dsh-mnemon 0.5.32 → 0.5.33

package/README.md

@@ -92,7 +92,7 @@ npx @deepseek-ai/dsh web
 4. For Memory Spaces, install the Mnemon CLI for Mnemon Native with `npm install --global @mnemon-dev/mnemon`, or enable another Provider on the Memory Spaces page.
 5. Choose the main strategy and enhancements under **Plugins → dsh-mnemon**.
 
-dsh-mnemon supports DSH `0.2.0-rc.2` (npm `latest`) and `0.2.1-rc.2` (npm `next`). The same package serves the desktop app's Plugins page, `dsh plugin --profile web add dsh-mnemon` on the command line, and Headless with `dsh plugin --profile headless add dsh-mnemon`; older hosts keep the release [compatibility and upgrades](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/en/reference/compatibility.md) names for them. [Getting started](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/en/guides/getting-started.md) continues from here, and [compatibility and upgrades](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/en/reference/compatibility.md) covers existing installations.
+dsh-mnemon supports DSH `0.2.1-rc.2` (npm `latest` and `next`) and `0.2.0-rc.2`. The same package serves the desktop app's Plugins page, `dsh plugin --profile web add dsh-mnemon` on the command line, and Headless with `dsh plugin --profile headless add dsh-mnemon`; older hosts keep the release [compatibility and upgrades](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/en/reference/compatibility.md) names for them. [Getting started](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/en/guides/getting-started.md) continues from here, and [compatibility and upgrades](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/en/reference/compatibility.md) covers existing installations.
 
 ## How it works
 
@@ -146,3 +146,17 @@ pnpm verify:plugins
 ```
 
 Use Node.js `^22.19.0 || >=24.0.0` and pnpm. `node scripts/serve-e2e.mjs` starts a disposable real WebUI; add `--docs-demo` for the seeded project behind these screenshots, and `--live-model` to have the DeepSeek API answer, with the key read from `DEEPSEEK_API_KEY`. Mechanical tests are not claims about model accuracy or live cloud Providers. [Development and verification](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/en/development/README.md).
+
+## Star History
+
+<a href="https://www.star-history.com/?repos=omdsh-dev%2Fdsh-mnemon&type=timeline&legend=bottom-right">
+ <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=omdsh-dev/dsh-mnemon&type=timeline&theme=dark&legend=bottom-right" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=omdsh-dev/dsh-mnemon&type=timeline&legend=bottom-right" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=omdsh-dev/dsh-mnemon&type=timeline&legend=bottom-right" />
+ </picture>
+</a>
+
+## License
+
+[MIT](https://github.com/omdsh-dev/dsh-mnemon/blob/main/LICENSE). Third-party providers keep their own licenses and terms; see [Third-party notices](https://github.com/omdsh-dev/dsh-mnemon/blob/main/THIRD_PARTY_NOTICES.md).

package/README.zh-CN.md

@@ -93,7 +93,7 @@ npx @deepseek-ai/dsh web
 4. 使用记忆空间时，可用 `npm install --global @mnemon-dev/mnemon` 安装 Mnemon Native 所需的 CLI，或在记忆空间页面启用其他 Provider。
 5. 在**插件 → 可组合记忆**中选择主策略与增强。
 
-dsh-mnemon 支持 DSH `0.2.0-rc.2`（npm `latest`）与 `0.2.1-rc.2`（npm `next`）。同一个包也用于桌面版的插件页、命令行 `dsh plugin --profile web add dsh-mnemon`，以及 Headless：`dsh plugin --profile headless add dsh-mnemon`；更早的宿主请继续使用[兼容性与升级](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/zh-CN/reference/compatibility.md)为其列出的版本。接下来可以看[入门指南](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/zh-CN/guides/getting-started.md)，已有安装的升级见[兼容性与升级](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/zh-CN/reference/compatibility.md)。
