dsh-jira-tasks 1.0.6 → 1.0.8

package/README.en.md

@@ -25,12 +25,18 @@ Published to npm:
 dsh plugin --profile web add dsh-jira-tasks
 ```
 
+Or straight from GitHub (the repository root is the package directory; `lib/` is prebuilt):
+
+```bash
+dsh plugin --profile web add github:liu3734/jira-tasks-dsh-plugin
+```
+
 **Restart DSH** to activate.
 
 <details>
 <summary>Manual install (without npm)</summary>
 
-1. Copy the repo's `profile-package/` to `~/.dsh/profiles/web/packages/dsh-jira-tasks/`
+1. Copy this repository (its root is the package directory) to `~/.dsh/profiles/web/packages/dsh-jira-tasks/` (skip `.git/`)
 2. Edit `~/.dsh/profiles/web/package.json`:
    - Add to `dependencies`: `"dsh-jira-tasks": "file:./packages/dsh-jira-tasks"`
    - Append to `dsh.profile.bundles`: `"dsh-jira-tasks"`
@@ -53,10 +59,18 @@ In a DSH session, use the Cordis tools: `cordis_define` (`kind: new`, `idPrefix:
 Open **Settings → Plugins → Plugin configuration → JIRA** and fill in:
 
 - **JIRA base URL**: e.g. `http://jira.example.com/` (stored in the user settings document and read back by the form)
-- **Access token / PAT**: written to the credential store (`$DSH_HOME/.credentials.yaml`); the browser only ever sees "configured", never the token itself
+- **Access token / PAT**: written to the credential store (`$DSH_HOME/.credentials.yaml`) under the plugin-owned ref `JIRA_TASKS_TOKEN`; the browser only ever sees "configured", never the token itself
 
 Leaving the token blank on save keeps the existing one; clearing the address on save removes the override and falls back to the environment. Auth is auto-detected: tokens containing `:` use Basic, otherwise Bearer (JIRA PAT).
 
+> **The settings-page token takes precedence over the environment.** When the environment that launched DSH already defines `JIRA_API_TOKEN` (a Windows *user-level* variable counts), the card is still editable: it stores the token in its own ref `JIRA_TASKS_TOKEN`, which DSH accepts (it only refuses to write a ref the launching environment shadows), and the Host resolves tokens in this order:
+>
+> ```
+> JIRA_TASKS_TOKEN (settings card) > JIRA_API_TOKEN > JIRA_TOKEN
+> ```
+>
+> Click **Clear settings token** in the card to fall back to the environment variable again.
+
 #### Connection test
 
 The card's footer carries a status light and a **Test connection** button:
@@ -73,7 +87,7 @@ JIRA_API_TOKEN: "<PAT or user:token>"
 ```
 
 - Base URL aliases: `JIRA_BASE_URL` / `JIRA_URL`
-- Token aliases: `JIRA_API_TOKEN` / `JIRA_TOKEN`
+- Token resolution order: `JIRA_TASKS_TOKEN` (written by the settings card) → `JIRA_API_TOKEN` → `JIRA_TOKEN`; the first match wins
 
 ### 2. Project key and JQL (per workspace)
 
@@ -108,6 +122,20 @@ dsh plugin --profile web remove dsh-jira-tasks
 | Cannot parse JIRA response | Network / proxy issue, curl produced no output |
 </details>
 
