dsh-plan-completion 0.1.3 → 0.1.4

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project are documented here.
 Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), versioning: SemVer.
 
+## [0.1.4] - 2026-11-02
+
+### Fixed
+- Suggestion/Markdown cleaning no longer destroys identifiers, file names or globs: `transaction_id`,
+  `payment_test.py`, `C:\work\my_file.js` and `src/**/*.js` keep their underscores/stars. Only paired
+  emphasis markers (`**bold**`, `*italic*`, `_emphasis_`, `~~strike~~`) are stripped; inline code keeps
+  its content with backticks removed.
+- Semantic shortening replaces the raw 40-character cut: prefer the last clause boundary, then a
+  whitespace boundary, then cut before an ASCII token; never leave a truncated identifier/path or a
+  dangling command prefix (`npm`, `npm te`), and drop dangling separators.
+- New `test/text.test.js` covers the identifier/glob/command cases and the old guarantees
+  (single line, ≤40 chars, dangerous suggestions filtered).
+
+### Changed
+- `npm test` now reports **132/132** tests.
+
 ## [0.1.3] - 2026-11-02
 
 ### Added

package/README.md

@@ -85,6 +85,12 @@ Client 侧关键 API（实测）：`inputActions.captureInsertion()` 返回 `{st
 - 默认目录 `~/.dsh/plan-completion-data`；可用 `storageDir` 改到别处，`persistPlans: false` 退回纯内存；
 - 注意：存储为本地明文 JSON（含计划/建议文本，可能来自会话）；不加密、不自动清理，不适合多用户共享机器。
 
+## 建议文本安全（v0.1.4）
+
+- 去 Markdown 只剥离**成对**的行内标记；`transaction_id`、`payment_test.py`、`C:\a_b\file.js`、`src/**/*.js` 等标识符/路径/glob 原样保留；
+- 超过 40 字时按分句/空白/ASCII token 边界语义化缩短，不再把 `npm test` 截成 `npm`/`npm te`，也不会切断标识符或路径；
+- 危险命令过滤（rm -rf、format、Drop DB 等）不变；单行、≤40 字、可直接发送的约束不变。
+
 ## 模型路由与隐私
 
 - 仅使用宿主 `agentDefaultModel.currentSelection()` 当前默认的 provider/model，不自动改投其他已配置供应商；无可用路由时使用启发式。该默认值不一定是历史会话原先使用的模型。

package/docs/publish-assessment.md

@@ -1,6 +1,8 @@
 # GitHub 发布评估 · 会话计划补全插件（2026-11-02）
 
-> 历史文档：以下保留 v0.1.0 的交付/评估/计划记录。**当前最新为 v0.1.2**（本地计划持久化 + 鉴权/状态一致性/隐私边界修复），详见 [security.md](security.md) 与 [CHANGELOG](../CHANGELOG.md)；旧记录中的“无鉴权”、原始诊断字段与独立评审不代表当前实现。
+> 历史文档：以下保留 v0.1.0 的交付/评估/计划记录。**当前最新为 v0.1.3**（核对进度 + 本地计划持久化 + 鉴权/状态一致性/隐私边界修复），详见 [security.md](security.md) 与 [CHANGELOG](../CHANGELOG.md)；旧记录中的“无鉴权”、原始诊断字段与独立评审不代表当前实现。
+>
+> v0.1.3 发布记录（2026-11-02）：tag `v0.1.3` + [Release](https://github.com/Xumi0920/dsh-plan-completion/releases/tag/v0.1.3)；GitHub Actions [run 41368609382](https://github.com/Xumi0920/dsh-plan-completion/actions/runs/41368609382)（Ubuntu/Windows × Node20/22 四 job 全绿，126/126 tests）；npm `dsh-plan-completion@0.1.3`（31 files，shasum `11adee0fe9acff199a180be511ca8bc600afdf6f`）；canary 验证 `/plan-completion/verify` 未认证 401、客户端鉴权请求正常。
 >
 > v0.1.1 发布记录（2026-11-02）：tag `v0.1.1` + [Release](https://github.com/Xumi0920/dsh-plan-completion/releases/tag/v0.1.1)；GitHub Actions [run 41366651557](https://github.com/Xumi0920/dsh-plan-completion/actions/runs/41366651557)（Ubuntu/Windows × Node20/22 四 job 全绿）；npm `dsh-plan-completion@0.1.1`（31 files，shasum `18989b0f50b72d5c8c332f3fdee7f43ccb5fd91a`）。
 >

package/host/text.js

@@ -49,12 +49,17 @@ export function oneLine(value) {
 }
 
 const MD_LINE_PREFIX = /^\s{0,3}(?:#{1,6}\s+|>\s*|[-*+]\s+|\d+[.)]\s+)/;
-const MD_INLINE = /(\*\*|__|\*|_|`)/g;
 const MD_LINK = /\[([^\]]*)\]\([^)]*\)/g;
 const WRAPPING_QUOTES = /^["'“”‘’「」『』]+|["'“”‘’「」『』]+$/g;
+const CLAUSE_BOUNDARY = /[，。；！？、,;!?]/;
+const ASCII_TOKEN_CHAR = /[A-Za-z0-9_./\\-]/;
 
