misakanet 2.42.1 → 2.42.3

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "misakanet",
-  "version": "2.42.1",
+  "version": "2.42.3",
   "description": "Failure-memory network for AI coding agents: search evidence-rated failure lessons, submit new failures, and turn crashes into reusable knowledge.",
   "author": {
     "name": "Ikalus1988",

package/README.ja.md

@@ -335,10 +335,6 @@ jobs:
 
 → [入力と出力](docs/agents/external-usage.md) · [`actions: read` が省略できない理由](docs/agents/external-usage.md)
 
-### 8秒で見る
-
-![Search lesson demo](promotional/search%20lesson.gif)
-
 ## ドキュメント
 
 **ジャーニーを選んでください** — MisakaNet の使い方は、やりたいことに応じて異なります:

package/README.md

@@ -346,10 +346,6 @@ jobs:
 
 → [inputs and outputs](docs/agents/external-usage.md) · [why `actions: read` is not optional](docs/agents/external-usage.md)
 
-### See it in 8 seconds
-
-![Search lesson demo](promotional/search%20lesson.gif)
-
 ## Documentation
 
 **Choose your journey** — MisakaNet is useful in different ways depending on what you are trying to do:

package/index.js

@@ -109,6 +109,19 @@ export async function apply(ctx, config = {}) {
       if (options.failOnStartupError) throw error;
       // Expected on npm skill-only installs: the skill (SKILL.md) is the payload,
       // and a missing client must not take the whole profile down with it.
+      //
+      // Returning quietly is right for **boot** and wrong for **diagnosis**. `lib/client.js`
+      // mounts the browser half either way, so the observable result is a rendered MisakaNet
+      // panel whose tools never reach the agent — intake #2759 reported exactly that ("the
+      // sidebar is decorative", zero requests to misakanet.org) with nothing in the host log
+      // to separate "this profile never installed the client" from "this profile is broken".
+      // The other two guarded paths already log; this one was the only silent branch, and it is
+      // the branch that runs most often. Measured 2026-10-08 with the client unresolvable:
+      // `apply()` returned and `logger.warn` was called 0 times.
+      ctx?.logger?.warn?.(
+        'misakanet: @deepseek-ai/dsh-mcp-client is not resolvable, so the MCP tools are not '
+        + `mounted (the skill still works): ${error?.message ?? error}`,
+      );
       return;
     }
 

package/lib/client.js

@@ -41,10 +41,13 @@
  *
  * WHAT IT DELIBERATELY DOES NOT DO
  * --------------------------------
- * No lesson links (the site's directory slugs are truncated, so a URL cannot be built from an id), no
- * gap-report button (that belongs with the intake side, not with a satisfaction vote), and no
+ * No gap-report button (that belongs with the intake side, not with a satisfaction vote), and no
  * credentials — the endpoints are public, anonymous and rate-limited. And no auto-voting, ever.
  *
+ * Lesson links, by contrast, ARE built, in two places. A lesson's `id` is the slug its page is
+ * published under, so `/lessons/<id>` is a real address rather than a guess — and both
+ * call sites build it the same way (`MisakanetOverlayRow`, `MisakanetShellToast`).
+ *
  * KNOWN LIMITS (v1, stated rather than hidden)
  * --------------------------------------------
  * The verdict learns that a search happened from this module's own per-session memory, not from a host
@@ -191,7 +194,7 @@ window.__ModuleLoader__.load({
 			"panel.trust.checking": "checking…",
 			"panel.trust.unavailable": "unavailable",
 			"panel.trust.human": "human confirmation",
-			"panel.trust.none": "no level",
+			"panel.trust.noLevel": "no level",
 			"panel.trust.used": " · used ",
 			"panel.trust.footnote": "The level is the lesson's own stored evidence. The count is other people's confirmations, not yours: one makes the reuse event appear, the second is what agents read as E4.",
 			"panel.activity.session": "this session: ",
@@ -300,7 +303,7 @@ window.__ModuleLoader__.load({
 			"panel.trust.checking": "核验中……",
 			"panel.trust.unavailable": "不可用",
 			"panel.trust.human": "人工确认",
-			"panel.trust.none": "无等级",
+			"panel.trust.noLevel": "无等级",
 			"panel.trust.used": " · 已复用 ",
 			"panel.trust.footnote": "等级来自课程自己存的证据；计数是别人的确认，不是你的：前者让复用事件出现，后者才是 agent 读到的 E4。",
 			"panel.activity.session": "本会话：",
@@ -441,18 +444,30 @@ window.__ModuleLoader__.load({
 			if (sessionId) lastSessionId = sessionId;
 		}
 
