dsh-global-todo 0.13.0 → 0.13.2

package/CHANGELOG.md

@@ -1,3 +1,33 @@
+## [0.13.2] — 2026-10-22
+
+Four gaps the Windows sweep found in the new weight/settings surface (#5).
+
+- **`null` is a bad settings body, not zero.** `Number(null) === 0`, so `{captureMinWeight: null}`
+  answered 200, stored 0 and turned the whole capture gate off — while `{autoCollect: null}` was
+  correctly 400. Every numeric field now refuses `null` with a message saying to omit the field.
+- **The weight threshold is two decimals or a bad request.** `{captureMinWeight: 0.345}` used to be
+  rounded to 0.35 and stored, the same silent adjustment a fractional minute is rejected for.
+- **A deadline must be a real date.** `normalizeDue` was a bare `Date.parse`, so `"2026"` became
+  January 1st and `"October 2026"` an implementation-defined, timezone-dependent day. Input is now
+  a date, a date with time, or a date with time and zone — and `2026-02-31` is refused instead of
+  rolling over to March. The capture scorer reuses the same rule, so a garbage deadline can no
+  longer earn the +0.2 bonus that carried weak candidates past the gate.
+- **A blank step is refused, not dropped.** `steps: ['']` was silently discarded while the caller
+  believed it was stored, and the scorer still gave it +0.15 for "already broken into steps".
+
+## [0.13.1] — 2026-10-22
+
+The sort orders are total orders now, which is what CI caught.
+
+- **Two todos created in the same millisecond could sort in either order.** The comparators
+  returned 0 for equal timestamps and leaned on the sort's stability, so a fast machine (the
+  packed `npm pack --dry-run` step, where the whole suite runs again) produced a different order
+  than the same tests a minute earlier. `seq`, which the service assigns monotonically, is the
+  final tiebreaker for all four sorts.
+- **The ordering test uses a stepping clock**, so it asserts the semantics it is named for instead
+  of depending on how fast the machine creates three todos; a second test pins the same-millisecond
+  case on purpose.
+
 ## [0.13.0] — 2026-10-22
 
 Batch capture now scores what it is given, and drops what is not worth a todo.

package/README.md

@@ -184,7 +184,7 @@ The plugin is a Loader row, not a hot-loaded script: **restart the host** (`dsh
 after installing, then refresh the page. A "待办 / Todos" entry appears in the sidebar.
 
 The npm package is the source of truth. A community catalog can lag behind it or point at an
-older release; pin the version you want (`dsh plugin --profile web add dsh-global-todo@0.12.4`)
+older release; pin the version you want (`dsh plugin --profile web add dsh-global-todo@0.13.1`)
 when it matters.
 
 **Hand-copied a directory instead?** Check it before wondering why the plugins page looks wrong:

package/README.zh.md

@@ -174,7 +174,7 @@ npx dsh-global-todo-doctor "$HOME/.dsh/plugins-local/全局待办插件"
 `Plugin metadata … ENOENT … \locale`。
 
 npm 上的包才是事实来源。社区目录可能落后于 npm、或指向某个旧 release；需要确定版本时
-直接钉版本（`dsh plugin --profile web add dsh-global-todo@0.10.0`）。
+直接钉版本（`dsh plugin --profile web add dsh-global-todo@0.13.1`）。
 
 回滚：
 

package/docs/DISTRIBUTION.md

@@ -15,10 +15,10 @@ of trusting this table.
 
 | Registry | Form | What it gives you | Verified state |
 |---|---|---|---|
-| **npm** | the package | the install path | `dsh-global-todo@0.12.10` |
+| **npm** | the package | the install path | `dsh-global-todo@0.13.1` |
 | **1024 Store** ([deepseek1024.com](https://deepseek1024.com)) · [repo](https://github.com/imsai-sh/awesome-deepseek-harness-plugins) | catalog entry, merged [#654](https://github.com/imsai-sh/awesome-deepseek-harness-plugins/pull/654) | searchable, has a public API | 🟡 entry live, but its install line still resolves to `github:LUgABeEEE/dsh-global-todo` — their npm enrichment has not caught up. Install works either way. |
 | **dsh.pub** · [page](https://dsh.pub/en/plugins/dsh-global-todo/) | published page + `dshpub` CLI | `npx dshpub add LUgABeEEE/dsh-global-todo` | ✅ page live, pinned to a commit |
-| **DSH-Plugins-Marketplace** ([bradeGithub](https://github.com/bradeGithub/DSH-Plugins-Marketplace)) | `registry.json`, collected from the `dsh-plugin` topic | one-click install inside DSH | ✅ `v0.12.x`, risk tier `safe` |
+| **DSH-Plugins-Marketplace** ([bradeGithub](https://github.com/bradeGithub/DSH-Plugins-Marketplace)) | `registry.json`, collected from the `dsh-plugin` topic | one-click install inside DSH | ✅ `v0.13.x`, risk tier `safe` |
 | **awesome-dsh-plugin** ([19.7k★](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin)) | one YAML per plugin | the largest directory | ✅ merged [#7498](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/7498) |
 | **walkinglabs/awesome-deepseek-harness-plugins** | README entry (source-verified list) | review-backed listing | ✅ merged [#114](https://github.com/walkinglabs/awesome-deepseek-harness-plugins/pull/114) |
 