 /**
  * 去掉常见 Markdown 痕迹，得到适合直接发送的纯文本。
+ *
+ * 只剥离「成对」的行内标记：`transaction_id`、`C:\a_b\file.js`、`src/**\/*.js`
+ * 这类标识符/路径/glob 里的 `_`、`*` 不再被误删；
+ * 反引号只去掉包裹符号，代码内容原样保留。
  * @param {unknown} value
  * @returns {string}
  */
@@ -66,18 +71,89 @@ export function stripMarkdown(value) {
     .map((line) => line.replace(MD_LINE_PREFIX, ''))
     .join(' ');
   text = text.replace(MD_LINK, '$1');
-  text = text.replace(MD_INLINE, '');
+  // Protect glob/star patterns (src/**/*.js, *.py, **/) before emphasis stripping.
+  const stars = [];
+  text = text.replace(/\*\*\/|\*\/|\*\.[A-Za-z0-9_-]+/g, (match) => {
+    stars.push(match);
+    return `\u0000${stars.length - 1}\u0000`;
+  });
+  // Inline code: drop the backtick delimiters, keep the code text (underscores intact).
+  text = text.replace(/`([^`\n]+)`/g, '$1').replace(/`/g, '');
+  // Paired emphasis markers only. Never strip a lone _/* that belongs to an identifier,
+  // file name or glob (e.g. transaction_id, foo_bar, *.js).
+  text = text
+    .replace(/\*\*([^*\n]+)\*\*/g, '$1')
+    .replace(/__([^_\n]+)__/g, '$1')
+    .replace(/~~([^~\n]+)~~/g, '$1')
+    .replace(/\*([^*\n]+)\*/g, '$1')
+    .replace(/(^|[^\p{L}\p{N}_])_([^_\n]+)_(?=[^\p{L}\p{N}_]|$)/gu, '$1$2');
+  text = text.replace(/\u0000(\d+)\u0000/g, (_match, index) => stars[Number(index)] ?? '');
   return oneLine(text).replace(WRAPPING_QUOTES, '').trim();
 }
 
 /**
- * 建议文本规范化：单行 + 去 Markdown + 截断到 max 字。
+ * 语义化截短：不把标识符/路径/命令从中间切断。
+ *
+ * 依次尝试：句子/分句边界（，。；！？、,;!?）→ 空白边界 → 回退到 ASCII token 起点。
+ * 实在没有边界时才硬截断，保证返回长度 ≤ max。
+ * @param {unknown} value
+ * @param {number} [max]
+ * @returns {string}
+ */
+export function shortenSuggestion(value, max = DEFAULTS.suggestionMaxChars) {
+  const text = oneLine(value);
+  const limit = Number.isFinite(max) ? Math.floor(max) : 0;
+  if (limit <= 0) return '';
+  const chars = Array.from(text);
+  if (chars.length <= limit) return text;
+
+  const prefix = chars.slice(0, limit).join('');
+  const minUseful = Math.max(1, Math.floor(limit * 0.4));
+
+  // 1) Prefer the last clause boundary so the returned text stays a complete clause.
+  for (let i = prefix.length - 1; i >= minUseful; i -= 1) {
+    if (!CLAUSE_BOUNDARY.test(chars[i])) continue;
+    // Keep sentence-ending punctuation; drop separators such as ，、；: so the
+    // returned suggestion still reads like a message the user can send directly.
+    const keep = /[。！？!?]/.test(chars[i]) ? 1 : 0;
+    const head = chars.slice(0, i + keep).join('').trim();
+    if (head) return head;
+  }
+  // 2) Whitespace boundary: never leaves a partially copied word after it.
+  for (let i = prefix.length - 1; i >= minUseful; i -= 1) {
+    if (/\s/.test(chars[i])) {
+      let head = chars.slice(0, i).join('').trim();
+      // If the cut leaves a lone ASCII command prefix ("…再重跑 npm") and the next
+      // character is another ASCII token, drop that dangling token too.
+      const next = chars[i + 1] ?? '';
+      const tail = head.match(/(?:^|\s)([A-Za-z0-9_./\\-]+)$/);
+      if (tail && ASCII_TOKEN_CHAR.test(next)) {
+        head = head.slice(0, head.length - tail[1].length).trim().replace(/[\s，。；、,;:：-]+$/, '');
+      }
+      if (head) return head;
+    }
+  }
+  // 3) Do not split an ASCII identifier/path/command token: cut before the token.
+  let cut = limit;
+  while (cut > 0 && ASCII_TOKEN_CHAR.test(chars[cut - 1] ?? '') && ASCII_TOKEN_CHAR.test(chars[cut] ?? '')) {
+    cut -= 1;
+  }
+  if (cut > 0) {
+    const head = chars.slice(0, cut).join('').trim().replace(/[\s，。；、,;:：-]+$/, '');
+    if (head) return head;
+  }
+  // 4) Single oversized token: hard clamp (still ≤ limit).
+  return prefix;
+}
+
+/**
+ * 建议文本规范化：单行 + 去 Markdown + 语义化截断到 max 字。
  * @param {unknown} value
  * @param {number} [max]
  * @returns {string}
  */
 export function clampSuggestion(value, max = DEFAULTS.suggestionMaxChars) {
-  return clampChars(stripMarkdown(value), max);
+  return shortenSuggestion(stripMarkdown(value), max);
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plan-completion",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "private": false,
   "type": "module",
   "description": "Implicit session plans with Tab-completable next-message suggestions for DeepSeek Harness",