+		/**
+		 * One shape for a session record, because two places can create one.
+		 *
+		 * `overlayOf()` creates a record too, and it used to build a smaller literal. Whoever created
+		 * the record first won, and the overlay always renders first — so the record that
+		 * `sessionLog()` found already there had no `sessionId`, and nothing ever added it. That is
+		 * not a warning, it is a dead end: every recorder ends in `notify(log.sessionId)`, which
+		 * returns immediately on a null id, so the panel and the toasts stopped repainting while the
+		 * numbers underneath them kept changing.
+		 */
+		function newSessionLog(sessionId) {
+			return {
+				sessionId: sessionId,
+				searches: [], intakes: [], votes: [],
+				lessons: Object.create(null),
+				// The verdict's own state: which message it was offered on, and whether it is spent.
+				shownFor: "", voted: false,
+			};
+		}
+
 		function sessionLog(sessionId) {
 			if (!sessionId) return null;
 			touchSession(sessionId);
-			if (!sessions[sessionId]) {
-				sessions[sessionId] = {
-					sessionId: sessionId,
-					searches: [], intakes: [], votes: [],
-					lessons: Object.create(null),
-					// The verdict's own state: which message it was offered on, and whether it is spent.
-					shownFor: "", voted: false,
-				};
-			}
+			if (!sessions[sessionId]) sessions[sessionId] = newSessionLog(sessionId);
 			return sessions[sessionId];
 		}
 
@@ -521,6 +536,12 @@ window.__ModuleLoader__.load({
 		 */
 		function playCue(cue) {
 			if (!cue || !voiceEnabled()) return false;
+			// The cue is the one string in this file that comes straight out of a response body and
+			// lands in a URL. Every cue the server names is `[a-z0-9-]` (`connect-success`,
+			// `pair-success`, `lesson-found`, `failure-warning`), so anything outside that shape is not a
+			// cue we ship: refuse it instead of letting it walk out of the path. Same-origin either
+			// way, so this is hardening and not a fix for a live defect.
+			if (!/^[a-z0-9-]+$/.test(String(cue))) return false;
 			try {
 				var audio = new window.Audio(API + "/assets/voice/" + cue + ".mp3");
 				var played = audio.play();
@@ -575,9 +596,11 @@ var DEFAULT_MCP_URL = "https://misakanet.org/mcp";
 
 		function overlayOf(sessionId) {
 			var log = sessions[sessionId];
-			if (!log) {
-				log = sessions[sessionId] = { searches: [], intakes: [], votes: [], lessons: {} };
-			}
+			// The overlay renders before any tool row does, so this is the record a session really
+			// starts with — same constructor as `sessionLog()`, and deliberately no
+			// `touchSession()`: merely mounting the card must not claim the frame-wide seats'
+			// "last session".
+			if (!log) log = sessions[sessionId] = newSessionLog(sessionId);
 			if (!log.overlay) {
 				log.overlay = { open: false, query: "", status: "idle", results: [], error: null };
 			}
@@ -610,7 +633,16 @@ var DEFAULT_MCP_URL = "https://misakanet.org/mcp";
 			}
 			setOverlay(sessionId, { open: true, query: query, status: "loading", results: [], error: null });
 			var timedOut = false;
-			var timer = setTimeout(function () { timedOut = true; }, OVERLAY_TIMEOUT_MS);
+			var timer = setTimeout(function () {
+				timedOut = true;
+				// The flag below silences a late answer, and that was the whole effect: the card sat on
+				// "Searching…" for good, with no error and nothing to retry, so
+				// `OVERLAY_TIMEOUT_MS` was inert. Someone is looking at this card, so a stalled request
+				// has to land in the same state a failed one does — `setOverlay` draws the
+				// reason through `overlay.failed`, which already knows how to say it.
+				setOverlay(sessionId, { status: "error", results: [],
+					error: "no answer after " + Math.round(OVERLAY_TIMEOUT_MS / 1000) + "s" });
+			}, OVERLAY_TIMEOUT_MS);
 			var url = SEARCH_ENDPOINT + "?q=" + encodeURIComponent(query) + "&limit=" + OVERLAY_LIMIT;
 			fetch(url, { headers: { accept: "application/json" } })
 				.then(function (response) {
@@ -734,8 +766,8 @@ var DEFAULT_MCP_URL = "https://misakanet.org/mcp";
 				log.lessons[entry.lessonId].count += 1;
 				log.lessons[entry.lessonId].last = entry.at;
 			}
-			return entry;
 			notifyShell();
+			return entry;
 		}
 
 		/** Record a vote and retire the sighting it answered. */
@@ -766,7 +798,12 @@ var DEFAULT_MCP_URL = "https://misakanet.org/mcp";
 		function intakeState(payload) {
 			if (!payload || typeof payload !== "object") return "unknown";
 			if (payload.converted) return "converted";
-			if (payload.answered) return T("intake.answered");
+			// An ASCII state id, like every other state here. It used to return the localized
+			// `T("intake.answered")` instead, which the panel then compared against the literal
+			// `"answered"`: on a Chinese interface an answered report never matched, so it stayed in
+			// the pending count with the "we will re-check this" line attached. The copy is the
+			// labels' job; see `MisakanetIntakeRow` and the panel.
+			if (payload.answered) return "answered";
 			if (payload.already_have) return "already_have";
 			if (payload.pending || payload.duplicate || payload.submitted) return "pending";
 			return "unknown";
@@ -805,8 +842,8 @@ var DEFAULT_MCP_URL = "https://misakanet.org/mcp";
 			bumpStat("reportsFiled");
 			if (entry.state === "converted") bumpStat("reportsConverted");
 			notify(log.sessionId);
-			return entry;
 			notifyShell();
+			return entry;
 		}
 