+<details>
+<summary>Can the settings card override the token from the environment?</summary>
+
+**Yes.** The card stores the token under the plugin-owned ref `JIRA_TASKS_TOKEN` instead of writing the environment's `JIRA_API_TOKEN`. DSH only refuses to write a ref the launching environment *shadows*, so its own ref is always writable: even with `JIRA_API_TOKEN` exported by the shell or the OS, the field accepts input, the save succeeds, and the Host prefers it:
+
+```
+JIRA_TASKS_TOKEN (settings card) > JIRA_API_TOKEN > JIRA_TOKEN
+```
+
+- The card names the effective source: with a saved token it says "overrides environment variable JIRA_API_TOKEN"; without one it says "currently using environment variable JIRA_API_TOKEN — fill in and save to override"
+- Saving re-probes the connection; **Clear settings token (fall back to environment)** removes the override
+- The one remaining case that reports `is supplied read-only by the launching environment` is someone exporting `JIRA_TASKS_TOKEN` itself — that ref really is read-only then; remove it (Windows: System Properties → Environment Variables, or PowerShell `[Environment]::SetEnvironmentVariable('JIRA_TASKS_TOKEN', $null, 'User')`) and restart DSH
+</details>
+
 <details>
 <summary>Panel does not appear</summary>
 
@@ -125,14 +153,14 @@ dsh plugin --profile web remove dsh-jira-tasks
 │ conversation.composer.dock (active)        │      │ webServer route /jira/api/search │
 │ conversation.input.dock (new, order:99)    │      │   ↓                            │
 │   ↓ on mount/refresh fetch POST            │      │ settings.get("jira-tasks")      │
-│ render: list / error / unconfigured        │      │ credentials.resolve(JIRA_*)     │
+│ render: list / error / unconfigured        │      │ credentials.resolve(TOKEN_REFS) │
 │ localStorage per-workspace key/JQL         │      │ subprocess.spawn(curl …)        │
 │ settings.plugin.item (Settings card)       │      │   ↓ stdout JSON                 │
 └────────────────────────────────────────────┘      │ parse issues → {ok,issues}      │
                                                     └────────────────────────────────┘
 ```
 
-- **Host**: registers the `jira-tasks` settings namespace (`baseUrl`, readable) and a `webServer` route `POST /jira/api/search`; the address comes from the settings document, the token from the `credentials` service (Settings card / env / `$DSH_HOME/.credentials.yaml`, hot-reloaded); queries run through `subprocess` spawning `curl` directly, with the auth header passed via stdin (`--config -`) so the token never appears in argv.
+- **Host**: registers the `jira-tasks` settings namespace (`baseUrl`, readable) and a `webServer` route `POST /jira/api/search`; the address comes from the settings document, the token from the `credentials` service resolved in the order `JIRA_TASKS_TOKEN` (written by the Settings card) → `JIRA_API_TOKEN` → `JIRA_TOKEN` (`$DSH_HOME/.credentials.yaml` / environment, hot-reloaded), so a saved card token overrides the environment; queries run through `subprocess` spawning `curl` directly, with the auth header passed via stdin (`--config -`) so the token never appears in argv.
 - **Client**: a standard `window.__ModuleLoader__.load({ id, factory })` web bundle; registers `conversation.composer.dock` (active sessions) and `conversation.input.dock` (new sessions, flex `order: 99` below the input, aligned width), plus `settings.plugin.item` (`key: "jira-tasks"`) for the Settings card — the address is written through `settingsScope` and the token through `remote.credentials`.
 - **Why not the `shell` service**: `shell` wraps commands with `sandbox-exec`, which is broken on some macOS versions (`sandbox_apply: Operation not permitted`); `subprocess` is the raw process seam without this issue.
 - **New-session display**: the DSH shell does not render `composer.dock` during the hero (blank session) phase, so the plugin also registers `input.dock` and de-duplicates by "session has messages".

package/README.md

@@ -16,6 +16,9 @@
 - 👤 默认仅显示当前用户（`assignee = currentUser()`）的「开启 / 重新开启」任务
 - ⚙️ **设置 → 插件 → JIRA** 配置 JIRA 地址与访问令牌（令牌写入凭据存储，不回传前端）
 - 🟢 设置卡片自动探测连接并显示状态灯：绿=可用、红=不可用、灰=未配置；点「测试连接」可用**未保存的草稿值**即时验证
+
+<img width="1590" height="1574" alt="image" src="https://github.com/user-attachments/assets/af5f11c6-aa9a-4c3b-84ca-cff6c0017b22" />
+
 - ⚙️ 项目 Key 与 JQL 按工作区保存；未配置的工作区显示"未配置"
 - 🔄 打开新会话自动查询，面板内支持一键刷新（⟳）
 - 🧭 点击标题可**收起 / 展开**面板；标题徽标显示查询命中的任务总数（列表最多展示 50 条，按更新时间倒序）
@@ -31,6 +34,12 @@
 dsh plugin --profile web add dsh-jira-tasks
 ```
 
