fix: dist 产物 ESM require 崩溃 + dsh-qaq 插件零运行时依赖

package.json

@@ -14,7 +14,7 @@
     "qaq": "./bin/qaq.mjs"
   },
   "scripts": {
-    "build": "esbuild src/cli.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/qaq.mjs",
+    "build": "esbuild src/cli.ts --bundle --platform=node --format=esm --target=node22 --banner:js=\"import { createRequire as __qaqCRequire } from 'module'; const require = __qaqCRequire(import.meta.url);\" --outfile=dist/qaq.mjs",
     "qaq": "tsx src/cli.ts",
     "test": "vitest run",
     "smoke": "node tools/smoke.mjs",
@@ -31,4 +31,4 @@
     "typescript": "^5.6.0",
     "vitest": "^4.1.0"
   }
-}
+}

packages/dsh-qaq/lib/index.js

@@ -1,7 +1,12 @@
-import { join } from "node:path";
+import { join, resolve } from "node:path";
+import { homedir } from "node:os";
 import { copyFileSync, mkdirSync, writeFileSync, existsSync, readdirSync, rmSync } from "node:fs";
-import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 const name = "dsh-qaq";
+function resolveDshHome() {
+  const fromEnv = process.env.DSH_HOME;
+  const selected = fromEnv !== void 0 && fromEnv.trim().length > 0 ? fromEnv : join(homedir(), ".dsh");
+  return resolve(selected);
+}
 const QAQ_DIR = ".qaq";
 const KEEP = 5;
 const FILES = ["package.json", "cordis.patch.yml"];

packages/dsh-qaq/package.json

@@ -18,12 +18,10 @@
     }
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-home-paths": ">=0.1.0"
+    "@deepseek-ai/cordis": "^4.0.1"
   },
   "peerDependenciesMeta": {
-    "@deepseek-ai/cordis": { "optional": true },
-    "@deepseek-ai/dsh-home-paths": { "optional": true }
+    "@deepseek-ai/cordis": { "optional": true }
   },
   "files": ["lib", "cordis.patch.yml"]
 }

packages/dsh-qaq/src/index.ts

@@ -5,13 +5,25 @@
  * and history/. Backup-only: it never detects failure, never rolls back, and
  * changes no DSH behavior.
  */
-import { join } from 'node:path'
+import { join, resolve } from 'node:path'
+import { homedir } from 'node:os'
 import { copyFileSync, mkdirSync, writeFileSync, existsSync, readdirSync, rmSync } from 'node:fs'
 import type { Context } from '@deepseek-ai/cordis'
-import { resolveDshHome } from '@deepseek-ai/dsh-home-paths'
 
 export const name = 'dsh-qaq'
 
+/** Inline equivalent of @deepseek-ai/dsh-home-paths' resolveDshHome: a non-empty
+ * DSH_HOME wins, otherwise ~/.dsh. Inlined (instead of imported) so the plugin
+ * has ZERO runtime dependencies: it is mounted into a profile via a junction
+ * from outside the DSH tree, and a bare-specifier import would walk up the
+ * QAQ repo's node_modules — which never contains @deepseek-ai — and fail the
+ * very boot this tool exists to guard. */
+function resolveDshHome(): string {
+  const fromEnv = process.env.DSH_HOME
+  const selected = fromEnv !== undefined && fromEnv.trim().length > 0 ? fromEnv : join(homedir(), '.dsh')
+  return resolve(selected)
+}
+
 const QAQ_DIR = '.qaq'
 const KEEP = 5
 const FILES = ['package.json', 'cordis.patch.yml'] as const
@@ -72,4 +84,4 @@ function inferProfileName(ctx: Context): string | null {
   const cwd = (process.env.INIT_CWD ?? process.cwd())
   const m = cwd.match(/profiles[\\/]([^\\/]+)/)
   return m ? m[1] : null
-}
+}