v0.1.8 — Pre-Prompt Redaction for AI Optimization

English

• Pre-Prompt Redaction for AI Optimization (#68): Enforced host-side sanitization of all user-supplied input fields (title, observed, reproduction, expected, pluginName, errorStack, diagnostics, environment) in POST /dsh-issue-reporter/ai/optimize before constructing prompts or calling llm.stream, preventing sensitive tokens, credentials, paths, and LAN IPs from being sent to external LLM providers.
• Defensive Prompt Construction: Updated buildAiOptimizationPrompt() in lib/domain.js to automatically sanitize all parameters prior to assembly, guaranteeing safe prompts regardless of caller context.
• Structured Diagnostics Sanitization: Enhanced normalizeRedactInput in lib/domain.js to serialize nested objects and arrays into formatted JSON before applying redaction patterns, ensuring structured logs and diagnostic maps are scrubbed safely.
• Model Output & Heuristic Fallback Protection: Sanitized model responses before returning them to client, and maintained full redaction across the heuristic draft fallback.
• Design Contract: Codified prompt redaction invariant in docs/design/DESIGN.md.

---

Русский

• Санитизация входных данных перед вызовом LLM (#68): В эндпоинте POST /dsh-issue-reporter/ai/optimize обеспечена обязательная очистка всех пользовательских полей (title, observed, reproduction, expected, pluginName, errorStack, diagnostics, environment) через redactText до сборки промпта и отправки в llm.stream. Исключена утечка токенов, паролей, путей файловой системы и LAN IP внешним провайдерам моделей.
• Защитная сборка промпта: В функции buildAiOptimizationPrompt() (lib/domain.js) добавлена санитизация входных аргументов на стороне хоста.
• Поддержка структурированных диагностик: Функция normalizeRedactInput сериализует вложенные объекты и массивы в JSON перед применением правил REDACTIONS (включая поддержку Bearer <token> и исключение кавычек JSON).
• Очистка ответа модели и фоллбэка: Возвращаемый текст от LLM санитизируется перед отправкой клиенту; эвристический фоллбэк черновика гарантированно защищён от утечек.
• Дизайн-контракт: Инвариант очистки зафиксирован в docs/design/DESIGN.md.

---

中文

• AI 优化提示词预脱敏 (#68)：在 POST /dsh-issue-reporter/ai/optimize 路由中，在构建提示词和调用 llm.stream 之前，强制对所有用户提交的字段（title、observed、reproduction、expected、pluginName、errorStack、diagnostics、environment）执行 redactText 脱敏，防止敏感令牌、凭证、私有路径和局域网 IP 发送至外部 LLM 服务商。
• 防御性提示词构建：在 lib/domain.js 的 buildAiOptimizationPrompt() 中添加了宿主侧参数清洗，确保无论调用来源均生成安全的提示词文本。
• 结构化诊断脱敏：增强了 normalizeRedactInput，在应用脱敏规则前将嵌套对象与数组序列化为格式化 JSON，安全脱敏嵌套日志与环境诊断。
• 模型输出与回退保护：在返回给客户端前对模型响应进行脱敏，并在启发式草稿回退路径中保持完整的脱敏保护。
• 设计契约：在 docs/design/DESIGN.md 中固化了 AI 提示词脱敏规范。

---

Provenance: Gitea d4f892927cc45faad79ff604f18c90d20d09763b -> Mirror 588b46dd89c7d9869ba7cb55dce904f03181c739

v0.1.7 — Resilience, throttling, and route polish

English

Network Request Safety (#62)

• Enforced a default 15-second operation timeout (DEFAULT_TIMEOUT_MS = 15_000) across all GitHub and Gitea REST API calls in lib/github.js.
• Prevents DSH route handlers and worker threads from hanging indefinitely when remote forge connections stall or drop packets. Preserves caller-supplied signals.

Batch Status Throttling & Caching (#64)

• Throttled /dsh-issue-reporter/issues/batch-status requests to chunks of BATCH_CONCURRENCY = 4 (down from 20 parallel requests).
• Added an in-memory Map cache with a 60-second TTL and 100-entry capacity keyed by ${forge}:${owner}/${repo}#${number} to mitigate secondary rate limits and redundant round-trips.

Dead Code Pruning (#63)

• Removed the uncalled /dsh-issue-reporter/templates server route and unused fetchIssueTemplates method per YAGNI (ponytail), reducing bundle size and maintenance overhead.

