dsh-global-todo 0.12.9 → 0.12.11

package/CHANGELOG.md

@@ -1,3 +1,27 @@
+## [0.12.11] — 2026-10-21
+
+One more silent fallback, found while re-reading the settings path.
+
+- **`{idleMinutes: 30.5}` was accepted and then ignored.** `normalizeSettings` only keeps
+  integers for the minute fields and otherwise falls back to the default, so the request looked
+  like it worked while the value never changed. The settings route now rejects a fractional
+  minute with `400 invalid-body`, like every other out-of-range value.
+
+## [0.12.10] — 2026-10-21
+
+Two follow-ups from #3, plus the notification channel this repository actually has.
+
+- **`/health` names what waits for review.** `review.count` said something was waiting;
+  `review.items` says which (id, seq, title, doneAt, newest first) — checking the state no longer
+  means opening the panel and clicking through the list.
+- **The panel says when the running version is older than the installed one.** `stale` was added to
+  `/health` in 0.12.9; the panel now shows a one-time notice naming both versions and saying to
+  restart `dsh web`. This is the trap where the client is new, the module graph is old, and the
+  panel calls routes that 404.
+- **`tools/notify.mjs`** — pushes release / CI-failed / new-issue messages to WeChat through the
+  host's delivery library, which owns the freshness window and the outbox. `--dry-run` composes and
+  reports the window without sending; a closed window queues instead of failing.
+
 ## [0.12.9] — 2026-10-21
 
 Everything a Windows tester found in a 41-case sweep, answered (#3).

package/README.md

@@ -381,7 +381,7 @@ fence when that service is present, and by a strict loopback check otherwise.
 | POST | `/api/global-todo/capture` | `{ sessionId? }` — ask the current conversation to collect its follow-ups |
 | POST | `/api/global-todo/bulk` | `{ ids, status?, addTags?, removeTags? }` — one change across a selection; a stale id lands in `unmatched` instead of failing the batch |
 | POST | `/api/global-todo/ingest` | `{ items: [{ title, source: { kind }, confidence }], dryRun? }` with `Authorization: Bearer <settings.ingestToken>` — external items; below `ingestConfirmBelow` they wait in the inbox |
-| GET | `/api/global-todo/health` | — (store location, counts, dispatch capabilities, plus **tool registration** and **whether the completion watcher attached** — both fail quietly, so both are reported — and `metrics`: dispatch success rate, agent tool calls, list growth; `autoCollect`: why each waiting conversation was or was not asked, counters, and how the settings file loaded; `version` is the running module and `packageVersion`/`stale` say whether the installed package is newer than the running one) |
+| GET | `/api/global-todo/health` | — (store location, counts, dispatch capabilities, plus **tool registration** and **whether the completion watcher attached** — both fail quietly, so both are reported — and `metrics`: dispatch success rate, agent tool calls, list growth; `autoCollect`: why each waiting conversation was or was not asked, counters, and how the settings file loaded; `version` is the running module and `packageVersion`/`stale` say whether the installed package is newer than the running one; `review.items` names the finished todos that still wait for a person, so a check does not have to drive the panel) |
 | POST | `/api/global-todo/create` | `{ title, description?, links?, steps?, tags?, priority?, dueAt? }` |
 | POST | `/api/global-todo/update` | `{ id, ...fields, by?: human\|agent }` |
 | POST | `/api/global-todo/status` | `{ id, status, by?: human\|agent }` |

package/docs/DISTRIBUTION.md

@@ -15,10 +15,10 @@ of trusting this table.
 
