lib/client.js ships unbundled ESM — tsc in the build step overwrites the browser bundle, so the plugin crashes DSH on load

Environment

DSH: 0.2.0-rc.1 (desktop app, macOS arm64)
@perrylink/dsh-github: 0.7.15 (latest as of 2026-09-25)

Summary

The browser half of this plugin cannot load on DSH 0.2, and it takes the app's client boot down with it:

Uncaught SyntaxError: Cannot use import statement outside a module
  @ dsh-app://app/plugins/??@perrylink/dsh-github/client.js&rev=…:23

package.json points exports["./client"] at ./lib/client.js, and DSH injects that file into the renderer as a
classic script. But the published file is TypeScript-compiled ESM source, not a browser bundle, so the first
import is a syntax error.

Evidence from the published tarball

$ npm pack @perrylink/dsh-github@0.7.15 && tar xzf perrylink-dsh-github-0.7.15.tgz
$ wc -c package/lib/client.js
12473 package/lib/client.js

$ grep -c '__ModuleLoader__' package/lib/client.js
0

$ grep -n '^import ' package/lib/client.js
23:import { createElement, useState } from 'react';
24:import { Button, IconLoadingOutlineRegular, } from '@deepseek-ai/dsh-client-ui-primitives';

DSH 0.2's client loader only accepts the bundled form:

window.__ModuleLoader__.load({ id: '@scope/plugin', factory(require) { … } });

0 occurrences of __ModuleLoader__ plus two top-level imports means the file cannot be executed as a classic
script. The rest of the bundle looks intact — this is purely a packaging/build-order problem.

Likely cause

package.json:

"scripts": {
  "build": "tsc --noEmitOnError && node scripts/fix-dts.mjs",
  "prepublishOnly": "npm run build && npm test"
}

tsc is run with emit and outputs next to the sources, so it rewrites lib/client.js with compiled module
code. Whatever bundler step produced the real browser bundle is either not wired into prepublishOnly or runs
before this tsc and gets overwritten.

The file's own header comment suggests this is unintentional:

/**
 * dsh-github browser half — …
 * The shipped `lib/client.js` is the built bundle of this module. The browser
 * module loader executes that bundle, not this file.
 */
import { createElement, useState } from 'react';

Line 19 says the shipped file is the built bundle; line 23 is a bare ESM import. The doc and the artifact
disagree — consistent with a build step clobbering a correct bundle.

Suggested fix

Make the browser bundle the last thing written to lib/client.js — either run the bundler after tsc
(e.g. tsc --noEmit for types, then the bundler for lib/client.js), or emit tsc output to a separate
directory so it cannot overwrite the bundle.
Point exports["./client"] at the bundle explicitly if it lives elsewhere.
The repo already has a verify:artifacts script and a verify:self-contained script — a check that
lib/client.js contains __ModuleLoader__ (and has no top-level import) would catch this before publish.
I'd be happy to send that as a small PR if useful.

Impact note

This is not cosmetic for DSH users: the renderer aborts its client boot, and the desktop app reports
web boot: N entry did not activate and shows "应用无法启动", then runs its crash recovery (disables all
third-party bundles and resets the profile). One malformed client artifact costs the whole plugin set.

I confirmed this reproduces on a clean profile with 0.7.15 as the only third-party plugin.

中文摘要

@perrylink/dsh-github@0.7.15 的 lib/client.js 不是浏览器打包产物，而是 tsc 编译出来的 ESM 源码
（12,473 字节，__ModuleLoader__ 出现 0 次，第 23/24 行是裸 import）。DSH 0.2 把它当普通脚本注入
→ SyntaxError: Cannot use import statement outside a module → 客户端启动失败，应用弹「无法启动」。

成因很可能是构建顺序："build": "tsc --noEmitOnError && node scripts/fix-dts.mjs" 里的 tsc
带 emit，把编译产物写回 lib/client.js，覆盖掉了打包器的输出。文件第 19 行的注释还写着
"The shipped lib/client.js is the built bundle of this module" —— 注释和产物自相矛盾，说明是构建步骤把它冲掉了。

修复建议：tsc 改成 --noEmit（或输出到别处），确保打包产物最后写入；并在发布前加一条
「lib/client.js 必须含 __ModuleLoader__」的校验 —— 仓库里已经有 verify:artifacts 脚本，加进去很自然。
需要的话我可以直接提个小 PR。

Confirmed on 0.2.0-rc.2 as well — this is not specific to 0.2.0-rc.1.