+dsh-mnemon 支持 DSH `0.2.1-rc.2`（npm `latest` 与 `next`）与 `0.2.0-rc.2`。同一个包也用于桌面版的插件页、命令行 `dsh plugin --profile web add dsh-mnemon`，以及 Headless：`dsh plugin --profile headless add dsh-mnemon`；更早的宿主请继续使用[兼容性与升级](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/zh-CN/reference/compatibility.md)为其列出的版本。接下来可以看[入门指南](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/zh-CN/guides/getting-started.md)，已有安装的升级见[兼容性与升级](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/zh-CN/reference/compatibility.md)。
 
 ## 工作原理
 
@@ -147,3 +147,17 @@ pnpm verify:plugins
 ```
 
 需要 Node.js `^22.19.0 || >=24.0.0` 与 pnpm。`node scripts/serve-e2e.mjs` 会启动一个用后即弃的真实 WebUI；加上 `--docs-demo` 即可得到这些截图背后的示例项目，再加 `--live-model` 则由 DeepSeek API（读取 `DEEPSEEK_API_KEY`）真实作答。机制测试不代表模型准确率，也不代表云端 Provider 的实际表现。详见[开发与验证](https://github.com/omdsh-dev/dsh-mnemon/blob/main/docs/zh-CN/development/README.md)。
+
+## Star 历史
+
+<a href="https://www.star-history.com/?repos=omdsh-dev%2Fdsh-mnemon&type=timeline&legend=bottom-right">
+ <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=omdsh-dev/dsh-mnemon&type=timeline&theme=dark&legend=bottom-right" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=omdsh-dev/dsh-mnemon&type=timeline&legend=bottom-right" />
+   <img alt="Star 历史图表" src="https://api.star-history.com/chart?repos=omdsh-dev/dsh-mnemon&type=timeline&legend=bottom-right" />
+ </picture>
+</a>
+
+## 许可证
+
+[MIT](https://github.com/omdsh-dev/dsh-mnemon/blob/main/LICENSE)。第三方 Provider 适用各自的许可证与服务条款，见[第三方声明](https://github.com/omdsh-dev/dsh-mnemon/blob/main/THIRD_PARTY_NOTICES.md)。

package/lib/client.js

@@ -131,7 +131,11 @@ window.__ModuleLoader__.load({
 		const SSH = /^ssh:\/\/[^\s/]+(?::\d+)?\/[^\s]+$/u;
 		const SCP = /^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:[^\s]+$/u;
 		const SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//u;
-		const EMBEDDED_CREDENTIAL = /^https:\/\/[^/]*@/u;
+		const HTTPS_USER = /^https:\/\/([^/]*)@/u;
+		const USER_TEXT = /^(?:[A-Za-z0-9._~!$&'()*+,;=-]|%[0-9A-Fa-f]{2})+$/u;
+		const NOT_A_NAME = /[:@\s\p{Cc}]/u;
+		const TOKEN_SHAPE = /^(?:gh[opsru]_|github_pat_|glpat-|gldt-|glcbt-|hf_|ATBB|ATCTT|ATATT)|^[0-9A-Fa-f]{32,}$|^[A-Za-z0-9]{52,}$/u;
+		const USER_NAME_MAX = 100;
 		const EMAIL = /^[^\s<>@]+@[^\s<>@]+$/u;
 		const WINDOWS_DRIVE = /^[A-Za-z]:[\\/]/u;
 		const CONTROL = /[\p{Cc}\u2028\u2029]/u;
@@ -149,17 +153,35 @@ window.__ModuleLoader__.load({
 		}
 		/**
 		* What is wrong with a repository address, or nothing for an https:// or ssh:// URL without
-		* credentials in it, a git@host:path address, or a local path that `localPath` takes.
+		* credentials in it, a git@host:path address, or a local path that `localPath` takes. An HTTPS
+		* address may name the user a host wants its token offered under, as Bitbucket's do, but never a
+		* password, nor a token written where that name goes.
 		*/
 		function syncRepositoryProblem(url, localPath) {
 			if (url === "" || url.length > 2e3 || /\s/u.test(url)) return "format";
 			if (SCHEME.test(url)) {
 				if (!HTTPS.test(url) && !SSH.test(url)) return "format";
-				return EMBEDDED_CREDENTIAL.test(url) ? "credentials" : void 0;
+				const user = HTTPS_USER.exec(url)?.[1];
+				return user === void 0 || syncUserName(user) ? void 0 : "credentials";
 			}
 			return SCP.test(url) || localPath(url) ? void 0 : "format";
 		}
 		/**
+		* Whether the user part of an HTTPS address is a user name. It is judged as Git reads it, with its
+		* escapes decoded, so an escaped colon, an escaped token prefix or an escaped line break counts as what
+		* it decodes to; one that does not decode is no name at all.
+		*/
+		function syncUserName(written) {
+			if (!USER_TEXT.test(written)) return false;
+			let name;
+			try {
+				name = decodeURIComponent(written);
+			} catch {
+				return false;
+			}
+			return name.length <= USER_NAME_MAX && !NOT_A_NAME.test(name) && !TOKEN_SHAPE.test(name);
+		}
+		/**
 		* A local path that is absolute on POSIX or on Windows, for the browser, which cannot tell which
 		* platform the Host runs on: a POSIX path, a Windows path on a drive, or a UNC share. The Host
 		* checks a path by its own platform's rule instead.
