dsh-jira-tasks 1.0.7 → 1.0.8

package/README.en.md

@@ -59,11 +59,17 @@ In a DSH session, use the Cordis tools: `cordis_define` (`kind: new`, `idPrefix:
 Open **Settings → Plugins → Plugin configuration → JIRA** and fill in:
 
 - **JIRA base URL**: e.g. `http://jira.example.com/` (stored in the user settings document and read back by the form)
-- **Access token / PAT**: written to the credential store (`$DSH_HOME/.credentials.yaml`); the browser only ever sees "configured", never the token itself
+- **Access token / PAT**: written to the credential store (`$DSH_HOME/.credentials.yaml`) under the plugin-owned ref `JIRA_TASKS_TOKEN`; the browser only ever sees "configured", never the token itself
 
 Leaving the token blank on save keeps the existing one; clearing the address on save removes the override and falls back to the environment. Auth is auto-detected: tokens containing `:` use Basic, otherwise Bearer (JIRA PAT).
 
-> **A token supplied by the environment cannot be overwritten from this card.** If the environment that launched DSH already defines `JIRA_API_TOKEN` (a Windows *user-level* variable counts), DSH treats that reference as read-only: the card disables the token field and explains why. The panel already uses that variable, so **no save is needed**; to manage the token from settings instead, remove the variable first (Windows: System Properties → Environment Variables, or PowerShell `[Environment]::SetEnvironmentVariable('JIRA_API_TOKEN', $null, 'User')`) and restart DSH.
+> **The settings-page token takes precedence over the environment.** When the environment that launched DSH already defines `JIRA_API_TOKEN` (a Windows *user-level* variable counts), the card is still editable: it stores the token in its own ref `JIRA_TASKS_TOKEN`, which DSH accepts (it only refuses to write a ref the launching environment shadows), and the Host resolves tokens in this order:
+>
+> ```
+> JIRA_TASKS_TOKEN (settings card) > JIRA_API_TOKEN > JIRA_TOKEN
+> ```
+>
+> Click **Clear settings token** in the card to fall back to the environment variable again.
 
 #### Connection test
 
@@ -81,7 +87,7 @@ JIRA_API_TOKEN: "<PAT or user:token>"
 ```
 
 - Base URL aliases: `JIRA_BASE_URL` / `JIRA_URL`
-- Token aliases: `JIRA_API_TOKEN` / `JIRA_TOKEN`
+- Token resolution order: `JIRA_TASKS_TOKEN` (written by the settings card) → `JIRA_API_TOKEN` → `JIRA_TOKEN`; the first match wins
 
 ### 2. Project key and JQL (per workspace)
 
@@ -117,17 +123,17 @@ dsh plugin --profile web remove dsh-jira-tasks
 </details>
 
 <details>
-<summary>Saving the token fails with "is supplied read-only by the launching environment"</summary>
+<summary>Can the settings card override the token from the environment?</summary>
 
-`JIRA_API_TOKEN` (or `JIRA_TOKEN`) is supplied by the environment that launched DSH, and DSH treats that reference as read-only: a write would be shadowed by the variable, so it is refused. The panel already uses that variable and queries fine, so **there is nothing to save**.
+**Yes.** The card stores the token under the plugin-owned ref `JIRA_TASKS_TOKEN` instead of writing the environment's `JIRA_API_TOKEN`. DSH only refuses to write a ref the launching environment *shadows*, so its own ref is always writable: even with `JIRA_API_TOKEN` exported by the shell or the OS, the field accepts input, the save succeeds, and the Host prefers it:
 
-To manage the token from the settings card instead, remove the variable and restart DSH:
-
-- Windows (PowerShell): `[Environment]::SetEnvironmentVariable('JIRA_API_TOKEN', $null, 'User')`, then reopen the terminal
-- Windows (GUI): System Properties → Advanced → Environment Variables, delete the user variable
-- macOS / Linux: remove the export from `~/.zshrc` / `~/.bashrc` (or equivalent) and reopen the terminal
+```
+JIRA_TASKS_TOKEN (settings card) > JIRA_API_TOKEN > JIRA_TOKEN
+```
 
-Since v1.0.7 the card detects a read-only token, disables the field, and shows this guidance inline instead of failing on save.
+- The card names the effective source: with a saved token it says "overrides environment variable JIRA_API_TOKEN"; without one it says "currently using environment variable JIRA_API_TOKEN — fill in and save to override"
+- Saving re-probes the connection; **Clear settings token (fall back to environment)** removes the override
+- The one remaining case that reports `is supplied read-only by the launching environment` is someone exporting `JIRA_TASKS_TOKEN` itself — that ref really is read-only then; remove it (Windows: System Properties → Environment Variables, or PowerShell `[Environment]::SetEnvironmentVariable('JIRA_TASKS_TOKEN', $null, 'User')`) and restart DSH
 </details>
 
 <details>
@@ -147,14 +153,14 @@ Since v1.0.7 the card detects a read-only token, disables the field, and shows t
 │ conversation.composer.dock (active)        │      │ webServer route /jira/api/search │
 │ conversation.input.dock (new, order:99)    │      │   ↓                            │
 │   ↓ on mount/refresh fetch POST            │      │ settings.get("jira-tasks")      │
-│ render: list / error / unconfigured        │      │ credentials.resolve(JIRA_*)     │
+│ render: list / error / unconfigured        │      │ credentials.resolve(TOKEN_REFS) │
 │ localStorage per-workspace key/JQL         │      │ subprocess.spawn(curl …)        │
 │ settings.plugin.item (Settings card)       │      │   ↓ stdout JSON                 │
 └────────────────────────────────────────────┘      │ parse issues → {ok,issues}      │
                                                     └────────────────────────────────┘
 ```
 
