dsh-syn-config 0.8.1 → 0.8.3

package/README.md

@@ -18,6 +18,8 @@
 > 点它打开面板：顶部是体检结论（阻塞/警告数），下面四个动作——**体检 / 拉取计划 / 推送计划 / 密钥扫描**——都是对只读路由的 `GET`，面板只能看、不能写；每个结果旁边有「复制命令」，真正的写操作仍要 `/syn-dsh … now`。
 > `syn-dsh` 技能由插件自带（`assets/syn-dsh.md`，rank 600），不再放在配置仓库里。
 >
+> **升级插件后要 push 清单。** 配置仓库 `profiles/<profile>/package.json` 是 `apply.sh` 的来源；只改本机不改仓库，下次 `apply.sh --yes` 会把本机清单覆盖回仓库版本（曾因此把 `dsh-syn-config` 回滚成旧的 `dsh-config-sync`，状态灯随之变红）。`verify.mjs` 现在会比对这两份清单，不一致直接失败并给出修复路径。想彻底不漂移：`/syn-dsh push now`（或 `apply.sh` 之后手工提交该文件）。
+>
 > **密钥只由人注入。** 工具与斜杠命令都拒绝写 `inject`/`refresh`：`/syn-dsh secrets` 只放 `scan`/`fingerprint`，`dsh_sync_secrets` 在 `dry_run:false` 时直接拒绝，并提示自己执行 `bash ~/dsh-config/scripts/apply.sh --yes`。确需让工具代写，本机在插件行加 `allowSecretInject: true`（默认关闭）。
 >
 > 设计理由与后续阶段见主仓库的调研文档：`../research/syn-dsh-plugin/PLAN.md`。

