@dsh-fly/dsh-plugin-fly-mode 0.0.0-stage → 0.1.2

package/tools/dsh-plugin-fly-diag/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "dsh-plugin-fly-diag",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "wifi.js"
+  ],
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-shell": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.2.0-rc.2"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ethanchen669/dsh-fly.git",
+    "directory": "packages/dsh-plugin-fly-diag"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/"
+  }
+}

package/tools/dsh-plugin-fly-diag/wifi.js

@@ -0,0 +1,402 @@
+/**
+ * Link-layer report parsing for the `fly-diag` tool face.
+ *
+ * Pure functions only — no I/O, no `ctx`, no clock, no `system_profiler` call.
+ * The collector commands live in `index.js`; this module turns their stdout into
+ * numbers. The split exists for one reason: the tool face is only as honest as
+ * this file, and this file can be pinned against captured fixtures
+ * (`scripts/tests/wifi-report.spec.mjs`) instead of against whatever radio the
+ * host running the gate happens to have.
+ *
+ * ## The `0 dBm` trap — why signal parsing is stricter than it looks
+ *
+ * A first revision of this logic lived in a shell script and treated any value
+ * that was not a literal `-` as a number:
+ *
+ *     s = ($4 == "-") ? -999 : $4 + 0
+ *
+ * Two shapes reach that expression as `0`:
+ *
+ *   · `system_profiler` prints **no `Signal / Noise` line at all** for many
+ *     entries. In the captured fixture below, 15 of 16 neighbour entries have no
+ *     such line.
+ *   · When it cannot measure, it can print `0 dBm / 0 dBm`.
+ *
+ * Either way the channel map rendered `ch36 80MHz 0 dBm` — the strongest
+ * possible reading, invented out of the *absence* of a measurement. So
+ * `parseSignalDbm()` returns `null` for empty, `-`, non-numeric text, **and for
+ * `0`**: 0 dBm is 1 mW at the antenna, no consumer AP ever measures it, and
+ * macOS uses it as the "no reading" placeholder. `0` is a sentinel here, not a
+ * measurement. Every consumer must treat `null` as "unknown" and never as 0.
+ *
+ * @module dsh-plugin-fly-diag/wifi
+ */
+
+/** The one "we have no measurement" value. Deliberately `null`, never `0`. */
+const UNKNOWN = null
+
+/**
+ * Parse one half of a `Signal / Noise: -58 dBm / -94 dBm` line.
+ *
+ * @param raw - field text such as `-58 dBm`, `0 dBm`, `-`, or `''`.
+ * @returns dBm as a number, or `null` when there is no real measurement.
+ */
+export function parseSignalDbm(raw) {
+  const text = String(raw ?? '').trim()
+  if (text === '' || text === '-') return UNKNOWN
+  const match = /^(-?\d+(?:\.\d+)?)\s*dBm$/u.exec(text)
+  if (match === null) return UNKNOWN
+  const value = Number(match[1])
+  if (!Number.isFinite(value) || value === 0) return UNKNOWN
+  return value
+}
+
+/**
+ * Parse `Channel: 149 (5GHz, 80MHz)`.
+ *
+ * The number is the **primary** 20MHz channel, not the block centre: a radio
+ * reporting `149 (5GHz, 80MHz)` occupies 149–161, and one reporting
+ * `40 (5GHz, 80MHz)` occupies the *same* 149-free block 36–48. Reading these as
+ * three different "channels" is how a channel map ends up claiming four
+ * neighbours where there is really one block.
+ *
+ * @param raw - the field text after `Channel:`.
+ * @returns `{ channel, band, widthMhz }`, or `null` when unparseable.
+ */
+export function parseChannelLine(raw) {
+  const match = /^(\d+)\s*\(([^,]+),\s*(\d+)\s*MHz\)$/u.exec(String(raw ?? '').trim())
+  if (match === null) return null
+  return { channel: Number(match[1]), band: match[2].trim(), widthMhz: Number(match[3]) }
+}
+
+/**
+ * Parse `Supported Channels: 1 (2GHz), 36 (5GHz), …`.
+ *
+ * This list is a regulatory answer that macOS does **not** redact, so the
+ * feasible-channel arithmetic below is derived from the host's own report
+ * instead of from a hardcoded country table.
+ *
+ * @param raw - the field text after `Supported Channels:`.
+ * @returns array of `{ channel, band }`, in report order.