-- **Host**: registers the `jira-tasks` settings namespace (`baseUrl`, readable) and a `webServer` route `POST /jira/api/search`; the address comes from the settings document, the token from the `credentials` service (Settings card / env / `$DSH_HOME/.credentials.yaml`, hot-reloaded); queries run through `subprocess` spawning `curl` directly, with the auth header passed via stdin (`--config -`) so the token never appears in argv.
+- **Host**: registers the `jira-tasks` settings namespace (`baseUrl`, readable) and a `webServer` route `POST /jira/api/search`; the address comes from the settings document, the token from the `credentials` service resolved in the order `JIRA_TASKS_TOKEN` (written by the Settings card) → `JIRA_API_TOKEN` → `JIRA_TOKEN` (`$DSH_HOME/.credentials.yaml` / environment, hot-reloaded), so a saved card token overrides the environment; queries run through `subprocess` spawning `curl` directly, with the auth header passed via stdin (`--config -`) so the token never appears in argv.
 - **Client**: a standard `window.__ModuleLoader__.load({ id, factory })` web bundle; registers `conversation.composer.dock` (active sessions) and `conversation.input.dock` (new sessions, flex `order: 99` below the input, aligned width), plus `settings.plugin.item` (`key: "jira-tasks"`) for the Settings card — the address is written through `settingsScope` and the token through `remote.credentials`.
 - **Why not the `shell` service**: `shell` wraps commands with `sandbox-exec`, which is broken on some macOS versions (`sandbox_apply: Operation not permitted`); `subprocess` is the raw process seam without this issue.
 - **New-session display**: the DSH shell does not render `composer.dock` during the hero (blank session) phase, so the plugin also registers `input.dock` and de-duplicates by "session has messages".

package/README.md

@@ -70,11 +70,17 @@ dsh plugin --profile web add github:liu3734/jira-tasks-dsh-plugin
 打开 **设置 → 插件 → 插件配置 → JIRA**，填写：
 
