dsh-global-todo 0.13.2 → 0.14.0

package/CHANGELOG.md

@@ -1,3 +1,23 @@
+## [0.14.0] — 2026-10-22
+
+Choose how much surface a deployment pays for.
+
+- **`config.toolGroups`: `all` (10 tools, default), `core` (6 — the list itself) or `none`.**
+  The ten tool schemas cost about **2k tokens per turn**; a deployment that only wants the panel
+  should not pay for a collaboration surface it never asks an agent to use. An unrecognised value
+  is reported and treated as `all`, so a typo cannot silently remove tools.
+- **The guidance section follows the tools.** With `core`/`none` the model is no longer told to
+  call `global_todo_capture`, which would be a call that cannot exist; `none` injects no guidance
+  at all.
+- **`/health` reports `modules`** (`toolGroups`, `registered`, `capture`), and the panel hides the
+  "collect from this conversation" entries when the capture tool is off instead of offering a
+  button that 404s. An older host with no `modules` field is assumed fully on.
+- **Deferred, on purpose**: splitting the package into several Loader rows (one row per module),
+  which the harness does support — `dsh.bundle.patch` may list files and a row may name a package
+  subpath. It buys Plugins-page cards for a user base of three stars; the config key buys the same
+  context saving today. `modules` in `/health` is the protocol that split would need, so it is in
+  place before anyone needs it.
+
 ## [0.13.2] — 2026-10-22
 
 Four gaps the Windows sweep found in the new weight/settings surface (#5).

package/README.md

@@ -434,6 +434,7 @@ topic feeds we have not verified, is [docs/DISTRIBUTION.md](docs/DISTRIBUTION.md
     storePath: /home/me/notes/global-todos.json   # a synced or versioned folder
     dispatchDir: /home/me/projects/thing          # default cwd for a new session
     requireExistingFiles: true                    # refuse a document that is not there yet
+    toolGroups: all                               # all (10 tools) | core (6: the list itself) | none
 ```
 
 The file is the artifact: plain JSON, one record per todo, written through a temp file and
@@ -473,8 +474,11 @@ and [docs/ROADMAP.md](docs/ROADMAP.md) for what could come next.
 npm run check     # parse every file, assert the shipping shape, and — when a DSH
                   # profile is present — validate every tool schema against the
                   # Host's own validator
-npm test          # 257 unit, contract and bundle tests, zero dependencies
-npm run verify    # both
+npm test              # unit, contract and bundle tests, zero dependencies
+npm run verify        # static checks + tests
+npm run check:contracts  # the cross-field matrix a reviewer re-tests by hand:
+                      # one invalid value, one answer, whichever field it lands on
+npm run check:windows    # the same idea on a real filesystem (Windows in CI)
 npm run check:matrix  # the running dsh against engines.dsh, then the manifest,
                       # bundle and tool-schema contracts (no preview writes)
 ```