+ */
+export function parseSupportedChannels(raw) {
+  return [...String(raw ?? '').matchAll(/(\d+)\s*\(([^)]+)\)/gu)]
+    .map(match => ({ channel: Number(match[1]), band: match[2].trim() }))
+}
+
+/**
+ * Normalize `802.11 a/b/g/n/ac/ax` into full mode names.
+ *
+ * macOS puts the family prefix on the first token only, so a naive
+ * `split('/')` yields `['802.11 a', 'b', 'g', 'n', 'ac', 'ax']` and every
+ * `includes('802.11ax')` test — and every capability claim built on it — fails
+ * while looking like the host simply does not support the mode.
+ *
+ * @param raw - the field text after `Supported PHY Modes:`.
+ * @returns mode names such as `['802.11a', '802.11b', '802.11ax']`.
+ */
+export function normalizePhyModes(raw) {
+  const parts = String(raw ?? '').split('/').map(part => part.trim()).filter(Boolean)
+  if (parts.length === 0) return []
+  const head = /^(802\.11\s*)([A-Za-z]+)$/u.exec(parts[0])
+  if (head === null) return parts
+  const family = head[1].replace(/\s+/gu, '')
+  return [`${family}${head[2]}`, ...parts.slice(1).map(part => `${family}${part}`)]
+}
+
+/**
+ * `Key: value` lines inside a network entry or an interface block.
+ *
+ * The key class **must** allow `/`: the field that carries the signal is spelled
+ * `Signal / Noise`, and a key class of `[A-Za-z ]` silently fails to match it —
+ * which yields `rssiDbm: null` for every entry in the report. That failure is
+ * indistinguishable from "this host has no measurements", i.e. it renders as a
+ * confidently empty report. Only a fixture asserting the concrete -58 / -94
+ * values catches it (see `scripts/tests/wifi-report.spec.mjs`).
+ */
+const FIELD = /^\s*([A-Za-z][A-Za-z /]*?):\s*(.*)$/u
+
+/**
+ * Parse one network entry (the indented lines under a `<redacted>:` heading).
+ *
+ * Every absent field becomes `null`. A missing `Transmit Rate` must never
+ * surface as `0`, for the same reason a missing signal must not: the renderer
+ * cannot tell the difference after the fact.
+ *
+ * @param lines - the entry's raw lines, headed by no `<redacted>:` line itself.
+ * @returns the normalized entry record.
+ */
+export function parseNetworkEntry(lines) {
+  const fields = new Map()
+  for (const line of lines) {
+    const match = FIELD.exec(line)
+    if (match !== null) fields.set(match[1].trim(), match[2].trim())
+  }
+
+  const channel = parseChannelLine(fields.get('Channel'))
+  const signal = fields.get('Signal / Noise')
+  const halves = signal === undefined ? [] : signal.split('/').map(part => part.trim())
+  // A beacon with no signal line is the common case, not the exception: index 0
+  // and 1 are both absent rather than defaulted, so `snrDb` stays null too.
+  const rssi = parseSignalDbm(halves[0])
+  const noise = parseSignalDbm(halves[1])
+  const rate = Number(fields.get('Transmit Rate'))
+  const mcs = Number(fields.get('MCS Index'))
+
+  return {
+    phy: fields.get('PHY Mode') ?? null,
+    channel: channel?.channel ?? null,
+    band: channel?.band ?? null,
+    widthMhz: channel?.widthMhz ?? null,
+    security: fields.get('Security') ?? null,
+    rssiDbm: rssi,
+    noiseDbm: noise,
+    snrDb: rssi === null || noise === null ? null : rssi - noise,
+    transmitRateMbps: Number.isFinite(rate) && rate > 0 ? rate : null,
+    mcs: Number.isFinite(mcs) ? mcs : null,
+  }
+}
+
+/**
+ * Parse a whole `system_profiler SPAirPortDataType` report.
+ *
+ * Structure it walks: `Interfaces:` → one `<ifname>:` block per interface →
+ * `Current Network Information:` and `Other Local Wi-Fi Networks:` → one
+ * `<redacted>:` entry each. Indentation is **not** trusted: the real fixture
+ * contains a driver banner at column 0 in the middle of the `en0` block, so the
+ * walker keys off the section headings and the numeric interface names instead
+ * of off indentation depth.
+ *
+ * @param text - raw stdout of `system_profiler SPAirPortDataType`.