package/docs/ROADMAP.md

@@ -15,14 +15,29 @@ is the durable part, and a stale number is worse than none.
 - Global list, one JSON file, atomic writes, one write path for both writers.
 - Creation time on every entry, immutable and shown everywhere.
 - Attachments as references: any number of documents and addresses per todo.
-- Nine `global_todo_*` tools — `add`, `capture`, `list`, `get`, `update`, `link`, `note`,
-  `done`, `remove`; `reopen` joined them later (below). What `/health` reports as
+- Ten `global_todo_*` tools — `add`, `capture`, `list`, `get`, `update`, `link`, `note`,
+  `done`, `remove`, and `reopen`, which followed in 0.3. What `/health` reports as
   `tools.registered` is the list as it stands, and panel and tools share the same validation.
 - Four hand-off modes, with success **and failure** recorded on the record.
 - Restore/undo for a delete, keyboard shortcuts, editable detail panel.
 - Proactive capture: `global_todo_capture` for batches, plus guidance that says when the
   agent should record something itself and when it must not.
 
+### Landed in 0.6
+
+The panel became one column with one type scale, and every conditional state got a baseline.
+
+- **The layout is a column, not a wrapping row** (`0.6.0`); the header wraps its actions, the
+  toolbar is two semantic rows, and the directory / handoff / browse controls sit behind a single
+  Context toggle. Five type sizes, one 28px control height, a 340px settings inspector instead of
+  an in-flow block.
+- **The settings panel was rebuilt as an inspector** (`0.6.4`): title row, three labelled groups,
+  help text under every field, a pinned save row, and About showing the data file and version.
+- **Every conditional state has an image** (`0.6.3`, `0.6.8`): empty list, filter with no match,
+  inbox, due reminder, selection, settings. `npm run screenshots` photographs them from the same
+  `SCENARIOS` table the static preview renders, and `npm run check:render` asserts each state's
+  marker, so a blank picture fails CI instead of shipping.
+
 ### Landed since 0.1
 
 Things that used to sit on the Next list (or in the Later table) and are facts in the

package/lib/index.js

@@ -37,7 +37,7 @@ import { createStore, resolveStorePath } from './store.js'
 import { createTools } from './tools.js'
 
 /** Must equal `package.json`'s version; `npm run check` enforces that. */
-export const VERSION = '0.13.0'
+export const VERSION = '0.13.2'
 
 /** Plugin id. Also the Loader row id in `cordis.patch.yml`. */
 export const name = 'dsh-global-todo'

package/lib/model.js

@@ -108,6 +108,52 @@ function normalizeText(value, field, max, code) {
   return text
 }
 
