@goodandready/dsh-plugin-notify 0.4.2 → 0.4.3

package/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.3] - 2026-10-15
+
+### Fixed
+- **Host event cleanup** (#59): Prune dead listener on non-existent host event `settings/updated` in `lib/index.js` (active settings updates remain reliably monitored via `settings/document-updated` and `loader/volatile-update`).
+- **Client slot registration** (#59): Remove dead registration of non-existent client seat `settings.plugin.item` in `lib/client.js` (official plugin list page seat `plugins.item` and row config seat `plugins.row.config` handle settings cards).
+- **Web push state path containment** (#59): Constrain custom `webPush.stateFile` paths by resolving relative paths against the DSH home directory instead of returning raw unconstrained strings.
+
 ## [0.4.2] - 2026-10-10
 
 ### Fixed

package/lib/client.js

@@ -895,19 +895,13 @@ window.__ModuleLoader__.load({
             (props) => React.createElement(NotifyCard, { ...props, ctx }),
           )
         })
-        // Row seat and the legacy seat kept as fallbacks for older cores.
+        // Row seat fallback for older cores.
         ctx.slots.inject('plugins.row.config', () => {
           ctx.slots.register(
             { name: 'plugins.row.config', key: ROW_CONFIG_KEY, locale: NS, order: 40, inject: () => ({ ctx }) },
             (props) => React.createElement(NotifyCard, { ...props, ctx }),
           )
         })
-        ctx.slots.inject('settings.plugin.item', () => {
-          ctx.slots.register(
-            { name: 'settings.plugin.item', key: ROW_ID, locale: NS, order: 40, inject: () => ({ ctx }) },
-            (props) => React.createElement(NotifyCard, { ...props, ctx }),
-          )
-        })
       } catch (e) {
         console.warn('[dsh-plugin-notify] settings seats failed', e)
       }

package/lib/index.js

@@ -344,10 +344,12 @@ export function generateVapidKeys() {
 }
 
 export function resolveStatePath(webPushConfig = {}) {
-    if (webPushConfig && typeof webPushConfig.stateFile === 'string' && webPushConfig.stateFile.trim())
-        return webPushConfig.stateFile.trim();
     const home = (process.env.DSH_HOME && process.env.DSH_HOME.trim())
         || path.join(os.homedir(), '.dsh');
+    if (webPushConfig && typeof webPushConfig.stateFile === 'string' && webPushConfig.stateFile.trim()) {
+        const custom = webPushConfig.stateFile.trim();
+        return path.isAbsolute(custom) ? path.normalize(custom) : path.resolve(home, custom);
+    }
     return path.join(home, 'plugin-notify-state.json');
 }
 
@@ -793,7 +795,6 @@ export function apply(ctx, config = {}) {
             if (typeof ctx.on === 'function') {
                 ctx.on('settings/document-updated', refreshSettings);
                 ctx.on('loader/volatile-update', refreshSettings);
-                ctx.on('settings/updated', refreshSettings);
             }
             if (typeof sctx.settings?.on === 'function') {
                 try { sctx.settings.on('update', refreshSettings); } catch { /* ignore */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-plugin-notify",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "DSH plugin: audio chimes, cross-session toasts, desktop push, IM webhooks, and web push (PWA) for turn completion, errors, and approvals.",
   "license": "MIT",
   "type": "module",