+ * @returns `{ interfaces }`, each with `current` (or null) and `neighbors`.
+ */
+export function parseWifiReport(text) {
+  const interfaces = []
+  let iface = null
+  let section = null
+  let entry = null
+
+  const closeEntry = () => {
+    if (entry === null) return
+    const parsed = parseNetworkEntry(entry)
+    if (section === 'neighbors') iface.neighbors.push(parsed)
+    else if (section === 'current') iface.current = parsed
+    entry = null
+  }
+  const closeInterface = () => {
+    closeEntry()
+    if (iface !== null) interfaces.push(iface)
+    iface = null
+    section = null
+  }
+
+  for (const line of String(text ?? '').split('\n')) {
+    if (/^\s*Current Network Information:\s*$/u.test(line)) {
+      closeEntry()
+      section = 'current'
+      continue
+    }
+    if (/^\s*Other Local Wi-Fi Networks:\s*$/u.test(line)) {
+      closeEntry()
+      section = 'neighbors'
+      continue
+    }
+    // `        en0:` / `        awdl0:` — a bare interface heading.
+    const heading = /^\s{4,10}([A-Za-z]+\d+):\s*$/u.exec(line)
+    if (heading !== null) {
+      closeInterface()
+      iface = {
+        name: heading[1],
+        status: null,
+        countryCode: null,
+        phyModes: [],
+        supportedChannels: [],
+        current: null,
+        neighbors: [],
+      }
+      continue
+    }
+    if (iface === null) continue
+
+    if (section === null) {
+      const field = FIELD.exec(line)
+      if (field === null) continue
+      const key = field[1].trim()
+      const value = field[2].trim()
+      if (key === 'Status') iface.status = value
+      else if (key === 'Country Code') iface.countryCode = value
+      else if (key === 'Supported PHY Modes') iface.phyModes = normalizePhyModes(value)
+      else if (key === 'Supported Channels') iface.supportedChannels = parseSupportedChannels(value)
+      continue
+    }
+
+    if (/^\s*<redacted>:\s*$/u.test(line)) {
+      closeEntry()
+      entry = []
+      continue
+    }
+    if (entry !== null) entry.push(line)
+  }
+  closeInterface()
+
+  return { interfaces }
+}
+
+/**
+ * The 80MHz blocks 802.11 defines across the 5GHz band, and whether each one
+ * contains DFS channels (which force a 60-second channel-availability check and
+ * let a radar hit vacate the channel).
+ *
+ * The 5.8GHz band spans 5725–5850MHz = 125MHz, so `149+153+157+161` is the only
+ * block that fits there and **160MHz cannot exist in 5.8GHz at all** — that is
+ * arithmetic, not a regulatory opinion. 160MHz therefore requires two
+ * *adjacent* 80MHz blocks, which in this table means 36–48 + 52–64.
+ */
+export const BLOCKS_5GHZ = Object.freeze([
+  Object.freeze({ primary: 36, channels: Object.freeze([36, 40, 44, 48]), dfs: false }),
+  Object.freeze({ primary: 52, channels: Object.freeze([52, 56, 60, 64]), dfs: true }),
+  Object.freeze({ primary: 100, channels: Object.freeze([100, 104, 108, 112]), dfs: true }),
+  Object.freeze({ primary: 116, channels: Object.freeze([116, 120, 124, 128]), dfs: true }),
+  Object.freeze({ primary: 132, channels: Object.freeze([132, 136, 140, 144]), dfs: true }),
+  Object.freeze({ primary: 149, channels: Object.freeze([149, 153, 157, 161]), dfs: false }),
+])
+
+/** The 80MHz block a primary channel belongs to, or `null`. */
+export function blockOf(channel) {
+  if (!Number.isFinite(channel)) return null
+  return BLOCKS_5GHZ.find(block => block.channels.includes(channel)) ?? null
+}
+
+/**
+ * Collapse a neighbour list into distinct occupancy, one row per
+ * (band, width, primary channel).
+ *
+ * Deduplication must **not** include RSSI: a single AP whose signal wobbles
+ * 1–2 dB between scan rounds otherwise counts as several APs. Conversely the
+ * merge must prefer a *known* signal over an unknown one, because most beacons
+ * carry no signal line at all — a naive `Math.max` over `null → 0` would make
+ * the unknown entries win every time.
+ *
+ * @param neighbors - entries from `parseWifiReport`.