+/**
+ * @param {unknown} value
+ * @returns {string | null} canonical ISO-8601 (UTC) or null
+ */
+/**
+ * The shapes a deadline may take: a date, or a date with time, optionally zoned.
+ *
+ * The old implementation was a bare `Date.parse`, which accepts `"2026"` (January 1st,
+ * invented), `"October 2026"` (implementation-defined, timezone-dependent) and anything
+ * else the engine happens to recognise. A deadline that silently becomes New Year's Day
+ * is worse than a rejected one.
+ */
+const DUE_SHAPE = /^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,3}))?)?(Z|[+-]\d{2}:\d{2})?)?$/
+
+/**
+ * @param {unknown} value
+ * @returns {{ ok: true, iso: string } | { ok: false, reason: string }}
+ */
+export function parseDueText(value) {
+  if (typeof value !== 'string') return { ok: false, reason: '不是字符串' }
+  const text = value.trim()
+  const match = DUE_SHAPE.exec(text)
+  if (match === null) return { ok: false, reason: '只接受 2026-10-20 / 2026-10-20T10:00 / 带时区三种写法' }
+  const year = Number(match[1])
+  const month = Number(match[2])
+  const day = Number(match[3])
+  if (month < 1 || month > 12) return { ok: false, reason: '月份不合法' }
+  if (day < 1 || day > new Date(Date.UTC(year, month, 0)).getUTCDate()) return { ok: false, reason: '日期不合法' }
+  if (match[4] !== undefined && (Number(match[4]) > 23 || Number(match[5]) > 59 || Number(match[6] ?? 0) > 59)) {
+    return { ok: false, reason: '时间不合法' }
+  }
+  // A zone-less value keeps its usual meaning (local time, as the panel's datetime picker
+  // produces); only the accepted shapes were narrowed.
+  const parsed = Date.parse(text)
+  if (Number.isNaN(parsed)) return { ok: false, reason: '无法解析' }
+  return { ok: true, iso: new Date(parsed).toISOString() }
+}
+
+/**
+ * @param {unknown} value
+ * @returns {boolean} whether this value would be accepted as a deadline
+ */
+export function isValidDue(value) {
+  return typeof value === 'string' && value.trim() !== '' && parseDueText(value).ok === true
+}
+
 /**
  * @param {unknown} value
  * @returns {string | null} canonical ISO-8601 (UTC) or null
@@ -115,13 +161,12 @@ function normalizeText(value, field, max, code) {
 export function normalizeDue(value) {
   if (value === undefined || value === null || value === '') return null
   if (typeof value !== 'string') throw new TodoError('invalid-due', '截止时间必须是 ISO-8601 字符串')
-  const text = value.trim()
-  if (text === '') return null
-  const parsed = Date.parse(text)
-  if (Number.isNaN(parsed)) {
-    throw new TodoError('invalid-due', `无法解析截止时间：${value}（用 ISO-8601，例如 2026-10-20T10:00 或 2026-10-20）`)
+  if (value.trim() === '') return null
+  const verdict = parseDueText(value)
+  if (verdict.ok !== true) {
+    throw new TodoError('invalid-due', `无法解析截止时间：${value}（${verdict.reason}；例如 2026-10-20 或 2026-10-20T10:00）`)
   }
-  return new Date(parsed).toISOString()
+  return verdict.iso
 }
 
 /**
@@ -722,8 +767,11 @@ export function normalizeSteps(value) {
       if (text.length > LIMITS.step) {
         throw new TodoError('invalid-steps', `每一步最多 ${LIMITS.step} 字，收到 ${text.length} 字`)
       }
-      // A blank line in a textarea is a typo, not a step.
-      if (text !== '') out.push({ text, done: false })
+      // A blank step used to be dropped on the floor while the caller believed it was
+      // stored — and it earned the capture weight bonus for "already broken into steps".
+      // The panel already filters empty lines, so this only catches a caller that meant it.
+      if (text === '') throw new TodoError('invalid-steps', '步骤不能为空')
+      out.push({ text, done: false })
       continue
     }
     if (item === null || typeof item !== 'object' || Array.isArray(item)) {
@@ -733,7 +781,7 @@ export function normalizeSteps(value) {
     if (text.length > LIMITS.step) {
       throw new TodoError('invalid-steps', `每一步最多 ${LIMITS.step} 字，收到 ${text.length} 字`)
     }
-    if (text === '') continue
+    if (text === '') throw new TodoError('invalid-steps', '步骤不能为空')
     out.push({ text, done: item.done === true })
   }
   return out

package/lib/routes.js

@@ -796,10 +796,21 @@ function assertSettingsRange(body) {
   }
   for (const [field, [low, high, whole]] of Object.entries(ranges)) {
     const value = body[field]
-    if (value === undefined || value === null) continue
+    if (value === undefined) continue
+    // `null` used to fall through to the clamp: `Number(null) === 0`, so a null weight
+    // became 0 and turned the whole capture gate off while answering 200. A field that is
+    // present but null is a bad body, like every other non-number here.
+    if (value === null) {
+      throw new TodoError('invalid-body', `${field} 不能是 null；要恢复默认就从请求里省略它`)
+    }
     if (typeof value !== 'number' || !Number.isFinite(value)) {
       throw new TodoError('invalid-body', `${field} 必须是数字（${low}–${high}）`)
     }
+    // The weight is a two-decimal number by contract; storing 0.345 as 0.35 is the same
+    // silent adjustment that a fractional minute is rejected for.
+    if (field === 'captureMinWeight' && Math.round(value * 100) / 100 !== value) {
+      throw new TodoError('invalid-body', 'captureMinWeight 最多两位小数，收到 ' + String(value))
+    }
     // normalizeSettings only accepts integers for the minute fields and otherwise falls back
     // to the default — a silently ignored 30.5 is the same trap as a silent clamp.
     if (whole === true && !Number.isInteger(value)) {

