Turtle
9b4aacb41a
Move @deepseek-ai/dsh-official-bundles from packages/boot to packages/util and move the plugin manager's protected plugin list and the Web plugin page's hidden, ordered, and experimental bundle lists into it, so editing any of these lists no longer touches app-boot or either plugin manager package.
414 lines
21 KiB
TypeScript
414 lines
21 KiB
TypeScript
/**
|
|
* Keep experimental packages outside default installations, runtime imports, and shipped compositions.
|
|
* The one declared exception is a bundle the launcher names in `OPTIONAL_BUNDLES`: shipped for the person to
|
|
* switch on, selected by no shipped template, its own dependency graph outside the default product's.
|
|
*/
|
|
|
|
import { existsSync, globSync, readFileSync, statSync } from 'node:fs'
|
|
import { basename, dirname, extname, relative, resolve } from 'node:path'
|
|
import { fileURLToPath } from 'node:url'
|
|
import { JSDOM } from 'jsdom'
|
|
import ts from 'typescript'
|
|
import { applyEntryPatches, type PatchOptions } from '@deepseek-ai/cordis-plugin-include'
|
|
import type { EntryOptions } from '@deepseek-ai/cordis-plugin-loader'
|
|
import { loadOverlayPatches } from '../packages/boot/app-boot/src/index.ts'
|
|
import { bundlePatchPaths, composeEntries } from '../packages/boot/app-boot/src/profile.ts'
|
|
import type { DshBundleManifest } from '../packages/util/package-manifest/src/types.ts'
|
|
import { isAgentPresetEntry, isCordisGroupEntry, loadCordisYaml } from './cordis-yaml.ts'
|
|
import {
|
|
collectRuntimeLocalSourceSpecifiers,
|
|
collectRuntimeSourceSpecifiers,
|
|
} from './verify-client-packages.ts'
|
|
|
|
import { isExperimentalPackageName } from './experimental-package-policy.ts'
|
|
// The independently published entry package owns platform-engine dependencies.
|
|
const EXTERNAL_KIT_PACKAGES = new Set(['@deepseek-ai/libreoffice-kit'])
|
|
const PROFILE_SOURCE = 'packages/util/official-bundles/src/bundles.ts'
|
|
const PRESET_PATTERN = 'packages/bundle/web-app/presets/*.patch.yml'
|
|
const RUNTIME_SECTIONS = ['dependencies', 'optionalDependencies', 'peerDependencies'] as const
|
|
|
|
interface Manifest {
|
|
name: string
|
|
icon?: unknown
|
|
exports?: Record<string, unknown>
|
|
dependencies?: Record<string, string>
|
|
optionalDependencies?: Record<string, string>
|
|
peerDependencies?: Record<string, string>
|
|
devDependencies?: Record<string, string>
|
|
dsh?: { bundle?: DshBundleManifest; configTrees?: Array<{ path: string }> }
|
|
}
|
|
|
|
interface Package {
|
|
directory: string
|
|
manifest: Manifest
|
|
}
|
|
|
|
/** Counts and violations from the default product's source and configuration inputs. */
|
|
export interface ProductIsolationResult {
|
|
failures: string[]
|
|
packageCount: number
|
|
sourceCount: number
|
|
configCount: number
|
|
webPluginCount: number
|
|
}
|
|
|
|
/**
|
|
* Check default app installations and their authored runtime/configuration inputs.
|
|
* Experimental opt-in packages and separate Web preview entries are outside these roots.
|
|
* @param root - repository root; no build outputs or installed workspace links are read.
|
|
* @returns violations and the sizes of the checked package, source, and configuration sets.