Environment: DSH 0.2.0-rc.2 (desktop, win32 x64, Electron 44.0.0, Node 24.18.1), @perrylink/dsh-github@0.7.15 from npm latest. Identical failure:

Uncaught SyntaxError: Cannot use import statement outside a module
  @ dsh-app://app/plugins/??…,@perrylink/dsh-github/client.js&rev=…:23
Error: web boot: 1 entry did not activate
@perrylink/dsh-github: import failed

Scope check. I swept the whole profile to confirm this is isolated rather than a profile-wide incompatibility:

Across all 29 bundles entries, @perrylink/dsh-github is the only one whose engines.dsh declares a host range below 0.2.0 (it caps at <0.2.0). Every other bundle either declares >=0.2.0-rc.1, declares no host range at all, or is an official @deepseek-ai/* bundle supplied by the app itself.
Of the 23 user-layer bundles, 10 ship an explicit exports["./client"] entry — every one of those 10 client.js files is a classic script with 0 top-level import/export. The other 13 resolve their client half through the host manifest.
Loading every user-layer bundle's server entry under Node: 0 SyntaxError, 18 clean imports, and 5 ERR_MODULE_NOT_FOUND for @deepseek-ai/dsh-* packages the host provides from its built-in bundles — expected outside the host.

So the client artifact shape is the defect, exactly as #13 describes.

Two things that may help decide what to merge:

fix(client): ship lib/client.js as the DSH browser bundle, not tsc output #11 and fix(client): register the browser half with the module loader #14 overlap and will conflict. Both replace the same build step that produces lib/client.js (scripts/client-bundle.mjs vs scripts/build-client.mjs), and both extend scripts/verify-artifacts.mjs. fix(client): register the browser half with the module loader #14 additionally widens engines.dsh and the @deepseek-ai/dsh-* peer union with || >=0.2.0-rc.1 <0.3.0-0, and moves the Compat workflow's profile job to both ends of the band. Picking one and closing the other avoids a three-way conflict in prepare.mjs, package.json and the lockfile.
There may be no recovery path through the market. My profile's state.json.disabled was empty, so I had no off switch for this package to begin with — but the market's toggle is loader-entry based (for other bundles it logs no loader entry matched and still leaves them in the boot list), so a failure that happens during renderer boot, before any row is registered, looks unreachable from that toggle. What actually worked was editing the profile's dsh.profile.bundles and restarting.

Recovery detail worth recording: after removing the row from dsh.profile.bundles, the host started normally even though node_modules/@perrylink/dsh-github/ and pnpm-lock.yaml both still contained the package. Only the bundles row drives renderer boot, so removing the installed copy and pruning the lockfile is not required to recover — which matters when the UI is down and the market cannot be used to uninstall anything.

I have it disabled this way for now and will reinstall once a release declares 0.2 support.

补充一份 0.7.19 上的复现，与 #13 同根因。

【环境】

插件版本：@perrylink/dsh-github@0.7.19（npm 最新版，2026-10-05 发布）
安装渠道：DSH 桌面端内置插件市场（dsh-market v1.66.11）。市场卡片显示
"DSH >=0.1.2-rc.1 <0.2.0 || >=…"，安装时只给出一条 cordis 版本风险警告就放行。
Harness：DSH Desktop 2.0.17，内核 @deepseek-ai/dsh 0.2.0-rc.2，宿主 @deepseek-ai/cordis 4.0.4
OS / Node：Windows 10 专业版 10.0.19045 / Node v24.18.1

【实际行为】
安装后重启桌面端，启动页出现 "Failed to load plugins"，桌面端随即进入
恢复模式窗口（内核针对 renderer 启动失败的标准降级路径），应用无法正常进入。
在恢复模式中卸载该插件后重启，立即恢复正常（1/1 复现）。

【日志】
%APPDATA%\DSH Desktop\logs\dsh-2026-10-08.error.log

dsh-plugin-desktop: renderer boot failed (plugins: @perrylink/dsh-github):
The client Loader did not provide an error message.
RendererStartupFailure: Renderer boot failed for 1 plugin(s)
at start (file:///G:/DSH Desktop/resources/app/lib/main.js:4967:49)

【期望行为】

单个插件的客户端半边加载失败，不应让整个应用起不来；
至少应给出可读的失败原因，而不是 "did not provide an error message"。

【补充证据：0.7.19 仍未修复】

lib/client.js（unpkg 与 jsdelivr 双源一致）：12255 字节，ModuleLoader 出现 0 次，
含 2 条顶层 bare import —— 与 lib/client.js ships unbundled ESM — tsc in the build step overwrites the browser bundle, so the plugin crashes DSH on load #13 描述的"tsc 产物覆盖浏览器 bundle"一致。
CHANGELOG 中 0.7.13–0.7.19 无任何客户端打包修复条目；修复 PR fix(client): ship lib/client.js as the DSH browser bundle, not tsc output #11 目前仍 open 未合并。