+或直接从 GitHub 安装（仓库根即包目录，`lib/` 为预构建产物）：
+
+```bash
+dsh plugin --profile web add github:liu3734/jira-tasks-dsh-plugin
+```
+
 **重启 DSH** 后生效。
 
 > 若改用 GitHub Packages 源：先在 profile 的 `.npmrc` 配置 `@liu3734:registry=https://npm.pkg.github.com/` 及读取令牌，再执行 `dsh plugin --profile web add @liu3734/dsh-jira-tasks`。
@@ -38,7 +47,7 @@ dsh plugin --profile web add dsh-jira-tasks
 <details>
 <summary>手动安装（不使用 npm）</summary>
 
-1. 将仓库 `profile-package/` 复制为 `~/.dsh/profiles/web/packages/dsh-jira-tasks/`
+1. 将本仓库（仓库根目录即包目录）复制为 `~/.dsh/profiles/web/packages/dsh-jira-tasks/`（可忽略 `.git/`）
 2. 编辑 `~/.dsh/profiles/web/package.json`：
    - `dependencies` 增加：`"dsh-jira-tasks": "file:./packages/dsh-jira-tasks"`
    - `dsh.profile.bundles` 追加：`"dsh-jira-tasks"`
@@ -61,10 +70,18 @@ dsh plugin --profile web add dsh-jira-tasks
 打开 **设置 → 插件 → 插件配置 → JIRA**，填写：
 
 - **JIRA 地址**：如 `http://jira.example.com/`（存入用户设置文档，可在界面回读）
-- **访问令牌 / PAT**：写入凭据存储（`$DSH_HOME/.credentials.yaml`），前端只显示"已配置"，不回传令牌本身
+- **访问令牌 / PAT**：写入凭据存储（`$DSH_HOME/.credentials.yaml`，引用名是插件自有的 `JIRA_TASKS_TOKEN`），前端只显示"已配置"，不回传令牌本身
 
 留空并保存会保持已有令牌不变；地址留空并保存则清除设置项，回退到环境变量。认证自动识别：令牌含 `:` 用 Basic，否则用 Bearer（JIRA PAT）。
 
+> **设置页令牌优先于环境变量**：启动 DSH 的环境里已有 `JIRA_API_TOKEN`（Windows 用户级环境变量也算）时，卡片照常可以输入并保存——保存的是插件自有引用 `JIRA_TASKS_TOKEN`，DSH 不会拒绝（它只拒绝写入会被环境遮蔽的同名引用），Host 解析时也把它排在环境变量之前：
+>
+> ```
+> JIRA_TASKS_TOKEN（设置页） > JIRA_API_TOKEN > JIRA_TOKEN
+> ```
+>
+> 想改回用环境变量，点卡片里的「清除设置页令牌」即可。
+
 #### 连接测试
 