Repository Hygiene (#65)

• Verified ancestor status and cleaned up 16 historical task worktrees and detached heads, codifying the worktree lifecycle in DESIGN.md.

---

中文

网络请求安全性 (#62)

• 在 lib/github.js 中为所有 GitHub 和 Gitea REST API 调用添加了默认 15 秒操作超时（DEFAULT_TIMEOUT_MS = 15_000）。
• 防止在网络连接中断或远端服务挂起时无限期阻塞 DSH 路由处理器。

批量状态限流与缓存 (#64)

• 将 /dsh-issue-reporter/issues/batch-status 中的并发请求限制为每批 4 个请求（从 20 个并发请求下调）。
• 添加内存 LRU/TTL 缓存（60 秒），防止触发次级速率限制和不必要的重复请求。

清理死代码 (#63)

• 根据 YAGNI 原则完全移除了未被调用的 /dsh-issue-reporter/templates 端点和 fetchIssueTemplates 方法，精简代码库。

仓库维护 (#65)

• 完成并清理了 16 个已合并的历史任务工作树，并在 DESIGN.md 中固化了工作树生命周期规范。

---

Русский

Безопасность сетевых вызовов (#62)

• Добавлен таймаут по умолчанию 15 секунд (DEFAULT_TIMEOUT_MS = 15_000) для всех вызовов к REST API GitHub и Gitea в lib/github.js.
• Исключено зависание обработчиков маршрутов и рабочих потоков DSH при сбоях сети или зависании удалённых сервисов.

Троттлинг и кэширование пакетного опроса (#64)

• Опрос статусов тикетов в /issues/batch-status ограничен параллельными батчами по 4 запроса (вместо 20 одновременных вызовов).
• Добавлен in-memory TTL-кэш (60 секунд) для защиты от вторичных rate limits и избыточных повторных запросов.

Удаление мёртвого кода (#63)

• Удалены неиспользуемый эндпоинт /templates и метод fetchIssueTemplates по правилу YAGNI (Ponytail).

Чистота репозитория (#65)

• Проведена верификация и очистка 16 устаревших worktree завершённых задач с закреплением инварианта в DESIGN.md.

---

Gitea source commit: f02f85d23d2e75077f6c3f84eabfd741163d69c2
Mirror sanitized commit: 35580cb5b72be8c1bcfcaf37037a4bd136955328

v0.1.6

Full Changelog: v0.1.2...v0.1.6

v0.1.5

Full Changelog: v0.1.2...v0.1.5

v0.1.4

Changelog

0.1.4

English

• Fixed native DSH theme-token compatibility and plugin inventory interactions.
• Fixed report-editor session-log loading and improved updater error diagnostics.
• Added regression coverage for plugin-card behavior, theme styling, session logs, and updater failures.

中文

• 修复原生 DSH 主题令牌兼容性及插件清单交互问题。
• 修复报告编辑器的会话日志加载，并改进更新器错误诊断。
• 增加回归测试，覆盖插件卡片、主题样式、会话日志和更新失败处理。

Русский

• Исправлена совместимость с токенами темы DSH и взаимодействие с каталогом плагинов.
• Исправлена загрузка журналов сессии в редакторе отчёта и улучшена диагностика ошибок обновления.
• Добавлены регрессионные проверки карточки плагина, темы, журналов сессии и ошибок обновления.

0.1.3

• Hardened privacy redaction and report-draft persistence.
• Failed closed when the DSH authorization guard is unavailable.
• Fixed plugin settings, route error handling, and native DSH styling.
• Refactored client and server routes into testable modules without changing the runtime bundle entry point.
• Excluded internal planning and design files from the published package.

0.1.2

• Registered autonomous report_issue tool in Cordis ctx.tools for agent-driven error triage and safe drafting (Refs: #28).

• Added AI-assisted draft optimization via ctx.llm / /dsh-issue-reporter/ai/optimize for reproduction steps and titles (Refs: #29).

• Added live session log snippet selector via /dsh-issue-reporter/logs with automated redaction (Refs: #30).

• Added issue watcher with batch status polling via /dsh-issue-reporter/issues/batch-status (Refs: #31).

• Added smart auto-labeling and component detection via /dsh-issue-reporter/labels (Refs: #32).

