dsh-jira-tasks 1.0.6 → 1.0.7

package/README.en.md

@@ -25,12 +25,18 @@ Published to npm:
 dsh plugin --profile web add dsh-jira-tasks
 ```
 
+Or straight from GitHub (the repository root is the package directory; `lib/` is prebuilt):
+
+```bash
+dsh plugin --profile web add github:liu3734/jira-tasks-dsh-plugin
+```
+
 **Restart DSH** to activate.
 
 <details>
 <summary>Manual install (without npm)</summary>
 
-1. Copy the repo's `profile-package/` to `~/.dsh/profiles/web/packages/dsh-jira-tasks/`
+1. Copy this repository (its root is the package directory) to `~/.dsh/profiles/web/packages/dsh-jira-tasks/` (skip `.git/`)
 2. Edit `~/.dsh/profiles/web/package.json`:
    - Add to `dependencies`: `"dsh-jira-tasks": "file:./packages/dsh-jira-tasks"`
    - Append to `dsh.profile.bundles`: `"dsh-jira-tasks"`
@@ -57,6 +63,8 @@ Open **Settings → Plugins → Plugin configuration → JIRA** and fill in:
 
 Leaving the token blank on save keeps the existing one; clearing the address on save removes the override and falls back to the environment. Auth is auto-detected: tokens containing `:` use Basic, otherwise Bearer (JIRA PAT).
 
+> **A token supplied by the environment cannot be overwritten from this card.** If the environment that launched DSH already defines `JIRA_API_TOKEN` (a Windows *user-level* variable counts), DSH treats that reference as read-only: the card disables the token field and explains why. The panel already uses that variable, so **no save is needed**; to manage the token from settings instead, remove the variable first (Windows: System Properties → Environment Variables, or PowerShell `[Environment]::SetEnvironmentVariable('JIRA_API_TOKEN', $null, 'User')`) and restart DSH.
+
 #### Connection test
 
 The card's footer carries a status light and a **Test connection** button:
@@ -108,6 +116,20 @@ dsh plugin --profile web remove dsh-jira-tasks
 | Cannot parse JIRA response | Network / proxy issue, curl produced no output |
 </details>
 
+<details>
+<summary>Saving the token fails with "is supplied read-only by the launching environment"</summary>
+
+`JIRA_API_TOKEN` (or `JIRA_TOKEN`) is supplied by the environment that launched DSH, and DSH treats that reference as read-only: a write would be shadowed by the variable, so it is refused. The panel already uses that variable and queries fine, so **there is nothing to save**.
+
+To manage the token from the settings card instead, remove the variable and restart DSH:
+
+- Windows (PowerShell): `[Environment]::SetEnvironmentVariable('JIRA_API_TOKEN', $null, 'User')`, then reopen the terminal
+- Windows (GUI): System Properties → Advanced → Environment Variables, delete the user variable
+- macOS / Linux: remove the export from `~/.zshrc` / `~/.bashrc` (or equivalent) and reopen the terminal
+
+Since v1.0.7 the card detects a read-only token, disables the field, and shows this guidance inline instead of failing on save.
+</details>
+
 <details>
 <summary>Panel does not appear</summary>
 

package/README.md

@@ -16,6 +16,9 @@
 - 👤 默认仅显示当前用户（`assignee = currentUser()`）的「开启 / 重新开启」任务
 - ⚙️ **设置 → 插件 → JIRA** 配置 JIRA 地址与访问令牌（令牌写入凭据存储，不回传前端）
 - 🟢 设置卡片自动探测连接并显示状态灯：绿=可用、红=不可用、灰=未配置；点「测试连接」可用**未保存的草稿值**即时验证
+
+<img width="1590" height="1574" alt="image" src="https://github.com/user-attachments/assets/af5f11c6-aa9a-4c3b-84ca-cff6c0017b22" />
+
 - ⚙️ 项目 Key 与 JQL 按工作区保存；未配置的工作区显示"未配置"
 - 🔄 打开新会话自动查询，面板内支持一键刷新（⟳）
 - 🧭 点击标题可**收起 / 展开**面板；标题徽标显示查询命中的任务总数（列表最多展示 50 条，按更新时间倒序）
@@ -31,6 +34,12 @@
 dsh plugin --profile web add dsh-jira-tasks
 ```
 
+或直接从 GitHub 安装（仓库根即包目录，`lib/` 为预构建产物）：
+
+```bash
+dsh plugin --profile web add github:liu3734/jira-tasks-dsh-plugin
+```
+
 **重启 DSH** 后生效。
 
 > 若改用 GitHub Packages 源：先在 profile 的 `.npmrc` 配置 `@liu3734:registry=https://npm.pkg.github.com/` 及读取令牌，再执行 `dsh plugin --profile web add @liu3734/dsh-jira-tasks`。
@@ -38,7 +47,7 @@ dsh plugin --profile web add dsh-jira-tasks
 <details>
 <summary>手动安装（不使用 npm）</summary>
 