【另两点建议】

engines.dsh 的 ">=0.2.0-0 <0.3.0" 段经 semver 7.8.5 实测确实放行 0.2.0-rc.2，
但 peerDependencies 要求 @deepseek-ai/cordis ^4.0.5-alpha.1（只存在于 0.2.1-alpha 线），
本机宿主 4.0.4 不满足 —— 两处声明口径不一致，导致市场按 engines 放行、装完即崩。建议同步收窄。
建议在 README 给出应急恢复步骤（把该行从 profile 的 dsh.profile.bundles 移除后重启即可，
见 lib/client.js ships unbundled ESM — tsc in the build step overwrites the browser bundle, so the plugin crashes DSH on load #13 的评论），本次因找不到说明只能整包卸载。

【脱敏说明】已自行检查，正文不含 token / 凭据 / 请求头。

Confirmed on 0.7.20 — still the current npm latest (gitHead 1b42270), i.e. two releases after the 0.7.19 report.

Env: DSH Desktop 0.2.0-rc.2 (win32 x64, Electron 44.0.0, Node 24.18.1), host @deepseek-ai/cordis@4.0.4.

$ node -e "const t=require('fs').readFileSync('lib/client.js','utf8');console.log(t.length, t.includes('__ModuleLoader__'))"
12255 false

Two details that may help narrow the fix:

Only the browser half is broken. After install the host half is live — include:dsh-github is in the loader tree and the plugin's own tools (gh_repo, gh_issue, gh_search, …) are callable — while the client slot it declares (plugins.item) never registers. The defect is confined to the ./client artifact.
Enable and install disagree about the risk. The market's toggle detects it and refuses to persist: warn toggle: @perrylink/dsh-github: enable failed; leaving it disabled rather than persisting a state that crashes at boot (#575). But installing goes through the host's own replay — install: the host's own replay activated it; adopted instead of mounting a second copy (#814, #827) — which writes the package into dsh.profile.bundles. The profile is then "fine until the next restart", and the restart fails:

Error: web boot: 1 entry did not activate
@perrylink/dsh-github: import failed

On the build side, 0.7.20's package.json contains no client-bundle step at all (build is tsc --noEmitOnError && node scripts/fix-dts.mjs, prepublishOnly is npm run build && npm test), and verify:artifacts is not wired into prepublishOnly — so nothing between that tsc and npm publish can catch the overwrite.

Recovery: removing the @perrylink/dsh-github row from dsh.profile.bundles (leaving the package installed) is enough to boot again.

中文摘要：0.7.20（当前 npm 最新版）上仍然复现，比 0.7.19 那条报告又晚了两个版本；本机宿主 0.2.0-rc.2 / cordis 4.0.4，lib/client.js 12255 字节、__ModuleLoader__ 0 次。补充两点：①只有浏览器半坏——宿主半已加载（include:dsh-github 在 loader 里、插件工具可调用），它声明的客户端槽位 plugins.item 始终未注册；②market 的启用路径会拦（#575 拒绝落盘），但安装路径走宿主 replay，会把它写进 dsh.profile.bundles，用户于是处在"装完到下次重启之间正常"的状态，一重启就 web boot: 1 entry did not activate。另外 0.7.20 的 scripts 里没有任何客户端打包步骤，verify:artifacts 也没接进 prepublishOnly。恢复方式：把该行从 dsh.profile.bundles 移除即可启动（包可留在 node_modules）。

Navigation Menu

Repository navigation

`lib/client.js` ships unbundled ESM — `tsc` in the build step overwrites the browser bundle, so the plugin crashes DSH on load #13

Environment

Summary

Evidence from the published tarball

Likely cause

Suggested fix

Impact note

中文摘要

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

lib/client.js ships unbundled ESM — tsc in the build step overwrites the browser bundle, so the plugin crashes DSH on load #13

Description

Environment

Summary

Evidence from the published tarball

Likely cause

Suggested fix

Impact note

中文摘要

Activity

Swcmb commented on Oct 2, 2026

ljyzww commented on Oct 8, 2026

fishdivinity commented on Oct 14, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

`lib/client.js` ships unbundled ESM — `tsc` in the build step overwrites the browser bundle, so the plugin crashes DSH on load #13