dsh-syn-config 0.8.0 → 0.8.1

package/README.md

@@ -18,6 +18,8 @@
 > 点它打开面板：顶部是体检结论（阻塞/警告数），下面四个动作——**体检 / 拉取计划 / 推送计划 / 密钥扫描**——都是对只读路由的 `GET`，面板只能看、不能写；每个结果旁边有「复制命令」，真正的写操作仍要 `/syn-dsh … now`。
 > `syn-dsh` 技能由插件自带（`assets/syn-dsh.md`，rank 600），不再放在配置仓库里。
 >
+> **密钥只由人注入。** 工具与斜杠命令都拒绝写 `inject`/`refresh`：`/syn-dsh secrets` 只放 `scan`/`fingerprint`，`dsh_sync_secrets` 在 `dry_run:false` 时直接拒绝，并提示自己执行 `bash ~/dsh-config/scripts/apply.sh --yes`。确需让工具代写，本机在插件行加 `allowSecretInject: true`（默认关闭）。
+>
 > 设计理由与后续阶段见主仓库的调研文档：`../research/syn-dsh-plugin/PLAN.md`。
 
 ## 为什么是插件，而不是又一层 shell

package/assets/syn-dsh.md

@@ -221,3 +221,13 @@ cd ~/dsh-config && bash scripts/cross-platform-selftest.sh
 2. **变化**：改动的技能名（超过 10 个只列前 10 + 共几个）；是否动了配置/插件
 3. **生效**：新开会话（技能）/ 重启客户端（插件）
 4. **待办**：缺密钥、冲突未合、推送失败等
+
+## 密钥注入只由人执行
+
+`/syn-dsh secrets` 只支持 `scan` / `fingerprint`（只读）。`inject` / `refresh` 会写真实密钥进已部署配置，**只能由人执行**：
+
+```bash
+bash ~/dsh-config/scripts/apply.sh --yes     # 从 ~/.dsh/secrets.env 注入
+```
+
+要让模型工具代写，需在本机插件行显式加 `allowSecretInject: true`（默认关闭）。

package/lib/core/commands.js

@@ -172,7 +172,16 @@ export function registerCommands(ctx, settings) {
 
         if (subcommand === 'secrets') {
           const action = (tokens[1] ?? 'scan').toLowerCase()
-          const readOnly = action === 'scan' || action === 'fingerprint'
+          // The slash command cannot inject: writing a real value into the live
+          // configuration stays a human action (`apply.sh`), so a command that
+          // is easy to type cannot be the thing that leaks a key.
+          if (action !== 'scan' && action !== 'fingerprint') {
+            return {
+              kind: 'error',
+              text: `secrets ${action}: 只读命令只支持 scan / fingerprint；注入真值请自己执行 \`bash ~/dsh-config/scripts/apply.sh --yes\``,
+            }
+          }
+          const readOnly = true
           const result = await runSecretsAction({
             action,
             repoPath,

package/lib/index.js

@@ -172,7 +172,11 @@ export function resolveSettings(config = {}) {
   const dshHome = typeof config.dshHome === 'string' && config.dshHome.trim() !== ''
     ? config.dshHome.trim()
     : undefined
-  return { repoPath, gitTimeoutMs, fetchOnStatus: config.fetchOnStatus === true, profile, dshHome }
+  // Injecting a real secret into the live configuration is a human action.
+  // The model-callable tool refuses it unless this machine explicitly opts in,
+  // so an agent can never turn "sync my config" into "write my API key".
+  const allowSecretInject = config.allowSecretInject === true
+  return { repoPath, gitTimeoutMs, fetchOnStatus: config.fetchOnStatus === true, profile, dshHome, allowSecretInject }
 }
 
 /** Result shape of the health-check tool. */
@@ -741,13 +745,35 @@ function apply(ctx, config = {}) {
     async execute(args, exec) {
       const requested = typeof args?.repo === 'string' && args.repo.trim() !== '' ? args.repo.trim() : settings.repoPath
       const profile = typeof args?.profile === 'string' && args.profile.trim() !== '' ? args.profile.trim() : settings.profile
+      const action = String(args?.action ?? '')
+      const dryRun = typeof args?.dry_run === 'boolean' ? args.dry_run : true
+      // Human-only gate: `inject` and `refresh` write the real value into the
+      // deployed configuration. Refuse them from the tool unless the machine
+      // opted in, and say where the human path is.
+      if ((action === 'inject' || action === 'refresh') && dryRun === false && settings.allowSecretInject !== true) {
+        return {
+          action,
+          ok: false,
+          dryRun: false,
+          changed: [],
+          leftover: [],
+          hits: [],
+          fingerprints: [],
+          historyHits: [],
+          notes: [
+            'refused: secrets are injected by the human, not by the agent',
+            'run it yourself: `bash ~/dsh-config/scripts/apply.sh --yes`',
+            'or set `allowSecretInject: true` in this plugin row if you want the tool to do it',
+          ],
+        }
+      }
       try {
         const result = await runSecretsAction({
-          action: args?.action,
+          action,
           repoPath: requested,
           dshHome: settings.dshHome,
           profile,
-          dryRun: typeof args?.dry_run === 'boolean' ? args.dry_run : true,
+          dryRun,
           deep: args?.deep === true,
         })
         return { ...result, historyHits: result.historyHits ?? [] }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-syn-config",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "private": false,
   "description": "Cross-platform (macOS + Windows) DeepSeek Harness plugin that syncs DSH config — skills, profile settings, AGENTS.md — with a private dsh-config repository.",
   "type": "module",