 卡片底部有连接状态灯与 **测试连接** 按钮：
@@ -81,7 +98,7 @@ JIRA_API_TOKEN: "<PAT 或 user:token>"
 ```
 
 - 地址别名：`JIRA_BASE_URL` / `JIRA_URL`
-- 令牌别名：`JIRA_API_TOKEN` / `JIRA_TOKEN`
+- 令牌解析顺序：`JIRA_TASKS_TOKEN`（设置页写入）→ `JIRA_API_TOKEN` → `JIRA_TOKEN`，前者优先
 
 ### 2. 项目 Key 与 JQL（按工作区）
 
@@ -119,6 +136,20 @@ dsh plugin --profile web remove dsh-jira-tasks
 | 无法解析 JIRA 响应：… | 网络 / 代理问题，curl 无输出 |
 </details>
 
+<details>
+<summary>环境变量里的令牌，能不能在设置页覆盖？</summary>
+
+**能。** 卡片把令牌保存到插件自有引用 `JIRA_TASKS_TOKEN`，而不是直接写环境变量用的 `JIRA_API_TOKEN`。DSH 只拒绝写入「会被启动环境遮蔽的同名引用」，插件自有引用不受影响，所以哪怕 shell / 系统里已导出 `JIRA_API_TOKEN`，设置页也能正常输入并保存，并且 Host 解析时优先用它：
+
+```
+JIRA_TASKS_TOKEN（设置页） > JIRA_API_TOKEN > JIRA_TOKEN
+```
+
+- 卡片会显示当前生效来源：已保存设置页令牌时提示「优先于环境变量 JIRA_API_TOKEN」；未保存时提示「当前使用环境变量 JIRA_API_TOKEN，填写并保存即可覆盖」
+- 保存后自动重测连接；点「清除设置页令牌（回退到环境变量）」可删除覆盖值
+- 唯一仍会报 `is supplied read-only by the launching environment` 的情况：有人把 `JIRA_TASKS_TOKEN` 本身也导出到了启动环境——那种情况下该引用确实只读，需先移除它（Windows：系统属性 → 环境变量，或 PowerShell `[Environment]::SetEnvironmentVariable('JIRA_TASKS_TOKEN', $null, 'User')`）并重启 DSH
+</details>
+
 <details>
 <summary>面板不显示</summary>
 
@@ -136,15 +167,15 @@ dsh plugin --profile web remove dsh-jira-tasks
 │ conversation.composer.dock（活跃会话）  │   │ webServer 路由 /jira/api/search     │
 │ conversation.input.dock（新会话）       │   │ ↓                                   │
 │   面板 hero 布局（flex order:99）       │   │ settings.get("jira-tasks").baseUrl   │
-│   ↓ 挂载 / 刷新时 fetch POST            │   │ credentials.resolve(JIRA_API_TOKEN) │
+│   ↓ 挂载 / 刷新时 fetch POST            │   │ credentials.resolve(TOKEN_REFS)     │
 │ 渲染：任务列表 / 错误 / 未配置          │   │ subprocess.spawn(curl …)            │
 │ localStorage 按工作区存取项目 Key/JQL   │   │ ↓ stdout JSON                       │
 │ settings.plugin.item（设置页卡片）      │   │ 解析 issues → 返回 {ok,issues}      │
 └────────────────────────────────────────┘   └────────────────────────────────────┘
 ```
 
