dsh-global-todo 0.12.7 → 0.12.9

package/CHANGELOG.md

@@ -1,3 +1,51 @@
+## [0.12.9] — 2026-10-21
+
+Everything a Windows tester found in a 41-case sweep, answered (#3).
+
+- **`P0`–`P3` are accepted as input.** The panel printed the labels and the API rejected them.
+  `priority: "P0"` now means `urgent` (likewise `P1`–`P3`), in create and in patch.
+- **A paraphrase of something finished minutes ago is the same errand.** The 7-day cooldown only
+  compared exact titles, so 「T3 逾期项（再办一次）」 slipped past a row completed a minute earlier.
+  Similar wording now counts, with its own reason (`similar-recently-done`).
+- **`POST /note` needs text.** An empty note appended a nameless entry to the activity trail; it is
+  now `400 invalid-body`.
+- **`POST /diagnostics` needs a scope.** Without it every report collapsed into one nameless bucket
+  in `/health`.
+- **A missing `id` is a bad body, not a missing record.** `POST /dispatch {}` answered 404; it is 400
+  now, matching the documented error contract.
+- **One bad ingest row no longer aborts the batch.** Each item is isolated (like capture), and the
+  ingest title cap is the model's own 200 rather than a second opinion at 500.
+- **Out-of-range settings are reported.** `{idleMinutes: -5}` answered 200 with 5; a provided value
+  outside its range is `400 invalid-body` instead of a silent clamp.
+- **`POST /restore` refuses partial records.** `{id, title}` used to restore with an invented
+  `createdAt`, empty tags and a reassigned `seq`; a lossy success is worse than a refusal.
+- **`/health` says when the installed package is newer than the running module**
+  (`packageVersion`, `stale`), which is the silent trap behind "I upgraded and the panel calls a
+  route that 404s".
+- **Smaller ones**: `invalid-evidence` / `invalid-steps` / `invalid-decision` are now listed in
+  `ERROR_CODES`; an over-long step is rejected like an over-long list (both used to differ); the
+  Markdown section notes that `doing`/`cancelled` come back as `open`.
+- **Reviewed, not changed**: an agent completion already sets `review.pending` in every path
+  (`model.js:545/641/685`), so the auto-complete case the report describes is covered since 0.7.
+
+## [0.12.8] — 2026-10-21
+
+The Windows runner kept finding things after 0.12.7. Four more, all real.
+
+- **`mkdir` over a file is `EEXIST` on Windows**, not `ENOTDIR`. The store translated only the
+  POSIX code, so an unwritable location could surface as a raw error; both now become
+  `store-unwritable`.
+- **The diagnostics trim could lose its rename** while a reader held the log. The atomic write is
+  now shared (`lib/atomic.js`) by the store, settings and diagnostics, with a longer retry budget
+  for a file that is read constantly.
+- **`tools/preview.mjs` created a directory named `panel.html`** on Windows: it stripped the file
+  name with a SQL-style regex on `/`, which matched nothing there. `path.dirname` instead — this is
+  what made `npm pack --dry-run` fail on the Windows runner.
+- **Two test assertions were POSIX literals** (a default store path and a `path.resolve` result).
+  They now compare resolved paths, which is what the contract actually says.
+- **CI is green on `windows-latest`** — tests, static checks, package shape and
+  `node tools/windows-check.mjs` all run there.
+
 ## [0.12.7] — 2026-10-21
 
 Windows, tested instead of assumed.

package/README.md

@@ -94,7 +94,9 @@ description, steps, attachments and progress notes stay.
 