package/README.zh.md

@@ -317,6 +317,7 @@ dsh plugin --profile web remove dsh-global-todo
     storePath: /home/me/notes/global-todos.json   # 放进同步盘或版本库
     dispatchDir: /home/me/projects/thing          # 新会话的默认工作目录
     requireExistingFiles: true                    # 文件还不存在就先不让挂
+    toolGroups: all                               # all（10 个工具）| core（6 个：只操作清单）| none
 ```
 
 **文件本身就是产物**：纯 JSON、一条记录一个待办，写入走「临时文件 + rename」，

package/cordis.patch.yml

@@ -24,6 +24,13 @@
         # Inject the short usage guidance into every turn. `false` leaves the tools
         # available but stops asking the model to record things on its own.
         guidance: true
+        # Which Agent tools this deployment registers. The ten schemas cost roughly
+        # 2k tokens per turn, so a deployment that only wants the panel can shed them:
+        #   all   10 tools (default)
+        #   core  6 tools: add / list / get / update / note / done
+        #   none  no tools; the guidance section is skipped too
+        # An unrecognised value is reported and treated as `all`.
+        toolGroups: all
         # Starting point for the panel's built-in folder browser when the shell has
         # no native picker. Empty = home directory, then the Host's cwd.
         browseRoot: ''

package/docs/ROADMAP.md

@@ -148,14 +148,13 @@ reminder) photographed into `docs/screenshots/` by `npm run screenshots`, and
 `npm run check:render` asserting each state's marker.
 ### Partly landed
 
-- **Session read-back** — `sessionAlive` is on every listed todo (`sessionAlive` in
-  `lib/dispatch.js`, surfaced by `GET /list`). Reading what that session last said, and
-  linking to it, is not: `lib/completion.js` reads `assistant/message` only to close a todo
-  this plugin dispatched, and stores one summary in its completion record.
-- **What the agents produced** — the per-todo record with a summary and the changed files landed
-  (`completeTodo()` in `lib/model.js`, 「完成记录」 in `lib/client.js`, the 已完成 filter and
-  group). The cross-todo "what did the sessions finish this week, and what did they touch" view
-  did not.
+- ~~**Session read-back**~~ — landed: `GET /session?id=` returns `alive`, `dir` and the last
+  assistant `tail` (`lib/routes.js`, `sessionTails` in `lib/index.js`), and the detail panel shows
+  that line (`lib/client.js`). It stays cheap and failure-tolerant: a conversation this process
+  has not seen speak answers `null`, which is the normal case for an old hand-off.
+- ~~**What the agents produced**~~ — landed: `GET /report?days=7` aggregates completion records
+  into finished items, conversations, touched files and the review backlog (`lib/report.js`), and
+  the panel shows it from `⋯ → 本周报告`.
 - **Attachment health** — a dead file link is flagged on read, but there is no 「重新挂载」 next
   to it (`relink` does not exist anywhere in `lib/`), and `annotateLinks()` has no unit test:
   today the render assertion in `tools/preview.mjs` is the only coverage.
@@ -177,17 +176,12 @@ plan. `normalizeSteps()` in `lib/model.js`, `dispatchPrompt()` in `lib/service.j
 What is left of the original idea: making a step addressable on its own (a tool that ticks step 3
 without resending the array) — not worth a tenth tool today.
 
-### 2. Session read-back — makes hand-off stop being fire-and-forget
+### 2. ~~Session read-back~~ — landed in 0.12
 
-`sessionAlive` says a bound conversation still exists. Next: one line of its latest
-assistant message plus a link to open it.
-
-- Today: `lib/completion.js` reads `assistant/message` only to close a todo this plugin
-  dispatched; nothing exposes it to the panel.
-- Effort: medium, and it must stay cheap and failure-tolerant: a missing or huge message is
-  a normal case, not an error.
-- Why second: the panel currently cannot answer "did the thing I handed over get anywhere",
-  which is the question people actually ask.
+`GET /session?id=` answers `alive`, `dir` and the last assistant `tail`, and the detail panel
+shows that line instead of a bare "still alive" flag. `lib/completion.js` keeps the tail it
+already reads for its own closing logic; a conversation this process has not seen speak answers
+`null`, which is a normal case rather than an error.
 
 ### 3. ~~Markdown import and export~~ — landed in 0.10.0
 

package/lib/client.js

@@ -3089,6 +3089,9 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
 
       // The two toggles belong with the other "how this panel behaves" controls, not in
       // the title row.
+      // Absent modules (an older host) means everything is on; a switched-off capture tool
+      // means the group action would ask for a tool that cannot exist.
