@goodandready/dsh-approval-gate 0.1.26 → 0.1.28

package/lib/client.js

@@ -1,5 +1,5 @@
 // lib/client.js
-// Browser client half for DeepSeek Harness: Approval Gate UI (#74, #75, #82, #86, #60).
+// Browser client half for DeepSeek Harness: Approval Gate UI (#74, #75, #82, #86, #60, #49, #84, #83, #116).
 // Self-registering module for window.__ModuleLoader__.
 // Canonical languages: English (en) and Chinese (zh).
 
@@ -26,16 +26,25 @@ window.__ModuleLoader__.load({
       viewDiff: "View Diff",
       diffModalTitle: "Unified Diff Viewer",
       close: "Close",
-      expandFold: "Click to expand {count} unchanged lines",
-      collapseFold: "Collapse unchanged lines",
       autoTimeoutIn: "Auto-decision in {seconds}s",
       timerPaused: "Timer paused",
       pauseTimer: "Pause",
       resumeTimer: "Resume",
       turnSummary: "Round Summary",
-      statusClean: "Clean (all calls approved)",
-      statusWarnings: "Warnings (confirmations requested)",
-      statusBlocked: "Blocked operations detected",
+      settingsTitle: "Approval Gate Settings",
+      settingsSubtitle: "Security rules, path whitelists and learned rules management",
+      rulesEditorTitle: "Rules & Whitelists",
+      whitelistPaths: "Path Whitelist",
+      addPath: "Add Path",
+      learnedRulesTitle: "Learned Routine Rules",
+      learnedRulesDesc: "Safe operations auto-learned after repeated manual confirmations",
+      revoke: "Revoke",
+      noLearnedRules: "No learned rules in active session.",
+      toastAutoApproved: "Auto-approved: ",
+      modeStrict: "Strict",
+      modeHybrid: "Hybrid",
+      modeAuto: "Auto",
+      modeManual: "Manual",
     };
 
     const zh = {
@@ -50,16 +59,25 @@ window.__ModuleLoader__.load({
       viewDiff: "查看差异",
       diffModalTitle: "统一差异比对器",
       close: "关闭",
-      expandFold: "点击展开 {count} 行未修改代码",
-      collapseFold: "折叠未修改代码",
       autoTimeoutIn: "倒计时 {seconds} 秒后自动判定",
       timerPaused: "倒计时已暂停",
       pauseTimer: "暂停",
       resumeTimer: "继续",
       turnSummary: "轮次总结",
-      statusClean: "安全（全部放行）",
-      statusWarnings: "提示（已请求人工确认）",
-      statusBlocked: "拦截（存在违规操作）",
+      settingsTitle: "审批网关设置",
+      settingsSubtitle: "安全规则、路径白名单及自动学习规则管理",
+      rulesEditorTitle: "自定义规则与白名单",
+      whitelistPaths: "路径白名单",
+      addPath: "添加路径",
+      learnedRulesTitle: "已学习规则管理",
+      learnedRulesDesc: "经过多次手动确认后自动放行的安全例行操作",
+      revoke: "撤回",
+      noLearnedRules: "当前会话尚无已学习规则。",
+      toastAutoApproved: "已自动放行：",
+      modeStrict: "严格",
+      modeHybrid: "混合",
+      modeAuto: "自动",
+      modeManual: "手动",
     };
 
     // ----------------------------------------------------------- CSS Styles
@@ -104,8 +122,6 @@ window.__ModuleLoader__.load({
       .ag-diff-num { width: 36px; flex: none; text-align: right; padding-right: 8px; color: var(--dsw-alias-label-tertiary); user-select: none; }
       .ag-diff-sign { width: 16px; flex: none; text-align: center; font-weight: bold; user-select: none; }
       .ag-diff-text { flex: 1; white-space: pre-wrap; word-break: break-all; }
-      
-      /* Hunk Folding #75 */
       .ag-diff-fold { padding: 4px 12px; background: rgba(0,0,0,0.2); border-top: 1px dashed var(--dsw-alias-border-l2); border-bottom: 1px dashed var(--dsw-alias-border-l2); text-align: center; color: var(--dsw-alias-label-secondary); cursor: pointer; font-size: 11px; margin: 4px 0; }
       .ag-diff-fold:hover { background: rgba(0,0,0,0.3); color: var(--dsw-alias-label-primary); }
 