 ### Markdown in and out
 
-The JSON export is the round-trip format. Markdown is the one you read, diff and edit by hand:
+The JSON export is the round-trip format. Markdown is the one you read, diff and edit by hand
+(note that `doing` and `cancelled` come back as `open`: a hand-edited list has no work-in-progress
+state, and the JSON remains the format that round-trips exactly):
 
 ```text
 - [ ] 标题
@@ -288,7 +290,8 @@ Your list is not touched by install or uninstall: it lives outside the plugin, a
   wall of rows. A conversation with one item shows that row directly; items with no source
   conversation (added in the panel) sit under 手动添加. `time` is the original
   overdue / today / soon / later / no-due buckets, `level` groups by priority.
-- **Levels P0–P3** — `P0 urgent / P1 high / P2 normal (default) / P3 low`, with a badge on the
+- **Levels P0–P3** — `P0 urgent / P1 high / P2 normal (default) / P3 low`; the API accepts
+  either the canonical names or the labels (`priority: "P0"` works), with a badge on the
   row. Records written before levels existed keep their `high/normal/low`, so nothing needed a
   migration. A conversation group shows the highest level it holds, and a green dot marks a
   group with a conversation still running.
@@ -378,7 +381,7 @@ fence when that service is present, and by a strict loopback check otherwise.
 | POST | `/api/global-todo/capture` | `{ sessionId? }` — ask the current conversation to collect its follow-ups |
 | POST | `/api/global-todo/bulk` | `{ ids, status?, addTags?, removeTags? }` — one change across a selection; a stale id lands in `unmatched` instead of failing the batch |
 | POST | `/api/global-todo/ingest` | `{ items: [{ title, source: { kind }, confidence }], dryRun? }` with `Authorization: Bearer <settings.ingestToken>` — external items; below `ingestConfirmBelow` they wait in the inbox |
-| GET | `/api/global-todo/health` | — (store location, counts, dispatch capabilities, plus **tool registration** and **whether the completion watcher attached** — both fail quietly, so both are reported — and `metrics`: dispatch success rate, agent tool calls, list growth; `autoCollect`: why each waiting conversation was or was not asked, counters, and how the settings file loaded) |
+| GET | `/api/global-todo/health` | — (store location, counts, dispatch capabilities, plus **tool registration** and **whether the completion watcher attached** — both fail quietly, so both are reported — and `metrics`: dispatch success rate, agent tool calls, list growth; `autoCollect`: why each waiting conversation was or was not asked, counters, and how the settings file loaded; `version` is the running module and `packageVersion`/`stale` say whether the installed package is newer than the running one) |
 | POST | `/api/global-todo/create` | `{ title, description?, links?, steps?, tags?, priority?, dueAt? }` |
 | POST | `/api/global-todo/update` | `{ id, ...fields, by?: human\|agent }` |
 | POST | `/api/global-todo/status` | `{ id, status, by?: human\|agent }` |

package/README.zh.md

@@ -217,7 +217,7 @@ dsh plugin --profile web remove dsh-global-todo
   `auto` 优先复用这条待办已绑定的会话、其次是当前对话、最后才新开；`new` 总是新开对话；`bound` 只发给已绑定的对话，不在就明确报出原因。
   找不到任何可用的对话时**明确失败**，不会偷偷开一个新的。
 - **分组维度**：工具栏上有 `对话 / 时间 / 级别` 三个维度，**默认按对话**——同一个 agent 对话提交的待办会**合并成一条**（显示「N 条」，点开才展开），这样几次「抓一下待办」不会把清单糊成一片。单条的对话直接显示那一行；没有来源对话的（在面板里手加的）归到「手动添加」。`时间` 是原来的逾期 / 今天 / 接下来 / 以后 / 没有截止时间，`级别` 按高 / 一般 / 低分组。
-- **级别 P0–P3**：每条待办可设 `P0 紧急 / P1 高 / P2 常规 / P3 低`（旧记录里的 high/normal/low 原样有效，默认 P2）。行上有徽标，对话分组头显示组内**最高级别**，绿色小圆点表示该对话里还有在跑的会话。
+- **级别 P0–P3**：每条待办可设 `P0 紧急 / P1 高 / P2 常规 / P3 低`；接口两种写法都收（`priority: "P0"` 或 `"urgent"`），旧记录里的 high/normal/low 原样有效，默认 P2。行上有徽标，对话分组头显示组内**最高级别**，绿色小圆点表示该对话里还有在跑的会话。
 - **从本对话抓取**：面板上一个按钮，把「请把这段对话里需要跟进的事用 `global_todo_capture` 抓一下」注入你正在说话的那个对话——聊着聊着把该跟进的事一次变成待办，不用自己一条条敲。提示词里同样写清了「不要记什么」（会话计划、闲聊、已完成的事），否则抓取只会制造噪音。
 - **自动完成**：派发出去的会话**干净结束**时，宿主自己把这条待办标成完成，并附上**它最后那段回复**作为完成说明、**这一轮改动的文件**作为产出——不用等模型记得调工具。面板上完成的行显示「完成于 …」加产出芯片，展开详情有「完成记录」段（说明 + 产出路径，可点开或复制）。
   两条护栏值得知道：**只对刚派发过的会话生效**（你在那个会话里随便聊两句不会把待办完成掉），**失败 / 中断的回合不标记完成**（宁可留着未完成，也不能让一份干砸的活显示成已完成）。

package/docs/WINDOWS.md

@@ -21,6 +21,11 @@ Windows machine should run.
 CI runs the suite on **ubuntu-latest and windows-latest** (node 22.19 on both, node 24 on Linux).
 Windows runs `node tools/windows-check.mjs` as an extra step.
 
+That matrix earned its keep on its first day: it found four things Linux could not see — a `mkdir`
+over a file reporting `EEXIST` instead of `ENOTDIR`, the diagnostics trim losing a rename to a busy
+reader, `tools/preview.mjs` creating a directory named `panel.html` (a POSIX-only regex), and two
+test assertions that pinned POSIX literals. All fixed in 0.12.8.
+
 ## The real-filesystem check
 
