[Bug] resolveNonRootPackage 被 exports "./*" 通配劫持：@modelcontextprotocol/sdk 的 package.json 被解析成 dist/cjs/package.json（无 name 字段）→ 提前 return，子路径回退逻辑永远跑不到 #745

608:    // Some SDKs publish a root export without shipping its target, while their
609:    // supported API is exposed through concrete client/server subpaths. Package
610:    // dependency validation must not require an unused root entry. Require an
611:    // existing runtime subpath instead; a manifest alone is insufficient here.
612:    if (exported !== null && typeof exported === 'object' && !Array.isArray(exported)) {
613:      for (const [subpath, target] of Object.entries(exported)) {
...
618:        if (existsSync(entry)) return entry
619:      }
620:    }

556:  async function resolveNonRootPackage(requireFromPackage, dependency) {
557:    // Harness intercepts package resolution, but resolve.paths() still exposes
558:    // legacy filesystem links. Ask the active resolver for the manifest first.
559:    let selectedManifest
560:    try {
561:      selectedManifest = requireFromPackage.resolve(`${dependency}/package.json`)   // ← 就是这一行
562:    } catch {
...
575:      if (manifest.name !== dependency) return undefined    // ← 直接放弃

manifest.name !== dependency   // undefined !== '@modelcontextprotocol/sdk' → true
→ return undefined

let selectedManifest
try {
  selectedManifest = requireFromPackage.resolve(`${dependency}/package.json`)
} catch {
  // 保持原有 fallback
}
// 新增：通配导出可能把 package.json 映射到内层文件，回退到真实路径
if (selectedManifest !== undefined) {
  const direct = join(packageDirectoryOf(requireFromPackage, dependency), 'package.json')
  ...
}

const candidates = selectedManifest ? [selectedManifest] : []
// 始终追加真实路径候选，即使 resolve 成功了
for (const modules of requireFromPackage.resolve.paths(dependency) ?? []) {
  candidates.push(join(modules, dependency, 'package.json'))
}

for (const file of candidates) {
  const manifest = await readJsonOrUndefined(file)
  if (manifest?.name !== dependency) continue   // ← 跳过无效候选，而不是 return
  ...
}

if (manifest.name !== dependency) {
  // {"type": "commonjs"} 这类 exports 通配命中的内层声明不是包清单
  if (Object.keys(manifest).every(k => k === 'type')) continue
  return undefined
}

problems.push(`${prefix}${dependency} does not resolve from the generation or installation closure` +
  (selectedManifest ? ` (manifest probe landed on ${selectedManifest})` : ''))

const { createRequire } = require('node:module')
const { readFileSync, existsSync } = require('node:fs')
const { join } = require('node:path')

const genRoot = '<generation>/node_modules'
const rq = createRequire(join(genRoot, 'dsh-skill-mcp-panel/package.json'))

// 安装器实际拿到的"清单"
const hijacked = rq.resolve('@modelcontextprotocol/sdk/package.json')
console.log(hijacked)                                  // => .../dist/cjs/package.json
console.log(readFileSync(hijacked, 'utf8'))            // => {"type":"commonjs"}
console.log(JSON.parse(readFileSync(hijacked,'utf8')).name)  // => undefined

// 真实清单
const real = JSON.parse(readFileSync(join(genRoot, '@modelcontextprotocol/sdk/package.json'), 'utf8'))
console.log(real.name, real.version)                   // => @modelcontextprotocol/sdk 1.32.1