@@ -113,6 +129,33 @@ window.__ModuleLoader__.load({
       .ag-countdown-box { display: flex; align-items: center; gap: 8px; font-size: 11px; color: #eab308; margin-top: 6px; }
       .ag-countdown-badge { background: rgba(234, 179, 8, 0.2); border: 1px solid rgba(234, 179, 8, 0.4); padding: 2px 6px; border-radius: 4px; font-weight: 600; }
       .ag-pause-btn { background: none; border: 1px solid var(--dsw-alias-border-l2); color: var(--dsw-alias-label-secondary); border-radius: 4px; padding: 1px 6px; cursor: pointer; font-size: 10px; }
+
+      /* Settings Card #49, #84 */
+      .ag-card { border: 1px solid var(--dsw-alias-border-l2); background: var(--dsw-alias-bg-layer-3); border-radius: 12px; list-style: none; margin-bottom: 12px; }
+      .ag-card-head { appearance: none; width: 100%; font: inherit; color: inherit; text-align: left; cursor: pointer; background: 0 0; border: 0; border-radius: 12px; display: flex; align-items: center; gap: 12px; padding: 14px 16px; }
+      .ag-card-title { color: var(--dsw-alias-label-primary); font-size: 15px; font-weight: 600; line-height: 1.4; }
+      .ag-card-sub { color: var(--dsw-alias-label-secondary); font-size: 13px; }
+      .ag-card-body { border-top: 1px solid var(--dsw-alias-border-l2); margin: 0 16px; padding: 12px 0 16px; }
+      .ag-chev { margin-left: auto; flex: none; color: var(--dsw-alias-label-tertiary); transition: transform .16s; font-size: 12px; }
+      .ag-chev-open { transform: rotate(180deg); }
+      
+      .ag-sec-title { font-size: 13px; font-weight: 600; color: var(--dsw-alias-label-primary); margin: 12px 0 6px; }
+      .ag-table { width: 100%; border-collapse: collapse; font-size: 12px; margin-top: 6px; }
+      .ag-table th { text-align: left; padding: 6px 8px; border-bottom: 1px solid var(--dsw-alias-border-l2); color: var(--dsw-alias-label-secondary); font-weight: 500; }
+      .ag-table td { padding: 6px 8px; border-bottom: 1px solid var(--dsw-alias-border-l2); color: var(--dsw-alias-label-primary); }
+      .ag-btn-revoke { background: rgba(239, 68, 68, 0.15); color: #ef4444; border: 1px solid rgba(239, 68, 68, 0.3); border-radius: 4px; padding: 2px 8px; cursor: pointer; font-size: 11px; }
+      .ag-input { height: 30px; border: 1px solid var(--dsw-alias-border-l2); background: var(--dsw-alias-bg-layer-2); color: var(--dsw-alias-label-primary); border-radius: 6px; padding: 0 8px; font-size: 12px; }
+
+      /* Floating Toast #83 */
+      .ag-toast { position: fixed; bottom: 80px; left: 50%; transform: translateX(-50%); background: var(--dsw-alias-bg-layer-3); border: 1px solid #22c55e; color: var(--dsw-alias-label-primary); border-radius: 20px; padding: 6px 14px; font-size: 12px; display: flex; align-items: center; gap: 6px; box-shadow: 0 4px 16px rgba(0,0,0,0.3); z-index: 9999; animation: agFade .2s ease-in; }
+      @keyframes agFade { from { opacity: 0; transform: translate(-50%, 8px); } to { opacity: 1; transform: translate(-50%, 0); } }
+
+      /* Toolbar Badge #116 */
+      .ag-mode-badge { font-size: 10px; font-weight: 600; padding: 2px 7px; border-radius: 10px; text-transform: uppercase; letter-spacing: 0.5px; cursor: default; }
+      .ag-mode-auto { background: rgba(34, 197, 94, 0.2); color: #22c55e; border: 1px solid rgba(34, 197, 94, 0.4); }
+      .ag-mode-hybrid { background: rgba(234, 179, 8, 0.2); color: #eab308; border: 1px solid rgba(234, 179, 8, 0.4); }
+      .ag-mode-strict { background: rgba(59, 130, 246, 0.2); color: #3b82f6; border: 1px solid rgba(59, 130, 246, 0.4); }
+      .ag-mode-manual { background: rgba(156, 163, 175, 0.2); color: #9ca3af; border: 1px solid rgba(156, 163, 175, 0.4); }
     `;
 
