dsh-global-todo 0.12.2 → 0.12.4

package/CHANGELOG.md

@@ -1,3 +1,36 @@
+## [0.12.4] — 2026-10-21
+
+The repository leaked its own location. Three real paths, and a guard that could not see them.
+
+- **Removed the absolute paths**: `AGENTS.md` named the guard by full path (now `$DSH_HOME/…`),
+  `tools/demo/seed.mjs` hard-coded the checkout (now resolved from `import.meta.url`),
+  `tools/demo/capture.mjs` hard-coded Playwright's location in one profile (now
+  `PLAYWRIGHT_MODULE` or the normal resolution), and `tools/demo/scenes.sh` hard-coded a font in
+  one home (now `DEMO_FONT`, else fontconfig).
+- **The rule can now see them.** It only knew `/home/<user>/` and `/Users/<user>/`. It also
+  rejects Windows profile paths and any path containing this checkout's own home or directory —
+  computed at run time, so the repository cannot know every layout but it does know the one
+  running the check. Both shapes were verified by planting a file and watching the check fail.
+- **The file list comes from git.** The hand-kept ignore list had drifted from `.gitignore`:
+  `reports/` and `.agent-teams/` were ignored by git yet still scanned, so a clean tree reported
+  four failures nobody could act on. `git ls-files --cached --others --exclude-standard` is now
+  the single source of truth, with the walker kept as a fallback. `reports/` also joined
+  `.gitignore`, where it belonged.
+
+## [0.12.3] — 2026-10-21
+
+A desktop report explained, and the packaging contract behind it guarded.
+
+- **`docs/FAQ.md` §15** answers `Plugin metadata … ENOENT … \locale`: the Host resolves
+  `<pkg>/locale/en.json` through the `exports` wildcard (which Node resolves **without** checking
+  the file), then scans that directory. A hand-copied `plugins-local` folder that kept `lib/`,
+  `package.json` and the patch but dropped `locale/` therefore reports this — while the plugin
+  itself still loads. The entry gives both fixes (install from npm, or copy `locale/` and
+  `docs/icon.svg` into the local folder) and says the metadata is read once at startup.
+- **`test/manifest.test.mjs` now asserts the contract**: the `./locale/*.json` export exists and
+  `locale` is in `files`. Drop either and the plugins page silently loses its title, description
+  and icon — the exact failure that shipped as a user-visible error.
+
 ## [0.12.2] — 2026-10-21
 
 The description reached the last two places it was still thin.

package/docs/FAQ.md

@@ -157,3 +157,34 @@ rm -r "$DSH_HOME/global-todo"
 失败一定带原因，也记在详情的「最近派发」里；不会静默什么都不做。
 
 
+## 15. 桌面端报 `Plugin metadata … ENOENT … \locale` 是什么？
+
+**插件本身已经加载了，这是「显示文字」取不到**，不影响面板和工具。宿主读插件页标题/描述的顺序是：
+先解析 `<包>/locale/en.json`（走 `exports` 里的 `./locale/*.json`），解析成功后**扫这个目录**，
+把 `zh.json`/`en.json` 逐个读进来。目录不存在，扫描就抛 ENOENT，于是元信息报错。
+
+也就是说：**你那份本地插件目录缺 `locale/` 文件夹**。常见于把仓库文件夹手动复制到
+`%USERPROFILE%\.dsh\plugins-local\` 时只拷了 `lib`、`package.json`、`cordis.patch.yml`。
+
+修法二选一：
+
+1. **推荐**：别用本地目录，直接装 npm 包（包里有 `locale/en.json`、`locale/zh.json`）：
+
+   ```powershell
+   dsh plugin add dsh-global-todo
+   ```
+
+2. 保留本地目录，把缺的补齐（`$src` 换成仓库或 npm 包里那份）：
+
+   ```powershell
+   $dst = "$env:USERPROFILE\.dsh\plugins-local\全局待办插件"
+   $src = "C:\path\to\dsh-global-todo"
+   New-Item -ItemType Directory -Force "$dst\locale" | Out-Null
+   Copy-Item "$src\locale\*.json" "$dst\locale\" -Force
+   Copy-Item "$src\docs\icon.svg" "$dst\docs\" -Force   # 图标同理会报错
+   ```
+
+   然后重启宿主（插件元信息在启动时读一次）。
+
+为什么会这么脆：`exports` 的 `./locale/*.json` 是**通配映射**，Node 解析它时不检查文件是否存在，
+所以宿主以为文件在、去扫目录，才发现没有。完整安装不会触发；只有手工拷半份才会。

package/lib/index.js

@@ -36,7 +36,7 @@ import { createStore, resolveStorePath } from './store.js'
 import { createTools } from './tools.js'
 
 /** Must equal `package.json`'s version; `npm run check` enforces that. */
-export const VERSION = '0.12.2'
+export const VERSION = '0.12.4'
 
 /** Plugin id. Also the Loader row id in `cordis.patch.yml`. */
 export const name = 'dsh-global-todo'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-global-todo",
-  "version": "0.12.2",
+  "version": "0.12.4",
   "icon": "./docs/icon.svg",
   "description": "Cross-session todo list for DeepSeek Harness: one JSON file a person and an agent both write to, with step plans that ship as a numbered hand-off, session read-back, and a human confirmation before an agent's \"done\" counts.",
   "type": "module",