|
|
*/
|
|
export function verifyDefaultProductIsolation(root: string): ProductIsolationResult {
|
|
const failures: string[] = []
|
|
const packages = new Map<string, Package>()
|
|
const directories = new Map<string, Package>()
|
|
const display = (path: string): string => relative(root, path).replaceAll('\\', '/')
|
|
for (const path of globSync([
|
|
'apps/*/package.json', 'packages/*/*/package.json', 'vendor/*/package.json',
|
|
'native/system/packages/*/package.json', 'python/sdk-runtime/package.json',
|
|
], { cwd: root }).sort()) {
|
|
const manifest = JSON.parse(readFileSync(resolve(root, path), 'utf8')) as Manifest
|
|
if (typeof manifest.name !== 'string' || manifest.name === '') throw new Error(`${path}: missing package name`)
|
|
if (packages.has(manifest.name)) throw new Error(`${path}: duplicate package name ${manifest.name}`)
|
|
const pkg = { directory: dirname(resolve(root, path)), manifest }
|
|
packages.set(manifest.name, pkg)
|
|
directories.set(pkg.directory, pkg)
|
|
}
|
|
for (const path of ['apps/cli/package.json', 'apps/web/package.json', 'python/sdk-runtime/package.json']) {
|
|
if (!existsSync(resolve(root, path))) failures.push(`missing default product root ${path}`)
|
|
}
|
|
const cli = directories.get(resolve(root, 'apps/cli'))
|
|
if (cli?.manifest.name !== '@deepseek-ai/dsh') {
|
|
failures.push('apps/cli/package.json must identify @deepseek-ai/dsh')
|
|
}
|
|
// The bundles the launcher ships switched off: each a runtime dependency of the installation that is a bundle
|
|
// with an icon and locale display metadata for the plugin manager's Official group, none a default.
|
|
const profilePath = resolve(root, PROFILE_SOURCE)
|
|
const selection = existsSync(profilePath) ? profilePackages(readFileSync(profilePath, 'utf8')) : undefined
|
|
const optionalBundles = new Set(selection?.optionalBundles ?? [])
|
|
for (const name of optionalBundles) {
|
|
if (cli?.manifest.dependencies?.[name] === undefined) {
|
|
failures.push(`${PROFILE_SOURCE}: optional bundle ${name} must be a runtime dependency of apps/cli`)
|
|
}
|
|
const manifest = packages.get(name)?.manifest
|
|
if (manifest?.dsh?.bundle?.patch === undefined) {
|
|
failures.push(`${PROFILE_SOURCE}: optional bundle ${name} must declare dsh.bundle.patch`)
|
|
}
|
|
if (typeof manifest?.icon !== 'string' && manifest?.exports?.['./icon'] == null) {
|
|
failures.push(`${PROFILE_SOURCE}: optional bundle ${name} must declare icon or export ./icon`)
|
|
}
|
|
if (manifest?.exports?.['./locale/*.json'] === undefined) {
|
|
failures.push(`${PROFILE_SOURCE}: optional bundle ${name} must export ./locale/*.json display metadata`)
|
|
}
|
|
}
|
|
|
|
const queue: Package[] = []
|
|
const visited = new Set<string>()
|
|
const sources = new Set<string>()
|
|
const configs = new Set<string>()
|
|
let webPluginCount = 0
|
|
const isExperimental = (pkg: Package): boolean => isExperimentalPackageName(pkg.manifest.name)
|
|
|| display(pkg.directory).startsWith('packages/experimental/')
|
|
const add = (pkg: Package, origin: string): void => {
|
|
if (isExperimental(pkg)) {
|
|
failures.push(`${origin} -> ${pkg.manifest.name}: default product must not include experimental packages`)
|
|
} else if (!visited.has(pkg.directory)) {
|
|
visited.add(pkg.directory)
|
|
queue.push(pkg)
|
|
}
|
|
}
|
|
const ownerOf = (path: string): Package | undefined => {
|
|
let directory = dirname(path)
|
|
for (;;) {
|
|
const pkg = directories.get(directory)
|
|
if (pkg !== undefined) return pkg
|
|
const parent = dirname(directory)
|
|
if (parent === directory) return undefined
|
|
directory = parent
|
|
}
|
|
}
|
|