-- **Host**：注册 `settings` 命名空间 `jira-tasks`（`baseUrl`，可读）与 `webServer` 路由 `POST /jira/api/search`；地址优先读设置文档，令牌经 `credentials` 服务解析（设置页写入 / 环境变量 / `$DSH_HOME/.credentials.yaml`，热加载）；查询用 `subprocess` 直接 `spawn curl`，认证头经 stdin（`--config -`）传入，令牌不进入命令行参数。
-- **Client**：`window.__ModuleLoader__.load({ id, factory })` 标准 web bundle；注册 `conversation.composer.dock`（活跃会话，注册 `order: 5`）与 `conversation.input.dock`（新会话，注册 `order: 10`）。新会话面板走 hero 布局：面板元素自身 `flex order: 99` 排在输入框之后下方，并以 `--dsh-composer-side-clearance` / `--dsh-composer-card-max-width` 与输入卡等宽。另注册 `settings.plugin.item`（`key: "jira-tasks"`）作为设置页卡片：地址经 `settingsScope` 写入命名空间，令牌经 `remote.credentials` 写入凭据存储。
+- **Host**：注册 `settings` 命名空间 `jira-tasks`（`baseUrl`，可读）与 `webServer` 路由 `POST /jira/api/search`；地址优先读设置文档，令牌经 `credentials` 服务按 `JIRA_TASKS_TOKEN`（设置页写入）→ `JIRA_API_TOKEN` → `JIRA_TOKEN` 的顺序解析（`$DSH_HOME/.credentials.yaml` / 环境变量，热加载），因此设置页保存的令牌能覆盖环境变量；查询用 `subprocess` 直接 `spawn curl`，认证头经 stdin（`--config -`）传入，令牌不进入命令行参数。
+- **Client**：`window.__ModuleLoader__.load({ id, factory })` 标准 web bundle；注册 `conversation.composer.dock`（活跃会话，注册 `order: 5`）与 `conversation.input.dock`（新会话，注册 `order: 10`）。新会话面板走 hero 布局：面板元素自身 `flex order: 99` 排在输入框之后下方，并以 `--dsh-composer-side-clearance` / `--dsh-composer-card-max-width` 与输入卡等宽。另注册 `settings.plugin.item`（`key: "jira-tasks"`）作为设置页卡片：地址经 `settingsScope` 写入命名空间，令牌经 `remote.credentials` 写入 `JIRA_TASKS_TOKEN`。
 - **为什么不用 `shell` 服务**：`shell` 会套 `sandbox-exec`，部分 macOS 上不可用（`sandbox_apply: Operation not permitted`）；`subprocess` 是原始进程缝，无此问题。
 - **新会话显示**：DSH 壳在 hero（空白会话）阶段不渲染 `composer.dock`，故额外注册 `input.dock`，并用「会话是否已有消息」去重（新版 DSH 依据 `SessionSnapshot.blank`），避免双份面板。
 

package/lib/client.js

@@ -285,8 +285,25 @@ window.__ModuleLoader__.load({
     // ---- 设置页卡片：设置 → 插件 → JIRA ----
     // 地址存 settings 命名空间（可读）；令牌写 credentials（永不随响应回传）。
     var SETTINGS_NS = "jira-tasks";
-    var TOKEN_REF = "JIRA_API_TOKEN";
-    var TOKEN_REFS = ["JIRA_API_TOKEN", "JIRA_TOKEN"];
+    // 令牌写入插件自有引用，而不是直接写 JIRA_API_TOKEN：启动环境里导出的
+    // JIRA_API_TOKEN 会让那个引用只读（DSH 拒绝写入会被环境遮蔽的引用），而
+    // 插件自有引用不受影响，因此设置页保存的值可以覆盖环境变量——优先级由
+    // Host 的解析顺序保证（JIRA_TASKS_TOKEN → JIRA_API_TOKEN → JIRA_TOKEN）。
+    var TOKEN_REF = "JIRA_TASKS_TOKEN";
+    var ENV_TOKEN_REFS = ["JIRA_API_TOKEN", "JIRA_TOKEN"];
+    var TOKEN_REFS = [TOKEN_REF].concat(ENV_TOKEN_REFS);
+
+    // credentials-local 拒绝写入“由启动环境提供”的引用时，原始信息是英文的；这里取出引用名并给出可操作的中文说明。
+    function shadowedTokenRef(message) {
+      var m = /"([^"]+)" is supplied read-only by the launching environment/.exec(String(message || ""));
+      return m ? m[1] : "";
+    }
+    function tokenReadOnlyHint(ref) {
+      var name = ref || TOKEN_REF;
+      return "环境变量 " + name + " 由启动 DSH 的终端提供且只读，无法写入该引用。"
+        + "请先移除它（Windows：系统属性 → 环境变量，或 PowerShell "
+        + "[Environment]::SetEnvironmentVariable('" + name + "', $null, 'User')）并重启 DSH。";
+    }
 