package/lib/service.js

@@ -219,20 +219,24 @@ export function createService(options) {
     if (!SORTS.includes(sort)) {
       throw new TodoError('invalid-body', `排序只能是 ${SORTS.join(' / ')}，收到 ${sort}`)
     }
+    // Every comparator ends on `seq`, which the service assigns monotonically: two todos
+    // created in the same millisecond used to tie, and the order then depended on the sort's
+    // stability rather than on anything the list guarantees. A CI run caught that.
+    const newestFirst = (a, b) => b.createdAt - a.createdAt || (b.seq ?? 0) - (a.seq ?? 0)
     out = out.slice().sort((a, b) => {
-      if (sort === 'updated') return b.updatedAt - a.updatedAt
+      if (sort === 'updated') return b.updatedAt - a.updatedAt || (b.seq ?? 0) - (a.seq ?? 0)
       if (sort === 'due') {
         const left = a.dueAt === null ? Number.POSITIVE_INFINITY : Date.parse(a.dueAt)
         const right = b.dueAt === null ? Number.POSITIVE_INFINITY : Date.parse(b.dueAt)
         if (left !== right) return left - right
-        return b.createdAt - a.createdAt
+        return newestFirst(a, b)
       }
       if (sort === 'priority') {
         const rank = PRIORITY_RANK[a.priority] - PRIORITY_RANK[b.priority]
         if (rank !== 0) return rank
-        return b.createdAt - a.createdAt
+        return newestFirst(a, b)
       }
-      return b.createdAt - a.createdAt
+      return newestFirst(a, b)
     })
 
     const limit = Number.isInteger(query.limit) && query.limit > 0 ? Math.min(query.limit, 1000) : 200

package/lib/weight.js

@@ -13,6 +13,8 @@
  * @module dsh-global-todo/weight
  */
 
+import { isValidDue } from './model.js'
+
 /** A phrase that reads like a commitment rather than an observation. */
 const COMMITMENT = ['记得', '别忘', '回头', '下周', '明天', '后天', '截止', 'deadline', '要交', '待确认', '等回复', '跟进', '安排', '发我', '确认一下', '记得要', '别忘了']
 
@@ -46,10 +48,15 @@ export function scoreItem(item, options = {}) {
   else if (length >= 3) add('specific', 0.05, '标题偏短')
   else add('tiny', -0.15, '标题几乎没有信息')
 
-  const due = typeof item.dueAt === 'string' && Number.isFinite(Date.parse(item.dueAt))
+  // The same validity rule create() applies: a date the store would reject must not earn
+  // the deadline bonus here, or a garbage dueAt could carry a weak candidate past the gate.
+  const due = isValidDue(item.dueAt)
   if (due) add('due', 0.2, '有可解析的截止时间')
 
-  if (Array.isArray(item.steps) && item.steps.length > 0) add('steps', 0.15, '已经拆成步骤')
+  const stepTexts = Array.isArray(item.steps)
+    ? item.steps.map((step) => (typeof step === 'string' ? step : step !== null && typeof step === 'object' ? step.text : ''))
+    : []
+  if (stepTexts.some((text) => typeof text === 'string' && text.trim() !== '')) add('steps', 0.15, '已经拆成步骤')
   if (Array.isArray(item.links) && item.links.length > 0) add('links', 0.1, '挂了文档或地址')
   if (typeof item.evidence === 'string' && item.evidence.trim() !== '') add('evidence', 0.1, '引用了原话')
   if (item.priority === 'urgent') add('priority', 0.15, '标了 P0')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-global-todo",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "icon": "./docs/icon.svg",
   "description": "Cross-session todo list for DeepSeek Harness: one JSON file a person and an agent both write to, with step plans that ship as a numbered hand-off, session read-back, and a human confirmation before an agent's \"done\" counts.",
   "type": "module",