-1. 将仓库 `profile-package/` 复制为 `~/.dsh/profiles/web/packages/dsh-jira-tasks/`
+1. 将本仓库（仓库根目录即包目录）复制为 `~/.dsh/profiles/web/packages/dsh-jira-tasks/`（可忽略 `.git/`）
 2. 编辑 `~/.dsh/profiles/web/package.json`：
    - `dependencies` 增加：`"dsh-jira-tasks": "file:./packages/dsh-jira-tasks"`
    - `dsh.profile.bundles` 追加：`"dsh-jira-tasks"`
@@ -65,6 +74,8 @@ dsh plugin --profile web add dsh-jira-tasks
 
 留空并保存会保持已有令牌不变；地址留空并保存则清除设置项，回退到环境变量。认证自动识别：令牌含 `:` 用 Basic，否则用 Bearer（JIRA PAT）。
 
+> **令牌已由环境变量提供时，设置页无法改写它**：若启动 DSH 的环境里已设置 `JIRA_API_TOKEN`（Windows 用户级环境变量也算），DSH 会将该引用视为只读，卡片会禁用令牌输入并说明原因。此时面板已直接使用该环境变量，**无需保存**；要改由设置页管理，请先移除环境变量（Windows：系统属性 → 环境变量，或 PowerShell `[Environment]::SetEnvironmentVariable('JIRA_API_TOKEN', $null, 'User')`）后重启 DSH。
+
 #### 连接测试
 
 卡片底部有连接状态灯与 **测试连接** 按钮：
@@ -119,6 +130,20 @@ dsh plugin --profile web remove dsh-jira-tasks
 | 无法解析 JIRA 响应：… | 网络 / 代理问题，curl 无输出 |
 </details>
 
+<details>
+<summary>保存令牌报 “is supplied read-only by the launching environment”</summary>
+
+`JIRA_API_TOKEN`（或 `JIRA_TOKEN`）已由启动 DSH 的环境提供，DSH 判定该引用只读：写入会被环境变量遮蔽，因此拒绝保存。此时面板已经直接使用该环境变量，能正常查询，**无需在设置页保存**。
+
+如需改由设置页管理令牌，先移除环境变量再重启 DSH：
+
+- Windows（PowerShell）：`[Environment]::SetEnvironmentVariable('JIRA_API_TOKEN', $null, 'User')`，然后重开终端
+- Windows（图形界面）：系统属性 → 高级 → 环境变量，删除对应用户变量
+- macOS / Linux：从 `~/.zshrc` / `~/.bashrc` 等启动脚本中移除后重开终端
+
+v1.0.7 起卡片会检测只读令牌并直接禁用输入框、在卡片内给出上述提示，不再等到保存才报英文错误。
+</details>
+
 <details>
 <summary>面板不显示</summary>
 

package/lib/client.js

@@ -288,6 +288,18 @@ window.__ModuleLoader__.load({
     var TOKEN_REF = "JIRA_API_TOKEN";
     var TOKEN_REFS = ["JIRA_API_TOKEN", "JIRA_TOKEN"];
 
+    // credentials-local 拒绝写入“由启动环境提供”的引用时，原始信息是英文的；这里取出引用名并给出可操作的中文说明。
+    function shadowedTokenRef(message) {
+      var m = /"([^"]+)" is supplied read-only by the launching environment/.exec(String(message || ""));
+      return m ? m[1] : "";
+    }
+    function tokenReadOnlyHint(ref) {
+      var name = ref || TOKEN_REF;
+      return "令牌由启动 DSH 的环境变量 " + name + " 提供（只读），面板已直接使用，无需在此保存。"
+        + "如需改由设置页管理，请先移除该环境变量并重启 DSH；Windows 可在 PowerShell 执行 "
+        + "[Environment]::SetEnvironmentVariable('" + name + "', $null, 'User') 后重开终端。";
+    }
+
     function useScopeSnapshot(scope) {
       var state = React.useState(function () { return scope.getSnapshot(); });
       var snapshot = state[0], setSnapshot = state[1];
@@ -303,15 +315,20 @@ window.__ModuleLoader__.load({
     function createJiraSettingsCard(scope, credentials) {
       function readTokenInfo() {
         return credentials.describe(TOKEN_REFS).then(function (res) {
-          if (!res || !res.ok || !res.value) return { configured: false, writable: false };
+          if (!res || !res.ok || !res.value) return { configured: false, writable: true };
           for (var i = 0; i < TOKEN_REFS.length; i++) {
-            var info = res.value[TOKEN_REFS[i]];
-            if (info && info.configured) return { configured: true, writable: info.writable !== false };
+            var ref = TOKEN_REFS[i];
+            var info = res.value[ref];
+            // 命中的第一个引用即生效来源；writable 为 false 表示只读（由启动环境提供），写不进去。
+            if (info && info.configured) {
+              return { configured: true, writable: info.writable !== false, ref: ref };
+            }
           }
           var primary = res.value[TOKEN_REF];
-          return { configured: false, writable: primary ? primary.writable !== false : true };
+          return { configured: false, writable: primary ? primary.writable !== false : true, ref: TOKEN_REF };
         }).catch(function () {
-          return { configured: false, writable: false };
+          // 状态读取失败不阻断保存，交由写入路径给出真实错误。
+          return { configured: false, writable: true };
         });
       }
 
