fix(repository-plugin): require published prepare dependency

apps/cli/tests/github-repository-plugin.built.e2e.ts

@@ -1,7 +1,9 @@
-import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { cpSync, existsSync, globSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { createServer } from 'node:http'
 import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { delimiter, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { startMockLlmServer } from '@deepseek-ai/dsh-llm-mock-server'
 import { execa } from 'execa'
@@ -9,12 +11,121 @@ import { describe, expect, it } from 'vitest'
 
 const repoRoot = fileURLToPath(new URL('../../../', import.meta.url))
 const dshBin = join(repoRoot, 'apps/cli/lib/bin.js')
+const repositoryPluginPackage = join(repoRoot, 'packages/cordis/repository-plugin')
+const releasePackageNames = new Set(globSync([
+  'vendor/*/package.json',
+  'packages/*/*/package.json',
+  'apps/*/package.json',
+], { cwd: repoRoot }).map((filename) => {
+  const manifest = JSON.parse(readFileSync(join(repoRoot, filename), 'utf8')) as Record<string, unknown>
+  if (typeof manifest.name !== 'string') throw new Error(`workspace package name is missing: ${filename}`)
+  return manifest.name
+}))
 const source = process.env.DSH_GITHUB_REPOSITORY_PLUGIN_SOURCE
 const required = process.env.DSH_REQUIRE_GITHUB_REPOSITORY_PLUGIN_E2E === '1'
 const enabled = required || source !== undefined
 