     function injectStyles() {
@@ -154,10 +197,38 @@ window.__ModuleLoader__.load({
       );
     }
 
+    // ----------------------------------------------------------- Floating Toast Component (#83)
+    function AutoApprovalToast({ message, onDismiss }) {
+      React.useEffect(() => {
+        const t = setTimeout(() => { if (onDismiss) onDismiss(); }, 3000);
+        return () => clearTimeout(t);
+      }, [onDismiss]);
+
+      if (!message) return null;
+      return h("div", { className: "ag-toast", onClick: onDismiss },
+        h("span", null, "⚡ Auto-approved:"),
+        h("strong", null, message)
+      );
+    }
+
+    // ----------------------------------------------------------- Gate Mode Badge Component (#116)
+    function GateModeBadge() {
+      const [mode, setMode] = React.useState("hybrid");
+
+      React.useEffect(() => {
+        fetch("/dsh-approval-gate/mode")
+          .then((r) => r.json())
+          .then((d) => { if (d && d.mode) setMode(d.mode); })
+          .catch(() => {});
+      }, []);
+
+      const cls = `ag-mode-badge ag-mode-${mode}`;
+      return h("span", { className: cls, title: `Approval Gate mode: ${mode}` }, `🛡️ ${mode}`);
+    }
+
     // ----------------------------------------------------------- Diff Panel Modal (#74, #75)
     function DiffPanelModal({ diffData, onClose }) {
       const [expandedFolds, setExpandedFolds] = React.useState({});
-
       if (!diffData) return null;
       const hunks = diffData.hunks || [];
 
@@ -172,8 +243,8 @@ window.__ModuleLoader__.load({
             h("button", { className: "ag-diff-btn", onClick: onClose }, "✕ Close")
           ),
           h("div", { className: "ag-diff-content" },
-            hunks.map((hunk, hIdx) => {
-              return h("div", { key: `hunk_${hIdx}` },
+            hunks.map((hunk, hIdx) =>
+              h("div", { key: `hunk_${hIdx}` },
                 h("div", { className: "ag-diff-fold", style: { cursor: "default", fontWeight: "600" } }, hunk.header),
                 (hunk.items || []).map((item, iIdx) => {
                   if (item.type === "fold") {
@@ -194,26 +265,136 @@ window.__ModuleLoader__.load({
                       )
                     );
                   }
-
                   const isAdd = item.type === "add";
                   const isDel = item.type === "del";
                   const lineClass = isAdd ? "ag-diff-line ag-diff-line-add" : (isDel ? "ag-diff-line ag-diff-line-del" : "ag-diff-line");
-                  const sign = isAdd ? "+" : (isDel ? "-" : " ");
-
                   return h("div", { key: `line_${hIdx}_${iIdx}`, className: lineClass },
                     h("span", { className: "ag-diff-num" }, item.oldLine || ""),
                     h("span", { className: "ag-diff-num" }, item.newLine || ""),
-                    h("span", { className: "ag-diff-sign" }, sign),
+                    h("span", { className: "ag-diff-sign" }, isAdd ? "+" : (isDel ? "-" : " ")),
                     h("span", { className: "ag-diff-text" }, item.text)
                   );
                 })
-              );
-            })
+              )
+            )
           )
         )
       );
     }
 
