dsh-syn-config 0.8.2 → 0.8.3

package/lib/core/doctor.js

@@ -41,6 +41,59 @@ function section(id, title, items, extra = {}) {
   return { id, title, status, items, ...extra }
 }
 
+/**
+ * Semantic fingerprint of a plugin manifest.
+ *
+ * `link:` specs point at the same checkout from different bases on different
+ * machines (`/Users/me/x` vs `../../../x`), so only the final path segment is
+ * meaningful. Everything else compares by value.
+ *
+ * @param {string} text
+ * @returns {{ deps: Record<string, string>, bundles: string[] }}
+ */
+function manifestFingerprint(text) {
+  const parsed = JSON.parse(text)
+  const normalized = {}
+  for (const [name, spec] of Object.entries(parsed.dependencies ?? {})) {
+    const value = typeof spec === 'string' && spec.startsWith('link:')
+      ? `link:${spec.split(/[\\/]/u).filter((segment) => segment !== '').pop() ?? ''}`
+      : String(spec)
+    normalized[name] = value
+  }
+  const bundles = [...(parsed.dsh?.profile?.bundles ?? [])].map(String).sort()
+  return { deps: normalized, bundles }
+}
+
+/**
+ * Names of manifest entries that really differ between live and repository.
+ *
+ * @param {string} liveText
+ * @param {string} repoText
+ * @returns {string[]} human-readable differences, empty when equivalent
+ */
+export function manifestDrift(liveText, repoText) {
+  let live
+  let repo
+  try {
+    live = manifestFingerprint(liveText)
+    repo = manifestFingerprint(repoText)
+  } catch {
+    return ['清单无法解析']
+  }
+  const drift = []
+  for (const name of new Set([...Object.keys(live.deps), ...Object.keys(repo.deps)])) {
+    if (live.deps[name] !== repo.deps[name]) {
+      drift.push(`${name} ${live.deps[name] ?? '(缺)'} ↔ ${repo.deps[name] ?? '(缺)'}`)
+    }
+  }
+  if (live.bundles.join(',') !== repo.bundles.join(',')) {
+    const onlyLive = live.bundles.filter((x) => !repo.bundles.includes(x))
+    const onlyRepo = repo.bundles.filter((x) => !live.bundles.includes(x))
+    drift.push(`bundle ${[...onlyLive.map((x) => `+${x}`), ...onlyRepo.map((x) => `-${x}`)].join(' ') || '顺序不同'}`)
+  }
+  return drift
+}
+
 const sleep = (ms) => new Promise((done) => setTimeout(done, ms))
 
 /**
@@ -325,10 +378,10 @@ export async function runDoctor(options) {
     const liveManifestText = readTextFile(liveManifest)
     const repoManifestText = readTextFile(repoManifest)
     if (liveManifestText !== null && repoManifestText !== null) {
-      const same = liveManifestText.replace(/\s+$/u, '') === repoManifestText.replace(/\s+$/u, '')
-      items.push(same
-        ? item('ok', 'package.json（插件清单）与仓库一致')
-        : item('warn', 'package.json（插件清单）与仓库不同（装/卸了插件：sync 推送 / update 拉取）'))
+      const drift = manifestDrift(liveManifestText, repoManifestText)
+      items.push(drift.length === 0
+        ? item('ok', 'package.json（插件清单）与仓库一致（link: 的绝对/相对写法不参与比较）')
+        : item('warn', `package.json（插件清单）与仓库不同：${drift.slice(0, 5).join('，')}（装/卸了插件：sync 推送 / update 拉取）`))
       try {
         const parsed = JSON.parse(liveManifestText)
         const dependencies = Object.keys(parsed.dependencies ?? {})

package/lib/core/pack.js

@@ -30,6 +30,7 @@ import { resolveAgentsHome, resolveDshHome } from './env.js'
 import { isFile, readTextFile, writeFileAtomic } from './files.js'
 import { mirrorDir } from './mirror.js'
 import { adoptReasoningEffort } from './patch.js'
+import { loadSecrets, redact } from './secrets.js'
 
 /** Files mirrored from the profile directory; everything else stays local. */
 const PROFILE_FILES = ['package.json', 'cordis.patch.yml', 'cordis.yml', 'pnpm-lock.yaml', 'pnpm-workspace.yaml']
@@ -154,6 +155,12 @@ export function snapshot(options) {
   }
 
   // --- profile --------------------------------------------------------------
+  // A real value that the repository already stores as a placeholder is not a
+  // change to publish. Projecting redaction *before* the comparison keeps the
+  // plan honest — and means the plaintext never reaches the repository tree.
+  const secretEntries = loadSecrets(join(dshHome, 'secrets.env'))
+  /** Repository-form text: real secret values replaced by their placeholders. */
+  const forRepo = (text) => redact(text, secretEntries).text
   const profileWrites = []
   if (includeProfile && existsSync(profileDir)) {
     const previousPatch = readTextFile(join(repoProfile, 'cordis.patch.yml'))
@@ -175,9 +182,10 @@ export function snapshot(options) {
         // local machine state and must never travel.
         next = adoptReasoningEffort(next, previousPatch)
       }
+      const projected = forRepo(next)
       const current = readTextFile(join(repoProfile, name))
-      if (current !== next) {
-        profileWrites.push({ name, text: next })
+      if (current !== projected) {
+        profileWrites.push({ name, text: projected })
         changes.updated.push(`profiles/${profile}/${name}`)
         changes.files.push(`profiles/${profile}/${name}`)
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-syn-config",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "private": false,
   "description": "Cross-platform (macOS + Windows) DeepSeek Harness plugin that syncs DSH config — skills, profile settings, AGENTS.md — with a private dsh-config repository.",
   "type": "module",