 		/** Concatenate the text blocks of a result node; "" when there are none. */
@@ -1071,7 +1108,7 @@ var DEFAULT_MCP_URL = "https://misakanet.org/mcp";
 			var labels = {
 				filing: "filing…",
 				pending: "filed — waiting for a maintainer",
-				answered: "answered",
+				answered: T("intake.answered"),
 				already_have: "not filed — the corpus already covers this",
 				converted: "your report is cited by a lesson",
 				unknown: T("intake.submitted"),
@@ -1220,7 +1257,7 @@ var DEFAULT_MCP_URL = "https://misakanet.org/mcp";
 			} else {
 				rows.push(h("div", { key: "s2r" }, intakes.slice().reverse().map(function (entry) {
 					var labels = {
-						filing: "filing", pending: T("intake.waiting"), answered: "answered",
+						filing: "filing", pending: T("intake.waiting"), answered: T("intake.answered"),
 						already_have: T("intake.alreadyHave"), converted: T("intake.cited"), unknown: "submitted",
 					};
 					var issue = String(entry.issue || "").replace(/^issue-/, "#").replace(/^.*\/issues\//, "#");
@@ -1250,7 +1287,7 @@ var DEFAULT_MCP_URL = "https://misakanet.org/mcp";
 							: count(confirmations, T("panel.trust.human")) + (confirmations >= 2 ? " → E4" : ""));
 					return h("div", { key: "l" + lesson.lessonId, style: { borderTop: "1px solid " + MUTED, padding: "4px 0" } },
 						h("span", {}, lesson.title || lesson.lessonId),
-						h("span", { style: DIM }, "  " + (lesson.evidence || T("panel.trust.none")) + " · " + counted +
+						h("span", { style: DIM }, "  " + (lesson.evidence || T("panel.trust.noLevel")) + " · " + counted +
 							T("panel.trust.used") + lesson.count + "× · " + timeRange(lesson)));
 				})));
 			}
@@ -1325,7 +1362,9 @@ var DEFAULT_MCP_URL = "https://misakanet.org/mcp";
 		/** One result row: the title, where it came from, and a link to read it. */
 		function MisakanetOverlayRow(result) {
 			var path = String(result && result.id ? result.id : "");
-			var href = path ? "https://misakanet.org/lessons/" + path : "https://misakanet.org/";
+			// Encoded, like the shell toast at the other call site: a no-op for the `[a-z0-9-]` slugs
+			// the server hands out, and a correct URL for anything else.
+			var href = path ? "https://misakanet.org/lessons/" + encodeURIComponent(path) : "https://misakanet.org/";
 			return h("a", {
 				href: href, target: "_blank", rel: "noreferrer",
 				style: { display: "block", padding: "7px 8px", borderRadius: "8px", textDecoration: "none",
@@ -1469,7 +1508,10 @@ var DEFAULT_MCP_URL = "https://misakanet.org/mcp";
 				var searched = log.searches ? log.searches.length : 0;
 				var withLesson = log.searches ? log.searches.filter(function (s) { return s.lessonId; }).length : 0;
 				var ids = log.searches ? log.searches.map(function (s) { return s.lessonId; }).filter(Boolean) : [];
-				var helpful = log.votes ? log.votes.filter(function (v) { return v && v.helpful; }).length : 0;
+				// `recordVote` stores the verdict under `kind`; filtering a `helpful` field nothing writes
+				// made this line print 0 for every session, next to the panel's own count of the same
+				// votes. Same expression the panel uses.
+				var helpful = log.votes ? log.votes.filter(function (v) { return v && v.kind === "helpful"; }).length : 0;
 				var overlay = log.overlay || {};
 				var lines = [
 					"MisakaNet — this session",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "misakanet",
-  "version": "2.42.1",
+  "version": "2.42.3",
   "license": "Apache-2.0",
   "description": "MisakaNet failure-memory skill — evidence-rated failure lessons for AI agents. DSH bundle: registers the MCP tools as mcp__misakanet__* (misakanet_search/get_lesson/…), served by the public Streamable HTTP endpoint https://misakanet.org/mcp — live tools from an npm install, in any profile, with no local python. A profile that prefers the repo's own stdio server can override the bundle row.",
   "icon": "icon.svg",
@@ -83,7 +83,7 @@
     "wrangler": "^4.146.0"
   },
   "overrides": {
-    "sharp": "0.35.4"
+    "sharp": "0.35.5"
   },
   "main": "index.js",
   "exports": {