@@ -347,6 +364,9 @@ window.__ModuleLoader__.load({
         var baseValue = baseEdit === undefined ? storedBase : baseEdit;
         var dirty = (baseEdit !== undefined && baseEdit !== storedBase) || (tokenDraft || "").length > 0;
         var writable = snapshot.writable !== false;
+        // 令牌可能来自启动环境（只读）：此时禁用输入并说明原因，而不是等到保存才报 DSH 的英文错误。
+        var tokenWritable = !tokenInfo || tokenInfo.writable !== false;
+        var tokenReadOnly = !!(tokenInfo && tokenInfo.configured && tokenInfo.writable === false);
 
         // 命名空间未挂载时不显示，避免留下一张无法操作的卡片。
         if (snapshot.status === "unavailable") return null;
@@ -360,6 +380,11 @@ window.__ModuleLoader__.load({
             tasks.push(baseEdit === "" ? scope.unset("baseUrl") : scope.set("baseUrl", baseEdit));
           }
           var token = (tokenDraft || "").trim();
+          if (token && !tokenWritable) {
+            setBusy(false);
+            setFailed(tokenReadOnlyHint(tokenInfo && tokenInfo.ref));
+            return;
+          }
           if (token) {
             tasks.push(credentials.set(TOKEN_REF, token).then(function (res) {
               if (res && res.ok === false) {
@@ -377,7 +402,8 @@ window.__ModuleLoader__.load({
             setBusy(false);
           }).catch(function (err) {
             setBusy(false);
-            setFailed(String((err && err.message) || err));
+            var shadowed = shadowedTokenRef(err && err.message);
+            setFailed(shadowed ? tokenReadOnlyHint(shadowed) : String((err && err.message) || err));
           });
         }
 
@@ -404,7 +430,9 @@ window.__ModuleLoader__.load({
 
         var tokenHint = tokenInfo === null
           ? "正在读取令牌状态…"
-          : (tokenInfo.configured ? "令牌已配置；留空并保存可保持不变。" : "令牌未配置。含 “:” 时用 Basic，否则用 Bearer。");
+          : (tokenReadOnly
+            ? tokenReadOnlyHint(tokenInfo.ref)
+            : (tokenInfo.configured ? "令牌已配置；留空并保存可保持不变。" : "令牌未配置。含 “:” 时用 Basic，否则用 Bearer。"));
         var dotClass = probe.phase === "ok" ? "jt-dot jt-dot-ok"
           : probe.phase === "fail" ? "jt-dot jt-dot-fail"
             : probe.phase === "testing" ? "jt-dot jt-dot-testing" : "jt-dot";
@@ -433,9 +461,9 @@ window.__ModuleLoader__.load({
               className: "jt-input",
               type: "password",
               value: tokenDraft,
-              placeholder: tokenInfo && tokenInfo.configured ? "已配置，留空保持不变" : "粘贴令牌",
+              placeholder: tokenReadOnly ? "由环境变量提供（只读）" : (tokenInfo && tokenInfo.configured ? "已配置，留空保持不变" : "粘贴令牌"),
               autoComplete: "off",
-              disabled: !writable || busy,
+              disabled: !writable || busy || !tokenWritable,
               onChange: function (e) { setTokenDraft(e.target.value); },
               onKeyDown: function (e) { if (e.key === "Enter") save(); }
             })
@@ -455,7 +483,7 @@ window.__ModuleLoader__.load({
               onClick: function () { runProbe({ baseUrl: baseValue, token: (tokenDraft || "").trim() }); }
             }, probe.phase === "testing" ? "测试中…" : "测试连接"),
             h("button", { className: "jt-btn", disabled: !dirty || busy, onClick: discard }, "放弃"),
-            h("button", { className: "jt-btn jt-btn-primary", disabled: !dirty || busy || !writable, onClick: save }, busy ? "保存中…" : "保存")
+            h("button", { className: "jt-btn jt-btn-primary", disabled: !dirty || busy || !writable || ((tokenDraft || "").trim().length > 0 && !tokenWritable), onClick: save }, busy ? "保存中…" : "保存")
           )
         );
       };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-jira-tasks",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "JIRA open tasks panel for DeepSeek Harness (DSH): shows the current user's open/reopened issues below the composer, per-workspace project key, persistent profile bundle.",
   "type": "module",
   "main": "lib/index.js",