dsh-global-todo 0.12.10 → 0.12.11

package/CHANGELOG.md

@@ -1,3 +1,12 @@
+## [0.12.11] — 2026-10-21
+
+One more silent fallback, found while re-reading the settings path.
+
+- **`{idleMinutes: 30.5}` was accepted and then ignored.** `normalizeSettings` only keeps
+  integers for the minute fields and otherwise falls back to the default, so the request looked
+  like it worked while the value never changed. The settings route now rejects a fractional
+  minute with `400 invalid-body`, like every other out-of-range value.
+
 ## [0.12.10] — 2026-10-21
 
 Two follow-ups from #3, plus the notification channel this repository actually has.

package/docs/DISTRIBUTION.md

@@ -15,10 +15,10 @@ of trusting this table.
 
 | Registry | Form | What it gives you | Verified state |
 |---|---|---|---|
-| **npm** | the package | the install path | `dsh-global-todo@0.11.2` |
+| **npm** | the package | the install path | `dsh-global-todo@0.12.10` |
 | **1024 Store** ([deepseek1024.com](https://deepseek1024.com)) · [repo](https://github.com/imsai-sh/awesome-deepseek-harness-plugins) | catalog entry, merged [#654](https://github.com/imsai-sh/awesome-deepseek-harness-plugins/pull/654) | searchable, has a public API | 🟡 entry live, but its install line still resolves to `github:LUgABeEEE/dsh-global-todo` — their npm enrichment has not caught up. Install works either way. |
 | **dsh.pub** · [page](https://dsh.pub/en/plugins/dsh-global-todo/) | published page + `dshpub` CLI | `npx dshpub add LUgABeEEE/dsh-global-todo` | ✅ page live, pinned to a commit |
-| **DSH-Plugins-Marketplace** ([bradeGithub](https://github.com/bradeGithub/DSH-Plugins-Marketplace)) | `registry.json`, collected from the `dsh-plugin` topic | one-click install inside DSH | ✅ `v0.11.2`, risk tier `safe` |
+| **DSH-Plugins-Marketplace** ([bradeGithub](https://github.com/bradeGithub/DSH-Plugins-Marketplace)) | `registry.json`, collected from the `dsh-plugin` topic | one-click install inside DSH | ✅ `v0.12.x`, risk tier `safe` |
 | **awesome-dsh-plugin** ([19.7k★](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin)) | one YAML per plugin | the largest directory | ✅ merged [#7498](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/7498) |
 | **walkinglabs/awesome-deepseek-harness-plugins** | README entry (source-verified list) | review-backed listing | ✅ merged [#114](https://github.com/walkinglabs/awesome-deepseek-harness-plugins/pull/114) |
 

package/lib/index.js

@@ -37,7 +37,7 @@ import { createStore, resolveStorePath } from './store.js'
 import { createTools } from './tools.js'
 
 /** Must equal `package.json`'s version; `npm run check` enforces that. */
-export const VERSION = '0.12.10'
+export const VERSION = '0.12.11'
 
 /** Plugin id. Also the Loader row id in `cordis.patch.yml`. */
 export const name = 'dsh-global-todo'

package/lib/routes.js

@@ -742,17 +742,22 @@ export function createRoutes(deps) {
  */
 function assertSettingsRange(body) {
   const ranges = {
-    idleMinutes: [5, 24 * 60],
-    cooldownMinutes: [5, 24 * 60],
-    ingestConfirmBelow: [0, 1],
-    reminderLeadMinutes: [0, 24 * 60],
+    idleMinutes: [5, 24 * 60, true],
+    cooldownMinutes: [5, 24 * 60, true],
+    ingestConfirmBelow: [0, 1, false],
+    reminderLeadMinutes: [0, 24 * 60, true],
   }
-  for (const [field, [low, high]] of Object.entries(ranges)) {
+  for (const [field, [low, high, whole]] of Object.entries(ranges)) {
     const value = body[field]
     if (value === undefined || value === null) continue
     if (typeof value !== 'number' || !Number.isFinite(value)) {
       throw new TodoError('invalid-body', `${field} 必须是数字（${low}–${high}）`)
     }
+    // normalizeSettings only accepts integers for the minute fields and otherwise falls back
+    // to the default — a silently ignored 30.5 is the same trap as a silent clamp.
+    if (whole === true && !Number.isInteger(value)) {
+      throw new TodoError('invalid-body', `${field} 必须是整数分钟，收到 ${value}`)
+    }
     if (value < low || value > high) {
       throw new TodoError('invalid-body', `${field} 必须在 ${low}–${high} 之间，收到 ${value}`)
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-global-todo",
-  "version": "0.12.10",
+  "version": "0.12.11",
   "icon": "./docs/icon.svg",
   "description": "Cross-session todo list for DeepSeek Harness: one JSON file a person and an agent both write to, with step plans that ship as a numbered hand-off, session read-back, and a human confirmation before an agent's \"done\" counts.",
   "type": "module",