+ * @returns rows sorted by band then channel, each with `samples` and `bestRssiDbm`.
+ */
+export function collapseNeighbors(neighbors) {
+  const byKey = new Map()
+  for (const entry of neighbors) {
+    if (entry.channel === null) continue
+    const key = `${entry.band}|${entry.widthMhz}|${entry.channel}`
+    const row = byKey.get(key) ?? { band: entry.band, widthMhz: entry.widthMhz, channel: entry.channel, samples: 0, bestRssiDbm: UNKNOWN }
+    row.samples += 1
+    if (entry.rssiDbm !== null && (row.bestRssiDbm === null || entry.rssiDbm > row.bestRssiDbm)) {
+      row.bestRssiDbm = entry.rssiDbm
+    }
+    byKey.set(key, row)
+  }
+  return [...byKey.values()].sort((a, b) => (a.band === b.band ? a.channel - b.channel : String(a.band).localeCompare(String(b.band))))
+}
+
+/**
+ * Derive the channel plan a host can actually use, from its own report.
+ *
+ * Answers the questions that decide whether a wider channel is available at all:
+ * which 80MHz blocks the regulatory domain permits, which of them neighbours are
+ * already sitting on, and whether a 160MHz channel exists (it needs two adjacent
+ * permitted blocks, so in CN that is 36–64 *including* DFS 52–64 — the only
+ * option, with the mandatory radar check that implies).
+ *
+ * @param report - output of `parseWifiReport`.
+ * @param options.band - band to analyse, default `5GHz`.
+ * @returns block table plus the 160MHz verdict.
+ */
+export function summarizeChannels(report, { band = '5GHz' } = {}) {
+  const iface = report.interfaces.find(candidate => candidate.supportedChannels.some(entry => entry.band === band))
+    ?? report.interfaces[0]
+  const supported = new Set((iface?.supportedChannels ?? []).filter(entry => entry.band === band).map(entry => entry.channel))
+  const neighbors = collapseNeighbors(report.interfaces.flatMap(candidate => candidate.neighbors))
+    .filter(entry => entry.band === band)
+
+  const blocks = BLOCKS_5GHZ.map(block => {
+    // An 80MHz block is usable only when the domain grants every 20MHz channel
+    // in it; a country table that stops at 48 cannot carry 52–64.
+    const permissive = block.channels.every(channel => supported.has(channel))
+    const occupants = neighbors.filter(entry => block.channels.includes(entry.channel))
+    return {
+      primary: block.primary,
+      channels: [...block.channels],
+      span: `${block.channels[0]}-${block.channels[block.channels.length - 1]}`,
+      dfs: block.dfs,
+      permitted: permissive,
+      occupants,
+      occupied: occupants.length,
+    }
+  })
+
+  // A 160MHz channel is exactly two adjacent 80MHz blocks, so it exists only if
+  // the domain permits both halves. In CN that is 36-48 + 52-64 = 36-64, and the
+  // DFS half is unavoidable — which is the whole argument against reaching for
+  // 160MHz on a 5.8GHz-only-wide deployment.
+  const permitted = blocks.filter(block => block.permitted)
+  let pair = null
+  for (let index = 0; index + 1 < permitted.length; index += 1) {
+    const first = permitted[index]
+    const second = permitted[index + 1]
+    if (second.channels[0] === first.channels[3] + 4) {
+      pair = { first, second }
+      break
+    }
+  }
+
+  return {
+    band,
+    interfaceName: iface?.name ?? null,
+    permittedChannels: [...supported].sort((a, b) => a - b),
+    blocks,
+    width160: pair === null
+      ? { possible: false, span: null, includesDfs: false, reason: `${band} 里没有两个相邻且被允许的 80MHz 块` }
+      : {
+          possible: true,
+          span: `${pair.first.channels[0]}-${pair.second.channels[3]}`,
+          includesDfs: pair.first.dfs || pair.second.dfs,
+          reason: '160MHz 必须跨两个相邻 80MHz 块，其中含 DFS 段：需 60s CAC 静默期，且雷达命中即被迫换道',
+        },
+    widestVerdict: pair === null ? '80' : '160',
+  }
+}
+
+/**
+ * Parse the summary tail of `ping -q` (`round-trip min/avg/max/stddev = …`).
+ *
+ * @param text - captured stdout of `ping -c N -i I -q <host>`.