+interface PublishedPackageRegistry {
+  url: string
+  requests: string[]
+  close(): Promise<void>
+}
+
+function publishedManifest(): Record<string, unknown> {
+  const manifest = JSON.parse(readFileSync(join(repositoryPluginPackage, 'package.json'), 'utf8')) as Record<string, unknown>
+  const version = manifest.version
+  if (typeof version !== 'string') throw new Error('repository Plugin package version is missing')
+  Reflect.deleteProperty(manifest, 'private')
+  for (const field of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
+    const dependencies = manifest[field]
+    if (typeof dependencies !== 'object' || dependencies === null || Array.isArray(dependencies)) continue
+    const entries = dependencies as Record<string, unknown>
+    for (const name of Object.keys(entries)) {
+      if (releasePackageNames.has(name)) {
+        entries[name] = version
+      }
+    }
+  }
+  return manifest
+}
+
+async function startPublishedPackageRegistry(root: string): Promise<PublishedPackageRegistry> {
+  const staging = join(root, 'published-repository-plugin')
+  const artifacts = join(root, 'npm-registry-artifacts')
+  mkdirSync(staging)
+  mkdirSync(artifacts)
+  cpSync(join(repositoryPluginPackage, 'lib'), join(staging, 'lib'), { recursive: true })
+  for (const filename of ['README.md', 'README.zh.md', 'README.i18n.yaml']) {
+    cpSync(join(repositoryPluginPackage, filename), join(staging, filename))
+  }
+  cpSync(join(repoRoot, 'LICENSE'), join(staging, 'LICENSE'))
+  const manifest = publishedManifest()
+  writeFileSync(join(staging, 'package.json'), `${JSON.stringify(manifest, undefined, 2)}\n`)
+  const packed = await execa('pnpm', ['pack', '--pack-destination', artifacts], {
+    cwd: staging,
+    reject: false,
+  })
+  if (packed.exitCode !== 0) {
+    throw new Error(`failed to pack the simulated published prepare package:\n${packed.stderr}\n${packed.stdout}`)
+  }
+  const tarballs = readdirSync(artifacts).filter(filename => filename.endsWith('.tgz'))
+  if (tarballs.length !== 1) throw new Error(`expected one simulated published tarball, found ${tarballs.length}`)
+  const tarball = readFileSync(join(artifacts, tarballs[0]!))
+  const name = manifest.name as string
+  const version = manifest.version as string
+  const requests: string[] = []
+  let registryUrl = ''
+  const server = createServer((request, response) => {
+    const path = decodeURIComponent(new URL(request.url ?? '/', registryUrl).pathname)
+    requests.push(`${request.method ?? 'GET'} ${path}`)
+    if (path === `/${name}`) {
+      const metadata = {
+        name,
+        'dist-tags': { latest: version },
+        versions: {
+          [version]: {
+            ...manifest,
+            dist: {
+              tarball: `${registryUrl}${name}/-/${name.split('/').at(-1)}-${version}.tgz`,
+              shasum: createHash('sha1').update(tarball).digest('hex'),
+              integrity: `sha512-${createHash('sha512').update(tarball).digest('base64')}`,
+            },
+          },
+        },
+      }
+      response.writeHead(200, { 'content-type': 'application/json' })
+      response.end(JSON.stringify(metadata))
+      return
+    }
+    if (path === `/${name}/-/${name.split('/').at(-1)}-${version}.tgz`) {
+      response.writeHead(200, {
+        'content-type': 'application/octet-stream',
+        'content-length': String(tarball.length),
+      })
+      response.end(tarball)
+      return
+    }
+    response.writeHead(404, { 'content-type': 'application/json' })
+    response.end(JSON.stringify({ error: 'not found' }))
+  })
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', resolve)
+  })
+  const address = server.address()
+  if (address === null || typeof address === 'string') throw new Error('simulated npm registry did not expose a TCP address')
+  registryUrl = `http://127.0.0.1:${address.port}/`
+  return {
+    url: registryUrl,
+    requests,
+    close: () => new Promise<void>((resolve, reject) => {
+      server.close((error) => { if (error === undefined) resolve(); else reject(error) })
+    }),
+  }
+}
+
 describe.skipIf(!enabled)('dsh run GitHub repository Plugin installation', () => {
-  it('installs, builds, and runs skill, MCP, and TypeScript Plugin contributions from a private exact GitHub source', async () => {
+  it('installs the published prepare dependency, then builds and runs skill, MCP, and TypeScript Plugin contributions from a private exact GitHub source', async () => {
     expect(existsSync(dshBin), 'the repository Plugin acceptance must run the built dsh entry').toBe(true)
     expect(source, 'DSH_GITHUB_REPOSITORY_PLUGIN_SOURCE is required by this CI lane').toMatch(
       /^github:[^/\s#&]+\/[^/\s#&]+#[0-9a-f]{40}&path:\/.*\/\.dsh-plugin$/u,
@@ -29,6 +140,17 @@ describe.skipIf(!enabled)('dsh run GitHub repository Plugin installation', () =>
       successText: 'trusted GitHub repository package reached dsh run',
     })
     const home = mkdtempSync(join(tmpdir(), 'dsh-github-repository-plugin-'))
+    const registry = await startPublishedPackageRegistry(home)
+    const npmrc = join(home, 'npmrc')
+    writeFileSync(npmrc, `@deepseek-ai:registry=${registry.url}\n`)
+    const hostBin = join(home, 'host-bin')
+    mkdirSync(hostBin)
+    writeFileSync(join(hostBin, 'dsh-plugin-prepare'), [
+      '#!/bin/sh',
+      'echo "host PATH supplied dsh-plugin-prepare instead of the declared npm dependency" >&2',
+      'exit 91',
+      '',
+    ].join('\n'), { mode: 0o700 })
     const patch = join(home, 'github-repository-plugin.cordis.patch.yml')
     writeFileSync(patch, [
       '- id: repository-plugins',
@@ -59,6 +181,8 @@ describe.skipIf(!enabled)('dsh run GitHub repository Plugin installation', () =>
           DSH_TELEMETRY_DISABLED: '1',
           DEEPSEEK_API_KEY: apiKey,
           DEEPSEEK_BASE_URL: server.baseURL,
+          NPM_CONFIG_USERCONFIG: npmrc,
+          PATH: process.env.PATH === undefined ? hostBin : `${hostBin}${delimiter}${process.env.PATH}`,
         },
       })
       if (result.timedOut) {
@@ -68,6 +192,8 @@ describe.skipIf(!enabled)('dsh run GitHub repository Plugin installation', () =>
       expect(result.stdout).toBe('trusted GitHub repository package reached dsh run')
       expect(server.requests).toHaveLength(2)
       const runtimeDiagnostic = `${result.stderr}\nstdout:\n${result.stdout}`
+      expect(registry.requests, runtimeDiagnostic).toContain('GET /@deepseek-ai/dsh-repository-plugin')
+      expect(registry.requests, runtimeDiagnostic).toContain('GET /@deepseek-ai/dsh-repository-plugin/-/dsh-repository-plugin-0.0.1.tgz')
       const firstRequest = JSON.stringify(server.requests[0]!.body)
       const secondRequest = JSON.stringify(server.requests[1]!.body)
       expect(firstRequest, runtimeDiagnostic).toContain(
@@ -98,6 +224,7 @@ describe.skipIf(!enabled)('dsh run GitHub repository Plugin installation', () =>
           '@modelcontextprotocol/sdk': '1.29.0',
         },
         devDependencies: {
+          '@deepseek-ai/dsh-repository-plugin': '0.0.1',
           cordis: '4.0.0-rc.7',
           tsdown: '0.22.2',
           typescript: '6.0.3',
@@ -117,6 +244,7 @@ describe.skipIf(!enabled)('dsh run GitHub repository Plugin installation', () =>
       expect(wrapper).toContain('"entry":"./lib/plugin.mjs"')
     } finally {
       await server.close()
+      await registry.close()
       rmSync(home, { recursive: true, force: true })
     }
   }, 190_000)