dsh-syn-config 0.0.0-stage → 0.7.2

package/docs/RELEASE.md

@@ -0,0 +1,95 @@
+# 发布到 DSH 插件市场（dsh-market）的完整路径
+
+> 结论：**dsh-market 没有“上传接口”。** 它读的是精选列表 [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin) 的目录
+> （`https://awesome-dsh-plugin.com/plugins.json`，国内走 npm 镜像的同一份）。上架 = 往那个仓库提一个 YAML 文件的 PR。
+> 合并后目录 CI 每日刷新，通常一天内出现在市场的“发现”页与宿主 Discover 索引里。
+
+## 0. 发布前检查（本仓库已通过）
+
+```bash
+node scripts/publish-check.mjs     # 不允许：账号名/私有仓库 URL/launchd 标签/家目录路径
+node --test "test/*.test.mjs"      # 81 例
+node scripts/verify.mjs            # 安装形态
+```
+
+## 1. 发布包（任选其一；推荐两个都做）
+
+**A. npm（已发布）**
+
+`dsh-syn-config@0.7.1` 已在 registry 上：<https://www.npmjs.com/package/dsh-syn-config>（34 个文件，234 KB unpacked）。
+
+首次发布踩到的两个坑，记下来免得下台机器重踩：
+
+1. granular token 若用「Only select packages」选一个**还不存在**的包，作用域是空集 → 403 `You may not perform that action with these credentials`；
+2. 首次发布时 registry 会先挂一个 `0.0.0-stage` 占位版本（staged publishing 机制），真实版本在几分钟后出现，`npm view <name> version` 一开始会看到占位号，不要慌。
+
+```bash
+npm login
+npm publish --access public
+npm view dsh-syn-config version   # 0.7.1
+```
+
+**B. GitHub Release tarball（不发 npm 时的兜底，市场会优先展示它）**
+
+```bash
+npm pack                           # dsh-syn-config-0.7.0.tgz
+gh release create v0.7.0 dsh-syn-config-0.7.0.tgz
+```
+
+## 2. 仓库公开（这一步有隐私前提）
+
+市场的维护者会**实际阅读仓库**，所以仓库必须公开。但**历史不能直接公开**：早期提交里带着私有配置仓库的 URL（`assets/syn-dsh.md` 已在新版本里清掉，旧提交仍在）。
+
+推荐做法：**新建一个干净的公开仓库**，只放一个压缩后的初始提交，旧仓库留作私有归档：
+
+```bash
+git clone --depth 1 . /tmp/dsh-syn-config-public
+cd /tmp/dsh-syn-config-public && rm -rf .git
+git init && git add -A && git commit -m "feat: dsh-syn-config 0.7.0"
+git branch -M main
+gh repo create Dreamaniax/dsh-syn-config --public --source . --remote origin --push
+gh repo edit Dreamaniax/dsh-syn-config --add-topic dsh-plugin
+```
+
+## 3. 提 PR（一个文件）
+
+仓库 `awesome-dsh-plugin/awesome-dsh-plugin`，新增 `data/plugins/Dreamaniax__dsh-syn-config.yml`：
+
+```yaml
+url: https://github.com/Dreamaniax/dsh-syn-config
+name: Dreamaniax/dsh-syn-config
+category: workflow
+description:
+  en: 'Syncs DSH skills, profile settings and AGENTS.md with a private git repository: status, six-section health check, pull, secret redaction, and a snapshot-plus-push flow.'