 - **JIRA 地址**：如 `http://jira.example.com/`（存入用户设置文档，可在界面回读）
-- **访问令牌 / PAT**：写入凭据存储（`$DSH_HOME/.credentials.yaml`），前端只显示"已配置"，不回传令牌本身
+- **访问令牌 / PAT**：写入凭据存储（`$DSH_HOME/.credentials.yaml`，引用名是插件自有的 `JIRA_TASKS_TOKEN`），前端只显示"已配置"，不回传令牌本身
 
 留空并保存会保持已有令牌不变；地址留空并保存则清除设置项，回退到环境变量。认证自动识别：令牌含 `:` 用 Basic，否则用 Bearer（JIRA PAT）。
 
-> **令牌已由环境变量提供时，设置页无法改写它**：若启动 DSH 的环境里已设置 `JIRA_API_TOKEN`（Windows 用户级环境变量也算），DSH 会将该引用视为只读，卡片会禁用令牌输入并说明原因。此时面板已直接使用该环境变量，**无需保存**；要改由设置页管理，请先移除环境变量（Windows：系统属性 → 环境变量，或 PowerShell `[Environment]::SetEnvironmentVariable('JIRA_API_TOKEN', $null, 'User')`）后重启 DSH。
+> **设置页令牌优先于环境变量**：启动 DSH 的环境里已有 `JIRA_API_TOKEN`（Windows 用户级环境变量也算）时，卡片照常可以输入并保存——保存的是插件自有引用 `JIRA_TASKS_TOKEN`，DSH 不会拒绝（它只拒绝写入会被环境遮蔽的同名引用），Host 解析时也把它排在环境变量之前：
+>
+> ```
+> JIRA_TASKS_TOKEN（设置页） > JIRA_API_TOKEN > JIRA_TOKEN
+> ```
+>
+> 想改回用环境变量，点卡片里的「清除设置页令牌」即可。
 
 #### 连接测试
 
@@ -92,7 +98,7 @@ JIRA_API_TOKEN: "<PAT 或 user:token>"
 ```
 
 - 地址别名：`JIRA_BASE_URL` / `JIRA_URL`
-- 令牌别名：`JIRA_API_TOKEN` / `JIRA_TOKEN`
+- 令牌解析顺序：`JIRA_TASKS_TOKEN`（设置页写入）→ `JIRA_API_TOKEN` → `JIRA_TOKEN`，前者优先
 
 ### 2. 项目 Key 与 JQL（按工作区）
 
@@ -131,17 +137,17 @@ dsh plugin --profile web remove dsh-jira-tasks
 </details>
 
 <details>
-<summary>保存令牌报 “is supplied read-only by the launching environment”</summary>
+<summary>环境变量里的令牌，能不能在设置页覆盖？</summary>
 
-`JIRA_API_TOKEN`（或 `JIRA_TOKEN`）已由启动 DSH 的环境提供，DSH 判定该引用只读：写入会被环境变量遮蔽，因此拒绝保存。此时面板已经直接使用该环境变量，能正常查询，**无需在设置页保存**。
+**能。** 卡片把令牌保存到插件自有引用 `JIRA_TASKS_TOKEN`，而不是直接写环境变量用的 `JIRA_API_TOKEN`。DSH 只拒绝写入「会被启动环境遮蔽的同名引用」，插件自有引用不受影响，所以哪怕 shell / 系统里已导出 `JIRA_API_TOKEN`，设置页也能正常输入并保存，并且 Host 解析时优先用它：
 
-如需改由设置页管理令牌，先移除环境变量再重启 DSH：
-
-- Windows（PowerShell）：`[Environment]::SetEnvironmentVariable('JIRA_API_TOKEN', $null, 'User')`，然后重开终端
-- Windows（图形界面）：系统属性 → 高级 → 环境变量，删除对应用户变量
-- macOS / Linux：从 `~/.zshrc` / `~/.bashrc` 等启动脚本中移除后重开终端
+```
+JIRA_TASKS_TOKEN（设置页） > JIRA_API_TOKEN > JIRA_TOKEN
+```
 
-v1.0.7 起卡片会检测只读令牌并直接禁用输入框、在卡片内给出上述提示，不再等到保存才报英文错误。
+- 卡片会显示当前生效来源：已保存设置页令牌时提示「优先于环境变量 JIRA_API_TOKEN」；未保存时提示「当前使用环境变量 JIRA_API_TOKEN，填写并保存即可覆盖」
+- 保存后自动重测连接；点「清除设置页令牌（回退到环境变量）」可删除覆盖值
+- 唯一仍会报 `is supplied read-only by the launching environment` 的情况：有人把 `JIRA_TASKS_TOKEN` 本身也导出到了启动环境——那种情况下该引用确实只读，需先移除它（Windows：系统属性 → 环境变量，或 PowerShell `[Environment]::SetEnvironmentVariable('JIRA_TASKS_TOKEN', $null, 'User')`）并重启 DSH
 </details>
 
 <details>
@@ -161,15 +167,15 @@ v1.0.7 起卡片会检测只读令牌并直接禁用输入框、在卡片内给
 │ conversation.composer.dock（活跃会话）  │   │ webServer 路由 /jira/api/search     │
 │ conversation.input.dock（新会话）       │   │ ↓                                   │
 │   面板 hero 布局（flex order:99）       │   │ settings.get("jira-tasks").baseUrl   │
-│   ↓ 挂载 / 刷新时 fetch POST            │   │ credentials.resolve(JIRA_API_TOKEN) │
+│   ↓ 挂载 / 刷新时 fetch POST            │   │ credentials.resolve(TOKEN_REFS)     │
 │ 渲染：任务列表 / 错误 / 未配置          │   │ subprocess.spawn(curl …)            │
 │ localStorage 按工作区存取项目 Key/JQL   │   │ ↓ stdout JSON                       │
 │ settings.plugin.item（设置页卡片）      │   │ 解析 issues → 返回 {ok,issues}      │
 └────────────────────────────────────────┘   └────────────────────────────────────┘
 ```
 
