dsh-global-todo 0.12.10 → 0.12.12

package/CHANGELOG.md

@@ -1,3 +1,27 @@
+## [0.12.12] — 2026-10-21
+
+Three more silent coercions, found by reading the settings path instead of the tests.
+
+- **A Windows workspace exemption only covered its exact path.** `isExemptWorkspace` tested
+  `${root}/`, so `C:\dev` matched itself but not `C:\dev\sub` — an exemption that looks
+  configured and silently asks conversations it should skip. Separators are now normalized and
+  the check is case-insensitive on Windows only.
+- **`POST /settings` no longer coerces the wrong type.** The settings store is written for a
+  hand-edited file, where `autoCollect: "true"` becoming `false` and an unknown field being
+  ignored are reasonable; over HTTP they are typos that look successful. Booleans, arrays, the
+  token and the ingest sources are now type-checked, and an unknown key is `400` naming it.
+- **A fractional minute is refused** (`{idleMinutes: 30.5}` used to fall back to the default with
+  a 200). Same rule as every other out-of-range value.
+
+## [0.12.11] — 2026-10-21
+
+One more silent fallback, found while re-reading the settings path.
+
+- **`{idleMinutes: 30.5}` was accepted and then ignored.** `normalizeSettings` only keeps
+  integers for the minute fields and otherwise falls back to the default, so the request looked
+  like it worked while the value never changed. The settings route now rejects a fractional
+  minute with `400 invalid-body`, like every other out-of-range value.
+
 ## [0.12.10] — 2026-10-21
 
 Two follow-ups from #3, plus the notification channel this repository actually has.

package/docs/DISTRIBUTION.md

@@ -15,10 +15,10 @@ of trusting this table.
 
 | Registry | Form | What it gives you | Verified state |
 |---|---|---|---|
-| **npm** | the package | the install path | `dsh-global-todo@0.11.2` |
+| **npm** | the package | the install path | `dsh-global-todo@0.12.10` |
 | **1024 Store** ([deepseek1024.com](https://deepseek1024.com)) · [repo](https://github.com/imsai-sh/awesome-deepseek-harness-plugins) | catalog entry, merged [#654](https://github.com/imsai-sh/awesome-deepseek-harness-plugins/pull/654) | searchable, has a public API | 🟡 entry live, but its install line still resolves to `github:LUgABeEEE/dsh-global-todo` — their npm enrichment has not caught up. Install works either way. |
 | **dsh.pub** · [page](https://dsh.pub/en/plugins/dsh-global-todo/) | published page + `dshpub` CLI | `npx dshpub add LUgABeEEE/dsh-global-todo` | ✅ page live, pinned to a commit |
-| **DSH-Plugins-Marketplace** ([bradeGithub](https://github.com/bradeGithub/DSH-Plugins-Marketplace)) | `registry.json`, collected from the `dsh-plugin` topic | one-click install inside DSH | ✅ `v0.11.2`, risk tier `safe` |
+| **DSH-Plugins-Marketplace** ([bradeGithub](https://github.com/bradeGithub/DSH-Plugins-Marketplace)) | `registry.json`, collected from the `dsh-plugin` topic | one-click install inside DSH | ✅ `v0.12.x`, risk tier `safe` |
 | **awesome-dsh-plugin** ([19.7k★](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin)) | one YAML per plugin | the largest directory | ✅ merged [#7498](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/7498) |
 | **walkinglabs/awesome-deepseek-harness-plugins** | README entry (source-verified list) | review-backed listing | ✅ merged [#114](https://github.com/walkinglabs/awesome-deepseek-harness-plugins/pull/114) |
 

package/lib/index.js

@@ -37,7 +37,7 @@ import { createStore, resolveStorePath } from './store.js'
 import { createTools } from './tools.js'
 
 /** Must equal `package.json`'s version; `npm run check` enforces that. */
-export const VERSION = '0.12.10'
+export const VERSION = '0.12.12'
 
 /** Plugin id. Also the Loader row id in `cordis.patch.yml`. */
 export const name = 'dsh-global-todo'

package/lib/routes.js

@@ -28,6 +28,7 @@ import path from 'node:path'
 import { TodoError, asTodoError } from './errors.js'
 import { MAX_INGEST_ITEMS } from './ingest.js'
 import { fromMarkdown, toMarkdown } from './markdown.js'
+import { INGEST_SOURCES } from './settings.js'
 import { weeklyReport } from './report.js'
 
 /** Route prefix. The client appends this to the document base. */
@@ -535,6 +536,7 @@ export function createRoutes(deps) {
       // The settings store clamps silently, which is right for a hand-edited file and wrong
       // for an API: `{idleMinutes: -5}` answering 200-but-5 hides the rejected intent. A
       // provided value outside its range is reported instead.
+      assertSettingsShape(body ?? {})
       assertSettingsRange(body ?? {})
       const next = await deps.settings.update(body ?? {})
       return {
@@ -735,6 +737,47 @@ export function createRoutes(deps) {
   ]
 }
 