@@ -2832,6 +2854,11 @@ window.__ModuleLoader__.load({
 			"config.syncNoCredentialToken": "推送需要访问令牌",
 			"config.syncIssueAuthHttps": "需要凭据，请用 GitHub 登录或填写访问令牌",
 			"config.syncIssueAuthToken": "需要凭据，请填写访问令牌",
+			"config.syncIssueRejectedGitHub": "GitHub 拒绝了登录凭据，请重新登录，或检查它能否访问这个仓库",
+			"config.syncIssueRejectedGitHubToken": "GitHub 拒绝了保存的访问令牌，请更换令牌",
+			"config.syncIssueRejectedGitHubEnvironment": "GitHub 拒绝了 {env} 中的令牌，请更换它",
+			"config.syncIssueRejected": "仓库主机拒绝了保存的访问令牌，请更换令牌，或在地址中写上它要求的用户名",
+			"config.syncIssueRejectedEnvironment": "仓库主机拒绝了 {env} 中的令牌，请更换它",
 			"config.syncIssueAuthSsh": "SSH 认证失败，请检查这台电脑的 SSH 密钥",
 			"config.syncIssueAuth": "没有访问这个仓库的权限",
 			"config.syncIssueNotFound": "找不到这个仓库，请检查地址和访问权限",
@@ -2850,7 +2877,7 @@ window.__ModuleLoader__.load({
 			"config.syncRepoUrl": "仓库地址",
 			"config.syncRepoUrlPlaceholder": "https://…、git@主机:路径 或本机绝对路径",
 			"config.syncRepoUrlInvalid": "地址需要是 https://、ssh://、git@主机:路径 或本机绝对路径",
-			"config.syncRepoUrlCredentials": "不要把令牌写进地址，请填在“访问令牌”里",
+			"config.syncRepoUrlCredentials": "地址里只能写用户名，令牌请填在“访问令牌”里",
 			"config.syncToken": "访问令牌",
 			"config.syncTokenOptional": "可选",
 			"config.syncTokenSaved": "已保存；输入新令牌可替换",
@@ -3585,6 +3612,11 @@ window.__ModuleLoader__.load({
 			"config.syncNoCredentialToken": "pushing needs an access token",
 			"config.syncIssueAuthHttps": "Needs credentials; sign in with GitHub or add an access token",
 			"config.syncIssueAuthToken": "Needs credentials; add an access token",
+			"config.syncIssueRejectedGitHub": "GitHub rejected the sign-in; sign in again or check its access to this repository",
+			"config.syncIssueRejectedGitHubToken": "GitHub rejected the saved access token; replace it",
+			"config.syncIssueRejectedGitHubEnvironment": "GitHub rejected the token in {env}; replace it",
+			"config.syncIssueRejected": "The host rejected the saved token; replace it, or name the user it expects in the address",
+			"config.syncIssueRejectedEnvironment": "The host rejected the token in {env}; replace it",
 			"config.syncIssueAuthSsh": "SSH authentication failed; check this computer's SSH key",
 			"config.syncIssueAuth": "Access to this repository was refused",
 			"config.syncIssueNotFound": "Repository not found; check the address and your access",
@@ -3603,7 +3635,7 @@ window.__ModuleLoader__.load({
 			"config.syncRepoUrl": "Repository address",
 			"config.syncRepoUrlPlaceholder": "https://…, git@host:path, or an absolute local path",
 			"config.syncRepoUrlInvalid": "Use an https:// or ssh:// URL, git@host:path, or an absolute local path",
-			"config.syncRepoUrlCredentials": "Keep the token out of the address; enter it under Access token",
+			"config.syncRepoUrlCredentials": "Only a user name may go in the address; enter the token under Access token",
 			"config.syncToken": "Access token",
 			"config.syncTokenOptional": "Optional",
 			"config.syncTokenSaved": "Saved; type a new one to replace it",
@@ -7460,11 +7492,15 @@ window.__ModuleLoader__.load({
 				minute: "2-digit"
 			});
 		}
-		/** Why a remote could not be read, said for the transport the repository uses. */
-		function issueText(t, issue, url, error) {
+		/**
+		* Why a remote could not be read, said for the transport the repository uses and for the credential
+		* the Host offered it, which `credential` names as the status does.
+		*/
+		function issueText(t, issue, url, error, credential = "none") {
 			const transport = transportOf(url);
 			switch (issue) {
 				case "auth":
+					if (transport === "https" && credential !== "none") return rejectedText(t, url, credential);
 					if (transport === "https") return onGitHub(url) ? t("config.syncIssueAuthHttps") : t("config.syncIssueAuthToken");
 					return transport === "ssh" ? t("config.syncIssueAuthSsh") : t("config.syncIssueAuth");
 				case "not-found": return onGitHub(url) ? t("config.syncIssueNotFoundGitHub") : t("config.syncIssueNotFound");
@@ -7473,6 +7509,16 @@ window.__ModuleLoader__.load({
 				default: return t("config.syncIssueUnknown", { error: error ?? "" });
 			}
 		}
+		/**
+		* A credential the host refused, said for where it came from: a saved token or the environment variable
+		* comes before the GitHub sign-in, so only replacing that one changes what Git is given.