-- **Host**：注册 `settings` 命名空间 `jira-tasks`（`baseUrl`，可读）与 `webServer` 路由 `POST /jira/api/search`；地址优先读设置文档，令牌经 `credentials` 服务解析（设置页写入 / 环境变量 / `$DSH_HOME/.credentials.yaml`，热加载）；查询用 `subprocess` 直接 `spawn curl`，认证头经 stdin（`--config -`）传入，令牌不进入命令行参数。
-- **Client**：`window.__ModuleLoader__.load({ id, factory })` 标准 web bundle；注册 `conversation.composer.dock`（活跃会话，注册 `order: 5`）与 `conversation.input.dock`（新会话，注册 `order: 10`）。新会话面板走 hero 布局：面板元素自身 `flex order: 99` 排在输入框之后下方，并以 `--dsh-composer-side-clearance` / `--dsh-composer-card-max-width` 与输入卡等宽。另注册 `settings.plugin.item`（`key: "jira-tasks"`）作为设置页卡片：地址经 `settingsScope` 写入命名空间，令牌经 `remote.credentials` 写入凭据存储。
+- **Host**：注册 `settings` 命名空间 `jira-tasks`（`baseUrl`，可读）与 `webServer` 路由 `POST /jira/api/search`；地址优先读设置文档，令牌经 `credentials` 服务按 `JIRA_TASKS_TOKEN`（设置页写入）→ `JIRA_API_TOKEN` → `JIRA_TOKEN` 的顺序解析（`$DSH_HOME/.credentials.yaml` / 环境变量，热加载），因此设置页保存的令牌能覆盖环境变量；查询用 `subprocess` 直接 `spawn curl`，认证头经 stdin（`--config -`）传入，令牌不进入命令行参数。
+- **Client**：`window.__ModuleLoader__.load({ id, factory })` 标准 web bundle；注册 `conversation.composer.dock`（活跃会话，注册 `order: 5`）与 `conversation.input.dock`（新会话，注册 `order: 10`）。新会话面板走 hero 布局：面板元素自身 `flex order: 99` 排在输入框之后下方，并以 `--dsh-composer-side-clearance` / `--dsh-composer-card-max-width` 与输入卡等宽。另注册 `settings.plugin.item`（`key: "jira-tasks"`）作为设置页卡片：地址经 `settingsScope` 写入命名空间，令牌经 `remote.credentials` 写入 `JIRA_TASKS_TOKEN`。
 - **为什么不用 `shell` 服务**：`shell` 会套 `sandbox-exec`，部分 macOS 上不可用（`sandbox_apply: Operation not permitted`）；`subprocess` 是原始进程缝，无此问题。
 - **新会话显示**：DSH 壳在 hero（空白会话）阶段不渲染 `composer.dock`，故额外注册 `input.dock`，并用「会话是否已有消息」去重（新版 DSH 依据 `SessionSnapshot.blank`），避免双份面板。
 