 ```powershell

package/lib/atomic.js

@@ -0,0 +1,77 @@
+/**
+ * Small, shared file-system guarantees.
+ *
+ * Both the todo file and the diagnostics log are replaced by "write a sibling, then
+ * rename". That pattern has two platform traps this module exists to absorb:
+ *
+ * 1. `fsync` on Windows is `FlushFileBuffers`, which needs a **writable** handle. A
+ *    read-only handle always throws `EPERM`, and a save that throws before its rename
+ *    is a save that never happened (issue #2).
+ * 2. Antivirus, the search indexer and a concurrent reader can hold a handle for a few
+ *    milliseconds, which makes the rename fail with `EPERM`/`EBUSY`/`EACCES`. Retrying
+ *    those turns a spurious failure into a write; other errors still surface at once.
+ *
+ * @module dsh-global-todo/atomic
+ */
+
+import { open, rename, unlink } from 'node:fs/promises'
+
+const TRANSIENT_RENAME_CODES = new Set(['EPERM', 'EBUSY', 'EACCES'])
+
+/**
+ * Rename, retrying only the errors that mean "someone else has it for a moment".
+ *
+ * @param {{ rename: (from: string, to: string) => Promise<void> }} io
+ * @param {string} from temporary file
+ * @param {string} to target file
+ */
+export async function renameWithRetry(io, from, to, attempts = 4) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      await io.rename(from, to)
+      return
+    } catch (error) {
+      if (attempt >= attempts || !TRANSIENT_RENAME_CODES.has(error?.code)) throw error
+      await new Promise((resolve) => setTimeout(resolve, 20 * (attempt + 1)))
+    }
+  }
+}
+
+/**
+ * Replace a file atomically, and survive a platform that refuses `fsync`.
+ *
+ * The handle is opened for **writing** on purpose: on Windows `handle.sync()` needs a
+ * writable handle, and opening the temp file read-only made every write throw before the
+ * rename (the todo list looked empty while `*.tmp` debris accumulated).
+ *
+ * The sync itself is best effort: durability matters, but losing a save because a
+ * platform will not flush a handle is worse than a save that reaches the page cache.
+ *
+ * @param {string} file absolute path of the target
+ * @param {string} payload bytes to write
+ * @param {{ fs?: object, onSyncError?: (error: unknown) => void, renameAttempts?: number }} [options]
+ *   injected for tests; `renameAttempts` is there for callers whose target is read constantly
+ */
+export async function atomicWrite(file, payload, options = {}) {
+  const io = options.fs ?? { open, rename, unlink }
+  const temp = `${file}.${process.pid}.${Date.now()}.tmp`
+  let handle = null
+  let renamed = false
+  try {
+    handle = await io.open(temp, 'w', 0o600)
+    await handle.writeFile(payload, 'utf8')
+    try {
+      await handle.sync()
+    } catch (error) {
+      options.onSyncError?.(error)
+    }
+    await handle.close()
+    handle = null
+    await renameWithRetry(io, temp, file, options.renameAttempts)
+    renamed = true
+  } finally {
+    if (handle !== null) await handle.close().catch(() => {})
+    // Only debris is cleaned up: after a successful rename the temp file is gone.
+    if (!renamed) await io.unlink(temp).catch(() => {})
+  }
+}

