[fishdivinity]

Checklist

• The full gate is green: pnpm run typecheck && pnpm test && pnpm run build && pnpm run check:readmes
• Tests were added or updated for the change
• CHANGELOG.md has an entry under ## [Unreleased]
• All five READMEs stay in sync where the change touches docs — no README change needed
• A related issue is referenced (Fixes #16)
• No credentials, tokens, keys, or private paths are included in the diff

Summary

lib/client.js now registers its browser factory under the package name (@perrylink/dsh-github) instead of the hardcoded short id (dsh-github).

Why

DSH 0.2.1-rc.2's @deepseek-ai/dsh-client-modules keys client rows by package name. The first load of the batch registered dsh-github, so the row for @perrylink/dsh-github was still missing; the loader fell back to the single-resource URL, executed the same bundle a second time, and aborted web boot with duplicate factory registration. DSH Desktop fatal recovery then reset dsh.profile.bundles and backed up cordis.patch.yml, disabling every third-party plugin.

Fixes #16. This is the remaining id mismatch in the wrapper added for #12/#13; #13 fixed the raw ESM, not the id.

Changes

• scripts/bundle-client.mjs: read package.json.name and use it for the loader id; fail loud if the manifest has no name.
• lib/client.js: regenerated with the package-name id.
• scripts/verify-artifacts.mjs: execute the shipped bundle with a stub __ModuleLoader__, assert exactly one registration under the package name.
• test/client-bundle.test.ts: the same contract as a unit regression test.
• CHANGELOG.md: Unreleased entry.

Verification

• pnpm run typecheck ✅
• pnpm test ✅ 188 passed / 3 skipped
• pnpm run build ✅
• pnpm run verify:artifacts ✅
• pnpm run verify:self-contained ✅
• pnpm run check:readmes ✅
• pnpm run lint ✅ (0 errors; existing warnings only)

中文摘要

lib/client.js 的 __ModuleLoader__.load id 从写死的 dsh-github 改为 package.json.name（@perrylink/dsh-github）。DSH 0.2.1-rc.2 按包名建 client 行；短名会导致宿主回退到单资源 URL、重复执行同一个 bundle，触发 duplicate factory registration，web boot 失败后 DSH Desktop 会重置整个 profile。修复同时加了 verify:artifacts 校验和 VM 回归测试。Fixes #16。

[CarbonAnime]

Independently verified on a real DSH 0.2.1-rc.2 desktop profile — this is the right fix, and I'd take it as-is.

I hit the same failure with @perrylink/dsh-github@0.7.24 on Windows 11 x64 (DSH Desktop 0.2.1-rc.2), then checked out this branch (f706d49) locally with Node 24.19.0 / pnpm 11.22.0:

• pnpm install --ignore-scripts && pnpm run build → bundle-client: wrapped lib/client.js; the emitted registration is id: "@perrylink/dsh-github" (read from package.json.name).
• pnpm run verify:artifacts → artifacts OK: host face + browser registration id + bundle patch and action contract present.
• pnpm test → 20 passed | 1 skipped (files), 188 passed | 3 skipped (tests).
• Loader-level check of the contract this fixes: the host resolves a client row by normalizing <pkg>/client to <pkg> (stripClientSuffix) and then looking up an exact registration id. The row composed for this package is @perrylink/dsh-github, so a registration under dsh-github misses; under the package name it hits. That miss is what escalates to duplicate factory registration → web boot: 1 entry did not activate → DSH profile recovery, as reported in bug: 0.7.24 client wrapper registers "dsh-github" instead of "@perrylink/dsh-github" — boot aborts and DSH resets the profile #16.

Practical impact: until this lands, every 0.7.24 user has to carry a local patchedDependencies entry pinned to the exact version just to boot this plugin. A 0.7.25 cut from this branch removes that workaround; the release notes are also worth calling out 0.7.24 as affected.

One non-blocking nit: scripts/bundle-client.mjs still exits early when lib/client.js already starts with window.__ModuleLoader__.load(, so the script itself never repairs a stale committed artifact — your verify:artifacts + test/client-bundle.test.ts assertions cover exactly that case, so it does not need to change here.

[azagreev]

+1 from another affected desktop user — same failure on DSH Desktop 0.2.1-rc.2 with @perrylink/dsh-github@0.7.24 (Windows; crash logs and the full chain are in #16: web boot: 1 entry did not activate → duplicate factory registration for "dsh-github", then DSH's fatal recovery renamed cordis.patch.yml and wiped the third-party bundle list).

Could this be merged and published as 0.7.25? npm still serves 0.7.24 as latest, so every desktop user who installs it ends up with a non-bootable profile until the fix ships.