+ * @returns `{ transmitted, received, lossPercent, minMs, avgMs, maxMs, stddevMs }`
+ *   with `null` for every statistic ping did not print (a 100% loss run prints
+ *   no round-trip line at all — reporting `0` there is the same invented-value
+ *   bug as the 0 dBm one).
+ */
+export function parsePingStats(text) {
+  const out = String(text ?? '')
+  const counts = /(\d+)\s+packets transmitted,\s*(\d+)\s+(?:packets )?received/u.exec(out)
+  const timing = /=\s*([\d.]+)\/([\d.]+)\/([\d.]+)\/([\d.]+)\s*ms/u.exec(out)
+  const loss = /([\d.]+)%\s*packet loss/u.exec(out)
+  const number = value => (value === undefined ? null : Number(value))
+  return {
+    transmitted: counts === null ? null : Number(counts[1]),
+    received: counts === null ? null : Number(counts[2]),
+    lossPercent: loss === null ? null : Number(loss[1]),
+    minMs: timing === null ? null : number(timing[1]),
+    avgMs: timing === null ? null : number(timing[2]),
+    maxMs: timing === null ? null : number(timing[3]),
+    stddevMs: timing === null ? null : number(timing[4]),
+  }
+}
+
+/**
+ * Parse a single `curl -w` speed sample.
+ *
+ * @param raw - the `%{speed_download}` value in bytes/second.
+ * @returns bytes/second, or `null` when curl reported nothing (a failed
+ *   transfer must not read as "0 B/s, successfully measured").
+ */
+export function parseSpeedSample(raw) {
+  const value = Number(String(raw ?? '').trim())
+  return Number.isFinite(value) && value > 0 ? value : null
+}

package/tools/dsh-plugin-fly-guard/index.js

@@ -0,0 +1,101 @@
+/**
+ * fly-guard — DSH Fly 的「持久化写」授权门。
+ *
+ * 官方 `plugin_manager`（`@deepseek-ai/dsh-plugin-manager/tools`）是**唯一**能把包写进
+ * 这份部署的工具：`set_plugin` / `set_bundle` 改的是 `cordis.patch.yml`（profile 层的
+ * 覆盖项），`install_bundle` / `remove_bundle` 装/摘的是**会在宿主进程里跑起来**的代码。
+ * 这些改动跨会话存活、且绕过我们的装配脚本（`scripts/lib/fly-profile.mjs`）。
+ *
+ * 它自己的门只有「会话沙箱模式 + 逐次审批」这一层。而**创造模式**就是要一个能改自己的
+ * DSH，实测会话里那两项是 `never` + `danger-full-access` —— 也就是**没有门**（本仓库
+ * `packages/dsh-plugin-fly-plugins` 的面板一装上去就能看到这一层有多薄）。
+ *
+ * 所以 Fly 给「写自己」补一道自己的门，判据放在**宿主环境变量**上：
+ *
+ *   未设 `FLY_ALLOW_PROFILE_WRITE=1` → 只读动作放行，写入动作一律 deny（默认全拒）；
+ *   设了                              → 写入动作也放行（人显式授权）。
+ *
+ * 为什么是宿主 env 而不是行配置：行配置写在 patch 层里，而 agent 手里**正是**那个能改
+ * patch 层的工具 —— 用受它管的门去管它自己，不是门。env 只有人（终端 / Electron 主进程）
+ * 能设；会话里的 bash 子进程设不了宿主进程的 env。
+ *
+ * fail-closed：`plugin_manager` 上出现本文件不认识的 `action`（上游加了新动作），或读不到
+ * `action`（形状变了），**一律 deny**。上游 `lib/types/tools.js` 里的 `enum` 是那份词表的
+ * 真值来源，`scripts/tests/fly-guard.spec.mjs` 直接对着钉住的闭包逐条比 —— 上游加动作而
+ * 这里没跟上，门禁红（不是静默开门）。
+ *
+ * `action` 读的是 `exec.arguments.action`：引擎交给 `tools/pre-execute` 的 execution 由
+ * `@deepseek-ai/dsh-tools` 的 `createExecution()` 造出来，字段是 `arguments`，**没有 `args`**。
+ * 黑盒那包曾按 `exec.args?.action` 写、门禁也按 `args` 喂，于是"改动动作被 deny"假绿了
+ * 整整一版，真机上 5 个动作根本没进门（见 AGENTS.md 坑表）。
+ */
+export const name = 'fly-guard'