package/lib/capture.js

@@ -91,6 +91,11 @@ export function findDuplicate(input) {
       if (now - created < windowMs && similarity(title, todo.title) >= threshold) {
         return { duplicate: true, reason: 'similar-active', matchId: todo.id }
       }
+    } else if (now - doneAt < cooldownMs && similarity(title, todo.title) >= threshold) {
+      // The cooldown was exact-title only, so 「T3 逾期项」 finished two minutes ago and
+      // 「T3 逾期项（再办一次）」 was accepted — the same errand, re-registered. Similar
+      // wording counts here for the same reason it counts among active rows.
+      return { duplicate: true, reason: 'similar-recently-done', matchId: todo.id }
     }
   }
   return { duplicate: false }
@@ -101,4 +106,5 @@ export const CAPTURE_REASONS = Object.freeze({
   'same-active': '清单里已有同名的未完成条目，未重复登记',
   'similar-active': '清单里已有一条很相似的未完成条目，未重复登记',
   'recently-done': '这条刚完成不久（7 天内），没有重复登记',
+  'similar-recently-done': '这件事刚完成不久（7 天内），措辞不同也视为同一件，未重复登记',
 })

package/lib/diagnostics.js

@@ -9,7 +9,9 @@
  * @module dsh-global-todo/diagnostics
  */
 
-import { appendFile, readFile, rename, rm, writeFile } from 'node:fs/promises'
+import { appendFile, readFile, rm } from 'node:fs/promises'
+
+import { atomicWrite } from './atomic.js'
 
 /** How many entries `/health` shows, how many are kept in memory, how many on disk. */
 const RECENT = 5
@@ -66,15 +68,13 @@ export function createDiagnostics(options) {
    * @param {string[]} lines
    */
   const rewrite = async (lines) => {
-    const temp = `${options.file}.${process.pid}.${(rewrites += 1)}.tmp`
-    try {
-      await writeFile(temp, `${lines.slice(-ON_DISK).join('\n')}\n`, 'utf8')
-      await rename(temp, options.file)
-    } catch (error) {
-      // A failed trim must not leave litter beside the log it failed to trim.
-      await rm(temp, { force: true }).catch(() => {})
-      throw error
-    }
+    rewrites += 1
+    // Same helper as the todo file: opened for writing (Windows cannot fsync a read-only
+    // handle), rename retried while an antivirus or a reader holds the file for a moment,
+    // temp file removed if the replace fails.
+    // A debug reader (a tail, an editor, this test) may hold the file almost continuously,
+    // so the trim gets a longer retry budget than a normal save.
+    await atomicWrite(options.file, `${lines.slice(-ON_DISK).join('\n')}\n`, { renameAttempts: 12 })
   }
 
   return {

package/lib/errors.js

@@ -18,6 +18,9 @@ export const ERROR_CODES = Object.freeze([
   'invalid-due',
   'invalid-tags',
   'invalid-link',
+  'invalid-evidence',
+  'invalid-steps',
+  'invalid-decision',
   'invalid-body',
   'invalid-json',
   'payload-too-large',

package/lib/index.js

@@ -20,6 +20,7 @@
  * @module dsh-global-todo
  */
 
+import { readFileSync } from 'node:fs'
 import { readFile, writeFile } from 'node:fs/promises'
 import path from 'node:path'
 
@@ -36,7 +37,7 @@ import { createStore, resolveStorePath } from './store.js'
 import { createTools } from './tools.js'
 
 /** Must equal `package.json`'s version; `npm run check` enforces that. */
-export const VERSION = '0.12.7'
+export const VERSION = '0.12.9'
 