 | Registry | Form | What it gives you | Verified state |
 |---|---|---|---|
-| **npm** | the package | the install path | `dsh-global-todo@0.11.2` |
+| **npm** | the package | the install path | `dsh-global-todo@0.12.10` |
 | **1024 Store** ([deepseek1024.com](https://deepseek1024.com)) · [repo](https://github.com/imsai-sh/awesome-deepseek-harness-plugins) | catalog entry, merged [#654](https://github.com/imsai-sh/awesome-deepseek-harness-plugins/pull/654) | searchable, has a public API | 🟡 entry live, but its install line still resolves to `github:LUgABeEEE/dsh-global-todo` — their npm enrichment has not caught up. Install works either way. |
 | **dsh.pub** · [page](https://dsh.pub/en/plugins/dsh-global-todo/) | published page + `dshpub` CLI | `npx dshpub add LUgABeEEE/dsh-global-todo` | ✅ page live, pinned to a commit |
-| **DSH-Plugins-Marketplace** ([bradeGithub](https://github.com/bradeGithub/DSH-Plugins-Marketplace)) | `registry.json`, collected from the `dsh-plugin` topic | one-click install inside DSH | ✅ `v0.11.2`, risk tier `safe` |
+| **DSH-Plugins-Marketplace** ([bradeGithub](https://github.com/bradeGithub/DSH-Plugins-Marketplace)) | `registry.json`, collected from the `dsh-plugin` topic | one-click install inside DSH | ✅ `v0.12.x`, risk tier `safe` |
 | **awesome-dsh-plugin** ([19.7k★](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin)) | one YAML per plugin | the largest directory | ✅ merged [#7498](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/7498) |
 | **walkinglabs/awesome-deepseek-harness-plugins** | README entry (source-verified list) | review-backed listing | ✅ merged [#114](https://github.com/walkinglabs/awesome-deepseek-harness-plugins/pull/114) |
 

package/lib/client.js

@@ -175,6 +175,9 @@ window.__ModuleLoader__.load({
       'notice.autoCollectOn': '已开启自动获取：一次人为发言最多自动问一次',
       'notice.autoCollectOff': '已关闭自动获取',
       'notice.externalChange': '清单在别处被改过，已载入最新内容',
+      // Installed newer than running: the panel would otherwise call routes the old module
+      // graph does not have, and look broken until someone happens to restart the Host.
+      'notice.stale': '已安装 {installed}，当前运行的是 {running}；重启 dsh web 后生效',
       'reminder.title': '到点提醒（{n}）',
       'reminder.note': '这些是到了设定的提醒时间，和「逾期」不是同一批。',
       'reminder.dismissAll': '全部知道了',
@@ -472,6 +475,7 @@ window.__ModuleLoader__.load({
       'notice.autoCollectOn': 'Auto-collect on: at most one question per message from you',
       'notice.autoCollectOff': 'Auto-collect off',
       'notice.externalChange': 'The list changed somewhere else; the latest content is loaded',
+      'notice.stale': 'Installed {installed}, running {running}; restart dsh web to finish the upgrade',
       'reminder.title': 'Due now ({n})',
       'reminder.note': 'These reached their reminder time — a different set from Overdue.',
       'reminder.dismissAll': 'Dismiss all',
@@ -2715,6 +2719,9 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
       // The store counts file changes made outside this process (another machine, a sync
       // client). A new count means the panel's view was stale a moment ago; say so once.
       const externalRef = useRef(null)
+      // Warn once per mount: a version mismatch is a fact about this page load, not an
+      // event worth repeating on every refresh.
+      const staleRef = useRef(false)
       // The wide-screen detail card floats over the panel, so its offsets are measured from
       // the panel's own column rather than derived from the viewport width.
       const innerRef = useRef(null)
@@ -2782,6 +2789,17 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
             setTimeout(() => setNotice(null), 8000)
           }
           externalRef.current = external
+          if (data?.stale === true && !staleRef.current) {
+            staleRef.current = true
+            setNotice({
+              text: translate(lang, 'notice.stale', {
+                installed: String(data.packageVersion ?? '?'),
+                running: String(data.version ?? '?'),
+              }),
+              sessionId: '',
+            })
+            setTimeout(() => setNotice(null), 12000)
+          }
           setState((current) => ({ ...current, health: data }))
         } catch {
           /* the health mirror is not worth an error banner */

package/lib/index.js

@@ -37,7 +37,7 @@ import { createStore, resolveStorePath } from './store.js'
 import { createTools } from './tools.js'
 
 /** Must equal `package.json`'s version; `npm run check` enforces that. */
-export const VERSION = '0.12.9'
+export const VERSION = '0.12.11'
 