+
+/**
+ * `inject: ['tools']`：这道门挂在**工具面**上（`tools/pre-execute` 是工具执行的
+ * waterfall），必须在有工具注册表的那个 scope 里挂载。它自己不注册任何工具，
+ * 也不碰 `shell` —— 因此不需要 `shell` / `skills` 那两项。
+ */
+export const inject = ['tools']
+
+/** 上游 `plugin_manager` 的只读动作：任何情况下放行。 */
+export const READ_ONLY_ACTIONS = ['list_plugins', 'list_bundles', 'list_version_exemptions']
+
+/** 上游 `plugin_manager` 的写入动作：须 `FLY_ALLOW_PROFILE_WRITE=1`。 */
+export const WRITE_ACTIONS = ['set_plugin', 'set_bundle', 'install_bundle', 'remove_bundle', 'set_version_exemption']
+
+/** 本门只管这一个工具；其余任何工具原样透传。 */
+export const GATED_TOOL = 'plugin_manager'
+
+/** 放行写入的宿主环境变量（人也只能用它的名字，见上面"为什么是宿主 env"）。 */
+export const ALLOW_ENV = 'FLY_ALLOW_PROFILE_WRITE'
+
+/**
+ * 从引擎真正交下来的 execution 里读出 `action`。
+ *
+ * 读不到（没有 `arguments`、`action` 不是非空字符串）返回 `undefined` —— 由调用方
+ * **按受控处理**，不是放行。
+ *
+ * @param exec - `tools/pre-execute` 的 execution 对象。
+ * @returns 动作名，或 undefined（读不到）。
+ */
+function actionOf(exec) {
+  const action = exec?.arguments?.action
+  return typeof action === 'string' && action.trim() !== '' ? action : undefined
+}
+
+/**
+ * 拒绝文案。它要能被人直接读懂"为什么拒、怎么放行"，因为 agent 会把原文转给用户。
+ *
+ * @param action - 被拒的动作名，或 undefined（读不到）。
+ * @returns 一段给人看的拒绝理由。
+ */
+function denialReason(action) {
+  const what = action === undefined
+    ? '一个读不出名字的动作（可能是上游换了形状，或加了本门还不认识的新动作）'
+    : `\`${action}\``
+  return `Fly 的安全门拒绝了 plugin_manager 的 ${what}：任何写入都会**持久**留在 profile 里`
+    + '（patch 层的覆盖项 / bundles / 会在宿主进程里执行的代码），跨会话存活，并且绕过装配脚本。'
+    + `只读动作（${READ_ONLY_ACTIONS.join(' / ')}）不受限。`
+    + `确实要写，就请用户在他自己的终端给宿主进程设 ${ALLOW_ENV}=1 后重启 —— `
+    + '这个变量故意不放在会话里，agent 自己设不了它。'
+}
+
+/**
+ * 挂上这道门。
+ *
+ * 判定顺序就是权限顺序：先看是不是受管工具（不是 ⇒ `next()`，本门对别的工具零影响），
+ * 再看是不是声明的只读动作（是 ⇒ 放行），再看人的显式授权（`=1` ⇒ 放行），
+ * 剩下的**全拒** —— 未知动作、空动作、读不到 `action`，一个都不漏。
+ *
+ * @param ctx - Cordis 插件上下文（`inject: ['tools']`）。
+ */
+export function apply(ctx) {
+  ctx.on('tools/pre-execute', async (exec, next) => {
+    if (exec?.name !== GATED_TOOL) return next()
+    const action = actionOf(exec)
+    if (action !== undefined && READ_ONLY_ACTIONS.includes(action)) return next()
+    if (process.env[ALLOW_ENV] === '1') return next()
+    return { kind: 'deny', reason: denialReason(action) }
+  })
+}

package/tools/dsh-plugin-fly-guard/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "dsh-plugin-fly-guard",
+  "version": "0.1.0",
+  "description": "DSH Fly 的持久化写授权门：官方 plugin_manager 的写入动作默认全拒，须 FLY_ALLOW_PROFILE_WRITE=1",
+  "license": "MIT",
+  "type": "module",
+  "main": "index.js",
+  "exports": {
+    ".": "./index.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.js"
+  ],
+  "scripts": {
+    "test": "node --test tests/*.spec.mjs"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ethanchen669/dsh-fly.git",
+    "directory": "packages/dsh-plugin-fly-guard"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/"
+  }
+}