 /** Plugin id. Also the Loader row id in `cordis.patch.yml`. */
 export const name = 'dsh-global-todo'
@@ -525,6 +526,15 @@ export function apply(ctx, config) {
 
   ctx.inject(['webServer'], (webCtx) => {
     webCtx.effect(() => {
+      // The running module is the truth for behaviour; package.json is the truth for what
+      // was installed. When they differ the host is still executing the old graph, and
+      // nothing else in the system says so.
+      let diskVersion
+      try {
+        diskVersion = JSON.parse(readFileSync(path.join(import.meta.dirname, '..', 'package.json'), 'utf8')).version
+      } catch {
+        diskVersion = undefined
+      }
       const routes = createRoutes({
         service,
         dispatcher,
@@ -545,6 +555,9 @@ export function apply(ctx, config) {
         autoCollect: autoCollectState,
         reminders: reminderState,
         version: VERSION,
+        // What is on disk, which after an upgrade is not what this process is running.
+        // The panel talks to a tree that changed under it; /health is where that is visible.
+        diskVersion,
       })
       const disposers = routes.map((definition) => webCtx.webServer.register(definition))
       webCtx.logger?.info?.(`dsh-global-todo: 注册了 ${disposers.length} 条路由（${ROUTE_BASE}）`)

package/lib/ingest.js

@@ -9,6 +9,7 @@
  * @module dsh-global-todo/ingest
  */
 
+import { LIMITS } from './model.js'
 import { INGEST_SOURCES } from './settings.js'
 
 /** Tag that marks a record as waiting for a person. */
@@ -28,7 +29,9 @@ export function normalizeIngestItem(raw, options = {}) {
   if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) return { error: '条目必须是对象' }
   const title = typeof raw.title === 'string' ? raw.title.trim() : ''
   if (title === '') return { error: '缺 title' }
-  if (title.length > 500) return { error: 'title 超过 500 字' }
+  // The model's own limit, not a second opinion: a 500-character title passed here and was
+  // then rejected by create(), which aborted the whole batch instead of skipping one row.
+  if (title.length > LIMITS.title) return { error: `title 超过 ${LIMITS.title} 字` }
   const source = raw.source !== null && typeof raw.source === 'object' && !Array.isArray(raw.source) ? raw.source : {}
   const kind = typeof source.kind === 'string' ? source.kind.trim().toLowerCase() : ''
   if (!INGEST_SOURCES.includes(kind)) return { error: `source.kind 必须是 ${INGEST_SOURCES.join(' / ')}` }

package/lib/model.js

@@ -40,6 +40,23 @@ export const PRIORITY_LABELS = Object.freeze({
   low: 'P3 低',
 })
 
+/**
+ * The labels are also accepted on the way in.
+ *
+ * The panel and the tools show `P0`–`P3` everywhere, so a person (or a model reading the
+ * schema description) will eventually send `"P0"`; rejecting it with `invalid-priority`
+ * while the UI prints exactly that string is a trap, not a validation.
+ */
+export const PRIORITY_ALIASES = Object.freeze({ p0: 'urgent', p1: 'high', p2: 'normal', p3: 'low' })
+
+/** @param {unknown} value @returns {string} a canonical priority, or '' when unusable */
+function canonicalPriority(value) {
+  if (typeof value !== 'string') return ''
+  const key = value.trim().toLowerCase()
+  if (PRIORITIES.includes(key)) return key
+  return PRIORITY_ALIASES[key] ?? ''
+}
+
 /** Who performed a write. Recorded on every entry of the activity trail. */
 export const ACTORS = Object.freeze(['human', 'agent'])
 