const reference = (name: string, origin: string, owner?: Package): void => {
|
|
if (name.startsWith('.') || name.startsWith('/') || /^(?:file|link):/.test(name)) {
|
|
const target = name.startsWith('file://') ? fileURLToPath(name)
|
|
: resolve(owner?.directory ?? root, name.replace(/^(?:file|link):/, ''))
|
|
const pkg = directories.get(target) ?? ownerOf(target)
|
|
if (pkg !== undefined) add(pkg, origin)
|
|
return
|
|
}
|
|
const packageName = barePackageName(name)
|
|
if (isExperimentalPackageName(packageName)) {
|
|
failures.push(`${origin} -> ${name}: default product must not include experimental packages`)
|
|
return
|
|
}
|
|
const pkg = packages.get(packageName)
|
|
if (pkg !== undefined) add(pkg, origin)
|
|
else if (EXTERNAL_KIT_PACKAGES.has(packageName)) return
|
|
else if (packageName.startsWith('@deepseek-ai/')) failures.push(`${origin}: unknown workspace package ${name}`)
|
|
}
|
|
const dependency = (name: string, range: string, owner: Package, origin: string): void => {
|
|
reference(name, origin, owner)
|
|
if (/^(?:file:|link:|workspace:\.)/.test(range)) {
|
|
reference(range.replace(/^workspace:/, ''), origin, owner)
|
|
} else if (/^(?:npm:|workspace:)(?:@|[a-zA-Z])/.test(range)) {
|
|
reference(range.replace(/^(?:npm:|workspace:)/, ''), origin, owner)
|
|
}
|
|
}
|
|
const sourceReference = (specifier: string, path: string): void => {
|
|
const owner = ownerOf(path)
|
|
if (owner === undefined) return
|
|
reference(specifier, display(path), owner)
|
|
const name = barePackageName(specifier)
|
|
const range = [...RUNTIME_SECTIONS, 'devDependencies' as const]
|
|
.map(section => owner.manifest[section]?.[name]).find(value => value !== undefined)
|
|
if (range !== undefined) dependency(name, range, owner, display(path))
|
|
}
|
|
const scanSource = (path: string, followLocal = false, inlineSource?: string): void => {
|
|
if (sources.has(path)) return
|
|
sources.add(path)
|
|
const source = inlineSource ?? readFileSync(path, 'utf8')
|
|
for (const specifier of collectRuntimeSourceSpecifiers(path, source)) sourceReference(specifier, path)
|
|
for (const specifier of runtimeLocalSpecifiers(path, source)) {
|
|
const local = followLocal && specifier.startsWith('/')
|
|
? resolve(root, 'apps/web', `.${specifier.replace(/[?#].*$/, '')}`)
|
|
: resolve(dirname(path), specifier.replace(/[?#].*$/, ''))
|
|
const target = resolveSource(local)
|
|
const resolved = target ?? local
|
|
const owner = directories.get(resolved) ?? ownerOf(resolved)
|
|
if (owner !== undefined && isExperimental(owner)) add(owner, display(path))
|
|
if (/cordis[^/]*\.ya?ml$/.test(basename(resolved))) scanConfig(resolved)
|
|
if (followLocal && target !== undefined) scanSource(target, true)
|
|
}
|
|
}
|
|
const scanEntries = (
|
|
document: unknown[], path: string, composedWeb = false, includeStack: ReadonlySet<string> = new Set(),
|
|
): void => {
|
|
const visit = (entry: unknown): void => {
|
|
if (!isRecord(entry)) return
|
|
if (typeof entry.name === 'string') {
|
|
if (composedWeb) webPluginCount += 1
|
|
const owner = ownerOf(path)
|
|
if (entry.name.startsWith('.')) {
|
|
const target = resolve(dirname(path), entry.name)
|
|
const targetOwner = ownerOf(target)
|
|
if (targetOwner !== undefined) add(targetOwner, display(path))
|
|
} else reference(entry.name, display(path), owner)
|
|
}
|
|
if (isCordisGroupEntry(entry) || entry.name === 'cordis:group' && Array.isArray(entry.config)) {
|
|
(entry.config as unknown[]).forEach(visit)
|
|
}
|
|
if (isAgentPresetEntry(entry)) entry.config.plugins.forEach(visit)
|
|
if (Array.isArray(entry.insert)) entry.insert.forEach(visit)
|
|
if ((entry.name === '@deepseek-ai/cordis-plugin-include' || entry.name === 'cordis:include') && isRecord(entry.config)) {
