@suifei/dsh-pmo-button 0.7.2 → 0.7.4

package/README.md

@@ -51,7 +51,7 @@ dsh plugin --profile <你的profile> add github:suifei/dsh-pmo-button
 
 | 字段 | 默认值 | 说明 |
 |---|---|---|
-| `logFile` | `pmo-button.log` | 轮次日志路径（建议绝对路径） |
+| `logFile` | `~/.dsh/logs/pmo-button.log` | 轮次日志路径（默认在 Harness home 下，可改绝对路径） |
 | `maxChars` | `4000` | 日志单块截断阈值（转发块为 2×） |
 | `provider` | `spawn` | 子代理提供方（`ctx.subagents` 注册名） |
 | `childLabel` | `PMO 子代理` | 持久子代理标签 |

package/client.js

@@ -1,5 +1,5 @@
 /**
- * PMO button — Client half v0.7.1.
+ * PMO button — Client half v0.7.4.
  * Red start/stop control in `conversation.input.right` (idle: neutral circle
  * with red arrow; armed: red circle with pulse animation) plus a liveness
  * strip in `conversation.composer.dock`. State is owned by the Host half via
@@ -12,7 +12,7 @@ window.__ModuleLoader__.load({
     const React = require('react');
     const h = React.createElement;
     const BASE = '/pmo-button';
-    const VER = 'v0.7.1';
+    const VER = 'v0.7.4';
     let loadError = null;
     let t = { start: 'Start PMO automation', stop: 'PMO running: click to stop', busy: 'PMO: pending…', offline: 'PMO: host unreachable' };
 

package/index.js

@@ -1,5 +1,5 @@
 /**
- * PMO button — Host half v0.7.1.
+ * PMO button — Host half v0.7.4.
  * Per-session armed set, turn buffers, child registry, and the once-per-session
  * identity-prompt flag are persisted (pmo-state.json), so restarts lose nothing.
  * The `session/event` feed drives two jobs for armed sessions:
@@ -15,6 +15,7 @@
  * batch-flushed, while session/event is the documented post-commit surface.
  */
 import fs from 'node:fs'
+import os from 'node:os'
 import path from 'node:path'
 import Schema from '@deepseek-ai/schemastery'
 import { createUserMessage } from '@deepseek-ai/dsh-llm'
@@ -53,7 +54,8 @@ const ROLE_PROMPT_DEFAULT = [
 
 /** @typedef {{ logFile: string, maxChars: number, provider: string, childLabel: string, greet: string, rolePrompt: string }} Config */
 export const Config = Schema.object({
-  logFile: Schema.string().default('pmo-button.log'),
+  /** Deterministic default: ~/.dsh/logs/pmo-button.log (cwd-relative defaults break on restarts). */
+  logFile: Schema.string().default(path.join(os.homedir(), '.dsh', 'logs', 'pmo-button.log')),
   maxChars: Schema.number().default(4000),
   /** Subagent provider name registered on ctx.subagents (spawn-in-process default). */
   provider: Schema.string().default('spawn'),
@@ -178,6 +180,11 @@ export function apply(ctx, config) {
     if (t.length <= limit) return t
     return t.slice(0, limit) + `\n…(截断，原长 ${t.length} 字符)`
   }
+  /** Never let credential-looking strings (npm_ tokens etc.) reach the log,
+   *  the review forward, or the child's durable session. */
+  function redact(s) {
+    return String(s ?? '').replace(/npm_[A-Za-z0-9]{20,}/g, 'npm_***已脱敏***')
+  }
   /** Auto-stop: dim the button and gate forwarding WITHOUT deafening the
    * session listener — turn logging keeps running, and user speech (or a
    * button re-light) releases the gate so the loop can auto-resume. */
@@ -204,7 +211,7 @@ export function apply(ctx, config) {
   function sourceKind(data) {
     return data?.message?.source?.kind ?? data?.source?.kind ?? 'user'
   }
-  const OTHER_SOURCES = new Set(['inject', 'steering', 'time-context', 'agent-message', 'subagent-settled', 'system-reminder'])
+  const OTHER_SOURCES = new Set(['inject', 'steering', 'time-context', 'agent-message', 'subagent-settled', 'system-reminder', 'tool-jobs'])
   /** Compact summary of non-text content blocks (images, files, references). */
   function nonTextSummaries(data) {
     const m = data?.message ?? data
@@ -313,7 +320,7 @@ export function apply(ctx, config) {
       otherTasks.forEach((t) => parts.push(`[注入:${t.src}] ${t.text}`))
       attachTasks.forEach((t) => parts.push(t.text))
       if (b.texts?.length > 0) parts.push(`[主代理] ${b.texts.join('\n\n---\n\n')}`)
-      const forward = clip(`【PMO 轮次转发 · turn=${turn}】\n` + parts.join('\n'), config.maxChars * 2)
+      const forward = clip(redact(`【PMO 轮次转发 · turn=${turn}】\n` + parts.join('\n')), config.maxChars * 2)
       const agents = ctx.get('agents')
       const agent = agents && typeof agents.get === 'function' ? agents.get(sid) : undefined
       const subagentsSvc = ctx.get('subagents')
@@ -422,7 +429,7 @@ export function apply(ctx, config) {
         const srcKind = text.trimStart().startsWith('<system-reminder>')
           ? 'system-reminder'
           : sourceKind(event.data)
-        b.tasks.push({ src: srcKind, text })
+        b.tasks.push({ src: srcKind, text: redact(text) })
         for (const s of nonTextSummaries(event.data)) b.tasks.push({ src: '__attach__', text: s })
         // Recognize the PMO child's STATUS protocol from its settlement notice
         // or direct adjacent message, and record the review verdict.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suifei/dsh-pmo-button",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "description": "PMO 审查循环按钮 for DeepSeek Harness — 持久审查子代理 + 轮次转发 + STATUS 协议（CONTINUE/DONE/NEED_HUMAN）自动循环推进",
   "keywords": [
     "deepseek-harness", "dsh", "dsh-plugin", "pmo", "code-review",