     function useScopeSnapshot(scope) {
       var state = React.useState(function () { return scope.getSnapshot(); });
@@ -303,15 +320,30 @@ window.__ModuleLoader__.load({
     function createJiraSettingsCard(scope, credentials) {
       function readTokenInfo() {
         return credentials.describe(TOKEN_REFS).then(function (res) {
-          if (!res || !res.ok || !res.value) return { configured: false, writable: false };
-          for (var i = 0; i < TOKEN_REFS.length; i++) {
-            var info = res.value[TOKEN_REFS[i]];
-            if (info && info.configured) return { configured: true, writable: info.writable !== false };
+          if (!res || !res.ok || !res.value) return { configured: false, writable: true };
+          var value = res.value;
+          var override = value[TOKEN_REF];
+          var overridden = !!(override && override.configured);
+          var fallbackRef = "", fallbackSource = "";
+          for (var i = 0; i < ENV_TOKEN_REFS.length; i++) {
+            var info = value[ENV_TOKEN_REFS[i]];
+            if (info && info.configured) {
+              fallbackRef = ENV_TOKEN_REFS[i];
+              fallbackSource = info.source || "";
+              break;
+            }
           }
-          var primary = res.value[TOKEN_REF];
-          return { configured: false, writable: primary ? primary.writable !== false : true };
+          return {
+            configured: overridden || fallbackRef !== "",
+            overridden: overridden,
+            // 只有插件自有引用可能被环境遮蔽；JIRA_API_TOKEN 只读不影响这里的写入。
+            writable: !override || override.writable !== false,
+            // 仅当回退值确实来自启动环境时才称它为“环境变量”（旧版本可能把它存在凭据文件里）。
+            envRef: fallbackSource === "env" ? fallbackRef : ""
+          };
         }).catch(function () {
-          return { configured: false, writable: false };
+          // 状态读取失败不阻断保存，交由写入路径给出真实错误。
+          return { configured: false, writable: true };
         });
       }
 
@@ -345,23 +377,33 @@ window.__ModuleLoader__.load({
 
         var storedBase = snapshot.value && typeof snapshot.value.baseUrl === "string" ? snapshot.value.baseUrl : "";
         var baseValue = baseEdit === undefined ? storedBase : baseEdit;
-        var dirty = (baseEdit !== undefined && baseEdit !== storedBase) || (tokenDraft || "").length > 0;
+        var baseDirty = baseEdit !== undefined && baseEdit !== storedBase;
+        var tokenDraftText = (tokenDraft || "").trim();
+        var tokenDirty = tokenDraftText.length > 0;
+        var dirty = baseDirty || tokenDirty;
         var writable = snapshot.writable !== false;
+        // 插件自有引用通常可写；只有 JIRA_TASKS_TOKEN 本身也被导出到启动环境时才会只读。
+        var tokenWritable = !tokenInfo || tokenInfo.writable !== false;
+        var tokenOverridden = !!(tokenInfo && tokenInfo.overridden);
+        var envTokenRef = tokenInfo && tokenInfo.envRef ? tokenInfo.envRef : "";
 
         // 命名空间未挂载时不显示，避免留下一张无法操作的卡片。
         if (snapshot.status === "unavailable") return null;
 
