dsh-syn-config 0.8.0 → 0.8.2

package/README.md

@@ -18,6 +18,10 @@
 > 点它打开面板：顶部是体检结论（阻塞/警告数），下面四个动作——**体检 / 拉取计划 / 推送计划 / 密钥扫描**——都是对只读路由的 `GET`，面板只能看、不能写；每个结果旁边有「复制命令」，真正的写操作仍要 `/syn-dsh … now`。
 > `syn-dsh` 技能由插件自带（`assets/syn-dsh.md`，rank 600），不再放在配置仓库里。
 >
+> **升级插件后要 push 清单。** 配置仓库 `profiles/<profile>/package.json` 是 `apply.sh` 的来源；只改本机不改仓库，下次 `apply.sh --yes` 会把本机清单覆盖回仓库版本（曾因此把 `dsh-syn-config` 回滚成旧的 `dsh-config-sync`，状态灯随之变红）。`verify.mjs` 现在会比对这两份清单，不一致直接失败并给出修复路径。想彻底不漂移：`/syn-dsh push now`（或 `apply.sh` 之后手工提交该文件）。
+>
+> **密钥只由人注入。** 工具与斜杠命令都拒绝写 `inject`/`refresh`：`/syn-dsh secrets` 只放 `scan`/`fingerprint`，`dsh_sync_secrets` 在 `dry_run:false` 时直接拒绝，并提示自己执行 `bash ~/dsh-config/scripts/apply.sh --yes`。确需让工具代写，本机在插件行加 `allowSecretInject: true`（默认关闭）。
+>
 > 设计理由与后续阶段见主仓库的调研文档：`../research/syn-dsh-plugin/PLAN.md`。
 
 ## 为什么是插件，而不是又一层 shell

package/assets/syn-dsh.md

@@ -221,3 +221,20 @@ cd ~/dsh-config && bash scripts/cross-platform-selftest.sh
 2. **变化**：改动的技能名（超过 10 个只列前 10 + 共几个）；是否动了配置/插件
 3. **生效**：新开会话（技能）/ 重启客户端（插件）
 4. **待办**：缺密钥、冲突未合、推送失败等
+
+## 密钥注入只由人执行
+
+`/syn-dsh secrets` 只支持 `scan` / `fingerprint`（只读）。`inject` / `refresh` 会写真实密钥进已部署配置，**只能由人执行**：
+
+```bash
+bash ~/dsh-config/scripts/apply.sh --yes     # 从 ~/.dsh/secrets.env 注入
+```
+
+要让模型工具代写，需在本机插件行显式加 `allowSecretInject: true`（默认关闭）。
+
+## 升级插件后必须同步清单
+
+配置仓库里的 `profiles/<profile>/package.json` 与 `cordis.patch.yml` 是 `apply.sh` 的**来源**。只在本机改插件、不推仓库，下一次 `apply.sh --yes` 会把本机清单覆盖回仓库版本（真发生过：`dsh-syn-config` 被回滚成旧的 `dsh-config-sync`，状态灯变红）。
+
+- 升级后：`/syn-dsh push now`（或手动提交该文件）
+- 自检：`node scripts/verify.mjs` 会比对「本机清单」与「仓库清单」，不一致直接失败

package/lib/core/commands.js

@@ -172,7 +172,16 @@ export function registerCommands(ctx, settings) {
 
         if (subcommand === 'secrets') {
           const action = (tokens[1] ?? 'scan').toLowerCase()
-          const readOnly = action === 'scan' || action === 'fingerprint'
+          // The slash command cannot inject: writing a real value into the live
+          // configuration stays a human action (`apply.sh`), so a command that
+          // is easy to type cannot be the thing that leaks a key.
+          if (action !== 'scan' && action !== 'fingerprint') {
+            return {
+              kind: 'error',
+              text: `secrets ${action}: 只读命令只支持 scan / fingerprint；注入真值请自己执行 \`bash ~/dsh-config/scripts/apply.sh --yes\``,
+            }
+          }
+          const readOnly = true
           const result = await runSecretsAction({
             action,
             repoPath,