@@ -139,6 +156,21 @@ export function normalizeTags(value) {
  * @param {string} fallback
  * @returns {string}
  */
+/**
+ * Priority accepts the canonical names and the P0–P3 labels the panel prints.
+ *
+ * @param {unknown} value
+ * @param {string} fallback
+ * @returns {string}
+ */
+function normalizePriorityField(value, fallback) {
+  if (value === undefined || value === null || value === '') return fallback
+  const canonical = canonicalPriority(value)
+  if (canonical === '') {
+    throw new TodoError('invalid-priority', `优先级只能是 ${PRIORITIES.join(' / ')}（或 P0–P3 标签），收到 ${String(value)}`)
+  }
+  return canonical
+}
 function normalizeEnum(value, allowed, code, field, fallback) {
   if (value === undefined || value === null || value === '') return fallback
   if (typeof value !== 'string') throw new TodoError(code, `${field} 必须是字符串`)
@@ -204,7 +236,7 @@ export function createTodo(input, options = {}) {
     title,
     description: normalizeText(raw.description, '描述', LIMITS.description, 'invalid-description'),
     status: normalizeEnum(raw.status, STATUSES, 'invalid-status', '状态', 'open'),
-    priority: normalizeEnum(raw.priority, PRIORITIES, 'invalid-priority', '优先级', 'normal'),
+    priority: normalizePriorityField(raw.priority, 'normal'),
     dueAt: normalizeDue(raw.dueAt ?? raw.due),
     tags: normalizeTags(raw.tags),
     links,
@@ -563,7 +595,7 @@ export function applyPatch(todo, patch, options = {}) {
     }
   }
   if (patch.priority !== undefined) {
-    const priority = normalizeEnum(patch.priority, PRIORITIES, 'invalid-priority', '优先级', todo.priority)
+    const priority = normalizePriorityField(patch.priority, todo.priority)
     if (priority !== todo.priority) {
       todo.priority = priority
       changed.push('priority')
@@ -684,7 +716,12 @@ export function normalizeSteps(value) {
   const out = []
   for (const item of value) {
     if (typeof item === 'string') {
-      const text = item.trim().slice(0, LIMITS.step)
+      const text = item.trim()
+      // Over-long text used to be truncated silently while an over-long list was rejected;
+      // two limits, two behaviours, and the quiet one loses words. Both refuse now.
+      if (text.length > LIMITS.step) {
+        throw new TodoError('invalid-steps', `每一步最多 ${LIMITS.step} 字，收到 ${text.length} 字`)
+      }
       // A blank line in a textarea is a typo, not a step.
       if (text !== '') out.push({ text, done: false })
       continue
@@ -692,7 +729,10 @@ export function normalizeSteps(value) {
     if (item === null || typeof item !== 'object' || Array.isArray(item)) {
       throw new TodoError('invalid-steps', '步骤必须是字符串或 { text, done }')
     }
-    const text = typeof item.text === 'string' ? item.text.trim().slice(0, LIMITS.step) : ''
+    const text = typeof item.text === 'string' ? item.text.trim() : ''
+    if (text.length > LIMITS.step) {
+      throw new TodoError('invalid-steps', `每一步最多 ${LIMITS.step} 字，收到 ${text.length} 字`)
+    }
     if (text === '') continue
     out.push({ text, done: item.done === true })
   }

package/lib/routes.js

@@ -419,6 +419,11 @@ export function createRoutes(deps) {
       return {
         plugin: 'dsh-global-todo',
         version,
+        // `version` is what this process runs; `packageVersion` is what is installed. After
+        // an upgrade the two differ until the host restarts, and the panel then calls routes
+        // the old graph does not have (a 404 that looks like a plugin bug).
+        packageVersion: deps.diskVersion ?? version,
+        stale: deps.diskVersion !== undefined && deps.diskVersion !== version,
         store: await service.describe(),
         counts,
         // Purely additive, in-memory counters: hand-off success rate, agent tool
@@ -510,6 +515,11 @@ export function createRoutes(deps) {
 
     exact('POST', `${ROUTE_BASE}/diagnostics`, async (request) => {
       const body = await readJsonBody(request)
+      // `scope` is the grouping key in /health; without it every entry collapses into one
+      // nameless bucket, so it is required rather than defaulted.
+      if (typeof body.scope !== 'string' || body.scope.trim() === '') {
+        throw new TodoError('invalid-body', 'diagnostics 需要 scope（如 health / list / dispatch）')
+      }
       // The panel's failures happen in someone else's browser, where neither the Host
       // nor the person wants to be reading consoles. Reporting them here is what makes
       // "click it and tell me what it said" unnecessary.
@@ -519,6 +529,10 @@ export function createRoutes(deps) {
 
     exact('POST', `${ROUTE_BASE}/settings`, async (request) => {
       const body = await readJsonBody(request)
+      // The settings store clamps silently, which is right for a hand-edited file and wrong
+      // for an API: `{idleMinutes: -5}` answering 200-but-5 hides the rejected intent. A
+      // provided value outside its range is reported instead.
+      assertSettingsRange(body ?? {})
       const next = await deps.settings.update(body ?? {})
       return {
         settings: {
@@ -605,6 +619,11 @@ export function createRoutes(deps) {
 
