dsh-global-todo 0.12.11 → 0.12.13

package/CHANGELOG.md

@@ -1,3 +1,32 @@
+## [0.12.13] — 2026-10-21
+
+The dedupe promise now holds for short titles (#4).
+
+- **An appended addendum counts as the same errand, at any title length.** `similar-recently-done`
+  relied on symmetric Dice, which mathematically cannot reach 0.8 once 「（再办一次）」 is appended
+  to a short title: 「X」 scored 0.00 and 「T3 逾期项」 0.67, both accepted, while the padded test
+  title passed. Titles are now compared with their trailing brackets stripped, and rejected when
+  the rest is identical and one raw title is a prefix of the other.
+- **A *replaced* parenthetical is still a different errand.** 「修 A（后端）」 vs 「修 A（前端）」 strips
+  to the same text but replaces a word instead of appending one, so the prefix test refuses it.
+- **The tests use the examples the comments and release notes promised** — `X`, `T3 逾期项`,
+  `写周报`, `配置小米 NAS 证书`, `A` — instead of only a padded title that happened to pass.
+
+## [0.12.12] — 2026-10-21
+
+Three more silent coercions, found by reading the settings path instead of the tests.
+
+- **A Windows workspace exemption only covered its exact path.** `isExemptWorkspace` tested
+  `${root}/`, so `C:\dev` matched itself but not `C:\dev\sub` — an exemption that looks
+  configured and silently asks conversations it should skip. Separators are now normalized and
+  the check is case-insensitive on Windows only.
+- **`POST /settings` no longer coerces the wrong type.** The settings store is written for a
+  hand-edited file, where `autoCollect: "true"` becoming `false` and an unknown field being
+  ignored are reasonable; over HTTP they are typos that look successful. Booleans, arrays, the
+  token and the ingest sources are now type-checked, and an unknown key is `400` naming it.
+- **A fractional minute is refused** (`{idleMinutes: 30.5}` used to fall back to the default with
+  a 200). Same rule as every other out-of-range value.
+
 ## [0.12.11] — 2026-10-21
 
 One more silent fallback, found while re-reading the settings path.

package/lib/capture.js

@@ -30,6 +30,42 @@ export function normalizeTitle(title) {
   return String(title ?? '').normalize('NFKC').toLowerCase().replace(/[\s\p{P}\p{S}]+/gu, '')
 }
 
+
+/**
+ * A trailing parenthetical/【…】 addendum, e.g. 「（再办一次）」.
+ *
+ * Titles like that are the common way a person says "the same errand again", and symmetric
+ * Dice cannot see them on short titles: the addendum inflates the denominator, so 「X」 vs
+ * 「X（再办一次）」 scores 0 no matter what the threshold is.
+ *
+ * @param {unknown} title
+ * @returns {string}
+ */
+export function stripAddenda(title) {
+  const text = String(title ?? '')
+  return text.replace(/(\s*[（(【\[][^）)】\]]*[）)】\]]\s*)+$/u, '')
+}
+
+/**
+ * Is `candidate` the same errand as `existing`, with only an addendum appended?
+ *
+ * The stripped titles must be identical, and one raw title must be a prefix of the other:
+ * that rules out 「修 A（后端）」 vs 「修 A（前端）」, which strip to the same text but replace
+ * a word instead of appending one.
+ *
+ * @param {unknown} candidate
+ * @param {unknown} existing
+ * @returns {boolean}
+ */
+function isAppendedVariant(candidate, existing) {
+  const a = normalizeTitle(candidate)
+  const b = normalizeTitle(existing)
+  if (a === '' || b === '') return false
+  const sa = normalizeTitle(stripAddenda(candidate))
+  const sb = normalizeTitle(stripAddenda(existing))
+  if (sa === '' || sb === '' || sa !== sb) return false
+  return a === b || a.startsWith(b) || b.startsWith(a)
+}
 /** @param {string} text @returns {Set<string>} */
 function bigrams(text) {
   const chars = [...text]
@@ -91,10 +127,12 @@ export function findDuplicate(input) {
       if (now - created < windowMs && similarity(title, todo.title) >= threshold) {
         return { duplicate: true, reason: 'similar-active', matchId: todo.id }
       }
-    } else if (now - doneAt < cooldownMs && similarity(title, todo.title) >= threshold) {
-      // The cooldown was exact-title only, so 「T3 逾期项」 finished two minutes ago and
-      // 「T3 逾期项（再办一次）」 was accepted — the same errand, re-registered. Similar
-      // wording counts here for the same reason it counts among active rows.
+    } else if (
+      now - doneAt < cooldownMs &&
+      // Symmetric Dice alone only catches long titles: 「X」 vs 「X（再办一次）」 scores 0.
+      // An appended addendum is its own signal, so it is checked before the score.
+      (isAppendedVariant(title, todo.title) || similarity(title, todo.title) >= threshold)
+    ) {
       return { duplicate: true, reason: 'similar-recently-done', matchId: todo.id }
     }
   }

package/lib/index.js

@@ -37,7 +37,7 @@ import { createStore, resolveStorePath } from './store.js'
 import { createTools } from './tools.js'
 
 /** Must equal `package.json`'s version; `npm run check` enforces that. */
-export const VERSION = '0.12.11'
+export const VERSION = '0.12.13'
 