+    // ----------------------------------------------------------- Settings Card Component (#49, #84)
+    function ApprovalGateSettingsCard({ ctx }) {
+      const [open, setOpen] = React.useState(false);
+      const [learnedRules, setLearnedRules] = React.useState([]);
+      const [whitelist, setWhitelist] = React.useState([]);
+      const [newPath, setNewPath] = React.useState("");
+
+      const fetchSettings = React.useCallback(async () => {
+        try {
+          const lrRes = await fetch("/dsh-approval-gate/learned-rules");
+          if (lrRes.ok) {
+            const lrData = await lrRes.json();
+            setLearnedRules(lrData.rules || []);
+          }
+          const rRes = await fetch("/dsh-approval-gate/rules");
+          if (rRes.ok) {
+            const rData = await rRes.json();
+            setWhitelist(rData.whitelistPaths || []);
+          }
+        } catch (_) {}
+      }, []);
+
+      React.useEffect(() => {
+        if (open) fetchSettings();
+      }, [open, fetchSettings]);
+
+      const revokeRule = async (key) => {
+        try {
+          await fetch("/dsh-approval-gate/learned-rules/revoke", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ key }),
+          });
+          setLearnedRules((prev) => prev.filter((r) => r.key !== key));
+        } catch (_) {}
+      };
+
+      const addPath = async () => {
+        if (!newPath.trim()) return;
+        const updated = [...whitelist, newPath.trim()];
+        setWhitelist(updated);
+        setNewPath("");
+        try {
+          await fetch("/dsh-approval-gate/rules", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ whitelistPaths: updated }),
+          });
+        } catch (_) {}
+      };
+
+      return h("div", { className: "ag-card" },
+        h("button", {
+          className: "ag-card-head",
+          onClick: () => setOpen(!open),
+          "aria-expanded": open,
+        },
+          h("div", null,
+            h("div", { className: "ag-card-title" }, "🛡️ Approval Gate"),
+            h("div", { className: "ag-card-sub" }, "Rules editor, path whitelists and learned rules manager")
+          ),
+          h("span", { className: `ag-chev ${open ? "ag-chev-open" : ""}` }, "▼")
+        ),
+        open && h("div", { className: "ag-card-body" },
+          // Rules & Whitelists Editor (#49)
+          h("div", { className: "ag-sec-title" }, "Path Whitelist"),
+          h("div", { style: { display: "flex", gap: "6px", marginBottom: "8px" } },
+            h("input", {
+              className: "ag-input",
+              placeholder: "/workspace/temp",
+              value: newPath,
+              onChange: (e) => setNewPath(e.target.value),
+              style: { flex: 1 },
+            }),
+            h("button", { className: "ag-diff-btn", onClick: addPath }, "+ Add")
+          ),
+          whitelist.length > 0 && h("div", { style: { display: "flex", flexWrap: "wrap", gap: "4px", marginBottom: "12px" } },
+            whitelist.map((p, idx) => h("span", { key: idx, className: "ag-badge ag-badge-allow" }, p))
+          ),
+
+          // Learned Rules Manager (#84)
+          h("div", { className: "ag-sec-title" }, "Learned Rules Manager"),
+          learnedRules.length === 0
+            ? h("div", { style: { color: "var(--dsw-alias-label-tertiary)", fontSize: "12px" } }, "No learned rules in active session.")
+            : h("table", { className: "ag-table" },
+              h("thead", null,
+                h("tr", null,
+                  h("th", null, "Tool"),
+                  h("th", null, "Command / Target"),
+                  h("th", null, "Hits"),
+                  h("th", null, "Action")
+                )
+              ),
+              h("tbody", null,
+                learnedRules.map((rule) =>
+                  h("tr", { key: rule.key },
+                    h("td", null, rule.tool || "bash"),
+                    h("td", { style: { fontFamily: "monospace" } }, rule.command || rule.key),
+                    h("td", null, rule.count || 1),
+                    h("td", null,
+                      h("button", {
+                        className: "ag-btn-revoke",
+                        onClick: () => revokeRule(rule.key),
+                      }, "Revoke")
+                    )
+                  )
+                )
+              )
+            )
+        )
+      );
+    }
+
     // ----------------------------------------------------------- Timeline Tab (#82, #86)
     function ApprovalTimelineTab({ ctx }) {
       const [filter, setFilter] = React.useState("all");
@@ -233,9 +414,7 @@ window.__ModuleLoader__.load({
             const cData = await cRes.json();
             setTurnCard(cData.card);
           }
-        } catch (e) {
-          // ignore network poll errors
-        }
+        } catch (_) {}
       }, [filter]);
 
