dsh-followup-todo

Overview

DSH plugin: a cross-session follow-up todo list for the human. The agent records items you asked to handle later via todo_add/todo_list/todo_done/todo_archive, each carrying P0-P3 priority plus a structured handoff (context + inject) so a brand-new session can pick it up without re-reading the old conversation. Host persists to ~/.dsh/followup-todos-.json and serves /followup-todos HTTP routes for the browser half.

README / EN

Package documentation

Registry summary

DSH plugin: a cross-session follow-up todo list for the human. The agent records items you asked to handle later via todo_add/todo_list/todo_done/todo_archive, each carrying P0-P3 priority plus a structured handoff (context + inject) so a brand-new session can pick it up without re-reading the old conversation. Host persists to ~/.dsh/followup-todos-.json and serves /followup-todos HTTP routes for the browser half.

dsh.pub verifies the pinned bundle contract, runtime facts, and distribution semantics. The complete README remains in the source repository.

Read the full README on GitHub

LIMITATIONS

Known limitations

- **HTTP 接口做浏览器鉴权。** `/followup-todos/*` 由 dsh 的 webServer 注册，路由入口先调用 `connection.requestRejection(req)`：未通过鉴权的请求直接返回 401 / 403，不进入任何读写逻辑。已实测：不带会话凭据的裸请求被拒（`401 unauthorized`），浏览器内的同源请求正常通过。 - `connection` 服务缺席时（老版本 DSH）退化为不拦截，此时任何能访问到该端口的客户端都能读写任意工作区的待办。默认监听 `127.0.0.1` 时风险有限；**如果你把 dsh web 暴露到非回环地址，请自行再加一层访问控制。** - `ws` 参数直接取自 query，但文件名经过 base64url 编码，因此不存在路径穿越。 - 列表靠 3 秒轮询刷新（一个全局轮询覆盖所有已登记的工作区分片），不是实时推送；多窗口同时打开时可能有短暂的显示延迟。 - 界面文案走 dsh 的 locale 服务，内置中英两套字典，跟随客户端语言切换。 - **头部按钮**挂在 `conversation.session.header.utilities`，只在已打开的会话里渲染；空白新会话首页看不到它，这是插槽本身的行为。**输入框上方的待办条**挂在 `conversation.input.dock`，待办为空时不渲染。 - 仅实现了 web 端界面。headless profile 里工具可用，但没有 UI。

dsh-followup-todo