+/**
+ * Types the settings route insists on, because the store coerces instead of rejecting.
+ *
+ * \`normalizeSettings\` is written for a hand-edited file: \`autoCollect: "true"\` becomes
+ * false, an unknown source is dropped, a typo silently changes nothing. That is the right
+ * behaviour when reading a file and the wrong behaviour for a request.
+ *
+ * @param {Record<string, unknown>} body
+ */
+function assertSettingsShape(body) {
+  const known = ['autoCollect', 'idleMinutes', 'cooldownMinutes', 'exemptWorkspaces', 'ingestEnabled', 'ingestSources', 'ingestConfirmBelow', 'ingestToken', 'remindersEnabled', 'reminderLeadMinutes']
+  for (const key of Object.keys(body)) {
+    if (!known.includes(key)) {
+      throw new TodoError('invalid-body', '未知的设置项 ' + key + '；可写的是 ' + known.join(' / '))
+    }
+  }
+  for (const field of ['autoCollect', 'ingestEnabled', 'remindersEnabled']) {
+    const value = body[field]
+    if (value !== undefined && typeof value !== 'boolean') {
+      throw new TodoError('invalid-body', field + ' 必须是 true / false，收到 ' + JSON.stringify(value))
+    }
+  }
+  if (body.ingestToken !== undefined && typeof body.ingestToken !== 'string') {
+    throw new TodoError('invalid-body', 'ingestToken 必须是字符串')
+  }
+  if (body.exemptWorkspaces !== undefined) {
+    if (!Array.isArray(body.exemptWorkspaces) || body.exemptWorkspaces.some((entry) => typeof entry !== 'string')) {
+      throw new TodoError('invalid-body', 'exemptWorkspaces 必须是字符串数组')
+    }
+  }
+  if (body.ingestSources !== undefined) {
+    if (!Array.isArray(body.ingestSources)) {
+      throw new TodoError('invalid-body', 'ingestSources 必须是数组')
+    }
+    const bad = body.ingestSources.filter((entry) => typeof entry !== 'string' || !INGEST_SOURCES.includes(entry))
+    if (bad.length > 0) {
+      throw new TodoError('invalid-body', 'ingestSources 只能是 ' + INGEST_SOURCES.join(' / ') + '，收到 ' + bad.join(', '))
+    }
+  }
+}
+
 /**
  * Ranges the settings route refuses, mirroring the clamps in `normalizeSettings`.
  *
@@ -742,17 +785,22 @@ export function createRoutes(deps) {
  */
 function assertSettingsRange(body) {
   const ranges = {
-    idleMinutes: [5, 24 * 60],
-    cooldownMinutes: [5, 24 * 60],
-    ingestConfirmBelow: [0, 1],
-    reminderLeadMinutes: [0, 24 * 60],
+    idleMinutes: [5, 24 * 60, true],
+    cooldownMinutes: [5, 24 * 60, true],
+    ingestConfirmBelow: [0, 1, false],
+    reminderLeadMinutes: [0, 24 * 60, true],
   }
-  for (const [field, [low, high]] of Object.entries(ranges)) {
+  for (const [field, [low, high, whole]] of Object.entries(ranges)) {
     const value = body[field]
     if (value === undefined || value === null) continue
     if (typeof value !== 'number' || !Number.isFinite(value)) {
       throw new TodoError('invalid-body', `${field} 必须是数字（${low}–${high}）`)
     }
+    // normalizeSettings only accepts integers for the minute fields and otherwise falls back
+    // to the default — a silently ignored 30.5 is the same trap as a silent clamp.
+    if (whole === true && !Number.isInteger(value)) {
+      throw new TodoError('invalid-body', `${field} 必须是整数分钟，收到 ${value}`)
+    }
     if (value < low || value > high) {
       throw new TodoError('invalid-body', `${field} 必须在 ${low}–${high} 之间，收到 ${value}`)
     }

package/lib/settings.js

@@ -145,12 +145,31 @@ export function normalizeSettings(raw) {
  * @param {string[]} exemptWorkspaces
  * @returns {boolean}
  */
+/**
+ * One separator for comparisons, whatever the platform wrote.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+function normalizeSeparators(value) {
+  return value.replace(/\\/g, '/')
+}
 export function isExemptWorkspace(sessionDir, exemptWorkspaces) {
   if (typeof sessionDir !== 'string' || sessionDir === '') return false
-  const dir = sessionDir.replace(/\/+$/, '')
-  return (Array.isArray(exemptWorkspaces) ? exemptWorkspaces : []).some(
-    (root) => typeof root === 'string' && root !== '' && (dir === root || dir.startsWith(`${root}/`)),
-  )
+  // Compare on one separator: a Windows exemption of `C:\\dev` has to cover `C:\\dev\\sub`,
+  // and the old `${root}/` test made that false there while the exact match still worked —
+  // a half-working exemption is worse than none, because it looks configured.
+  const dir = normalizeSeparators(sessionDir).replace(/\/+$/, '')
+  const inWindows = process.platform === 'win32'
+  return (Array.isArray(exemptWorkspaces) ? exemptWorkspaces : []).some((root) => {
+    if (typeof root !== 'string' || root === '') return false
+    const base = normalizeSeparators(root).replace(/\/+$/, '')
+    const same = inWindows ? dir.toLowerCase() === base.toLowerCase() : dir === base
+    const inside = inWindows
+      ? dir.toLowerCase().startsWith(`${base.toLowerCase()}/`)
+      : dir.startsWith(`${base}/`)
+    return same || inside
+  })
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-global-todo",
-  "version": "0.12.10",
+  "version": "0.12.12",
   "icon": "./docs/icon.svg",
   "description": "Cross-session todo list for DeepSeek Harness: one JSON file a person and an agent both write to, with step plans that ship as a numbered hand-off, session read-back, and a human confirmation before an agent's \"done\" counts.",
   "type": "module",