• Added canonical one-click plugin updater in settings card from npm registry with loopback validation (Refs: #33).

• Added stable plugin style marker, theme-token styling, native chevron fallback, and reactive LocaleFace subscription (Refs: #42, #43, #44, #46).

• Split client source and server route handlers into maintainable modules while preserving the single-loader runtime bundle (Ref: #45).

• Surface authorization and upstream failures instead of silently reporting empty labels, templates, or credentials; reserve fallback behavior for documented optional cases (Ref: #47).

0.1.1

• Brought reporter UI design and styling to the dsh-clinebot standard with ensureCss() and native DSH design tokens (Refs: #24).
• Added top header status capsule badges for GitHub auth, inventory count, and Node.js runtime (Refs: #24).
• Protected settings card with an isolated ErrorBoundary component (Refs: #24).
• Added navigation tabs: Catalog, Report Editor, My Reports, and Authorization (Refs: #25).
• Added real-time instant search and filter input across installed plugins (Refs: #25).
• Added dual-mode Write / Preview views for formatted markdown inspection (Refs: #25).
• Added Device Flow 1-click Copy Code action with confirmation feedback (Refs: #25).
• Added screenshot attachment via Ctrl+V clipboard paste and interactive drag-and-drop zone with thumbnail gallery (Refs: #19).
• Added automatic environment diagnostics collection and quick-reporting for failed plugins with captured stack traces (Refs: #20).
• Added closed issues search option for duplicate detection and GitHub Issue Templates inspection (Refs: #21).
• Added persistent tracking of submitted issues with live status checks in the 'My Reports' tab (Refs: #22).
• Added multi-forge support for local and self-hosted Gitea / Forgejo repositories (Refs: #23).

0.1.0

• Initial public-ready development baseline for Gitea issue #1.

0.1.0 release candidate

• Added a DSH settings card that discovers installed plugins and separates native @deepseek-ai/* packages from third-party packages.
• Made the full reporter header row and supported plugin rows clickable, without duplicate trailing action buttons.
• Added GitHub OAuth App Device Flow sign-in, refresh-token handling, connected-account state, and sign-out for account switching.
• Corrected Device Flow host and query-parameter handling so OAuth requests go to github.com instead of the REST API host.
• Added bounded redaction for tokens, credentials, private paths, credential-bearing URLs, and email addresses.
• Added structured report drafting, preview, duplicate search, explicit confirmation, and prefilled issue-form fallback.
• Added PNG, JPG, GIF, and WebP screenshots with count, per-file, total-size, MIME, extension, base64, temporary-file, and cleanup checks.
• Added the GitHub CLI attachment path for gh 2.99 or newer; screenshot reports require a GitHub OAuth App token or personal access token, while reports without screenshots use the GitHub REST API.
• Added typed GitHub API errors, same-origin route protection, sanitized status responses, and no-store responses.
• Publication is owner-approved; this entry describes the candidate for the public GitHub and npm release.

dsh-issue-reporter 0.1.3

English

• Strengthened privacy redaction and report-draft persistence.
• Authorization now fails closed when the DSH guard is unavailable.
• Fixed plugin settings, route error handling, and native DSH styling.
• Refactored client and server routes without changing the runtime bundle entry point.
• Verification: all 43 automated tests pass.

简体中文

• 加强隐私信息脱敏和问题报告草稿持久化。
• DSH 授权保护不可用时，系统现在会安全地拒绝请求。
• 修复插件设置、路由错误处理和 DSH 原生样式。
• 重构客户端与服务端路由，同时保持运行时 bundle 入口不变。
• 验证结果：43 项自动化测试全部通过。

Русский

• Усилена очистка приватных данных и сохранение черновиков отчётов.
• Если механизм авторизации DSH недоступен, запрос теперь безопасно отклоняется.
• Исправлены настройки плагина, обработка ошибок маршрутов и нативные стили DSH.
• Клиентские и серверные маршруты реорганизованы без изменения runtime entry point.
• Проверка: все 43 автоматических теста пройдены.

v0.1.2 — Autonomous Agent Tool, AI Optimizer, Ticket Watcher & One-Click Updater

@goodandready/dsh-issue-reporter v0.1.2

Autonomous Agent Tool, AI Optimization, Telemetry Logs, Live Ticket Watcher, Smart Auto-Labels, and Canonical One-Click Updater for DeepSeek Harness.