       React.useEffect(() => {
@@ -244,30 +423,6 @@ window.__ModuleLoader__.load({
         return () => clearInterval(poll);
       }, [fetchTimeline]);
 
-      const openDiff = (evt) => {
-        if (evt.diffMeta) {
-          setActiveDiff(evt.diffMeta);
-        } else {
-          // Dummy sample diff for inspection demonstration
-          setActiveDiff({
-            filename: evt.command || "command.sh",
-            hunks: [{
-              header: "@@ -1,3 +1,4 @@",
-              items: [
-                { type: "eq", text: "#!/usr/bin/env bash", oldLine: 1, newLine: 1 },
-                { type: "del", text: "rm -rf /tmp/data", oldLine: 2, newLine: null },
-                { type: "add", text: "trash /tmp/data", oldLine: null, newLine: 2 },
-                { type: "fold", count: 8, foldedLines: [
-                  { type: "eq", text: "echo 'safe line 1'", oldLine: 3, newLine: 3 },
-                  { type: "eq", text: "echo 'safe line 2'", oldLine: 4, newLine: 4 },
-                ] },
-                { type: "add", text: "echo 'Done safely'", oldLine: null, newLine: 5 },
-              ]
-            }]
-          });
-        }
-      };
-
       return h("div", { className: "ag-view-tab" },
         h("div", { className: "ag-header" },
           h("span", { className: "ag-title" }, "🛡️ Security Gate"),
@@ -281,41 +436,31 @@ window.__ModuleLoader__.load({
             )
           )
         ),
-
-        // TurnCard Summary (#86)
         turnCard && h("div", { className: "ag-turn-card" },
           h("div", { className: `ag-turn-status ag-${turnCard.status}` },
             turnCard.status === "clean" ? "✓ Turn Clean" : (turnCard.status === "blocked" ? "⚠ Operations Blocked" : "ℹ Confirmations Asked")
           ),
           h("div", { className: "ag-turn-desc" }, turnCard.summaryText)
         ),
-
-        // Events List (#82)
         h("div", { className: "ag-events-list" },
           events.length === 0
             ? h("div", { style: { padding: "20px", textAlign: "center", color: "var(--dsw-alias-label-tertiary)" } }, "No events recorded yet")
-            : events.map((evt) => {
-              const badgeClass = `ag-badge ag-badge-${evt.verdict}`;
-              return h("div", { key: evt.id, className: "ag-event-item" },
+            : events.map((evt) =>
+              h("div", { key: evt.id, className: "ag-event-item" },
                 h("div", { className: "ag-event-head" },
                   h("span", { className: "ag-tool-name" }, evt.tool),
-                  h("span", { className: badgeClass }, evt.verdict)
+                  h("span", { className: `ag-badge ag-badge-${evt.verdict}` }, evt.verdict)
                 ),
                 evt.command && h("div", { className: "ag-cmd-snippet" }, evt.command),
                 evt.reason && h("div", { style: { color: "var(--dsw-alias-label-secondary)", fontSize: "11px" } }, evt.reason),
-                
-                // Countdown Timer for Ask state (#60)
                 evt.verdict === "ask" && evt.countdownSec && h(CountdownBadge, { initialSeconds: evt.countdownSec }),
-
                 h("div", { className: "ag-event-footer" },
                   h("span", { className: "ag-time" }, new Date(evt.timestamp).toLocaleTimeString()),
-                  h("button", { className: "ag-diff-btn", onClick: () => openDiff(evt) }, "Diff")
+                  h("button", { className: "ag-diff-btn", onClick: () => setActiveDiff(evt.diffMeta || { filename: evt.command || "cmd.sh", hunks: [] }) }, "Diff")
                 )
-              );
-            })
+              )
+            )
         ),
-
-        // Modal Diff Viewer (#74, #75)
         activeDiff && h(DiffPanelModal, { diffData: activeDiff, onClose: () => setActiveDiff(null) })
       );
     }
@@ -331,14 +476,14 @@ window.__ModuleLoader__.load({
         console.warn("[dsh-approval-gate] client locale registration:", err && err.message);
       }
 