+		*/
+		function rejectedText(t, url, credential) {
+			const github = onGitHub(url);
+			if (credential === "environment") return t(github ? "config.syncIssueRejectedGitHubEnvironment" : "config.syncIssueRejectedEnvironment", { env: MNEMON_SYNC_TOKEN_ENV });
+			if (credential === "github") return t("config.syncIssueRejectedGitHub");
+			return t(github ? "config.syncIssueRejectedGitHubToken" : "config.syncIssueRejected");
+		}
 		const REMOTE_ISSUE = {
 			"remote-auth": "auth",
 			"remote-not-found": "not-found",
@@ -7480,9 +7526,9 @@ window.__ModuleLoader__.load({
 			"remote-timeout": "timeout"
 		};
 		/** A failure the Host named, in this page's language; anything it could not name keeps its own words. */
-		function failureText(t, reason, message, url) {
+		function failureText(t, reason, message, url, credential = "none") {
 			const issue = reason === void 0 ? void 0 : REMOTE_ISSUE[reason];
-			if (issue !== void 0) return issueText(t, issue, url, message);
+			if (issue !== void 0) return issueText(t, issue, url, message, credential);
 			switch (reason) {
 				case "busy": return t("config.syncReasonBusy");
 				case "no-repository": return t("config.syncReasonNoRepository");
@@ -7541,7 +7587,7 @@ window.__ModuleLoader__.load({
 		* which computer, and what it held. A page is read at a time; the commit is a
 		* quiet tag, because the time and the computer are what a reader looks for.
 		*/
-		function SyncHistoryDialog({ client, repoUrl, t, onClose }) {
+		function SyncHistoryDialog({ client, repoUrl, credential, t, onClose }) {
 			const [history, setHistory] = (0, react.useState)(null);
 			const [busy, setBusy] = (0, react.useState)(true);
 			const [failed, setFailed] = (0, react.useState)(null);
@@ -7561,13 +7607,14 @@ window.__ModuleLoader__.load({
 						};
 					});
 				} catch (reason) {
-					setFailed(failureText(t, reasonOf(reason), message(reason), repoUrl));
+					setFailed(failureText(t, reasonOf(reason), message(reason), repoUrl, credential));
 				} finally {
 					setBusy(false);
 				}
 			}, [
 				client,
 				repoUrl,
+				credential,
 				t
 			]);
 			(0, react.useEffect)(() => {
@@ -7647,7 +7694,7 @@ window.__ModuleLoader__.load({
 		* deleted, and which removals the branch recorded. Reading writes nothing; the
 		* footer offers the sync itself and a merge that publishes nothing.
 		*/
-		function SyncCompareDialog({ client, repoUrl, writable, t, onClose, onSync, onChanged }) {
+		function SyncCompareDialog({ client, repoUrl, credential, writable, t, onClose, onSync, onChanged }) {
 			const [preview, setPreview] = (0, react.useState)(null);
 			const [difference, setDifference] = (0, react.useState)(null);
 			const [busy, setBusy] = (0, react.useState)("read");
@@ -7668,13 +7715,14 @@ window.__ModuleLoader__.load({
 					setPreview(null);
 					setDifference(null);
 					setEmpty(reasonOf(reason) === "remote-empty");
-					setFailed(failureText(t, reasonOf(reason), message(reason), repoUrl));
+					setFailed(failureText(t, reasonOf(reason), message(reason), repoUrl, credential));
 				} finally {
 					setBusy(null);
 				}
 			}, [
 				client,
 				repoUrl,
+				credential,
 				t
 			]);
 			(0, react.useEffect)(() => {
@@ -7691,7 +7739,7 @@ window.__ModuleLoader__.load({
 					const added = result.runtime?.added ?? 0;
 					setNotice(revive ? t("config.syncCompareRevived", { count: added }) : added > 0 ? t("config.syncMergedCount", { count: added }) : t("config.syncMerged", { commit: result.commit.slice(0, 8) }));
 				} catch (reason) {
-					failure = failureText(t, reasonOf(reason), message(reason), repoUrl);
+					failure = failureText(t, reasonOf(reason), message(reason), repoUrl, credential);
 				} finally {
 					setBusy(null);
 				}
@@ -8659,6 +8707,7 @@ window.__ModuleLoader__.load({
 			const connected = status !== null && status.enabled !== false && repoUrl !== void 0;
 			const editable = !disabled && client !== null;
 			const gitReady = status?.git.available === true;
+			const credential = status?.config.credentialSource ?? "none";
 			/**
 			* The one primary action: merge the repository here, then publish the result.
 			* Answers why it did not finish, or null when it did, for a caller that shows it elsewhere.