|
|
if (!composedWeb && Array.isArray(entry.config.patches)) entry.config.patches.forEach(visit)
|
|
const included = entry.config.path
|
|
if (typeof included !== 'string') return
|
|
const filename = included.startsWith('file:') ? fileURLToPath(included) : resolve(dirname(path), included)
|
|
if (includeStack.has(filename)) {
|
|
failures.push(`${display(path)}: cyclic Include path ${display(filename)}`)
|
|
return
|
|
}
|
|
const nestedStack = new Set([...includeStack, filename])
|
|
const initial = Array.isArray(entry.config.initial) ? entry.config.initial : undefined
|
|
if (initial !== undefined) scanEntries(initial, filename, false, nestedStack)
|
|
if (!composedWeb) {
|
|
if (existsSync(filename) || initial === undefined) scanConfig(filename)
|
|
return
|
|
}
|
|
const content = existsSync(filename) ? loadCordisYaml(readFileSync(filename, 'utf8')) : initial
|
|
if (!Array.isArray(content)) {
|
|
failures.push(`${display(filename)}: included composition must contain an entry array`)
|
|
return
|
|
}
|
|
const entries = applyEntryPatches(content as EntryOptions[], entry.config.patches as PatchOptions[] | undefined, () => {})
|
|
scanEntries(entries, filename, true, nestedStack)
|
|
}
|
|
}
|
|
document.forEach(visit)
|
|
}
|
|
const scanConfig = (path: string): void => {
|
|
if (configs.has(path)) return
|
|
configs.add(path)
|
|
const document = loadCordisYaml(readFileSync(path, 'utf8'))
|
|
if (!Array.isArray(document)) {
|
|
failures.push(`${display(path)}: shipped composition must contain an entry array`)
|
|
return
|
|
}
|
|
scanEntries(document, path)
|
|
}
|
|
|
|
for (const pkg of packages.values()) {
|
|
const path = display(pkg.directory)
|
|
if (path.startsWith('apps/') || path === 'python/sdk-runtime') add(pkg, path)
|
|
}
|
|
if (selection !== undefined) {
|
|
for (const name of selection.packages) {
|
|
reference(name, PROFILE_SOURCE)
|
|
if (packages.get(name)?.manifest.dsh?.bundle?.patch === undefined) {
|
|
failures.push(`${PROFILE_SOURCE}: default bundle ${name} must declare dsh.bundle.patch`)
|
|
}
|
|
if (optionalBundles.has(name)) failures.push(`${PROFILE_SOURCE}: optional bundle ${name} must not be a default bundle`)
|
|
}
|
|
const webLayers = selection.webBundles.flatMap((name) => {
|
|
const pkg = packages.get(name)
|
|
const bundle = pkg?.manifest.dsh?.bundle
|
|
if (pkg === undefined || bundle === undefined) return []
|
|
return [bundlePatchPaths(pkg.directory, bundle).flatMap(file => loadOverlayPatches('verify-default-product-isolation', file))]
|
|
})
|
|
if (webLayers.length !== selection.webBundles.length) {
|
|
failures.push(`${PROFILE_SOURCE}: default Web bundle layers are incomplete`)
|
|
} else {
|
|
const entries = composeEntries(webLayers)
|
|
scanEntries(entries, profilePath, true)
|
|
if (webPluginCount === 0) failures.push(`${PROFILE_SOURCE}: composed Web profile contains no plugins`)
|
|
}
|
|
} else failures.push(`missing default profile source ${PROFILE_SOURCE}`)
|
|
const presets = globSync(PRESET_PATTERN, { cwd: root }).sort()
|
|
if (presets.length === 0) failures.push(`no shipped presets matched ${PRESET_PATTERN}`)
|
|
for (const path of presets) scanConfig(resolve(root, path))
|
|
|
|
const html = resolve(root, 'apps/web/index.html')
|
|
if (existsSync(html)) {
|
|
const dom = new JSDOM(readFileSync(html, 'utf8'))
|
|
try {
|
|
const entries = [...dom.window.document.querySelectorAll('script[type="module"]')]
|
|
if (entries.length === 0) failures.push('apps/web/index.html: missing default module entry')
|
|
for (const [index, entry] of entries.entries()) {
|
|
const src = entry.getAttribute('src')