     exact('POST', `${ROUTE_BASE}/note`, async (request) => {
       const body = await readJsonBody(request)
+      // A note with no text records an empty entry in the activity trail: the README calls
+      // `text` required, so an empty one is a bad body, not a note.
+      if (typeof body.text !== 'string' || body.text.trim() === '') {
+        throw new TodoError('invalid-body', 'note 需要非空的 text')
+      }
       const { todo, note } = await service.note(body.id, body.text, { by: 'human' })
       return { todo, note }
     }),
@@ -644,7 +663,18 @@ export function createRoutes(deps) {
       // The panel's undo: put a removed record back verbatim, timestamps and
       // attachments included, instead of re-creating it as a new todo.
       const body = await readJsonBody(request)
-      return { todo: await service.restore(body.todo, { by: 'human' }) }
+      // A partial object would be "restored" with invented defaults (a new createdAt, empty
+      // tags, a reassigned seq) — a lossy success is worse than a refusal.
+      const todo = body.todo
+      if (todo === null || typeof todo !== 'object' || Array.isArray(todo)) {
+        throw new TodoError('invalid-body', 'restore 需要完整的 todo 对象')
+      }
+      for (const field of ['id', 'title', 'createdAt', 'status']) {
+        if (todo[field] === undefined || todo[field] === null || todo[field] === '') {
+          throw new TodoError('invalid-body', `restore 的 todo 缺少 ${field}；撤销要原样放回，不能补默认值`)
+        }
+      }
+      return { todo: await service.restore(todo, { by: 'human' }) }
     }),
 
     exact('POST', `${ROUTE_BASE}/link`, async (request) => {
@@ -681,6 +711,10 @@ export function createRoutes(deps) {
 
     exact('POST', `${ROUTE_BASE}/dispatch`, async (request) => {
       const body = await readJsonBody(request)
+      // A missing id is a malformed request (400), not a record that does not exist (404).
+      if (typeof body.id !== 'string' || body.id.trim() === '') {
+        throw new TodoError('invalid-body', 'dispatch 需要 id')
+      }
       return dispatcher.dispatch(body.id, {
         mode: body.mode,
         sessionId: body.sessionId,
@@ -698,4 +732,27 @@ export function createRoutes(deps) {
   ]
 }
 
+/**
+ * Ranges the settings route refuses, mirroring the clamps in `normalizeSettings`.
+ *
+ * @param {Record<string, unknown>} body
+ */
+function assertSettingsRange(body) {
+  const ranges = {
+    idleMinutes: [5, 24 * 60],
+    cooldownMinutes: [5, 24 * 60],
+    ingestConfirmBelow: [0, 1],
+    reminderLeadMinutes: [0, 24 * 60],
+  }
+  for (const [field, [low, high]] of Object.entries(ranges)) {
+    const value = body[field]
+    if (value === undefined || value === null) continue
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+      throw new TodoError('invalid-body', `${field} 必须是数字（${low}–${high}）`)
+    }
+    if (value < low || value > high) {
+      throw new TodoError('invalid-body', `${field} 必须在 ${low}–${high} 之间，收到 ${value}`)
+    }
+  }
+}
 export { sendJson, readJsonBody }

package/lib/service.js

@@ -775,7 +775,19 @@ export function createService(options) {
         preview.push({ title: verdict.item.title, tags: verdict.item.tags, inbox: verdict.inbox })
         continue
       }
-      const todo = await create(verdict.item, { by: 'agent' })
+      // One bad row must not take the batch down with it: `global_todo_capture` already
+      // isolates each create, and the HTTP door should behave the same way.
+      let todo
+      try {
+        todo = await create(verdict.item, { by: 'agent' })
+      } catch (error) {
+        skipped.push({
+          title: verdict.item.title.slice(0, 80),
+          reason: 'invalid',
+          error: error?.message ?? String(error),
+        })
+        continue
+      }
       created.push(todo)
       existing.push(todo)
     }