@@ -8669,11 +8718,11 @@ window.__ModuleLoader__.load({
 				setSyncFeedback(null);
 				let failure = null;
 				try {
-					const feedback = syncResult(t, await client.pushSync(), repoUrl);
+					const feedback = syncResult(t, await client.pushSync(), repoUrl, credential);
 					setSyncFeedback(feedback);
 					if (feedback.tone === "error") failure = feedback.text;
 				} catch (reason) {
-					failure = t("config.syncFailed", { error: failureText(t, reasonOf(reason), message(reason), repoUrl) });
+					failure = t("config.syncFailed", { error: failureText(t, reasonOf(reason), message(reason), repoUrl, credential) });
 					setSyncFeedback({
 						tone: "error",
 						text: failure
@@ -8755,7 +8804,7 @@ window.__ModuleLoader__.load({
 			}));
 			const autoHint = autoBackup?.lastError !== void 0 && minutes > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 				className: MnemonSettingsCard_module_css_default.error,
-				children: t("config.syncAutoFailed", { error: failureText(t, autoBackup.lastFailure, autoBackup.lastError, repoUrl ?? "") })
+				children: t("config.syncAutoFailed", { error: failureText(t, autoBackup.lastFailure, autoBackup.lastError, repoUrl ?? "", credential) })
 			}) : minutes <= 0 ? t("config.syncAutoHintOff") : [autoBackup?.nextAt === void 0 ? "" : t("config.syncAutoNext", { time: when(autoBackup.nextAt) }), autoBackup?.lastAt === void 0 ? "" : t("config.syncAutoLast", { time: when(autoBackup.lastAt) })].filter(Boolean).join(" · ") || t("config.syncAutoHintOn");
 			const lastRun = status?.lastRun;
 			const syncHint = lastRun === void 0 ? t("config.syncNever") : lastRun.kind === "merge" ? t("config.syncLastMerge", { time: when(lastRun.at) }) : t("config.syncLast", { time: when(lastRun.at) });
@@ -8913,6 +8962,7 @@ window.__ModuleLoader__.load({
 					client !== null && repoUrl !== void 0 && dialog === "compare" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SyncCompareDialog, {
 						client,
 						repoUrl,
+						credential,
 						writable: editable,
 						t,
 						onClose: () => setDialog(null),
@@ -8925,6 +8975,7 @@ window.__ModuleLoader__.load({
 					client !== null && repoUrl !== void 0 && dialog === "history" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SyncHistoryDialog, {
 						client,
 						repoUrl,
+						credential,
 						t,
 						onClose: () => setDialog(null)
 					}),
@@ -8945,7 +8996,7 @@ window.__ModuleLoader__.load({
 			});
 		}
 		/** What one finished sync did, said as one line. */
-		function syncResult(t, result, repoUrl) {
+		function syncResult(t, result, repoUrl, credential) {
 			const added = result.merged?.runtime?.added ?? 0;
 			const commit = result.commit.slice(0, 8);
 			if (result.pushed) return {
@@ -8961,7 +9012,7 @@ window.__ModuleLoader__.load({
 			};
 			return {
 				tone: "error",
-				text: t("config.syncPushFailed", { reason: failureText(t, result.failure, result.reason ?? "", repoUrl) })
+				text: t("config.syncPushFailed", { reason: failureText(t, result.failure, result.reason ?? "", repoUrl, credential) })
 			};
 		}
 		/** Where the repository is, whether it answers, and how it is authenticated. */
@@ -8977,7 +9028,7 @@ window.__ModuleLoader__.load({
 				text: t("config.syncReasonGitMissing")
 			} : !remote.reachable ? {
 				dot: "error",
-				text: issueText(t, remote.issue, url, remote.error)
+				text: issueText(t, remote.issue, url, remote.error, status.config.credentialSource)
 			} : {
 				dot: credential === void 0 && transportOf(url) === "https" ? "warning" : "done",
 				text: [remote.branchExists ? t("config.syncStateConnected") : t("config.syncStateNewBranch", { branch: status.config.branch }), ...credential !== void 0 ? [credential] : transportOf(url) === "https" ? [onGitHub(url) ? t("config.syncNoCredential") : t("config.syncNoCredentialToken")] : []].join(" · ")

package/lib/index.js

@@ -155,7 +155,11 @@ const HTTPS = /^https:\/\/[^\s/]+(?::\d+)?\/[^\s]+$/u;
 const SSH = /^ssh:\/\/[^\s/]+(?::\d+)?\/[^\s]+$/u;
 const SCP = /^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:[^\s]+$/u;
 const SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//u;
-const EMBEDDED_CREDENTIAL = /^https:\/\/[^/]*@/u;
+const HTTPS_USER = /^https:\/\/([^/]*)@/u;
+const USER_TEXT = /^(?:[A-Za-z0-9._~!$&'()*+,;=-]|%[0-9A-Fa-f]{2})+$/u;
+const NOT_A_NAME = /[:@\s\p{Cc}]/u;
+const TOKEN_SHAPE = /^(?:gh[opsru]_|github_pat_|glpat-|gldt-|glcbt-|hf_|ATBB|ATCTT|ATATT)|^[0-9A-Fa-f]{32,}$|^[A-Za-z0-9]{52,}$/u;
+const USER_NAME_MAX = 100;
 const EMAIL = /^[^\s<>@]+@[^\s<>@]+$/u;
 const CONTROL = /[\p{Cc}\u2028\u2029]/u;
 const GITHUB_REPOSITORY = /^(?!\.\.?$)[A-Za-z0-9._-]{1,100}$/u;
@@ -172,16 +176,34 @@ function syncDirectoryParts(value) {
 }
 /**
 * What is wrong with a repository address, or nothing for an https:// or ssh:// URL without
-* credentials in it, a git@host:path address, or a local path that `localPath` takes.