-      // Register right session panel slot: conversation.view (#82)
+      // 1. Register right session panel slot: conversation.view (#82)
       try {
         if (ctx.slots && typeof ctx.slots.inject === "function") {
           ctx.slots.inject("conversation.view", function () {
             return ctx.slots.register(
               {
                 name: "conversation.view",
-                id: "@goodandready/dsh-approval-gate",
+                id: PKG,
                 order: 45,
                 label: function () { return "🛡️ Approvals"; },
               },
@@ -349,6 +494,43 @@ window.__ModuleLoader__.load({
       } catch (err) {
         console.warn("[dsh-approval-gate] conversation.view slot registration:", err && err.message);
       }
+
+      // 2. Register settings card slot: settings.plugin.item (#49, #84)
+      try {
+        if (ctx.slots && typeof ctx.slots.inject === "function") {
+          ctx.slots.inject("settings.plugin.item", function () {
+            return ctx.slots.register(
+              {
+                name: "settings.plugin.item",
+                key: NS,
+                locale: NS,
+                inject: function () { return { ctx }; },
+              },
+              ApprovalGateSettingsCard
+            );
+          });
+        }
+      } catch (err) {
+        console.warn("[dsh-approval-gate] settings.plugin.item slot registration:", err && err.message);
+      }
+
+      // 3. Register toolbar badge slot: toolbar.badge (#116)
+      try {
+        if (ctx.slots && typeof ctx.slots.inject === "function") {
+          ctx.slots.inject("toolbar.badge", function () {
+            return ctx.slots.register(
+              {
+                name: "toolbar.badge",
+                id: PKG,
+                order: 25,
+              },
+              GateModeBadge
+            );
+          });
+        }
+      } catch (err) {
+        console.warn("[dsh-approval-gate] toolbar.badge slot registration:", err && err.message);
+      }
     }
 
     module.exports = {
@@ -357,6 +539,9 @@ window.__ModuleLoader__.load({
       DiffPanelModal,
       CountdownBadge,
       ApprovalTimelineTab,
+      ApprovalGateSettingsCard,
+      AutoApprovalToast,
+      GateModeBadge,
     };
     return module.exports;
   },

package/lib/compat.js

@@ -1,8 +1,10 @@
 // lib/compat.js
-// Host compatibility checks and polyfills across DeepSeek Harness minor versions (#106).
+// Host compatibility checks and polyfills across DeepSeek Harness minor versions (#106, #184).
 
 /**
- * Detects available runtime capabilities and services in the Cordis host context (#106).
+ * Detects available runtime capabilities and services in the Cordis host context (#106, #184).
+ * Safely accesses properties via ctx.get() and guarded property lookup to avoid
+ * throwing in strict Cordis contexts where uninjected property access is forbidden.
  *
  * @param {any} ctx - Cordis / DSH host context
  * @returns {{
@@ -11,7 +13,7 @@
  *   hasPreExecuteHook: boolean,
  *   hasProvideApi: boolean,
  *   hasLocaleService: boolean,
- *   harnessVersion: string | null
+ *   harnessVersion: string
  * }}
  */
 export function detectHarnessCapabilities(ctx) {
@@ -22,39 +24,48 @@ export function detectHarnessCapabilities(ctx) {
       hasPreExecuteHook: false,
       hasProvideApi: false,
       hasLocaleService: false,
-      harnessVersion: null,
+      harnessVersion: "unknown",
     };
   }
 
-  const getService = (name) => {
+  const safeGet = (name) => {
     try {
       if (typeof ctx.get === "function") return ctx.get(name);
     } catch {
       // ignore
     }
-    return ctx[name];
+    try {
+      return ctx[name];
+    } catch {
+      return undefined;
+    }
   };
 