+      const captureOn = state.health?.modules?.capture !== false
       const settingsOn = state.health?.settings?.autoCollect === true
       // The Host already knows why it stayed quiet; the switch's tooltip is the cheapest
       // place to show it, and "nothing ever happens" stops being a mystery.
@@ -4789,7 +4792,7 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
                             )
                           : null,
                         [
-                          group.sessionId === undefined
+                          group.sessionId === undefined || !captureOn
                             ? null
                             : {
                                 key: 'capture',
@@ -4810,7 +4813,7 @@ button.gt-chip[data-on="1"] { color: var(--dsw-alias-label-primary); border-colo
                           : h(Menu, {
                               label: t('group.actions'),
                               items: [
-                                group.sessionId === undefined
+                                group.sessionId === undefined || !captureOn
                                   ? null
                                   : {
                                       key: 'capture',

package/lib/index.js

@@ -34,10 +34,10 @@ import { LIMITS } from './model.js'
 import { ROUTE_BASE, createRoutes } from './routes.js'
 import { createService } from './service.js'
 import { createStore, resolveStorePath } from './store.js'
-import { createTools } from './tools.js'
+import { createTools, normalizeToolGroups, selectTools } from './tools.js'
 
 /** Must equal `package.json`'s version; `npm run check` enforces that. */
-export const VERSION = '0.13.2'
+export const VERSION = '0.14.0'
 
 /** Plugin id. Also the Loader row id in `cordis.patch.yml`. */
 export const name = 'dsh-global-todo'
@@ -49,6 +49,15 @@ export const DEFAULTS = Object.freeze({
   activityLimit: LIMITS.activity,
   requireExistingFiles: true,
   guidance: true,
+  /**
+   * Which agent tools this deployment registers: `all` (10), `core` (6, the list
+   * itself) or `none`.
+   *
+   * The schemas cost about 2k tokens per turn; a deployment that only wants the
+   * panel should not pay for the collaboration surface. An unrecognised value is
+   * reported and treated as `all`, because a typo must not silently remove tools.
+   */
+  toolGroups: 'all',
   // Starting point for the built-in folder browser when the shell has no picker.
   // Documented here because a patch override replaces `config` wholesale and has
   // to restate every key it wants to keep.
@@ -65,6 +74,24 @@ export const DEFAULTS = Object.freeze({
  *
  * Kept short on purpose: it is injected on every turn.
  */
+/**
+ * The guidance section for a tool-group mode: no tools, no instructions.
+ *
+ * Telling the model to use `global_todo_capture` when that tool was switched off
+ * is worse than saying nothing — it produces a call that cannot exist.
+ *
+ * @param {string} mode
+ * @returns {string} an empty string when nothing is registered
+ */
+export function guidanceFor(mode) {
+  const wanted = normalizeToolGroups(mode)
+  if (wanted === 'none') return ''
+  if (wanted === 'all') return GUIDANCE
+  return GUIDANCE.split('\n')
+    .filter((line) => !line.includes('global_todo_capture') && !line.includes('抓一下待办'))
+    .join('\n')
+}
+
 const GUIDANCE = [
   '【全局待办】一份跨会话、跨工作区、人和你共用的待办清单（`global_todo_*` 工具）。它和内置 `todo_write` 不是一回事：那个是你这个会话的计划，这份属于用户、跨会话保留。',
   '',
@@ -503,8 +530,15 @@ export function apply(ctx, config) {
     toolCtx.effect(() => {
       try {
         const definitions = createTools(service, { metrics, settings })
-        const disposers = definitions.map((definition) => toolCtx.tools.register(definition))
-        toolState.registered = definitions.map((definition) => definition.name)
+        const mode = normalizeToolGroups(resolved.toolGroups)
+        if (resolved.toolGroups !== mode) {
+          // A typo in `config.toolGroups` must be visible, not silently `all`.
+          logger?.warn?.(`dsh-global-todo: 未知的 toolGroups=${String(resolved.toolGroups)}，按 all 处理`)
+        }
+        const selected = selectTools(definitions, mode)
+        const disposers = selected.map((definition) => toolCtx.tools.register(definition))
+        toolState.registered = selected.map((definition) => definition.name)
+        toolState.mode = mode
         toolState.error = null
         toolCtx.logger?.info?.(`dsh-global-todo: 注册了 ${definitions.length} 个 Agent 工具`)
         return () => {
@@ -555,6 +589,13 @@ export function apply(ctx, config) {
         autoCollect: autoCollectState,
         reminders: reminderState,