package/lib/client.js

@@ -285,8 +285,13 @@ window.__ModuleLoader__.load({
     // ---- 设置页卡片：设置 → 插件 → JIRA ----
     // 地址存 settings 命名空间（可读）；令牌写 credentials（永不随响应回传）。
     var SETTINGS_NS = "jira-tasks";
-    var TOKEN_REF = "JIRA_API_TOKEN";
-    var TOKEN_REFS = ["JIRA_API_TOKEN", "JIRA_TOKEN"];
+    // 令牌写入插件自有引用，而不是直接写 JIRA_API_TOKEN：启动环境里导出的
+    // JIRA_API_TOKEN 会让那个引用只读（DSH 拒绝写入会被环境遮蔽的引用），而
+    // 插件自有引用不受影响，因此设置页保存的值可以覆盖环境变量——优先级由
+    // Host 的解析顺序保证（JIRA_TASKS_TOKEN → JIRA_API_TOKEN → JIRA_TOKEN）。
+    var TOKEN_REF = "JIRA_TASKS_TOKEN";
+    var ENV_TOKEN_REFS = ["JIRA_API_TOKEN", "JIRA_TOKEN"];
+    var TOKEN_REFS = [TOKEN_REF].concat(ENV_TOKEN_REFS);
 
     // credentials-local 拒绝写入“由启动环境提供”的引用时，原始信息是英文的；这里取出引用名并给出可操作的中文说明。
     function shadowedTokenRef(message) {
@@ -295,9 +300,9 @@ window.__ModuleLoader__.load({
     }
     function tokenReadOnlyHint(ref) {
       var name = ref || TOKEN_REF;
-      return "令牌由启动 DSH 的环境变量 " + name + " 提供（只读），面板已直接使用，无需在此保存。"
-        + "如需改由设置页管理，请先移除该环境变量并重启 DSH；Windows 可在 PowerShell 执行 "
-        + "[Environment]::SetEnvironmentVariable('" + name + "', $null, 'User') 后重开终端。";
+      return "环境变量 " + name + " 由启动 DSH 的终端提供且只读，无法写入该引用。"
+        + "请先移除它（Windows：系统属性 → 环境变量，或 PowerShell "
+        + "[Environment]::SetEnvironmentVariable('" + name + "', $null, 'User')）并重启 DSH。";
     }
 