-  const tools = getService("tools");
-  const locale = getService("locale");
+  const tools = safeGet("tools");
+  const locale = safeGet("locale");
+  const onFn = safeGet("on");
+  const provideFn = safeGet("provide");
+
+  const rawVersion = safeGet("version");
 
   const harnessVersion =
-    (typeof ctx.version === "string" && ctx.version) ||
-    (typeof process.env.DSH_VERSION === "string" && process.env.DSH_VERSION) ||
-    null;
+    (typeof rawVersion === "string" && rawVersion.trim()) ||
+    (rawVersion && typeof rawVersion === "object" && typeof rawVersion.version === "string" && rawVersion.version.trim()) ||
+    (typeof process.env.DSH_VERSION === "string" && process.env.DSH_VERSION.trim()) ||
+    "unknown";
 
   return {
     hasContext: true,
     hasToolsService: Boolean(tools),
-    hasPreExecuteHook: typeof ctx.on === "function",
-    hasProvideApi: typeof ctx.provide === "function",
+    hasPreExecuteHook: typeof onFn === "function",
+    hasProvideApi: typeof provideFn === "function",
     hasLocaleService: Boolean(locale && typeof locale.register === "function"),
     harnessVersion,
   };
 }
 
 /**
- * Asserts host compatibility and identifies missing optional or required features (#106).
+ * Asserts host compatibility and identifies missing optional or required features (#106, #184).
  *
  * @param {any} ctx
  * @param {{ requireTools?: boolean }} [options]
@@ -80,7 +91,7 @@ export function assertHarnessCompatibility(ctx, options = {}) {
 }
 
 /**
- * Safely provides a service to the host context with backward-compatible polyfill (#106).
+ * Safely provides a service to the host context with backward-compatible polyfill (#106, #184).
  *
  * @param {any} ctx
  * @param {string} serviceName
@@ -90,21 +101,32 @@ export function assertHarnessCompatibility(ctx, options = {}) {
 export function provideServicePolyfill(ctx, serviceName, serviceInstance) {
   if (!ctx || typeof ctx !== "object" || !serviceName) return false;
 
-  if (typeof ctx.provide === "function") {
+  let provideFn = undefined;
+  try {
+    provideFn = ctx.provide;
+  } catch {
+    // ignore
+  }
+
+  if (typeof provideFn === "function") {
     try {
-      ctx.provide(serviceName, serviceInstance);
+      provideFn.call(ctx, serviceName, serviceInstance);
       return true;
     } catch {
       // fallback to property assignment below
     }
   }
 
-  ctx[serviceName] = serviceInstance;
-  return true;
+  try {
+    ctx[serviceName] = serviceInstance;
+    return true;
+  } catch {
+    return false;
+  }
 }
 
 /**
- * Safely attaches an event hook to the host context with error boundary (#106).
+ * Safely attaches an event hook to the host context with error boundary (#106, #184).
  *
  * @param {any} ctx
  * @param {string} event
@@ -112,12 +134,23 @@ export function provideServicePolyfill(ctx, serviceName, serviceInstance) {
  * @returns {(() => void) | null} Unsubscribe dispose function or null
  */
 export function registerHookPolyfill(ctx, event, handler) {
-  if (!ctx || typeof ctx.on !== "function" || typeof handler !== "function") {
+  if (!ctx || typeof ctx !== "object" || typeof handler !== "function") {
+    return null;
+  }
+
+  let onFn = undefined;
+  try {
+    onFn = ctx.on;
+  } catch {
+    // ignore
+  }
+
+  if (typeof onFn !== "function") {
     return null;
   }
 
   try {
-    return ctx.on(event, handler);
+    return onFn.call(ctx, event, handler);
   } catch {
     return null;
   }

package/lib/index.js

@@ -408,7 +408,7 @@ export function apply(ctx, config) {
   };
   provideServicePolyfill(ctx, "approvalGate", gateService);
   const turnCard = new TurnCardTracker();
-  const timeline = new TimelineService({ turnCardTracker: turnCard });
+  const timeline = new TimelineService({ turnCardTracker: turnCard, learner: engine.learner, engine });
   timeline.registerRoutes(ctx);
   gateService.timeline = timeline;
   gateService.turnCard = turnCard;
@@ -539,12 +539,10 @@ export function apply(ctx, config) {
   return mount();
 }
 
