fix(repository-plugin): enforce published prepare dependency

packages/self-modification/repository-plugin/src/format.ts

@@ -16,6 +16,8 @@ export const PREPARED_ASSET_DIRECTORY = 'dsh-plugin-assets'
 export const REPOSITORY_PLUGIN_BUILTIN = 'dsh-repository-plugin'
 /** Dependency-provided command that repository package `prepack` lifecycles must invoke. */
 export const REPOSITORY_PLUGIN_PREPARE_COMMAND = 'dsh-plugin-prepare'
+/** Published package whose direct development dependency supplies the prepare command. */
+export const REPOSITORY_PLUGIN_PACKAGE_NAME = '@deepseek-ai/dsh-repository-plugin'
 
 /**
  * Whether a package lifecycle declaration names the preparation dependency's helper.
@@ -40,6 +42,9 @@ const sourceMetadataSchema = z.object({
 })
 const sourcePackageSchema = z.looseObject({
   name: z.string().min(1),
+  devDependencies: z.looseObject({
+    [REPOSITORY_PLUGIN_PACKAGE_NAME]: z.string().min(1),
+  }),
   scripts: z.looseObject({
     prepack: prepackSchema,
   }),

packages/self-modification/repository-plugin/src/index.ts

@@ -29,6 +29,7 @@ export {
   PREPARED_ASSET_DIRECTORY,
   PREPARED_ENTRY_FILENAME,
   REPOSITORY_PLUGIN_BUILTIN,
+  REPOSITORY_PLUGIN_PACKAGE_NAME,
   REPOSITORY_PLUGIN_PREPARE_COMMAND,
   prepareDshPlugin,
   type PreparedPluginManifest,

packages/self-modification/repository-plugin/src/source.ts

@@ -12,6 +12,7 @@ import { resolveDshHome } from '@deepseek-ai/dsh-paths'
 import { z } from 'zod'
 import {
   PREPARED_ENTRY_FILENAME,
+  REPOSITORY_PLUGIN_PACKAGE_NAME,
   REPOSITORY_PLUGIN_PREPARE_COMMAND,
   hasRepositoryPrepareCommand,
 } from './format.ts'
@@ -29,6 +30,9 @@ export const DEFAULT_REPOSITORY_CACHE_DIRECTORY = 'repository-plugins'
 // resolvable point').
 const GITHUB_SOURCE_PATTERN = /^github:([^/\s#&]+)\/([^/\s#&]+)#([^\s#&]+)(?:&path:(\/[^\s&]+))?$/
 const installedPackageSchema = z.looseObject({
+  devDependencies: z.looseObject({
+    [REPOSITORY_PLUGIN_PACKAGE_NAME]: z.string().min(1),
+  }),
   scripts: z.looseObject({
     prepack: z.string().min(1).refine(
       hasRepositoryPrepareCommand,
@@ -81,7 +85,7 @@ async function assertInstalledPackageMetadata(directory: string): Promise<void>
   const result = installedPackageSchema.safeParse(value)
   if (!result.success) {
     throw new Error([
-      `installed DSH plugin package must declare a non-empty scripts.prepack that invokes ${JSON.stringify(REPOSITORY_PLUGIN_PREPARE_COMMAND)}:`,
+      `installed DSH plugin package must declare a non-empty scripts.prepack that invokes ${JSON.stringify(REPOSITORY_PLUGIN_PREPARE_COMMAND)}, and declare ${JSON.stringify(REPOSITORY_PLUGIN_PACKAGE_NAME)} in devDependencies:`,
       z.prettifyError(result.error),
       'Clear the matching repository cache generation before retrying the same source, or select a different exact source/ref/path after fixing the package.',
     ].join('\n'))