+* credentials in it, a git@host:path address, or a local path that `localPath` takes. An HTTPS
+* address may name the user a host wants its token offered under, as Bitbucket's do, but never a
+* password, nor a token written where that name goes.
 */
 function syncRepositoryProblem(url, localPath) {
 	if (url === "" || url.length > 2e3 || /\s/u.test(url)) return "format";
 	if (SCHEME.test(url)) {
 		if (!HTTPS.test(url) && !SSH.test(url)) return "format";
-		return EMBEDDED_CREDENTIAL.test(url) ? "credentials" : void 0;
+		const user = HTTPS_USER.exec(url)?.[1];
+		return user === void 0 || syncUserName(user) ? void 0 : "credentials";
 	}
 	return SCP.test(url) || localPath(url) ? void 0 : "format";
 }
+/**
+* Whether the user part of an HTTPS address is a user name. It is judged as Git reads it, with its
+* escapes decoded, so an escaped colon, an escaped token prefix or an escaped line break counts as what
+* it decodes to; one that does not decode is no name at all.
+*/
+function syncUserName(written) {
+	if (!USER_TEXT.test(written)) return false;
+	let name;
+	try {
+		name = decodeURIComponent(written);
+	} catch {
+		return false;
+	}
+	return name.length <= USER_NAME_MAX && !NOT_A_NAME.test(name) && !TOKEN_SHAPE.test(name);
+}
 /** A commit author's address. */
 function syncEmailValid(email) {
 	return email.length <= 320 && EMAIL.test(email);
@@ -4597,6 +4619,47 @@ function isGitHubHttps(repoUrl) {
 	}
 }
 /**
+* The user name a token goes to Git under: the one GitHub documents for its tokens and its sign-in's
+* grant, which every host has been offered, and which stays for every host not known to refuse it.
+*/
+const TOKEN_USER = "x-access-token";
+/**
+* The hosts known to refuse `x-access-token` with a token, and the name each takes instead: Gitee
+* answers it with HTTP 403 and takes `oauth2` or the account name (#408). Any other host that wants
+* a name of its own, a self-hosted Gitee included, is given it in the address.
+*/
+const TOKEN_USER_BY_HOST = /* @__PURE__ */ new Map([["gitee.com", "oauth2"]]);
+/**
+* From this version on, the last `credential.username` Git reads wins, which is the command line's.
+* Before it, the first one configured did, and only a name in the address came before that.
+*/
+const LAST_USERNAME_WINS_GIT = "2.26";
+/**
+* Who Git is to look the token up as for one HTTPS address, and for which host: the user name the
+* address names, else the one its host takes a token under; the host exactly as the address writes
+* it, since Git compares a stored credential's host as text, its case and port included; and the
+* address without its user name. `user` is written as an address writes it, `name` as Git reads it.
+*/
+function credentialTarget(url) {
+	const [, written, host = "", rest = ""] = /^https:\/\/(?:([^/@]*)@)?([^/]*)(.*)$/u.exec(url) ?? [];
+	let hostname = "";
+	try {
+		hostname = new URL(url).hostname.toLowerCase().replace(/\.$/u, "");
+	} catch {}
+	const user = written ?? TOKEN_USER_BY_HOST.get(hostname) ?? TOKEN_USER;
+	let name = user;
+	try {
+		name = decodeURIComponent(user);
+	} catch {}
+	return {
+		user,
+		name,
+		named: written !== void 0,
+		host,
+		address: "https://" + host + rest
+	};
+}
+/**
 * What kind of failure one Git error describes. Git words these differently per
 * transport and per host, so the patterns are the phrases each transport uses:
 * a refused or missing credential, an address that leads nowhere (GitHub answers
@@ -4644,6 +4707,14 @@ function versionAtLeast(version, minimum) {
 	return true;
 }
 /**
+* A boolean as Git reads one: `true`, `yes`, `on` or a number other than 0 is true, and
+* `false`, `no`, `off`, 0 or an empty value is false.