     function useScopeSnapshot(scope) {
@@ -316,16 +321,26 @@ window.__ModuleLoader__.load({
       function readTokenInfo() {
         return credentials.describe(TOKEN_REFS).then(function (res) {
           if (!res || !res.ok || !res.value) return { configured: false, writable: true };
-          for (var i = 0; i < TOKEN_REFS.length; i++) {
-            var ref = TOKEN_REFS[i];
-            var info = res.value[ref];
-            // 命中的第一个引用即生效来源；writable 为 false 表示只读（由启动环境提供），写不进去。
+          var value = res.value;
+          var override = value[TOKEN_REF];
+          var overridden = !!(override && override.configured);
+          var fallbackRef = "", fallbackSource = "";
+          for (var i = 0; i < ENV_TOKEN_REFS.length; i++) {
+            var info = value[ENV_TOKEN_REFS[i]];
             if (info && info.configured) {
-              return { configured: true, writable: info.writable !== false, ref: ref };
+              fallbackRef = ENV_TOKEN_REFS[i];
+              fallbackSource = info.source || "";
+              break;
             }
           }
-          var primary = res.value[TOKEN_REF];
-          return { configured: false, writable: primary ? primary.writable !== false : true, ref: TOKEN_REF };
+          return {
+            configured: overridden || fallbackRef !== "",
+            overridden: overridden,
+            // 只有插件自有引用可能被环境遮蔽；JIRA_API_TOKEN 只读不影响这里的写入。
+            writable: !override || override.writable !== false,
+            // 仅当回退值确实来自启动环境时才称它为“环境变量”（旧版本可能把它存在凭据文件里）。
+            envRef: fallbackSource === "env" ? fallbackRef : ""
+          };
         }).catch(function () {
           // 状态读取失败不阻断保存，交由写入路径给出真实错误。
           return { configured: false, writable: true };
@@ -362,31 +377,33 @@ window.__ModuleLoader__.load({
 
         var storedBase = snapshot.value && typeof snapshot.value.baseUrl === "string" ? snapshot.value.baseUrl : "";
         var baseValue = baseEdit === undefined ? storedBase : baseEdit;
-        var dirty = (baseEdit !== undefined && baseEdit !== storedBase) || (tokenDraft || "").length > 0;
+        var baseDirty = baseEdit !== undefined && baseEdit !== storedBase;
+        var tokenDraftText = (tokenDraft || "").trim();
+        var tokenDirty = tokenDraftText.length > 0;
+        var dirty = baseDirty || tokenDirty;
         var writable = snapshot.writable !== false;
-        // 令牌可能来自启动环境（只读）：此时禁用输入并说明原因，而不是等到保存才报 DSH 的英文错误。
+        // 插件自有引用通常可写；只有 JIRA_TASKS_TOKEN 本身也被导出到启动环境时才会只读。
         var tokenWritable = !tokenInfo || tokenInfo.writable !== false;
-        var tokenReadOnly = !!(tokenInfo && tokenInfo.configured && tokenInfo.writable === false);
+        var tokenOverridden = !!(tokenInfo && tokenInfo.overridden);
+        var envTokenRef = tokenInfo && tokenInfo.envRef ? tokenInfo.envRef : "";
 
         // 命名空间未挂载时不显示，避免留下一张无法操作的卡片。
         if (snapshot.status === "unavailable") return null;
 
         function save() {
           if (busy || !dirty) return;
+          if (tokenDirty && !tokenWritable) {
+            setFailed(tokenReadOnlyHint(TOKEN_REF));
+            return;
+          }
           setBusy(true);
           setFailed("");
           var tasks = [];
-          if (baseEdit !== undefined && baseEdit !== storedBase) {
+          if (baseDirty) {
             tasks.push(baseEdit === "" ? scope.unset("baseUrl") : scope.set("baseUrl", baseEdit));
           }
-          var token = (tokenDraft || "").trim();
-          if (token && !tokenWritable) {
-            setBusy(false);
-            setFailed(tokenReadOnlyHint(tokenInfo && tokenInfo.ref));
-            return;
-          }
-          if (token) {
-            tasks.push(credentials.set(TOKEN_REF, token).then(function (res) {
+          if (tokenDirty) {
+            tasks.push(credentials.set(TOKEN_REF, tokenDraftText).then(function (res) {
               if (res && res.ok === false) {
                 var err = res.error;
                 throw new Error((err && (err.message || err.code)) || "令牌保存失败");
@@ -400,6 +417,31 @@ window.__ModuleLoader__.load({
             setBaseEdit(undefined);
             setTokenDraft("");
             setBusy(false);
+            // baseUrl 变更会经 snapshot.revision 触发自动重测；仅保存令牌时手动补一次。
+            if (!baseDirty) runProbe({});
+          }).catch(function (err) {
+            setBusy(false);
+            var shadowed = shadowedTokenRef(err && err.message);
+            setFailed(shadowed ? tokenReadOnlyHint(shadowed) : String((err && err.message) || err));
+          });
+        }
+
+        // 清除设置页保存的令牌，回退到环境变量 / 凭据文件中的旧值。
+        function clearOverride() {
+          if (busy) return;
+          setBusy(true);
+          setFailed("");
+          credentials.unset(TOKEN_REF).then(function (res) {
+            if (res && res.ok === false) {
+              var err = res.error;
+              throw new Error((err && (err.message || err.code)) || "清除令牌失败");
+            }
+            return readTokenInfo();
+          }).then(function (info) {
+            setTokenInfo(info);
+            setTokenDraft("");
+            setBusy(false);
+            runProbe({});
           }).catch(function (err) {
             setBusy(false);
             var shadowed = shadowedTokenRef(err && err.message);
@@ -430,9 +472,11 @@ window.__ModuleLoader__.load({
 