|
|
if (src === null) {
|
|
scanSource(`${html}.inline-${String(index)}.js`, true, entry.textContent)
|
|
continue
|
|
}
|
|
if (/^(?:https?:)?\/\//.test(src)) {
|
|
failures.push(`apps/web/index.html: external default module entry cannot be checked: ${src}`)
|
|
continue
|
|
}
|
|
scanSource(resolve(root, 'apps/web', src.replace(/^\//, '')), true)
|
|
}
|
|
} finally {
|
|
dom.window.close()
|
|
}
|
|
} else failures.push('missing default Web entry apps/web/index.html')
|
|
|
|
for (const pkg of queue) {
|
|
const { manifest } = pkg
|
|
for (const section of RUNTIME_SECTIONS) {
|
|
for (const [name, range] of Object.entries(manifest[section] ?? {})) {
|
|
const target = packages.get(name)
|
|
if (pkg === cli && section === 'dependencies' && optionalBundles.has(name) && target !== undefined && isExperimental(target)) continue
|
|
dependency(name, range, pkg, `${manifest.name} ${section}`)
|
|
}
|
|
}
|
|
for (const file of manifest.dsh?.bundle === undefined ? [] : bundlePatchPaths(pkg.directory, manifest.dsh.bundle)) scanConfig(file)
|
|
for (const tree of manifest.dsh?.configTrees ?? []) {
|
|
const treePath = resolve(pkg.directory, tree.path)
|
|
const files = existsSync(treePath) && statSync(treePath).isDirectory()
|
|
? globSync('**/*.{yml,yaml}', { cwd: treePath, exclude: ['**/*.i18n.yaml', '**/preset.yml'] }) : []
|
|
if (files.length === 0) failures.push(`${display(treePath)}: declared config tree has no composition files`)
|
|
for (const path of files) scanConfig(resolve(treePath, path))
|
|
}
|
|
if (display(pkg.directory) === 'apps/web') continue
|
|
const files = globSync('src/**/*.{ts,tsx,mts,cts,js,mjs,cjs}', { cwd: pkg.directory,
|
|
exclude: ['**/*.spec.*', '**/*.test.*', '**/*.d.ts', '**/tests/**', '**/__tests__/**', '**/node_modules/**'] })
|
|
if (display(pkg.directory) === 'apps/cli' && files.length === 0) failures.push('apps/cli: no default runtime sources')
|
|
for (const path of files) {
|
|
const sourcePath = resolve(pkg.directory, path)
|
|
if (statSync(sourcePath).isFile()) scanSource(sourcePath)
|
|
}
|
|
}
|
|
return { failures: [...new Set(failures)], packageCount: visited.size,
|
|
sourceCount: sources.size, configCount: configs.size, webPluginCount }
|
|
}
|
|
|
|
function barePackageName(specifier: string): string {
|
|
return /^(?:@[^/]+\/)?[^/@]+/.exec(specifier)?.[0] ?? specifier
|
|
}
|
|
|
|
function resolveSource(path: string): string | undefined {
|
|
const extension = extname(path)
|
|
if (extension !== '' && !/^\.[cm]?[jt]sx?$/.test(extension)
|
|
&& !(existsSync(path) && statSync(path).isDirectory())) return undefined
|
|
const extensions = ['.mjs', '.js', '.mts', '.ts', '.jsx', '.tsx']
|
|
const typed = extension === '.js' ? [path.replace(/\.js$/, '.ts'), path.replace(/\.js$/, '.tsx')]
|
|
: extension === '.mjs' ? [path.replace(/\.mjs$/, '.mts')]
|
|
: extension === '.cjs' ? [path.replace(/\.cjs$/, '.cts')] : []
|
|
return [path, ...typed, ...extension === '' ? extensions.map(suffix => `${path}${suffix}`) : [],
|
|
...extensions.map(suffix => resolve(path, `index${suffix}`))]
|
|
.find(candidate => existsSync(candidate) && statSync(candidate).isFile())
|
|
}
|
|
|
|
function runtimeLocalSpecifiers(path: string, source: string): Set<string> {
|
|
const specifiers = collectRuntimeLocalSourceSpecifiers(path, source, true)
|
|
const file = ts.createSourceFile(path, source, ts.ScriptTarget.Latest, true)
|
|
const visit = (node: ts.Node): void => {
|
|
if (ts.isNewExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === 'URL') {
|
|
const first = node.arguments?.[0]
|
|
if (first !== undefined && ts.isStringLiteralLike(first)
|
|