         function save() {
           if (busy || !dirty) return;
+          if (tokenDirty && !tokenWritable) {
+            setFailed(tokenReadOnlyHint(TOKEN_REF));
+            return;
+          }
           setBusy(true);
           setFailed("");
           var tasks = [];
-          if (baseEdit !== undefined && baseEdit !== storedBase) {
+          if (baseDirty) {
             tasks.push(baseEdit === "" ? scope.unset("baseUrl") : scope.set("baseUrl", baseEdit));
           }
-          var token = (tokenDraft || "").trim();
-          if (token) {
-            tasks.push(credentials.set(TOKEN_REF, token).then(function (res) {
+          if (tokenDirty) {
+            tasks.push(credentials.set(TOKEN_REF, tokenDraftText).then(function (res) {
               if (res && res.ok === false) {
                 var err = res.error;
                 throw new Error((err && (err.message || err.code)) || "令牌保存失败");
@@ -375,9 +417,35 @@ window.__ModuleLoader__.load({
             setBaseEdit(undefined);
             setTokenDraft("");
             setBusy(false);
+            // baseUrl 变更会经 snapshot.revision 触发自动重测；仅保存令牌时手动补一次。
+            if (!baseDirty) runProbe({});
+          }).catch(function (err) {
+            setBusy(false);
+            var shadowed = shadowedTokenRef(err && err.message);
+            setFailed(shadowed ? tokenReadOnlyHint(shadowed) : String((err && err.message) || err));
+          });
+        }
+
+        // 清除设置页保存的令牌，回退到环境变量 / 凭据文件中的旧值。
+        function clearOverride() {
+          if (busy) return;
+          setBusy(true);
+          setFailed("");
+          credentials.unset(TOKEN_REF).then(function (res) {
+            if (res && res.ok === false) {
+              var err = res.error;
+              throw new Error((err && (err.message || err.code)) || "清除令牌失败");
+            }
+            return readTokenInfo();
+          }).then(function (info) {
+            setTokenInfo(info);
+            setTokenDraft("");
+            setBusy(false);
+            runProbe({});
           }).catch(function (err) {
             setBusy(false);
-            setFailed(String((err && err.message) || err));
+            var shadowed = shadowedTokenRef(err && err.message);
+            setFailed(shadowed ? tokenReadOnlyHint(shadowed) : String((err && err.message) || err));
           });
         }
 
@@ -404,7 +472,11 @@ window.__ModuleLoader__.load({
 
         var tokenHint = tokenInfo === null
           ? "正在读取令牌状态…"
-          : (tokenInfo.configured ? "令牌已配置；留空并保存可保持不变。" : "令牌未配置。含 “:” 时用 Basic，否则用 Bearer。");
+          : (tokenOverridden
+            ? "设置页令牌已保存" + (envTokenRef ? "，优先于环境变量 " + envTokenRef : "") + "；留空并保存可保持不变。"
+            : (envTokenRef
+              ? "当前使用环境变量 " + envTokenRef + "；在下方填写并保存即可覆盖它。"
+              : (tokenInfo.configured ? "令牌已配置；留空并保存可保持不变。" : "令牌未配置。含 “:” 时用 Basic，否则用 Bearer。")));
         var dotClass = probe.phase === "ok" ? "jt-dot jt-dot-ok"
           : probe.phase === "fail" ? "jt-dot jt-dot-fail"
             : probe.phase === "testing" ? "jt-dot jt-dot-testing" : "jt-dot";
@@ -433,14 +505,18 @@ window.__ModuleLoader__.load({
               className: "jt-input",
               type: "password",
               value: tokenDraft,
-              placeholder: tokenInfo && tokenInfo.configured ? "已配置，留空保持不变" : "粘贴令牌",
+              placeholder: tokenOverridden ? "已保存，留空保持不变" : (envTokenRef ? "填写以覆盖环境变量" : (tokenInfo && tokenInfo.configured ? "已配置，留空保持不变" : "粘贴令牌")),
               autoComplete: "off",
-              disabled: !writable || busy,
+              disabled: busy || !tokenWritable,
               onChange: function (e) { setTokenDraft(e.target.value); },
               onKeyDown: function (e) { if (e.key === "Enter") save(); }
             })
           ),
           h("div", { className: "jt-hint", style: { marginBottom: "8px" } }, tokenHint),
+          tokenOverridden && tokenWritable
+            ? h("div", { className: "jt-hint", style: { margin: "-4px 0 8px" } },
+              h("button", { className: "jt-linklike", disabled: busy, onClick: clearOverride }, "清除设置页令牌（回退到环境变量）"))
+            : null,
           h("div", { className: "jt-probe", role: "status" },
             h("span", { className: dotClass, "aria-hidden": "true" }),
             h("span", null, probe.message || "未测试")
@@ -455,7 +531,7 @@ window.__ModuleLoader__.load({
               onClick: function () { runProbe({ baseUrl: baseValue, token: (tokenDraft || "").trim() }); }
             }, probe.phase === "testing" ? "测试中…" : "测试连接"),
             h("button", { className: "jt-btn", disabled: !dirty || busy, onClick: discard }, "放弃"),
-            h("button", { className: "jt-btn jt-btn-primary", disabled: !dirty || busy || !writable, onClick: save }, busy ? "保存中…" : "保存")
+            h("button", { className: "jt-btn jt-btn-primary", disabled: !dirty || busy || (baseDirty && !writable) || (tokenDirty && !tokenWritable), onClick: save }, busy ? "保存中…" : "保存")
           )
         );
       };