         var tokenHint = tokenInfo === null
           ? "正在读取令牌状态…"
-          : (tokenReadOnly
-            ? tokenReadOnlyHint(tokenInfo.ref)
-            : (tokenInfo.configured ? "令牌已配置；留空并保存可保持不变。" : "令牌未配置。含 “:” 时用 Basic，否则用 Bearer。"));
+          : (tokenOverridden
+            ? "设置页令牌已保存" + (envTokenRef ? "，优先于环境变量 " + envTokenRef : "") + "；留空并保存可保持不变。"
+            : (envTokenRef
+              ? "当前使用环境变量 " + envTokenRef + "；在下方填写并保存即可覆盖它。"
+              : (tokenInfo.configured ? "令牌已配置；留空并保存可保持不变。" : "令牌未配置。含 “:” 时用 Basic，否则用 Bearer。")));
         var dotClass = probe.phase === "ok" ? "jt-dot jt-dot-ok"
           : probe.phase === "fail" ? "jt-dot jt-dot-fail"
             : probe.phase === "testing" ? "jt-dot jt-dot-testing" : "jt-dot";
@@ -461,14 +505,18 @@ window.__ModuleLoader__.load({
               className: "jt-input",
               type: "password",
               value: tokenDraft,
-              placeholder: tokenReadOnly ? "由环境变量提供（只读）" : (tokenInfo && tokenInfo.configured ? "已配置，留空保持不变" : "粘贴令牌"),
+              placeholder: tokenOverridden ? "已保存，留空保持不变" : (envTokenRef ? "填写以覆盖环境变量" : (tokenInfo && tokenInfo.configured ? "已配置，留空保持不变" : "粘贴令牌")),
               autoComplete: "off",
-              disabled: !writable || busy || !tokenWritable,
+              disabled: busy || !tokenWritable,
               onChange: function (e) { setTokenDraft(e.target.value); },
               onKeyDown: function (e) { if (e.key === "Enter") save(); }
             })
           ),
           h("div", { className: "jt-hint", style: { marginBottom: "8px" } }, tokenHint),
+          tokenOverridden && tokenWritable
+            ? h("div", { className: "jt-hint", style: { margin: "-4px 0 8px" } },
+              h("button", { className: "jt-linklike", disabled: busy, onClick: clearOverride }, "清除设置页令牌（回退到环境变量）"))
+            : null,
           h("div", { className: "jt-probe", role: "status" },
             h("span", { className: dotClass, "aria-hidden": "true" }),
             h("span", null, probe.message || "未测试")
@@ -483,7 +531,7 @@ window.__ModuleLoader__.load({
               onClick: function () { runProbe({ baseUrl: baseValue, token: (tokenDraft || "").trim() }); }
             }, probe.phase === "testing" ? "测试中…" : "测试连接"),
             h("button", { className: "jt-btn", disabled: !dirty || busy, onClick: discard }, "放弃"),
-            h("button", { className: "jt-btn jt-btn-primary", disabled: !dirty || busy || !writable || ((tokenDraft || "").trim().length > 0 && !tokenWritable), onClick: save }, busy ? "保存中…" : "保存")
+            h("button", { className: "jt-btn jt-btn-primary", disabled: !dirty || busy || (baseDirty && !writable) || (tokenDirty && !tokenWritable), onClick: save }, busy ? "保存中…" : "保存")
           )
         );
       };