 /** Plugin id. Also the Loader row id in `cordis.patch.yml`. */
 export const name = 'dsh-global-todo'

package/lib/routes.js

@@ -426,6 +426,9 @@ export function createRoutes(deps) {
         stale: deps.diskVersion !== undefined && deps.diskVersion !== version,
         store: await service.describe(),
         counts,
+        // The count says something waits for a person; the items say what, so a check does not
+        // have to drive the UI to find out.
+        review: { count: counts.review, items: await service.awaitingReview() },
         // Purely additive, in-memory counters: hand-off success rate, agent tool
         // calls and how the list grew. `null` when they were never mounted — an
         // absent metric is not a zero.
@@ -739,17 +742,22 @@ export function createRoutes(deps) {
  */
 function assertSettingsRange(body) {
   const ranges = {
-    idleMinutes: [5, 24 * 60],
-    cooldownMinutes: [5, 24 * 60],
-    ingestConfirmBelow: [0, 1],
-    reminderLeadMinutes: [0, 24 * 60],
+    idleMinutes: [5, 24 * 60, true],
+    cooldownMinutes: [5, 24 * 60, true],
+    ingestConfirmBelow: [0, 1, false],
+    reminderLeadMinutes: [0, 24 * 60, true],
   }
-  for (const [field, [low, high]] of Object.entries(ranges)) {
+  for (const [field, [low, high, whole]] of Object.entries(ranges)) {
     const value = body[field]
     if (value === undefined || value === null) continue
     if (typeof value !== 'number' || !Number.isFinite(value)) {
       throw new TodoError('invalid-body', `${field} 必须是数字（${low}–${high}）`)
     }
+    // normalizeSettings only accepts integers for the minute fields and otherwise falls back
+    // to the default — a silently ignored 30.5 is the same trap as a silent clamp.
+    if (whole === true && !Number.isInteger(value)) {
+      throw new TodoError('invalid-body', `${field} 必须是整数分钟，收到 ${value}`)
+    }
     if (value < low || value > high) {
       throw new TodoError('invalid-body', `${field} 必须在 ${low}–${high} 之间，收到 ${value}`)
     }

package/lib/service.js

@@ -821,10 +821,29 @@ export function createService(options) {
     return counts(todos, now())
   }
 
+  /**
+   * Which finished todos an agent marked done that a person has not confirmed.
+   *
+   * The count in `/health` says something is waiting; this says what, so a check does not
+   * have to open the panel and click through the list to find out.
+   *
+   * @param {number} [limit] newest first, capped
+   * @returns {Promise<{ id: string, seq: number, title: string, doneAt: number }[]>}
+   */
+  async function awaitingReview(limit = 20) {
+    const todos = await store.all()
+    return todos
+      .filter((todo) => todo.status === 'done' && todo.review?.pending === true)
+      .sort((left, right) => (right.doneAt ?? right.updatedAt ?? 0) - (left.doneAt ?? left.updatedAt ?? 0))
+      .slice(0, limit)
+      .map((todo) => ({ id: todo.id, seq: todo.seq, title: todo.title, doneAt: todo.doneAt ?? todo.updatedAt ?? 0 }))
+  }
+
   return {
     list,
     listAll,
     get,
+    awaitingReview,
     create,
     update,
     setStatus,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-global-todo",
-  "version": "0.12.9",
+  "version": "0.12.11",
   "icon": "./docs/icon.svg",
   "description": "Cross-session todo list for DeepSeek Harness: one JSON file a person and an agent both write to, with step plans that ship as a numbered hand-off, session read-back, and a human confirmation before an agent's \"done\" counts.",
   "type": "module",
@@ -73,6 +73,7 @@
     "check": "node scripts/check.mjs",
     "doctor": "node tools/doctor.mjs",
     "check:windows": "node tools/windows-check.mjs",
+    "notify": "node tools/notify.mjs",
     "test": "node --test \"test/**/*.test.mjs\"",
     "verify": "npm run check && npm run check:render && npm test",
     "preview": "node tools/preview.mjs",