+  zh: '把 DSH 技能、profile 设置与 AGENTS.md 与私有 git 仓库双向同步：状态、六节体检、拉取、密钥脱敏，以及快照+推送。'
+icon: https://raw.githubusercontent.com/Dreamaniax/dsh-syn-config/main/assets/icon-180.png
+```
+
+## 4. 会被 CI 挡住的硬条件
+
+| 条件 | 我们的状态 |
+|---|---|
+| 仓库声明 `dsh.bundle`（可 `dsh plugin add`） | ✅ `dsh.bundle.patch` |
+| 仓库**创建满 1 天** | ⏳ 新仓库刚建，**PR 次日再提**，否则 CI 自动打回 |
+| 有真实可用的代码 | ✅ 6 个工具 + 命令 + 状态卡 + 81 例测试 |
+| 加 `dsh-plugin` topic | 步骤 2 已带 |
+| 描述与代码一致 | 描述里只写真实存在的工具与行为 |
+| 官方 `@deepseek-ai/*` 用 peerDependencies | ✅ 本插件不依赖官方包 |
+
+## 5. 合并之后
+
+- 目录 CI 每日重建 `plugins.json` → dsh-market 搜索即可命中；
+- 宿主 DSH 0.2.1+ 的「插件 → 发现 → 索引源」也可直接加 `https://awesome-dsh-plugin.com/index.json`；
+- 安装走 `dsh plugin add dsh-syn-config`（npm）或市场一键安装（源码/ tarball）。
+
+## 6. 安全边界（写给使用者）
+
+插件以宿主全权运行：能执行 `git`、读写 `~/.dsh`、注册一个本机 HTTP 路由。它**默认不写盘**（`pull`/`push` 的 `dry_run` 默认 true），不接受任何网络上报，密钥只在本机 `secrets.env`。
+
+## 7. 隐私复检（0.7.1）
+
+- **占位值不再误报**：`API_KEY=dummy_test_value_0001` 这类测试夹具被识别为占位值放过；带真实凭据前缀（`as_sk_`/`ghp_`/`sk-`/`AKIA`…）的一律不放过。
+- **凭据形状的键**：`*api_key / *token / *secret / *password / Authorization / private_key` 且值 ≥16 位、含字母+数字 → 判为错误（提示改用 `__KEY__`）；`vaultSyncS3Key` 这类标识符不算。
+- **历史扫描不再因体积失败**：单次 diff 超过缓冲时，自动收窄到 `profiles/ scripts/ AGENTS.md weekly/` 重试。
+- **定时任务标签**：不再硬编码个人反域名——读 `DSH_WEEKLY_LAUNCHD_LABEL` / `learning/schedule.env`，都没有就按 `*.dsh.weekly-retro` 后缀匹配。
+- 复检结果：`publish-check` 0 命中；`dsh_sync_doctor` 0 阻塞、2 警告（都是本机与仓库的正常漂移）。

package/lib/core/commands.js

@@ -0,0 +1,146 @@
+/**
+ * `/syn-dsh` — the user-facing slash command.
+ *
+ * A slash command runs against the agent directly: no model message is
+ * created, so it costs nothing and cannot be "misread" by the model. The
+ * command is deliberately thin — it calls the same core functions the model
+ * tools use, which keeps the two surfaces from drifting.
+ *
+ * Safety rule for the command: `push` and `pull` default to their dry-run
+ * plan. A real mutation needs the word `now`. That is the reverse of the tool
+ * default only in wording, not in behaviour: both require an explicit human
+ * decision before anything leaves this machine.
+ *
+ * @module dsh-syn-config/core/commands
+ */
+
+import { runDoctor } from './doctor.js'
+import { pullRepo } from './pull.js'
+import { pushRepo } from './push.js'
+import { runSecretsAction } from './secrets-ops.js'
+import { readRepoStatus } from './status.js'
+
+/** One-line status summary. */
+function formatStatus(status) {
+  if (!status.repoPresent) return `${status.repoPath}: no repository found`
+  if (!status.ok) return `${status.repoPath}: ${status.notes[0] ?? 'cannot read status'}`
+  const tracking = status.upstream === '' ? 'no upstream' : `${status.ahead} ahead / ${status.behind} behind ${status.upstream}`
+  const tree = status.dirty === 0 ? 'clean worktree' : `${status.dirty} changed file(s)`
+  return `${status.branch || '(detached)'} · ${tracking} · ${tree}`
+}
+
+/** Doctor summary: one line per section, only the worst finding. */
+function formatDoctor(result) {
+  const lines = [`health: ${result.fail} blocking / ${result.warn} warnings · exit ${result.exitCode}`]
+  for (const section of result.sections) {
+    const finding = section.items.find((entry) => entry.level === 'error')
+      ?? section.items.find((entry) => entry.level === 'warn')
+    lines.push(`${section.status.toUpperCase().padEnd(5)} ${section.title}${finding === undefined ? '' : ` — ${finding.text.trim()}`}`)
+  }
+  return lines.join('\n')
+}
+
+/**
+ * Register the command.