-export { SecurityEngine } from "./engine.js";
 export { BandsEngine } from "./bands.js";
 export { CircuitBreaker, CIRCUIT_STATE_ACTIVE, CIRCUIT_STATE_TRIPPED, CIRCUIT_STATE_RESUMED } from "./breaker.js";
 export { SessionGrantStore, DEFAULT_GRANT_TTL_MS, DEFAULT_GRANT_MAX_USES, matchGrantCriteria } from "./grants.js";
 export { canonicalizeCall, canonicalString, hashCall, sortKeys } from "./canonical.js";
-export { expandHome, resolveSafePath, isPathTraversal, canonicalizeFsPath } from "./paths.js";
 export { splitSubcommands } from "./tokenizer.js";
 export { redactCredentials, redactUrl } from "./redact.js";
 export { CommandDispatcher, isReviewerAgent, extractFilePath, TOOL_KIND_SHELL, TOOL_KIND_FILE_WRITE, TOOL_KIND_FILE_READ, TOOL_KIND_NETWORK, TOOL_KIND_GENERIC } from "./dispatcher.js";
@@ -557,7 +555,7 @@ export { RetryExhaustionGuard, DEFAULT_MAX_RETRY_ATTEMPTS } from "./retry-exhaus
 export { QualityLedger, MAX_LEDGER_EVENTS_PER_SESSION, CURRENT_SCHEMA_VERSION, SUPPORTED_SCHEMA_VERSIONS, migrateVerdictRecord } from "./ledger.js";
 export { AuditLogger, DEFAULT_AUDIT_LOG_RELATIVE, DEFAULT_MAX_AUDIT_BYTES, DEFAULT_MAX_AUDIT_LINES, DEFAULT_RETAIN_LINES, auditRotateContent } from "./audit-log.js";
 export { BlockCounters, categorizeReason } from "./counters.js";
-export { isCriticalOperation } from "./engine.js";
+export { SecurityEngine, isCriticalOperation } from "./engine.js";
 export { parseYaml, parseScalar, stripComment } from "./yaml-parser.js";
 export { matchConditionValue, evaluateWhen } from "./when-matcher.js";
 export { HotwordsMatcher, DEFAULT_HOTWORDS, extractWords } from "./hotwords.js";
@@ -565,7 +563,7 @@ export { DeclarativeRulesEngine, BUILTIN_RULES_FILE, WORKSPACE_RULES_REL, USER_R
 export { normalizeChatCompletionsUrl, withLlmRetry, sanitizeClassifierInput, truncateClassifierContext, isLowRiskExecution, isShapeRejectError, extractJsonPayload, ClassifierVerdictSchema, validateClassifierResponse, LlmClassifier } from "./classifier.js";
 export { ContractGuard } from "./contract-guard.js";
 export { OverengineeringGuard, DEFAULT_MAX_FILES_PER_SESSION } from "./overengineering.js";
-export { resolveTempRoot, isGlobalTempPath, checkTempIsolation } from "./paths.js";
+export { expandHome, resolveSafePath, isPathTraversal, canonicalizeFsPath, resolveTempRoot, isGlobalTempPath, checkTempIsolation } from "./paths.js";
 export { computePayloadSize, scanPromptInjection } from "./inspect.js";
 export { RISK_BUCKETS, RISK_TAGS, categorizeRiskBucket, extractRiskTags } from "./risk.js";
 export { ClassifierLatencyTracker, DEFAULT_CLASSIFIER_SLA_MS } from "./latency.js";

package/lib/learning.js

@@ -218,6 +218,11 @@ export class ConfirmationLearner {
     return rules;
   }
 
+  revoke(sessionId, key) {
+    const sessionMap = this._getSessionMap(sessionId);
+    return sessionMap.delete(key);
+  }
+
   clearSession(sessionId) {
     const key = sessionId || "default";
     this.sessions.delete(key);