dsh-syn-config 0.7.1 → 0.7.2

package/docs/RELEASE.md

@@ -14,12 +14,19 @@ node scripts/verify.mjs            # 安装形态
 
 ## 1. 发布包（任选其一；推荐两个都做）
 
-**A. npm（安装更顺，免 `allowBuilds`）**
+**A. npm（已发布）**
+
+`dsh-syn-config@0.7.1` 已在 registry 上：<https://www.npmjs.com/package/dsh-syn-config>（34 个文件，234 KB unpacked）。
+
+首次发布踩到的两个坑，记下来免得下台机器重踩：
+
+1. granular token 若用「Only select packages」选一个**还不存在**的包，作用域是空集 → 403 `You may not perform that action with these credentials`；
+2. 首次发布时 registry 会先挂一个 `0.0.0-stage` 占位版本（staged publishing 机制），真实版本在几分钟后出现，`npm view <name> version` 一开始会看到占位号，不要慌。
 
 ```bash
-npm login                          # 本机当前未登录
-# package.json: "private": false, 补 "publishConfig": { "access": "public" }
-npm publish --access public        # 名称 dsh-syn-config（已确认未被占用）
+npm login
+npm publish --access public
+npm view dsh-syn-config version   # 0.7.1
 ```
 
 **B. GitHub Release tarball（不发 npm 时的兜底，市场会优先展示它）**

package/lib/core/history.js

@@ -15,7 +15,7 @@
 
 import { findGit } from './env.js'
 import { runCommand } from './exec.js'
-import { SECRET_PATTERNS } from './files.js'
+import { isPlaceholderMatch, SECRET_PATTERNS } from './files.js'
 
 /** Mask the middle of a matched value so a hit is recognisable but not usable. */
 export function maskValue(value) {
@@ -41,9 +41,10 @@ export async function scanHistory(options) {
 
   const base = ['-C', repoPath, 'log', '-p', '--no-color', '--no-merges', '-n', String(maxCommits), '--format=%x01%H']
   let result = await runCommand(gitPath, base, { timeoutMs, signal })
-  // A repository with large binary-ish skills can overflow one buffer; retry
-  // over the paths that actually matter for credentials before giving up.
-  if (!result.ok && /ENOBUFS|maxBuffer|ERR_CHILD_PROCESS_STDIO_MAXBUFFER/i.test(result.stderr ?? '')) {
+  // A repository with large binary-ish skills overflows one buffer (the error
+  // text is not guaranteed: Node reports it in `code`, not `stderr`). Retry on
+  // any failure, restricted to the paths that can actually carry credentials.
+  if (!result.ok) {
     result = await runCommand(
       gitPath,
       [...base, '--', 'profiles', 'scripts', 'AGENTS.md', 'weekly'],
@@ -81,6 +82,10 @@ export async function scanHistory(options) {
       SECRET_PATTERNS[index].lastIndex = 0
       const match = SECRET_PATTERNS[index].exec(added)
       if (match === null) continue
+      // The same placeholder rule as the working-tree scan: a fixture that
+      // writes `API_KEY=dummy_test_value_0001` is not a leaked credential, and
+      // reporting it in history trains people to ignore the whole section.
+      if (isPlaceholderMatch(match[0])) continue
       hits.push({
         commit: current,
         pattern: index,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-syn-config",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "private": false,
   "description": "Cross-platform (macOS + Windows) DeepSeek Harness plugin that syncs DSH config — skills, profile settings, AGENTS.md — with a private dsh-config repository.",
   "type": "module",

package/scripts/publish-check.mjs

@@ -24,7 +24,7 @@ const here = resolve(dirname(fileURLToPath(import.meta.url)), '..')
 const argv = process.argv.slice(2)
 let repo = here
 // Documented examples that are intentionally generic.
-const allowed = ['/Users/you/', 'Dreamaniax', 'awesome-dsh-plugin']
+const allowed = ['/Users/you/', 'Dreamaniax', 'awesome-dsh-plugin', 'users.noreply.github.com']
 for (let index = 0; index < argv.length; index += 1) {
   if (argv[index] === '--repo') {
     repo = resolve(argv[index + 1] ?? '')