package/lib/index.js

@@ -1,16 +1,26 @@
 /**
  * dsh-jira-tasks — HOST half (persistent profile plugin).
  * Serves POST /jira/api/search: reads the JIRA base URL from the `jira-tasks`
- * settings namespace and the token from the credentials service (falling back
- * to JIRA_BASE_URL / JIRA_API_TOKEN for existing setups), queries JIRA
- * /rest/api/2/search through subprocess+curl (auth header via stdin
- * --config -), returns normalized issue JSON.
+ * settings namespace and the token from the credentials service — the
+ * settings-page JIRA_TASKS_TOKEN first, so it overrides an exported
+ * JIRA_API_TOKEN / JIRA_TOKEN — then queries JIRA /rest/api/2/search through
+ * subprocess+curl (auth header via stdin --config -), returning normalized
+ * issue JSON.
  */
 import z from '@deepseek-ai/schemastery';
 
 /** Settings namespace exposing the editable connection fields in the GUI. */
 const SETTINGS_NS = 'jira-tasks';
 
+/**
+ * Token references in precedence order. `JIRA_TASKS_TOKEN` is the plugin-owned
+ * ref the settings card writes to: unlike `JIRA_API_TOKEN`, the credentials
+ * provider can always store it, because the launching environment does not
+ * supply it. Listing it first is what makes a saved token override an exported
+ * `JIRA_API_TOKEN` / `JIRA_TOKEN`.
+ */
+const TOKEN_REFS = ['JIRA_TASKS_TOKEN', 'JIRA_API_TOKEN', 'JIRA_TOKEN'];
+
 /**
  * Durable connection schema. `baseUrl` is a plain readable field; the token is
  * deliberately NOT stored here — it stays in the credentials store (write-only
@@ -166,7 +176,7 @@ export default {
       try {
         const baseUrl = settingsBaseUrl() || await resolveFirst(['JIRA_BASE_URL', 'JIRA_URL']);
         if (!baseUrl) return { ok: false, error: '未配置 JIRA 地址（设置 → 插件 → JIRA，或环境变量 JIRA_BASE_URL）' };
-        const token = await resolveFirst(['JIRA_API_TOKEN', 'JIRA_TOKEN']);
+        const token = await resolveFirst(TOKEN_REFS);
         if (!token) return { ok: false, error: '未配置 JIRA 令牌（设置 → 插件 → JIRA，或环境变量 JIRA_API_TOKEN）' };
 
         const jql = buildJql(args && args.jql ? String(args.jql) : '', projectKey);
@@ -213,7 +223,7 @@ export default {
         const draftToken = args && typeof args.token === 'string' ? args.token.trim() : '';
         const baseUrl = draftBase || settingsBaseUrl() || await resolveFirst(['JIRA_BASE_URL', 'JIRA_URL']);
         if (!baseUrl) return { ok: false, code: 'unconfigured', error: '未配置 JIRA 地址' };
-        const token = draftToken || await resolveFirst(['JIRA_API_TOKEN', 'JIRA_TOKEN']);
+        const token = draftToken || await resolveFirst(TOKEN_REFS);
         if (!token) return { ok: false, code: 'unconfigured', error: '未配置 JIRA 令牌' };
 
         const raw = await probeJira(baseUrl, token);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-jira-tasks",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "JIRA open tasks panel for DeepSeek Harness (DSH): shows the current user's open/reopened issues below the composer, per-workspace project key, persistent profile bundle.",
   "type": "module",
   "main": "lib/index.js",