package/lib/store.js

@@ -19,76 +19,18 @@
  * @module dsh-global-todo/store
  */
 
-import { open, mkdir, readFile, rename, stat, unlink } from 'node:fs/promises'
-
-/**
- * Rename, retrying only the errors that mean "someone else has it for a moment".
- *
- * @param {{ rename: (from: string, to: string) => Promise<void> }} io
- * @param {string} from temporary file
- * @param {string} to target file
- */
-async function renameWithRetry(io, from, to) {
-  const transient = new Set(['EPERM', 'EBUSY', 'EACCES'])
-  for (let attempt = 0; ; attempt += 1) {
-    try {
-      await io.rename(from, to)
-      return
-    } catch (error) {
-      if (attempt >= 4 || !transient.has(error?.code)) throw error
-      await new Promise((resolve) => setTimeout(resolve, 20 * (attempt + 1)))
-    }
-  }
-}
-/**
- * Replace a file atomically, and survive a platform that refuses `fsync`.
- *
- * Opened for **writing** on purpose: on Windows `handle.sync()` is `FlushFileBuffers`,
- * which needs a writable handle. Opening the temp file read-only and syncing it threw
- * `EPERM` on every write, and because that sync sat before `rename()`, the target file
- * was never replaced — the list looked empty while the data piled up as `*.tmp` debris.
- * That was issue #2.
- *
- * The sync itself is best effort: durability matters, but losing a save because a
- * platform will not flush a handle is strictly worse than a save that reaches the page
- * cache. A failing sync is reported and the rename still happens.
- *
- * @param {string} file absolute path of the target
- * @param {string} payload bytes to write
- * @param {{ fs?: object, onSyncError?: (error: unknown) => void }} [options] injected for tests
- */
-export async function atomicWrite(file, payload, options = {}) {
-  const io = options.fs ?? { open, rename, unlink }
-  const temp = `${file}.${process.pid}.${Date.now()}.tmp`
-  let handle = null
-  let renamed = false
-  try {
-    handle = await io.open(temp, 'w', 0o600)
-    await handle.writeFile(payload, 'utf8')
-    try {
-      await handle.sync()
-    } catch (error) {
-      options.onSyncError?.(error)
-    }
-    await handle.close()
-    handle = null
-    // Windows antivirus and the search indexer take short-lived locks on files that were
-    // just written, which makes the rename fail with EPERM/EBUSY for a few milliseconds.
-    // A retry turns a spurious save failure into a save; other errors still surface at once.
-    await renameWithRetry(io, temp, file)
-    renamed = true
-  } finally {
-    if (handle !== null) await handle.close().catch(() => {})
-    // Only debris is cleaned up: after a successful rename the temp file is gone.
-    if (!renamed) await io.unlink(temp).catch(() => {})
-  }
-}
+import { mkdir, open, readFile, stat } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import path from 'node:path'
 
+import { atomicWrite } from './atomic.js'
 import { TodoError } from './errors.js'
 import { LIMITS, SCHEMA_VERSION, normalizeStored } from './model.js'
 
+// Re-exported because the tests (and anyone poking at the store) reach for it here; the
+// implementation lives in atomic.js so the diagnostics log can share it.
+export { atomicWrite }
+
 /**
  * @param {Record<string, string | undefined>} [env]
  * @returns {string} the DSH home directory
@@ -248,7 +190,13 @@ export function createStore(options) {
    */
   async function write(doc) {
     const directory = path.dirname(file)
-    await mkdir(directory, { recursive: true })
+    try {
+      await mkdir(directory, { recursive: true })
+    } catch (error) {
+      // A file where the directory should be reports ENOTDIR on POSIX and EEXIST on
+      // Windows; both mean the same thing to the caller, so both become store-unwritable.
+      throw new TodoError('store-unwritable', `建不了待办目录 ${directory}：${error?.message ?? error}`, { file })
+    }
     const payload = `${JSON.stringify({ version: SCHEMA_VERSION, todos: doc.todos }, null, 2)}\n`
     try {
       await atomicWrite(file, payload, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-global-todo",
-  "version": "0.12.7",
+  "version": "0.12.9",
   "icon": "./docs/icon.svg",
   "description": "Cross-session todo list for DeepSeek Harness: one JSON file a person and an agent both write to, with step plans that ship as a numbered hand-off, session read-back, and a human confirmation before an agent's \"done\" counts.",
   "type": "module",