&& (first.text.startsWith('.') || first.text.startsWith('/'))) specifiers.add(first.text)
|
|
}
|
|
ts.forEachChild(node, visit)
|
|
}
|
|
visit(file)
|
|
return specifiers
|
|
}
|
|
|
|
function isRecord(value: unknown): value is Record<string, unknown> {
|
|
return typeof value === 'object' && value !== null && !Array.isArray(value)
|
|
}
|
|
|
|
/** Read the literal package lists that define installation-owned profile defaults and the optional bundles it ships. */
|
|
function profilePackages(source: string): { packages: string[]; webBundles: string[]; optionalBundles: string[] } {
|
|
const file = ts.createSourceFile(PROFILE_SOURCE, source, ts.ScriptTarget.Latest, true)
|
|
const required = new Set(['PROFILE_TEMPLATES', 'DEFAULT_PROFILE_BUNDLES'])
|
|
const found = new Set<string>()
|
|
const packages: string[] = []
|
|
const webBundles: string[] = []
|
|
const optionalBundles: string[] = []
|
|
const literals = (node: ts.Node, path: string[]): void => {
|
|
if (ts.isStringLiteralLike(node)) {
|
|
if (path[0] === 'OPTIONAL_BUNDLES') optionalBundles.push(node.text)
|
|
else if (node.text.startsWith('@')) packages.push(node.text)
|
|
if (path.join('.') === 'PROFILE_TEMPLATES.web.bundles') webBundles.push(node.text)
|
|
} else if (ts.isArrayLiteralExpression(node)) node.elements.forEach((child) => { literals(child, path) })
|
|
else if (ts.isObjectLiteralExpression(node)) node.properties.forEach((child) => { literals(child, path) })
|
|
else if (ts.isPropertyAssignment(node)) {
|
|
if (!ts.isIdentifier(node.name) && !ts.isStringLiteralLike(node.name)) {
|
|
throw new Error(`${PROFILE_SOURCE}: default profile keys must be literal names`)
|
|
}
|
|
literals(node.initializer, [...path, node.name.text])
|
|
}
|
|
else if (ts.isAsExpression(node) || ts.isSatisfiesExpression(node) || ts.isParenthesizedExpression(node)) {
|
|
literals(node.expression, path)
|
|
} else throw new Error(`${PROFILE_SOURCE}: default profile packages must use static literal lists`)
|
|
}
|
|
for (const statement of file.statements) {
|
|
if (!ts.isVariableStatement(statement)) continue
|
|
for (const declaration of statement.declarationList.declarations) {
|
|
if (!ts.isIdentifier(declaration.name)
|
|
|| !required.has(declaration.name.text) && declaration.name.text !== 'INSTALLATION_OWNED_PROFILE_TUPLES'
|
|
&& declaration.name.text !== 'OPTIONAL_BUNDLES') continue
|
|
if (declaration.initializer === undefined) continue
|
|
if (required.has(declaration.name.text)) found.add(declaration.name.text)
|
|
const before = packages.length
|
|
literals(declaration.initializer, [declaration.name.text])
|
|
if (declaration.name.text !== 'OPTIONAL_BUNDLES' && packages.length === before) {
|
|
throw new Error(`${PROFILE_SOURCE}: ${declaration.name.text} has no default bundles`)
|
|
}
|
|
}
|
|
}
|
|
if (found.size !== required.size) throw new Error(`${PROFILE_SOURCE}: missing default profile declarations`)
|
|
if (webBundles.length === 0) throw new Error(`${PROFILE_SOURCE}: missing default Web bundle list`)
|
|
return { packages, webBundles, optionalBundles }
|
|
}
|
|
|
|
if (import.meta.main) {
|
|
const result = verifyDefaultProductIsolation(resolve(import.meta.dirname, '..'))
|
|
if (result.failures.length > 0) {
|
|
for (const failure of result.failures) console.error(`verify-default-product-isolation: ${failure}`)
|
|
process.exitCode = 1
|
|
} else {
|
|
console.log(`verify-default-product-isolation: ${String(result.packageCount)} packages, `
|
|
+ `${String(result.sourceCount)} runtime sources, ${String(result.configCount)} configurations, `
|
|
+ `${String(result.webPluginCount)} composed Web plugins exclude experimental packages.`)
|
|
}
|
|
}
|