 /** Plugin id. Also the Loader row id in `cordis.patch.yml`. */
 export const name = 'dsh-global-todo'

package/lib/routes.js

@@ -28,6 +28,7 @@ import path from 'node:path'
 import { TodoError, asTodoError } from './errors.js'
 import { MAX_INGEST_ITEMS } from './ingest.js'
 import { fromMarkdown, toMarkdown } from './markdown.js'
+import { INGEST_SOURCES } from './settings.js'
 import { weeklyReport } from './report.js'
 
 /** Route prefix. The client appends this to the document base. */
@@ -535,6 +536,7 @@ export function createRoutes(deps) {
       // The settings store clamps silently, which is right for a hand-edited file and wrong
       // for an API: `{idleMinutes: -5}` answering 200-but-5 hides the rejected intent. A
       // provided value outside its range is reported instead.
+      assertSettingsShape(body ?? {})
       assertSettingsRange(body ?? {})
       const next = await deps.settings.update(body ?? {})
       return {
@@ -735,6 +737,47 @@ export function createRoutes(deps) {
   ]
 }
 
+/**
+ * Types the settings route insists on, because the store coerces instead of rejecting.
+ *
+ * \`normalizeSettings\` is written for a hand-edited file: \`autoCollect: "true"\` becomes
+ * false, an unknown source is dropped, a typo silently changes nothing. That is the right
+ * behaviour when reading a file and the wrong behaviour for a request.
+ *
+ * @param {Record<string, unknown>} body
+ */
+function assertSettingsShape(body) {
+  const known = ['autoCollect', 'idleMinutes', 'cooldownMinutes', 'exemptWorkspaces', 'ingestEnabled', 'ingestSources', 'ingestConfirmBelow', 'ingestToken', 'remindersEnabled', 'reminderLeadMinutes']
+  for (const key of Object.keys(body)) {
+    if (!known.includes(key)) {
+      throw new TodoError('invalid-body', '未知的设置项 ' + key + '；可写的是 ' + known.join(' / '))
+    }
+  }
+  for (const field of ['autoCollect', 'ingestEnabled', 'remindersEnabled']) {
+    const value = body[field]
+    if (value !== undefined && typeof value !== 'boolean') {
+      throw new TodoError('invalid-body', field + ' 必须是 true / false，收到 ' + JSON.stringify(value))
+    }
+  }
+  if (body.ingestToken !== undefined && typeof body.ingestToken !== 'string') {
+    throw new TodoError('invalid-body', 'ingestToken 必须是字符串')
+  }
+  if (body.exemptWorkspaces !== undefined) {
+    if (!Array.isArray(body.exemptWorkspaces) || body.exemptWorkspaces.some((entry) => typeof entry !== 'string')) {
+      throw new TodoError('invalid-body', 'exemptWorkspaces 必须是字符串数组')
+    }
+  }
+  if (body.ingestSources !== undefined) {
+    if (!Array.isArray(body.ingestSources)) {
+      throw new TodoError('invalid-body', 'ingestSources 必须是数组')
+    }
+    const bad = body.ingestSources.filter((entry) => typeof entry !== 'string' || !INGEST_SOURCES.includes(entry))
+    if (bad.length > 0) {
+      throw new TodoError('invalid-body', 'ingestSources 只能是 ' + INGEST_SOURCES.join(' / ') + '，收到 ' + bad.join(', '))
+    }
+  }
+}
+
 /**
  * Ranges the settings route refuses, mirroring the clamps in `normalizeSettings`.
  *

package/lib/settings.js

@@ -145,12 +145,31 @@ export function normalizeSettings(raw) {
  * @param {string[]} exemptWorkspaces
  * @returns {boolean}
  */
+/**
+ * One separator for comparisons, whatever the platform wrote.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+function normalizeSeparators(value) {
+  return value.replace(/\\/g, '/')
+}
 export function isExemptWorkspace(sessionDir, exemptWorkspaces) {
   if (typeof sessionDir !== 'string' || sessionDir === '') return false
-  const dir = sessionDir.replace(/\/+$/, '')
-  return (Array.isArray(exemptWorkspaces) ? exemptWorkspaces : []).some(
-    (root) => typeof root === 'string' && root !== '' && (dir === root || dir.startsWith(`${root}/`)),
-  )
+  // Compare on one separator: a Windows exemption of `C:\\dev` has to cover `C:\\dev\\sub`,
+  // and the old `${root}/` test made that false there while the exact match still worked —
+  // a half-working exemption is worse than none, because it looks configured.
+  const dir = normalizeSeparators(sessionDir).replace(/\/+$/, '')
+  const inWindows = process.platform === 'win32'
+  return (Array.isArray(exemptWorkspaces) ? exemptWorkspaces : []).some((root) => {
+    if (typeof root !== 'string' || root === '') return false
+    const base = normalizeSeparators(root).replace(/\/+$/, '')
+    const same = inWindows ? dir.toLowerCase() === base.toLowerCase() : dir === base
+    const inside = inWindows
+      ? dir.toLowerCase().startsWith(`${base.toLowerCase()}/`)
+      : dir.startsWith(`${base}/`)
+    return same || inside
+  })
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-global-todo",
-  "version": "0.12.11",
+  "version": "0.12.13",
   "icon": "./docs/icon.svg",
   "description": "Cross-session todo list for DeepSeek Harness: one JSON file a person and an agent both write to, with step plans that ship as a numbered hand-off, session read-back, and a human confirmation before an agent's \"done\" counts.",
   "type": "module",