From 4a3b5b03a67a0faa4063d8fe2efd5e7f69a360df Mon Sep 17 00:00:00 2001
From: techflag <562635045@qq.com>
Date: Sat, 26 Sep 2026 04:39:44 +0800
Subject: [PATCH] test: verify packaged WorkDSH plugin inventory

---
 docs/desktop-boundaries.md                          |  6 ++++--
 .../scripts/verify-workdsh-carrier.ts               | 13 +++++++++++++
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/docs/desktop-boundaries.md b/docs/desktop-boundaries.md
index 41245f64bb..5c225b8ed8 100644
--- a/docs/desktop-boundaries.md
+++ b/docs/desktop-boundaries.md
@@ -48,5 +48,7 @@ browser, identity, access, and audit behavior. A source-level package count or
 successful config dump alone does not prove that runtime outcome.
 Profile preparation now boots the bundled DSH plugin manager and requires its
 `listBundles()` response to contain exactly the five installed and enabled
-WorkDSH products. The installed application's UI and feature flows still need
-their own acceptance checks on both platforms.
+WorkDSH products. The Electron `afterPack` gate repeats that live inventory
+check with the Node executable and Profile inside each packaged application.
+The installed application's UI and feature flows still need their own
+acceptance checks on both platforms.
diff --git a/dsh-plugin-desktop/scripts/verify-workdsh-carrier.ts b/dsh-plugin-desktop/scripts/verify-workdsh-carrier.ts
index 2d5cdd551a..8e16545948 100644
--- a/dsh-plugin-desktop/scripts/verify-workdsh-carrier.ts
+++ b/dsh-plugin-desktop/scripts/verify-workdsh-carrier.ts
@@ -1,6 +1,8 @@
 /** Verify that the Electron carrier contains no second Harness runtime. */
 import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
 import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { extractFile, listPackage } from '@electron/asar'
 import { DSH_VERSION } from './runtime-version.mjs'
 
@@ -94,6 +96,17 @@ export async function afterPack(context: PackContext): Promise<void> {
       throw new Error(`Bundled ${name} is ${String(pkg.version)}, expected ${DSH_VERSION}`)
     }
   }
+  const node = join(runtime, 'primary-runtime', 'dependencies', 'node', 'bin',
+    context.electronPlatformName === 'win32' ? 'node.exe' : 'node')
+  const inventoryCheck = fileURLToPath(new URL('./verify-product-plugin-inventory.mjs', import.meta.url))
+  const inventory = spawnSync(node, [inventoryCheck, runtime], {
+    encoding: 'utf8',
+    timeout: 120_000,
+  })
+  if (inventory.error || inventory.status !== 0) {
+    throw new Error(`Packaged WorkDSH plugin inventory check failed: ${String(inventory.error ?? inventory.stderr)}`)
+  }
+  process.stdout.write(inventory.stdout)
   console.log(`Verified thin Electron carrier and ${names.length} Harness ${DSH_VERSION} packages`)
 }