+*/
+function gitBoolean(value) {
+	const text = value.trim().toLowerCase();
+	return text === "true" || text === "yes" || text === "on" || /^[-+]?\d+$/u.test(text) && Number(text) !== 0;
+}
+/**
 * The deletions one side of the channel recorded. They live in the sync extension, never
 * in the payload, so a Pack stays readable by any version; a branch that predates the
 * extension recorded none, and an unreadable list is treated the same way rather than
@@ -4932,6 +5003,8 @@ var MnemonGitSync = class {
 	store;
 	machine;
 	sequence = 0;
+	/** The Git version the last check found, which decides how a token's user name is given to Git. */
+	gitVersion;
 	auth;
 	autoBackupView;
 	constructor(runner, config, packs, run = runProcess, now = () => /* @__PURE__ */ new Date()) {
@@ -5579,12 +5652,14 @@ var MnemonGitSync = class {
 			const result = await this.git(["--version"], { signal });
 			version = /(\d+\.\d+(?:\.\d+)?)/u.exec(result.stdout)?.[1];
 		} catch (error) {
+			this.gitVersion = void 0;
 			return {
 				available: false,
 				required,
 				issue: error instanceof Error ? error.message : String(error)
 			};
 		}
+		this.gitVersion = version;
 		if (version === void 0) return {
 			available: false,
 			required,
@@ -6116,7 +6191,7 @@ var MnemonGitSync = class {
 		}
 	}
 	async git(args, options) {
-		const prepared = this.credentials(args, options);
+		const prepared = await this.credentials(args, options);
 		try {
 			return await this.run(GIT_LABEL, prepared.args, {
 				timeoutMs: options.timeoutMs ?? 12e4,
@@ -6134,22 +6209,43 @@ var MnemonGitSync = class {
 	* Hand the token to Git through a `0600` credential store that lives for one
 	* command. The token never reaches an argument, a URL, a log, or the mirror,
 	* and it is removed before the caller sees the result.
+	*
+	* Git must look the token up under the name the store holds, not under one this
+	* machine configures, as Git Credential Manager setups do, nor by a path the store
+	* does not hold (#408). Git 2.26 and later are told so on the command line, which
+	* they read last and let win, and are given the address without a user name, as
+	* Git offers a name it finds there once without the token. An older Git kept the
+	* first name it read, and only a name in the address comes before that: the name
+	* goes there only where this machine's configuration names another, and the path
+	* leaves the lookup only where it puts the path in, so every other command, one
+	* that configures the store's own name included, stays the one that has always run.
 	*/
-	credentials(args, options) {
+	async credentials(args, options) {
 		const token = options.token;
 		if (token === void 0 || token === "" || options.authenticated !== true) return {
 			args: [...NO_REWRITE, ...args],
 			cleanup: () => {}
 		};
-		const url = args.find((argument) => argument.startsWith("https://"));
-		if (url === void 0) return {
+		const index = args.findIndex((argument) => argument.startsWith("https://"));
+		if (index === -1) return {
 			args: [...NO_REWRITE, ...args],
 			cleanup: () => {}
 		};
+		const url = args[index];
+		const target = credentialTarget(url);
+		const command = [...args];
+		const lookup = [];
+		if (this.gitVersion !== void 0 && versionAtLeast(this.gitVersion, LAST_USERNAME_WINS_GIT)) {
+			lookup.push("-c", "credential.useHttpPath=false", "-c", "credential.username=" + target.name);
+			command[index] = target.address;
+		} else {
+			const configured = await this.configuredLookup(url, options);
+			if (configured.path) lookup.push("-c", "credential.useHttpPath=false");
+			if (configured.user !== void 0 && configured.user !== target.name && !target.named) command[index] = "https://" + target.user + "@" + target.address.slice(8);
+		}
 		this.sequence += 1;
-		const host = new URL(url).host;
 		const path = join(this.store.directory(), ".credentials." + branchSlug(String(process.pid)) + "." + String(this.sequence) + ".tmp");
-		writeFileSync(path, "https://x-access-token:" + token + "@" + host + "\n", {
+		writeFileSync(path, "https://" + target.user + ":" + encodeURIComponent(token) + "@" + target.host + "\n", {
 			encoding: "utf8",
 			mode: 384
 		});
@@ -6160,13 +6256,53 @@ var MnemonGitSync = class {
 				"credential.helper=",
 				"-c",
 				"credential.helper=store --file=" + shellQuote(path),
-				...args
+				...lookup,
+				...command
 			],
 			cleanup: () => {
 				rmSync(path, { force: true });
 			}
 		};
 	}
+	/**
+	* The user name this machine's configuration gives an address, if any, and whether
+	* it adds the address's path to the lookup, read in the environment and directory
+	* the command runs in. A configuration Git cannot read leaves the command as it
+	* was, which fails on it the same way.