+ *
+ * @param {{ commands: { register(definition: object): unknown } }} ctx
+ * @param {{ repoPath: string, profile: string, dshHome?: string, gitTimeoutMs: number }} settings
+ */
+export function registerCommands(ctx, settings) {
+  if (ctx.commands === undefined || typeof ctx.commands.register !== 'function') return
+
+  ctx.commands.register({
+    // A stable, plugin-namespaced identity: optional for the registry, but it
+    // lets a UI pair the definition with its executions across reloads.
+    definitionId: 'dsh-syn-config/syn-dsh',
+    name: 'syn-dsh',
+    description: '同步 DSH 配置：status / doctor / pull / push / secrets（写操作默认 dry-run，加 now 才执行）',
+    input: { hint: 'status | doctor [online] | pull [now] | push [now] | secrets scan|fingerprint' },
+    async handler({ rawInput }) {
+      const tokens = String(rawInput ?? '').trim().split(/\s+/u).filter((token) => token !== '')
+      const subcommand = (tokens[0] ?? 'status').toLowerCase()
+      const flag = (tokens[1] ?? '').toLowerCase()
+      const repoPath = typeof settings.repoPath === 'string' ? settings.repoPath : ''
+      try {
+        if (subcommand === 'status') {
+          const status = await readRepoStatus({ repoPath, timeoutMs: settings.gitTimeoutMs })
+          return { kind: status.ok || status.repoPresent ? 'success' : 'error', text: formatStatus(status) }
+        }
+
+        if (subcommand === 'doctor' || subcommand === 'check') {
+          const result = await runDoctor({
+            repoPath,
+            dshHome: settings.dshHome,
+            profile: settings.profile,
+            offline: flag !== 'online',
+            timeoutMs: settings.gitTimeoutMs,
+          })
+          return { kind: result.exitCode === 1 ? 'error' : 'success', text: formatDoctor(result) }
+        }
+
+        if (subcommand === 'pull') {
+          const real = flag === 'now'
+          const result = await pullRepo({
+            repoPath,
+            dshHome: settings.dshHome,
+            dryRun: !real,
+            timeoutMs: settings.gitTimeoutMs,
+          })
+          const mirrors = result.mirrors
+            .map((mirror) => `${mirror.name} +${mirror.planned.added.length} ~${mirror.planned.updated.length} -${mirror.planned.deleted.length}`)
+            .join(' · ')
+          const head = real
+            ? `${result.pulled ? 'pulled' : 'already up to date'} ${result.before.slice(0, 7)} → ${result.after.slice(0, 7)}`
+            : `dry run: ${result.incomingCommits} incoming commit(s)`
+          const warnings = result.warnings.length === 0 ? '' : `\n${result.warnings.join('\n')}`
+          return { kind: result.ok ? 'success' : 'error', text: `${head}\n${mirrors}${warnings}` }
+        }
+
+        if (subcommand === 'push') {
+          const real = flag === 'now'
+          const result = await pushRepo({
+            repoPath,
+            dshHome: settings.dshHome,
+            profile: settings.profile,
+            dryRun: !real,
+            timeoutMs: settings.gitTimeoutMs,
+          })
+          const gates = `lint ${result.gates.lint.ok ? 'ok' : 'FAIL'} · redact ${result.gates.redact.changed.length} · scan ${result.gates.scan.ok ? 'ok' : 'FAIL'}`
+          const summary = result.commit.created
+            ? `commit ${result.commit.sha}${result.commit.pushed ? ' pushed' : ' NOT pushed'}`