package/assets/syn-dsh.md

@@ -231,3 +231,10 @@ bash ~/dsh-config/scripts/apply.sh --yes     # 从 ~/.dsh/secrets.env 注入
 ```
 
 要让模型工具代写，需在本机插件行显式加 `allowSecretInject: true`（默认关闭）。
+
+## 升级插件后必须同步清单
+
+配置仓库里的 `profiles/<profile>/package.json` 与 `cordis.patch.yml` 是 `apply.sh` 的**来源**。只在本机改插件、不推仓库，下一次 `apply.sh --yes` 会把本机清单覆盖回仓库版本（真发生过：`dsh-syn-config` 被回滚成旧的 `dsh-config-sync`，状态灯变红）。
+
+- 升级后：`/syn-dsh push now`（或手动提交该文件）
+- 自检：`node scripts/verify.mjs` 会比对「本机清单」与「仓库清单」，不一致直接失败

package/lib/core/doctor.js

@@ -41,6 +41,59 @@ function section(id, title, items, extra = {}) {
   return { id, title, status, items, ...extra }
 }
 
+/**
+ * Semantic fingerprint of a plugin manifest.
+ *
+ * `link:` specs point at the same checkout from different bases on different
+ * machines (`/Users/me/x` vs `../../../x`), so only the final path segment is
+ * meaningful. Everything else compares by value.
+ *
+ * @param {string} text
+ * @returns {{ deps: Record<string, string>, bundles: string[] }}
+ */
+function manifestFingerprint(text) {
+  const parsed = JSON.parse(text)
+  const normalized = {}
+  for (const [name, spec] of Object.entries(parsed.dependencies ?? {})) {
+    const value = typeof spec === 'string' && spec.startsWith('link:')
+      ? `link:${spec.split(/[\\/]/u).filter((segment) => segment !== '').pop() ?? ''}`
+      : String(spec)
+    normalized[name] = value
+  }
+  const bundles = [...(parsed.dsh?.profile?.bundles ?? [])].map(String).sort()
+  return { deps: normalized, bundles }
+}
+
+/**
+ * Names of manifest entries that really differ between live and repository.
+ *
+ * @param {string} liveText
+ * @param {string} repoText
+ * @returns {string[]} human-readable differences, empty when equivalent
+ */
+export function manifestDrift(liveText, repoText) {
+  let live
+  let repo
+  try {
+    live = manifestFingerprint(liveText)
+    repo = manifestFingerprint(repoText)
+  } catch {
+    return ['清单无法解析']
+  }
+  const drift = []
+  for (const name of new Set([...Object.keys(live.deps), ...Object.keys(repo.deps)])) {
+    if (live.deps[name] !== repo.deps[name]) {
+      drift.push(`${name} ${live.deps[name] ?? '(缺)'} ↔ ${repo.deps[name] ?? '(缺)'}`)
+    }
+  }
+  if (live.bundles.join(',') !== repo.bundles.join(',')) {
+    const onlyLive = live.bundles.filter((x) => !repo.bundles.includes(x))
+    const onlyRepo = repo.bundles.filter((x) => !live.bundles.includes(x))
+    drift.push(`bundle ${[...onlyLive.map((x) => `+${x}`), ...onlyRepo.map((x) => `-${x}`)].join(' ') || '顺序不同'}`)
+  }
+  return drift
+}
+
 const sleep = (ms) => new Promise((done) => setTimeout(done, ms))
 
 /**
@@ -325,10 +378,10 @@ export async function runDoctor(options) {
     const liveManifestText = readTextFile(liveManifest)
     const repoManifestText = readTextFile(repoManifest)
     if (liveManifestText !== null && repoManifestText !== null) {
-      const same = liveManifestText.replace(/\s+$/u, '') === repoManifestText.replace(/\s+$/u, '')
-      items.push(same
-        ? item('ok', 'package.json（插件清单）与仓库一致')
-        : item('warn', 'package.json（插件清单）与仓库不同（装/卸了插件：sync 推送 / update 拉取）'))
+      const drift = manifestDrift(liveManifestText, repoManifestText)
+      items.push(drift.length === 0
+        ? item('ok', 'package.json（插件清单）与仓库一致（link: 的绝对/相对写法不参与比较）')
+        : item('warn', `package.json（插件清单）与仓库不同：${drift.slice(0, 5).join('，')}（装/卸了插件：sync 推送 / update 拉取）`))
       try {
         const parsed = JSON.parse(liveManifestText)
         const dependencies = Object.keys(parsed.dependencies ?? {})

package/lib/core/pack.js

@@ -30,6 +30,7 @@ import { resolveAgentsHome, resolveDshHome } from './env.js'
 import { isFile, readTextFile, writeFileAtomic } from './files.js'
 import { mirrorDir } from './mirror.js'
 import { adoptReasoningEffort } from './patch.js'
+import { loadSecrets, redact } from './secrets.js'
 
 /** Files mirrored from the profile directory; everything else stays local. */
 const PROFILE_FILES = ['package.json', 'cordis.patch.yml', 'cordis.yml', 'pnpm-lock.yaml', 'pnpm-workspace.yaml']
@@ -154,6 +155,12 @@ export function snapshot(options) {
   }
 
   // --- profile --------------------------------------------------------------
+  // A real value that the repository already stores as a placeholder is not a
+  // change to publish. Projecting redaction *before* the comparison keeps the
+  // plan honest — and means the plaintext never reaches the repository tree.
+  const secretEntries = loadSecrets(join(dshHome, 'secrets.env'))
+  /** Repository-form text: real secret values replaced by their placeholders. */
+  const forRepo = (text) => redact(text, secretEntries).text
   const profileWrites = []
   if (includeProfile && existsSync(profileDir)) {
     const previousPatch = readTextFile(join(repoProfile, 'cordis.patch.yml'))
@@ -175,9 +182,10 @@ export function snapshot(options) {
         // local machine state and must never travel.
         next = adoptReasoningEffort(next, previousPatch)
       }
+      const projected = forRepo(next)
       const current = readTextFile(join(repoProfile, name))
-      if (current !== next) {
-        profileWrites.push({ name, text: next })
+      if (current !== projected) {
+        profileWrites.push({ name, text: projected })
         changes.updated.push(`profiles/${profile}/${name}`)
         changes.files.push(`profiles/${profile}/${name}`)
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-syn-config",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "private": false,
   "description": "Cross-platform (macOS + Windows) DeepSeek Harness plugin that syncs DSH config — skills, profile settings, AGENTS.md — with a private dsh-config repository.",
   "type": "module",

package/scripts/verify.mjs

@@ -136,6 +136,22 @@ async function main() {
     for (const note of status.notes) console.log(`       note: ${note}`)
   }
 
+  // The repo copy of the profile manifest is what `apply.sh` restores from.
+  // If it still names another package, the next apply rolls this machine back
+  // to it — which is exactly how a working install "became unavailable" once.
+  const repoManifestPath = join(repoPath, 'profiles', profileName, 'package.json')
+  if (existsSync(repoManifestPath)) {
+    const repoManifest = JSON.parse(readFileSync(repoManifestPath, 'utf8'))
+    const liveSync = Object.keys(manifest.dependencies ?? {}).filter((dep) => dep.includes('syn-config') || dep.includes('config-sync'))
+    const repoSync = Object.keys(repoManifest.dependencies ?? {}).filter((dep) => dep.includes('syn-config') || dep.includes('config-sync'))
+    const agree = liveSync.length === 1 && repoSync.length === 1 && liveSync[0] === repoSync[0]
+    record(step(agree, 'repo copy agrees with this install', agree ? liveSync[0] : `live=${liveSync.join(',') || 'none'} repo=${repoSync.join(',') || 'none'}`))
+    if (!agree) {
+      console.log('       the next `apply.sh --yes` would overwrite this profile from the repo:')
+      console.log(`       fix: update ${repoManifestPath} (dependencies + dsh.profile.bundles), then push`)
+    }
+  }
+
   console.log('')
   if (failures.length > 0) {
     console.error(`[verify] FAILED — ${failures.length} check(s) did not pass.`)