+	*/
+	async configuredLookup(url, options) {
+		let result;
+		try {
+			result = await this.run(GIT_LABEL, [
+				"config",
+				"--get-urlmatch",
+				"credential",
+				url
+			], {
+				timeoutMs: options.timeoutMs ?? 12e4,
+				env: gitEnvironment(),
+				...options.cwd === void 0 ? {} : { cwd: options.cwd },
+				...options.signal === void 0 ? {} : { signal: options.signal },
+				label: GIT_LABEL
+			});
+		} catch (error) {
+			if (options.signal?.aborted === true) throw error;
+			return {
+				user: void 0,
+				path: false
+			};
+		}
+		const settings = /* @__PURE__ */ new Map();
+		if (result.exitCode === 0) for (const line of result.stdout.split(/\r?\n/u)) {
+			const space = line.indexOf(" ");
+			if (space > 0) settings.set(line.slice(0, space).toLowerCase(), line.slice(space + 1));
+		}
+		const path = settings.get("credential.usehttppath");
+		return {
+			user: settings.get("credential.username"),
+			path: path !== void 0 && gitBoolean(path)
+		};
+	}
 };
 /**
 * How the payload files differ. The manifest and the checksum inventory describe a
@@ -12313,7 +12449,17 @@ var MnemonLifecycle = class {
 			this.taskAgentIds.delete(sessionId);
 		}
 	}
-	/** Resolve the same model route and preset composition as an ordinary fresh DSH Agent. */
+	/**
+	* Resolve the same model route and preset composition as an ordinary fresh DSH Agent.
+	*
+	* DSH persists a task Agent's session like any other. Its sidebar and ACP session
+	* list leave out a session whose header has `origin: 'subagent'`, the origin DSH
+	* gives its own subagents. Without it the sidebar hides a session that never started
+	* a turn only while DSH's projection cache holds a record of it, so a finished task
+	* could stay listed as an untitled Ungrouped conversation (#435). No `parentSession`
+	* or `delegationDepth`: the task belongs to no conversation, and its children stay
+	* one level deep.
+	*/
 	async taskAgentCreation(fallbackSessionId, workspaceRoot, signal) {
 		const agentOptions = this.taskAgentModelOptions(fallbackSessionId, workspaceRoot);
 		if (agentOptions === void 0) throw new Error("no default provider/model is available for a clean task Agent");
@@ -12321,15 +12467,17 @@ var MnemonLifecycle = class {
 		const presets = presetService(this.ctx.get("agentPresets"));
 		const presetId = presets === void 0 ? void 0 : (await presets.resolve()).id;
 		const workingDirectory = workFrom === void 0 ? void 0 : this.ctx.get("workingDirectory");
+		const meta = {
+			cwd,
+			origin: "subagent",
+			...presetId === void 0 ? {} : { agentPreset: presetId }
+		};
 		if (presets === void 0 && typeof workingDirectory?.set !== "function") return {
-			meta: { cwd },
+			meta,
 			agentOptions
 		};
 		return {
-			meta: {
-				cwd,
-				...presetId === void 0 ? {} : { agentPreset: presetId }
-			},
+			meta,
 			agentOptions,
 			setup: async (agentCtx, agent) => {
 				if (presets !== void 0 && presetId !== void 0) await presets.mount(agentCtx, presetId);

package/lib/types/src/client/locales.d.ts

@@ -537,6 +537,11 @@ export declare const zh: {
     'config.syncNoCredentialToken': string;
     'config.syncIssueAuthHttps': string;
     'config.syncIssueAuthToken': string;
+    'config.syncIssueRejectedGitHub': string;
+    'config.syncIssueRejectedGitHubToken': string;
+    'config.syncIssueRejectedGitHubEnvironment': string;
+    'config.syncIssueRejected': string;
+    'config.syncIssueRejectedEnvironment': string;
     'config.syncIssueAuthSsh': string;
     'config.syncIssueAuth': string;
     'config.syncIssueNotFound': string;

package/lib/types/src/host/sync-rules.d.ts

@@ -13,7 +13,9 @@ export declare function syncDirectoryParts(value: string): string[] | undefined;
 export type MnemonSyncRepositoryProblem = 'format' | 'credentials';
 /**
  * What is wrong with a repository address, or nothing for an https:// or ssh:// URL without
- * credentials in it, a git@host:path address, or a local path that `localPath` takes.
+ * credentials in it, a git@host:path address, or a local path that `localPath` takes. An HTTPS
+ * address may name the user a host wants its token offered under, as Bitbucket's do, but never a
+ * password, nor a token written where that name goes.
  */
 export declare function syncRepositoryProblem(url: string, localPath: (path: string) => boolean): MnemonSyncRepositoryProblem | undefined;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mnemon",
-  "version": "0.5.32",
+  "version": "0.5.33",
   "description": "Composable, view-based memory for DeepSeek Harness. Pluggable sources and strategies, with layered memory out of the box.",
   "keywords": [
     "deepseek-harness",