+            : result.commit.unchanged ? 'no changes to commit' : (real ? 'not committed' : 'dry run: nothing written')
+          const warnings = result.warnings.length === 0 ? '' : `\n${result.warnings.slice(0, 5).join('\n')}`
+          return {
+            kind: result.ok ? 'success' : 'error',
+            text: `changes +${result.changes.added.length} ~${result.changes.updated.length} -${result.changes.deleted.length} · skills ${result.manifest.skills}\n${gates}\n${summary}${warnings}`,
+          }
+        }
+
+        if (subcommand === 'secrets') {
+          const action = (tokens[1] ?? 'scan').toLowerCase()
+          const readOnly = action === 'scan' || action === 'fingerprint'
+          const result = await runSecretsAction({
+            action,
+            repoPath,
+            dshHome: settings.dshHome,
+            profile: settings.profile,
+            dryRun: true,
+          })
+          const detail = readOnly
+            ? (action === 'scan'
+              ? `${result.hits.length} plaintext hit(s)`
+              : result.fingerprints.map((entry) => `${entry.key} sha256:${entry.sha256} len=${entry.length}`).join('\n'))
+            : `would change: ${result.changed.join(', ') || '(nothing)'}`
+          return { kind: result.ok ? 'success' : 'error', text: `${action}: ${result.ok ? 'ok' : 'FAILED'}\n${detail}` }
+        }
+
+        return { kind: 'error', text: `unknown subcommand "${subcommand}" — use status | doctor | pull | push | secrets` }
+      } catch (error) {
+        return { kind: 'error', text: `syn-dsh ${subcommand} failed: ${String(error?.message ?? error)}` }
+      }
+    },
+  })
+}
+
+/** Re-exported for callers that only need the formatter. */
+export { formatDoctor, formatStatus }

package/lib/core/diagnostics.js

@@ -0,0 +1,54 @@
+/**
+ * What actually registered, and why it did not.
+ *
+ * A host plugin can fail in ways that are invisible from outside: reading a
+ * service without declaring it throws, a command registration can be rejected,
+ * a slot name can be wrong. Every registration step in `apply()` therefore
+ * records its outcome here, and the `dsh_sync_diag` tool reports it — so
+ * "is it loaded?" is a question the agent can answer instead of guess.
+ *
+ * @module dsh-syn-config/core/diagnostics
+ */
+
+const state = {
+  version: '',
+  startedAt: '',
+  services: {},
+  steps: [],
+  tools: [],
+}
+
+/** Reset for a fresh activation (a reload runs `apply()` again). */
+export function resetDiagnostics(version) {
+  state.version = version
+  state.startedAt = new Date().toISOString()
+  state.services = {}
+  state.steps = []
+  state.tools = []
+}
+
+/** Record one registered tool name. */
+export function recordTool(name) {
+  if (!state.tools.includes(name)) state.tools.push(name)
+}
+
+/** Record that a service was or was not available. */
+export function recordService(name, value) {
+  state.services[name] = value === undefined || value === null ? 'missing' : 'available'
+}
+
+/** Record one registration step. */
+export function recordStep(name, ok, detail = '') {
+  state.steps.push({ name, ok, detail: String(detail).slice(0, 200) })
+}
+
+/** A snapshot the tool can return. */
+export function readDiagnostics() {
+  return {
+    version: state.version,
+    startedAt: state.startedAt,
+    services: { ...state.services },
+    tools: [...state.tools],
+    steps: state.steps.map((step) => ({ ...step })),
+  }
+}