hansjone/dsh-im-ops
1
0
Fork 0
mirror of https://github.com/hansjone/dsh-im-ops.git synced 2026-10-09 07:43:13 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

test: reject bundled DSH runtime packages

Browse source
This commit is contained in:
xmanrui 2026-08-20 01:59:00 +08:00
parent 926a98a608
commit df5923ff39
1 changed files with 34 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

34
scripts/verify-package.mjs
View file

@ -48,6 +48,40 @@ const [client, host, patch, manifestText, lockText, hostSource, clientSource, ex
const manifest = JSON.parse(manifestText);
const lock = JSON.parse(lockText);
// DSH runtime packages use module-local Symbol keys, so a second physical copy breaks Host lookup.
const forbiddenDshDependency = /^@deepseek-ai\/dsh-/;
const dependencySections = [
'dependencies',
'devDependencies',
'optionalDependencies',
'peerDependencies',
];
for (const section of dependencySections) {
for (const name of Object.keys(manifest[section] ?? {})) {
if (forbiddenDshDependency.test(name)) {
throw new Error(
`${name} must not be declared in ${section}; DSH runtime packages must come from the host`,
);
}
}
}
const bundledDependencies = manifest.bundleDependencies ?? manifest.bundledDependencies ?? [];
if (Array.isArray(bundledDependencies)) {
for (const name of bundledDependencies) {
if (forbiddenDshDependency.test(name)) {
throw new Error(`${name} must not be bundled; DSH runtime packages must come from the host`);
}
}
}
const forbiddenDshLockPaths = Object.keys(lock.packages ?? {}).filter((path) => (
/(?:^|\/)node_modules\/@deepseek-ai\/dsh-[^/]+(?:\/|$)/.test(path)
));
if (forbiddenDshLockPaths.length > 0) {
throw new Error(
`package lock must not install DSH runtime packages: ${forbiddenDshLockPaths.join(', ')}`,
);
}
if (!client.includes('id: "@xmanrui/dsh-im"')) {
throw new Error('client bundle does not register the dsh-im loader id');
}