package/lib/index.js

@@ -172,7 +172,11 @@ export function resolveSettings(config = {}) {
   const dshHome = typeof config.dshHome === 'string' && config.dshHome.trim() !== ''
     ? config.dshHome.trim()
     : undefined
-  return { repoPath, gitTimeoutMs, fetchOnStatus: config.fetchOnStatus === true, profile, dshHome }
+  // Injecting a real secret into the live configuration is a human action.
+  // The model-callable tool refuses it unless this machine explicitly opts in,
+  // so an agent can never turn "sync my config" into "write my API key".
+  const allowSecretInject = config.allowSecretInject === true
+  return { repoPath, gitTimeoutMs, fetchOnStatus: config.fetchOnStatus === true, profile, dshHome, allowSecretInject }
 }
 
 /** Result shape of the health-check tool. */
@@ -741,13 +745,35 @@ function apply(ctx, config = {}) {
     async execute(args, exec) {
       const requested = typeof args?.repo === 'string' && args.repo.trim() !== '' ? args.repo.trim() : settings.repoPath
       const profile = typeof args?.profile === 'string' && args.profile.trim() !== '' ? args.profile.trim() : settings.profile
+      const action = String(args?.action ?? '')
+      const dryRun = typeof args?.dry_run === 'boolean' ? args.dry_run : true
+      // Human-only gate: `inject` and `refresh` write the real value into the
+      // deployed configuration. Refuse them from the tool unless the machine
+      // opted in, and say where the human path is.
+      if ((action === 'inject' || action === 'refresh') && dryRun === false && settings.allowSecretInject !== true) {
+        return {
+          action,
+          ok: false,
+          dryRun: false,
+          changed: [],
+          leftover: [],
+          hits: [],
+          fingerprints: [],
+          historyHits: [],
+          notes: [
+            'refused: secrets are injected by the human, not by the agent',
+            'run it yourself: `bash ~/dsh-config/scripts/apply.sh --yes`',
+            'or set `allowSecretInject: true` in this plugin row if you want the tool to do it',
+          ],
+        }
+      }
       try {
         const result = await runSecretsAction({
-          action: args?.action,
+          action,
           repoPath: requested,
           dshHome: settings.dshHome,
           profile,
-          dryRun: typeof args?.dry_run === 'boolean' ? args.dry_run : true,
+          dryRun,
           deep: args?.deep === true,
         })
         return { ...result, historyHits: result.historyHits ?? [] }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-syn-config",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "private": false,
   "description": "Cross-platform (macOS + Windows) DeepSeek Harness plugin that syncs DSH config — skills, profile settings, AGENTS.md — with a private dsh-config repository.",
   "type": "module",

package/scripts/verify.mjs

@@ -136,6 +136,22 @@ async function main() {
     for (const note of status.notes) console.log(`       note: ${note}`)
   }
 
+  // The repo copy of the profile manifest is what `apply.sh` restores from.
+  // If it still names another package, the next apply rolls this machine back
+  // to it — which is exactly how a working install "became unavailable" once.
+  const repoManifestPath = join(repoPath, 'profiles', profileName, 'package.json')
+  if (existsSync(repoManifestPath)) {
+    const repoManifest = JSON.parse(readFileSync(repoManifestPath, 'utf8'))
+    const liveSync = Object.keys(manifest.dependencies ?? {}).filter((dep) => dep.includes('syn-config') || dep.includes('config-sync'))
+    const repoSync = Object.keys(repoManifest.dependencies ?? {}).filter((dep) => dep.includes('syn-config') || dep.includes('config-sync'))
+    const agree = liveSync.length === 1 && repoSync.length === 1 && liveSync[0] === repoSync[0]
+    record(step(agree, 'repo copy agrees with this install', agree ? liveSync[0] : `live=${liveSync.join(',') || 'none'} repo=${repoSync.join(',') || 'none'}`))
+    if (!agree) {
+      console.log('       the next `apply.sh --yes` would overwrite this profile from the repo:')
+      console.log(`       fix: update ${repoManifestPath} (dependencies + dsh.profile.bundles), then push`)
+    }
+  }
+
   console.log('')
   if (failures.length > 0) {
     console.error(`[verify] FAILED — ${failures.length} check(s) did not pass.`)