dsh-unlag 1.9.118 → 1.9.119
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -1
- package/package.json +1 -1
- package/scripts/live-smoke.mjs +5 -0
package/README.md
CHANGED
|
@@ -72,7 +72,8 @@ dsh plugin install dsh-unlag
|
|
|
72
72
|
## 排错
|
|
73
73
|
|
|
74
74
|
- 日志：`~/.dsh/unlag-reload.log`，换代码／跳过／被拦各一行，含原因。
|
|
75
|
-
- 演练：`npm run live-smoke` 不按按钮，只按当前启动清单把下一个文档要加载的字节在沙箱里跑一遍，看每个插件是否都注册（`rehearsal.ok
|
|
75
|
+
- 演练：`npm run live-smoke` 不按按钮，只按当前启动清单把下一个文档要加载的字节在沙箱里跑一遍，看每个插件是否都注册（`rehearsal.ok`），并当场核对三件事：写死的旧版本号仍然拿得到现在的字节（`shim.staleRev`），按下前会做的那个判断此刻是否放行（`pressPath`），以及那个判断本身会不会误拒（`verify.sound` 应为 `ok`、`verify.broken` 应为 `blocked`、`verify.refuses` 与 `verify.accepts` 为 `true`）——它证明的是「按下去之后新页面能起来、按钮现在真的可按、拦住的是坏清单」，不换任何代码。
|
|
76
|
+
- 同一支脚本还现场核对路由的守门规则（`contract`）：读路由只认读、写路由缺 `x-dsh-unlag` 头或来自别的源一律 403、未知路径 404。它用的是和页面一样的请求，所以这条规则在运行中的 App 上是否还在，一眼可见。
|
|
76
77
|
- 状态：`GET /dsh-unlag/state` → `{"version":"<当前版本>","code":"<index.js 写入时间>","plugins":true,"page":true,"shim":{...}}`。`code` 用来分清「版本号没刷」和「旧代码真的还在跑」。
|
|
77
78
|
- 重建后的日志带起页面代次：`interface rebuilt; the page runs the plugins as served now (page <rev>)`，据此判断新文档加载的是新脚本还是旧脚本。
|
|
78
79
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "dsh-unlag",
|
|
3
|
-
"version": "1.9.
|
|
3
|
+
"version": "1.9.119",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "A press applies plugin edits right away and brings a laggy interface back; automatic reloading stays off unless you turn it on, so the press is the only trigger, and nothing restarts.",
|
|
6
6
|
"license": "MIT",
|
package/scripts/live-smoke.mjs
CHANGED
|
@@ -87,6 +87,11 @@ contract.push(['state DELETE', await status('/dsh-unlag/state', { method: 'DELET
|
|
|
87
87
|
contract.push(['graph PUT', await status('/dsh-unlag/graph', { method: 'PUT' }), 405])
|
|
88
88
|
contract.push(['reload without header', await status('/dsh-unlag/reload', { method: 'POST' }), 403])
|
|
89
89
|
contract.push(['verify without header', await status('/dsh-unlag/verify', { method: 'POST' }), 403])
|
|
90
|
+
// The button header is one half of the gate; the other half is that a page on another origin can
|
|
91
|
+
// never send it, so the same request carrying a foreign origin must be refused too.
|
|
92
|
+
contract.push(['report without header', await status('/dsh-unlag/report', { method: 'POST' }), 403])
|
|
93
|
+
contract.push(['verify from another origin', await status('/dsh-unlag/verify', { method: 'POST', headers: { 'x-dsh-unlag': '1', origin: 'https://evil.example', 'content-type': 'application/json' }, body: '{"rows":[]}' }), 403])
|
|
94
|
+
contract.push(['report from another origin', await status('/dsh-unlag/report', { method: 'POST', headers: { origin: 'https://evil.example', 'content-type': 'application/json' }, body: '{"kind":"done"}' }), 403])
|
|
90
95
|
const contractHeld = contract.every(([, got, want]) => got === want)
|
|
91
96
|
|
|
92
97
|
// The shim's one promise, asked of the running app: a document that replays the startup list the
|