What's New in v0.1.2

• Autonomous Agent Tool (report_issue): Injects report_issue tool into ctx.tools enabling agentic self-reporting of runtime exceptions and plugin incompatibilities with privacy redaction and duplicate search.
• AI Summary & Reproduction Steps (ctx.llm): Action button in Compose tab rewrites unformatted errors into structured GitHub/Gitea bug reports with clear reproduction steps and expected/actual behaviors.
• Live Diagnostics & Session Log Selector: Interactive checklist in Diagnostics tab to attach sanitized, redacted log snippets directly from DSH session manager into issue drafts.
• Issue Watcher & Live Status Badges: History tab tracks upstream ticket lifecycle (Open / Closed / Comment counters) with batch status endpoint polling.
• Smart Auto-Labeling: Recommends and suggests repository labels based on detected failure context and component tags.
• Canonical One-Click Plugin Updater: Settings card integration using official loopback security check (x-dsh-plugin-update: 1) allowing painless updates directly from npm.

Compatibility & Safety

• Tested on DSH Core 0.1.5-rc.2.
• Validated on isolated MiniPC test server dsh-test-web.service (port 3082).
• Zero secrets, local paths, or internal hostnames included. Package bundle size: 50.7 kB (< 256 KiB gate).

v0.1.1: UI Overhaul, Diagnostics, Attachments, and Multi-Forge Support

Changelog

0.1.1

• Brought reporter UI design and styling to the dsh-clinebot standard with ensureCss() and native DSH design tokens (Refs: #24).
• Added top header status capsule badges for GitHub auth, inventory count, and Node.js runtime (Refs: #24).
• Protected settings card with an isolated ErrorBoundary component (Refs: #24).
• Added navigation tabs: Catalog, Report Editor, My Reports, and Authorization (Refs: #25).
• Added real-time instant search and filter input across installed plugins (Refs: #25).
• Added dual-mode Write / Preview views for formatted markdown inspection (Refs: #25).
• Added Device Flow 1-click Copy Code action with confirmation feedback (Refs: #25).
• Added screenshot attachment via Ctrl+V clipboard paste and interactive drag-and-drop zone with thumbnail gallery (Refs: #19).
• Added automatic environment diagnostics collection and quick-reporting for failed plugins with captured stack traces (Refs: #20).
• Added closed issues search option for duplicate detection and GitHub Issue Templates inspection (Refs: #21).
• Added persistent tracking of submitted issues with live status checks in the 'My Reports' tab (Refs: #22).
• Added multi-forge support for local and self-hosted Gitea / Forgejo repositories (Refs: #23).

0.1.0

• Initial public-ready development baseline for Gitea issue #1.

0.1.0 release candidate

• Added a DSH settings card that discovers installed plugins and separates native @deepseek-ai/* packages from third-party packages.
• Made the full reporter header row and supported plugin rows clickable, without duplicate trailing action buttons.
• Added GitHub OAuth App Device Flow sign-in, refresh-token handling, connected-account state, and sign-out for account switching.
• Corrected Device Flow host and query-parameter handling so OAuth requests go to github.com instead of the REST API host.
• Added bounded redaction for tokens, credentials, private paths, credential-bearing URLs, and email addresses.
• Added structured report drafting, preview, duplicate search, explicit confirmation, and prefilled issue-form fallback.
• Added PNG, JPG, GIF, and WebP screenshots with count, per-file, total-size, MIME, extension, base64, temporary-file, and cleanup checks.
• Added the GitHub CLI attachment path for gh 2.99 or newer; screenshot reports require a GitHub OAuth App token or personal access token, while reports without screenshots use the GitHub REST API.
• Added typed GitHub API errors, same-origin route protection, sanitized status responses, and no-store responses.
• Publication is owner-approved; this entry describes the candidate for the public GitHub and npm release.

v0.1.0

Highlights: separate collapsible Native DSH and Third-party plugin sections; row-click plugin details; guided Report a bug flow; GitHub OAuth Device Flow login, account display, logout and account switching; safe issue creation for public plugin repositories; PNG/JPEG/GIF/WebP screenshots with validation and gh CLI attachments. Verification: 19 automated tests passed; exact candidate passed isolated MiniPC install/UI smoke/cleanup and production acceptance. Screenshot attachments require a GitHub OAuth App token or personal access token; GitHub App user-to-server tokens are rejected.