dsh-global-todo 0.12.11 → 0.12.12

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+## [0.12.12] — 2026-10-21
+
+Three more silent coercions, found by reading the settings path instead of the tests.
+
+- **A Windows workspace exemption only covered its exact path.** `isExemptWorkspace` tested
+  `${root}/`, so `C:\dev` matched itself but not `C:\dev\sub` — an exemption that looks
+  configured and silently asks conversations it should skip. Separators are now normalized and
+  the check is case-insensitive on Windows only.
+- **`POST /settings` no longer coerces the wrong type.** The settings store is written for a
+  hand-edited file, where `autoCollect: "true"` becoming `false` and an unknown field being
+  ignored are reasonable; over HTTP they are typos that look successful. Booleans, arrays, the
+  token and the ingest sources are now type-checked, and an unknown key is `400` naming it.
+- **A fractional minute is refused** (`{idleMinutes: 30.5}` used to fall back to the default with
+  a 200). Same rule as every other out-of-range value.
+
 ## [0.12.11] — 2026-10-21
 
 One more silent fallback, found while re-reading the settings path.

package/lib/index.js

@@ -37,7 +37,7 @@ import { createStore, resolveStorePath } from './store.js'
 import { createTools } from './tools.js'
 
 /** Must equal `package.json`'s version; `npm run check` enforces that. */
-export const VERSION = '0.12.11'
+export const VERSION = '0.12.12'
 
 /** Plugin id. Also the Loader row id in `cordis.patch.yml`. */
 export const name = 'dsh-global-todo'

package/lib/routes.js

@@ -28,6 +28,7 @@ import path from 'node:path'
 import { TodoError, asTodoError } from './errors.js'
 import { MAX_INGEST_ITEMS } from './ingest.js'
 import { fromMarkdown, toMarkdown } from './markdown.js'
+import { INGEST_SOURCES } from './settings.js'
 import { weeklyReport } from './report.js'
 
 /** Route prefix. The client appends this to the document base. */
@@ -535,6 +536,7 @@ export function createRoutes(deps) {
       // The settings store clamps silently, which is right for a hand-edited file and wrong
       // for an API: `{idleMinutes: -5}` answering 200-but-5 hides the rejected intent. A
       // provided value outside its range is reported instead.
+      assertSettingsShape(body ?? {})
       assertSettingsRange(body ?? {})
       const next = await deps.settings.update(body ?? {})
       return {
@@ -735,6 +737,47 @@ export function createRoutes(deps) {
   ]
 }
 
+/**
+ * Types the settings route insists on, because the store coerces instead of rejecting.
+ *
+ * \`normalizeSettings\` is written for a hand-edited file: \`autoCollect: "true"\` becomes
+ * false, an unknown source is dropped, a typo silently changes nothing. That is the right
+ * behaviour when reading a file and the wrong behaviour for a request.
+ *
+ * @param {Record<string, unknown>} body
+ */
+function assertSettingsShape(body) {
+  const known = ['autoCollect', 'idleMinutes', 'cooldownMinutes', 'exemptWorkspaces', 'ingestEnabled', 'ingestSources', 'ingestConfirmBelow', 'ingestToken', 'remindersEnabled', 'reminderLeadMinutes']
+  for (const key of Object.keys(body)) {
+    if (!known.includes(key)) {
+      throw new TodoError('invalid-body', '未知的设置项 ' + key + '；可写的是 ' + known.join(' / '))
+    }
+  }
+  for (const field of ['autoCollect', 'ingestEnabled', 'remindersEnabled']) {
+    const value = body[field]
+    if (value !== undefined && typeof value !== 'boolean') {
+      throw new TodoError('invalid-body', field + ' 必须是 true / false，收到 ' + JSON.stringify(value))
+    }
+  }
+  if (body.ingestToken !== undefined && typeof body.ingestToken !== 'string') {
+    throw new TodoError('invalid-body', 'ingestToken 必须是字符串')
+  }
+  if (body.exemptWorkspaces !== undefined) {
+    if (!Array.isArray(body.exemptWorkspaces) || body.exemptWorkspaces.some((entry) => typeof entry !== 'string')) {
+      throw new TodoError('invalid-body', 'exemptWorkspaces 必须是字符串数组')
+    }
+  }
+  if (body.ingestSources !== undefined) {
+    if (!Array.isArray(body.ingestSources)) {
+      throw new TodoError('invalid-body', 'ingestSources 必须是数组')
+    }
+    const bad = body.ingestSources.filter((entry) => typeof entry !== 'string' || !INGEST_SOURCES.includes(entry))
+    if (bad.length > 0) {
+      throw new TodoError('invalid-body', 'ingestSources 只能是 ' + INGEST_SOURCES.join(' / ') + '，收到 ' + bad.join(', '))
+    }
+  }
+}
+
 /**
  * Ranges the settings route refuses, mirroring the clamps in `normalizeSettings`.
  *

package/lib/settings.js

@@ -145,12 +145,31 @@ export function normalizeSettings(raw) {
  * @param {string[]} exemptWorkspaces
  * @returns {boolean}
  */
+/**
+ * One separator for comparisons, whatever the platform wrote.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+function normalizeSeparators(value) {
+  return value.replace(/\\/g, '/')
+}
 export function isExemptWorkspace(sessionDir, exemptWorkspaces) {
   if (typeof sessionDir !== 'string' || sessionDir === '') return false
-  const dir = sessionDir.replace(/\/+$/, '')
-  return (Array.isArray(exemptWorkspaces) ? exemptWorkspaces : []).some(
-    (root) => typeof root === 'string' && root !== '' && (dir === root || dir.startsWith(`${root}/`)),
-  )
+  // Compare on one separator: a Windows exemption of `C:\\dev` has to cover `C:\\dev\\sub`,
+  // and the old `${root}/` test made that false there while the exact match still worked —
+  // a half-working exemption is worse than none, because it looks configured.
+  const dir = normalizeSeparators(sessionDir).replace(/\/+$/, '')
+  const inWindows = process.platform === 'win32'
+  return (Array.isArray(exemptWorkspaces) ? exemptWorkspaces : []).some((root) => {
+    if (typeof root !== 'string' || root === '') return false
+    const base = normalizeSeparators(root).replace(/\/+$/, '')
+    const same = inWindows ? dir.toLowerCase() === base.toLowerCase() : dir === base
+    const inside = inWindows
+      ? dir.toLowerCase().startsWith(`${base.toLowerCase()}/`)
+      : dir.startsWith(`${base}/`)
+    return same || inside
+  })
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-global-todo",
-  "version": "0.12.11",
+  "version": "0.12.12",
   "icon": "./docs/icon.svg",
   "description": "Cross-session todo list for DeepSeek Harness: one JSON file a person and an agent both write to, with step plans that ship as a numbered hand-off, session read-back, and a human confirmation before an agent's \"done\" counts.",
   "type": "module",