package/lib/index.js

@@ -1,16 +1,26 @@
 /**
  * dsh-jira-tasks — HOST half (persistent profile plugin).
  * Serves POST /jira/api/search: reads the JIRA base URL from the `jira-tasks`
- * settings namespace and the token from the credentials service (falling back
- * to JIRA_BASE_URL / JIRA_API_TOKEN for existing setups), queries JIRA
- * /rest/api/2/search through subprocess+curl (auth header via stdin
- * --config -), returns normalized issue JSON.
+ * settings namespace and the token from the credentials service — the
+ * settings-page JIRA_TASKS_TOKEN first, so it overrides an exported
+ * JIRA_API_TOKEN / JIRA_TOKEN — then queries JIRA /rest/api/2/search through
+ * subprocess+curl (auth header via stdin --config -), returning normalized
+ * issue JSON.
  */
 import z from '@deepseek-ai/schemastery';
 
 /** Settings namespace exposing the editable connection fields in the GUI. */
 const SETTINGS_NS = 'jira-tasks';
 
+/**
+ * Token references in precedence order. `JIRA_TASKS_TOKEN` is the plugin-owned
+ * ref the settings card writes to: unlike `JIRA_API_TOKEN`, the credentials
+ * provider can always store it, because the launching environment does not
+ * supply it. Listing it first is what makes a saved token override an exported
+ * `JIRA_API_TOKEN` / `JIRA_TOKEN`.
+ */
+const TOKEN_REFS = ['JIRA_TASKS_TOKEN', 'JIRA_API_TOKEN', 'JIRA_TOKEN'];
+
 /**
  * Durable connection schema. `baseUrl` is a plain readable field; the token is
  * deliberately NOT stored here — it stays in the credentials store (write-only
@@ -166,7 +176,7 @@ export default {
       try {
         const baseUrl = settingsBaseUrl() || await resolveFirst(['JIRA_BASE_URL', 'JIRA_URL']);
         if (!baseUrl) return { ok: false, error: '未配置 JIRA 地址（设置 → 插件 → JIRA，或环境变量 JIRA_BASE_URL）' };
-        const token = await resolveFirst(['JIRA_API_TOKEN', 'JIRA_TOKEN']);
+        const token = await resolveFirst(TOKEN_REFS);
         if (!token) return { ok: false, error: '未配置 JIRA 令牌（设置 → 插件 → JIRA，或环境变量 JIRA_API_TOKEN）' };
 
         const jql = buildJql(args && args.jql ? String(args.jql) : '', projectKey);
@@ -213,7 +223,7 @@ export default {
         const draftToken = args && typeof args.token === 'string' ? args.token.trim() : '';
         const baseUrl = draftBase || settingsBaseUrl() || await resolveFirst(['JIRA_BASE_URL', 'JIRA_URL']);
         if (!baseUrl) return { ok: false, code: 'unconfigured', error: '未配置 JIRA 地址' };
-        const token = draftToken || await resolveFirst(['JIRA_API_TOKEN', 'JIRA_TOKEN']);
+        const token = draftToken || await resolveFirst(TOKEN_REFS);
         if (!token) return { ok: false, code: 'unconfigured', error: '未配置 JIRA 令牌' };
 
         const raw = await probeJira(baseUrl, token);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-jira-tasks",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "JIRA open tasks panel for DeepSeek Harness (DSH): shows the current user's open/reopened issues below the composer, per-workspace project key, persistent profile bundle.",
   "type": "module",
   "main": "lib/index.js",