         version: VERSION,
+        // What this deployment actually exposes, for the panel to hide absent entries and
+        // for a check to tell "switched off" apart from "failed to register".
+        modulesInfo: () => ({
+          toolGroups: normalizeToolGroups(resolved.toolGroups),
+          registered: toolState.registered.slice(),
+          capture: toolState.registered.includes('global_todo_capture'),
+        }),
         // What is on disk, which after an upgrade is not what this process is running.
         // The panel talks to a tree that changed under it; /health is where that is visible.
         diskVersion,
@@ -573,13 +614,14 @@ export function apply(ctx, config) {
     }, 'dsh-global-todo: web routes')
   })
 
-  if (resolved.guidance !== false) {
+  const guidanceText = guidanceFor(resolved.toolGroups)
+  if (resolved.guidance !== false && guidanceText !== '') {
     ctx.inject(['systemPrompt'], (promptCtx) => {
       try {
         const dispose = promptCtx.systemPrompt.section({
           name: 'dsh-global-todo:guidance',
           order: 3040,
-          text: GUIDANCE,
+          text: guidanceText,
         })
         return () => {
           try {

package/lib/routes.js

@@ -438,6 +438,10 @@ export function createRoutes(deps) {
         // Tool registration is the surface that fails quietly, so it is reported
         // rather than assumed.
         tools: deps.tools ?? { registered: [], error: null },
+        // Which optional surfaces this deployment has. The panel hides entries it cannot
+        // call, and a check can tell "switched off" (mode/registered) from "failed"
+        // (tools.error above). Absent on an older host → assume everything is on.
+        modules: deps.modulesInfo?.() ?? { toolGroups: 'all', registered: [], capture: true },
         // Automatic completion is the other surface that can fail quietly: if the
         // session watcher did not attach, the only symptom would be todos that
         // never finish themselves.

package/lib/tools.js

@@ -325,6 +325,40 @@ function originOf(exec) {
  * @param {{ now?: () => number, metrics?: object }} [options]
  * @returns {object[]} definitions for `ctx.tools.register`
  */
+/**
+ * Which tools a deployment gets. `core` is the list itself; `all` adds the
+ * collaboration surface (batch capture, attachments, delete, reopen).
+ *
+ * The ten tool schemas are about 2k tokens per turn, which is real money for a
+ * deployment that only wants a todo list and never asks an agent to touch it.
+ * A config value is enough to shed that; splitting the package into several
+ * Loader rows is the heavier option, deferred until adoption asks for it.
+ */
+export const TOOL_GROUPS = Object.freeze({
+  core: Object.freeze(['global_todo_add', 'global_todo_list', 'global_todo_get', 'global_todo_update', 'global_todo_note', 'global_todo_done']),
+  advanced: Object.freeze(['global_todo_capture', 'global_todo_link', 'global_todo_remove', 'global_todo_reopen']),
+})
+
+/**
+ * @param {string} value
+ * @returns {'all' | 'core' | 'none'} one of the supported modes
+ */
+export function normalizeToolGroups(value) {
+  return value === 'core' || value === 'none' || value === 'all' ? value : 'all'
+}
+
+/**
+ * @param {{ name: string }[]} definitions
+ * @param {'all' | 'core' | 'none'} mode
+ * @returns {{ name: string }[]} the subset this mode registers
+ */
+export function selectTools(definitions, mode) {
+  const wanted = normalizeToolGroups(mode)
+  if (wanted === 'none') return []
+  if (wanted === 'all') return definitions
+  return definitions.filter((definition) => TOOL_GROUPS.core.includes(definition.name))
+}
+
 export function createTools(service, options = {}) {
   const now = options.now ?? (() => Date.now())
   // Read lazily: the settings object is created before the tools and its value can change

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-global-todo",
-  "version": "0.13.2",
+  "version": "0.14.0",
   "icon": "./docs/icon.svg",
   "description": "Cross-session todo list for DeepSeek Harness: one JSON file a person and an agent both write to, with step plans that ship as a numbered hand-off, session read-back, and a human confirmation before an agent's \"done\" counts.",
   "type": "module",
@@ -73,6 +73,7 @@
     "check": "node scripts/check.mjs",
     "doctor": "node tools/doctor.mjs",
     "check:windows": "node tools/windows-check.mjs",
+    "check:contracts": "node tools/contracts-check.mjs",
     "notify": "node tools/notify.mjs",
     "test": "node --test \"test/**/*.test.mjs\"",
     "verify": "npm run check && npm run check:render && npm test",