {
       result: 'ERROR', coverage: 'not-run', reason, details: [], evidence: [], method: 'M', advisory: false,
     }))
   } else {
-    runtimeChecks = await runRuntimeChecks({
+    runtimeChecks = await isolatedRuntimeChecks({
       dir, manifest, kind: runtimeKind, entry: runtimeEntry,
-      runtimePath: options.runtime, timeoutMs: options.timeoutMs, sources,
+      runtimePath: options.runtime, timeoutMs: options.timeoutMs,
     })
   }
 
@@ -260,9 +310,18 @@ export async function main(argv = process.argv.slice(2)) {
     ...runtimeChecks,
     runCheck,
     advisoryChecks[0],
-    ...declarationChecks,
+    ...declarationAdjusted,
   ]
 
+  if (g4?.result === 'FAIL') {
+    const dsc01 = checks.find(item => item.id === 'DSC-01')
+    if (dsc01 && dsc01.result !== 'FAIL') {
+      dsc01.result = 'FAIL'
+      dsc01.reason = dsc01.reason ? `${dsc01.reason}; ${g4.reason ?? 'G4 failed'}` : (g4.reason ?? 'G4 failed')
+      dsc01.details = [...(dsc01.details ?? []), { item: 'G4', result: 'FAIL', reason: g4.reason ?? 'client shape failed' }]
+    }
+  }
+
   const subject = {
     mode: options.profile === 'listing' || options.profile === 'both' ? 'listing' : 'package',
     profile: options.profile,

package/40-checker/src/manifest.mjs

@@ -206,6 +206,8 @@ export function runManifestChecks(dir, options = {}) {
     manifestDetails.push(detail('C-1.2', 'WARN', `entry not present in checkout; source/build hint exists (${entry.sourceEntry ?? 'build script'})`, ['package.json#scripts']))
   } else if (kind === 'bundle' || kind === 'client') {
     manifestDetails.push(detail('C-1.2', 'WARN', `no runtime entry; ${kind} packages may be patch/client only`, ['package.json#exports']))
+  } else if (Array.isArray(manifest.workspaces) || (manifest.workspaces && typeof manifest.workspaces === 'object')) {
+    manifestDetails.push(detail('C-1.2', 'NA', 'workspace root; run the checker on a package subdirectory', ['package.json#workspaces']))
   } else {
     manifestDetails.push(detail('C-1.2', 'FAIL', 'no resolvable runtime entry', ['package.json#exports', 'package.json#main']))
   }
@@ -224,7 +226,7 @@ export function runManifestChecks(dir, options = {}) {
     manifestDetails.push(detail('C-1.5', 'PASS', `license=${manifest.license}`))
   }
   if (manifest.private === true) {
-    manifestDetails.push(detail('C-1.6', 'WARN', 'private:true; not publishable to a registry', ['package.json#private']))
+    manifestDetails.push(detail('C-1.6', 'NA', 'private:true; not publishable to a registry', ['package.json#private']))
   }
   const manifestResult = worst(manifestDetails.map(item => item.result))
   const manifestCheck = check({

package/40-checker/src/report.mjs

@@ -45,7 +45,10 @@ export function buildReport({ subject, anchor, checks, g4 = null, scope, profile
     ? adjustedChecks.map(item => runtimeIds.has(item.id) ? { ...item, result: 'NA', coverage: 'not-run', reason: 'out of scope for M1 static-only' } : item)
     : adjustedChecks
   const byId = new Map(effectiveChecks.map(item => [item.id, item]))
-  const selected = mandatory.map(id => byId.get(id)).filter(Boolean)
+  const selectedAll = mandatory.map(id => byId.get(id)).filter(Boolean)
+  // Advisory checks are reported but never move the verdict.
+  const selected = selectedAll.filter(item => item.advisory !== true)
+  const advisoryWarnings = selectedAll.filter(item => item.advisory === true && item.result === 'WARN')
   const missing = mandatory.filter(id => !byId.has(id))
   const failed = selected.filter(item => item.result === 'FAIL')
   const errored = selected.filter(item => item.result === 'ERROR')
@@ -80,6 +83,7 @@ export function buildReport({ subject, anchor, checks, g4 = null, scope, profile
   if (failed.length > 0) reasonParts.push(`FAIL: ${failed.map(item => item.id).join(', ')}`)
   if (notRunIds.length > 0) reasonParts.push(`not run: ${notRunIds.join(', ')}`)
   if (warnings.length > 0) reasonParts.push(`WARN: ${warnings.map(item => item.id).join(', ')}`)
+  if (advisoryWarnings.length > 0) reasonParts.push(`advisory: ${advisoryWarnings.map(item => item.id).join(', ')}`)
 
   return {
     schema: 'dsh-conformance/1',
@@ -92,6 +96,7 @@ export function buildReport({ subject, anchor, checks, g4 = null, scope, profile
       mandatory: mandatory.length,
       pass: pass.length,
       warn: warnings.length,
+      advisory: advisoryWarnings.length,
       fail: failed.length,
       na: selected.filter(item => item.result === 'NA').length,
       notRun: notRunIds.length,

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 1.0.2 — 2026-11-03
+
+- L1–L3 run in a child process and are hard-killed on timeout; a blocked event loop is reported as `not-run`, never a pass.
+- `dsh.capabilities` / `dsh.labels` warnings are advisory: still reported, no longer flip the verdict.
+- A `g4` client-shape failure now fails DSC-01 instead of being dropped.
+- `private: true` and workspace roots report NA instead of WARN/FAIL.
+- A directory without `package.json` returns exit 3 (usage), matching `dsh-levels`.
+
 ## 1.0.1 — 2026-11-03
 
 - 打包：`files` 收窄，不再把 `40-checker/results/` 打进 npm 包（此前包含第三方插件结果、截图与本机路径）。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-standards",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "DSH plugin standards and conformance checks: ENTRY/FLOW checks plus BOOST guidance. Non-official; no certification or ranking.",
   "type": "module",
   "main": "40-checker/src/index.mjs",