@mrweicodes/dsh-permgate 1.3.11 → 1.5.0

package/client.js

@@ -261,6 +261,7 @@ window.__ModuleLoader__.load({
 			'permgate:reload': ['POST', '/permgate/reload'],
 			'permgate:open-config': ['POST', '/permgate/open-config'],
 			'permgate:open-file': ['POST', '/permgate/open-file'],
+			'permgate:set-fallback': ['POST', '/permgate/set-fallback'],
 		};
 		function call(method, args) {
 			const entry = ROUTES[method] || ['GET', '/permgate/status'];
@@ -659,17 +660,31 @@ window.__ModuleLoader__.load({
 			};
 		}
 
-		const CATS = ['directory', 'command', 'read', 'edit', 'subagent', 'doomloop'];
-		const EXC_CATS = ['directory', 'command', 'read', 'edit'];
+		// 分类清单默认值：以宿主下发为准（见 applyStatusLists），避免双端各存一份而漂移
+		let CATS = ['directory', 'command', 'read', 'image', 'edit', 'undo', 'subagent', 'doomloop'];
+		let EXC_CATS = ['directory', 'command', 'read', 'image', 'edit', 'undo'];
+		function applyStatusLists(s) {
+			if (s && Array.isArray(s.cats) && s.cats.length) CATS = s.cats;
+			if (s && Array.isArray(s.excCats) && s.excCats.length) EXC_CATS = s.excCats;
+			if (s && Array.isArray(s.modes) && s.modes.length) MODES = s.modes;
+			if (s && Array.isArray(s.allModes) && s.allModes.length) ALL_MODES = s.allModes;
+			if (s && Array.isArray(s.quickPreset) && s.quickPreset.length) QUICK_PRESET = s.quickPreset;
+			if (s && s.quickDefaults && typeof s.quickDefaults === 'object') QUICK_DEFAULTS = s.quickDefaults;
+		}
 		// 例外列表超过该数量默认折叠（展开/折叠按钮在标题行右侧）
 		const EXC_COLLAPSE_THRESHOLD = 6;
 		// 文件对比缓存：按审批 id 缓存 /permgate/file-diff 结果（弹窗详情与右侧抽屉共用）
 		const diffCache = new Map();
 		const diffFetching = new Set();
-		const ALL_MODES = ['ask', 'allow', 'deny', 'inherit'];
-		const MODES = ['ask', 'allow', 'deny'];
+		let ALL_MODES = ['ask', 'allow', 'deny', 'inherit'];
+		let MODES = ['ask', 'allow', 'deny'];
 		const MODE_COLORS = { ask: '#e65100', allow: '#2e7d32', deny: '#c62828', inherit: '#888' };
-		const QUICK_PRESET = ['web_search', 'skill', 'grep', 'glob', 'web_fetch'];
+		// 快捷工具预设清单与默认动作都由宿主下发（permgate:status 的 quickPreset/quickDefaults），
+		// 与 CATS/MODES 同口径，避免宿主与浏览器各存一份清单、新增工具时漂移；
+		// 未显式配置的工具按「项目键 → 全局键 → 预设默认 → 会话兜底」显示，与服务端 quickAction 同链。
+		let QUICK_PRESET = [];
+		let QUICK_DEFAULTS = {};
+		let QUICK_FALLBACK = 'ask';
 
 		// ── 中英文适配：字典 + locale 绑定（跟随 dsh 语言设置自动切换）──────────
 		let LC = null; // apply 时注入的 ctx
@@ -694,6 +709,10 @@ window.__ModuleLoader__.load({
 				'app.diffMore': '其余 {n} 行',
 				'app.diffLoading': '加载中…',
 				'app.diffErr': '无法生成对比',
+				'app.imageTag': '图片',
+				'app.imageTooLarge': '图片过大，未生成缩略图',
+				'app.imageSizeUnknown': '无法确认图片尺寸，未生成缩略图',
+				'app.imageNoPreview': '暂无可用的缩略图',
 				'app.uiErr': '界面渲染出错',
 				'app.eolNote': '行尾已按 LF 归一化匹配（磁盘为 CRLF/CR 而参数为 LF）：预览仅为意图展示，实际编辑可能因行尾不一致失败',
 				'app.diffGapShow': '显示 {n} 行未更改',
@@ -718,13 +737,17 @@ window.__ModuleLoader__.load({
 				'cat.directory': '目录访问（工作区外）',
 				'cat.command': '执行命令',
 				'cat.read': '读取文件',
+				'cat.image': '读取图片',
 				'cat.edit': '编辑文件',
+				'cat.undo': '撤销操作（恢复上次编辑前的内容）',
 				'cat.subagent': '启动子代理',
 				'cat.doomloop': '重复操作(Doom Loop)',
 				'catS.directory': '目录',
 				'catS.command': '命令',
 				'catS.read': '读取',
+				'catS.image': '图片',
 				'catS.edit': '编辑',
+				'catS.undo': '撤销',
 				'catS.subagent': '子代理',
 				'catS.doomloop': '循环',
 				'mode.ask': '询问',
@@ -758,11 +781,10 @@ window.__ModuleLoader__.load({
 				'sandbox.desc.fa': '文件操作不受工作区限制',
 				'sandbox.desc.inherit': '跟随全局设置（当前全局：{g}）',
 				'panel.quick': '快捷工具（其他工具快速设置）',
-				'panel.quickHint': '适用于网页搜索、技能加载、grep/glob 等未归类的工具；改动即时生效。',
+				'panel.quickHint': '无文件/命令语义的工具，按工具名设定默认动作；不在清单里的工具走兜底策略，改动即时生效。',
 				'panel.quickAdd': '新增工具名（如 todo_write，支持通配）',
-				'panel.quickAddBtn': '添加（默认允许）',
+				'panel.quickAddBtn': '添加',
 				'panel.rules': '自定义规则（通用匹配）',
-				'panel.rulesHint': '优先级：自定义规则 > 分类例外 > 分类默认/快捷工具。',
 				'panel.actionDeny': 'deny 拒绝',
 				'panel.actionAsk': 'ask 审批',
 				'panel.actionAllow': 'allow 放行',
@@ -784,12 +806,39 @@ window.__ModuleLoader__.load({
 				'panel.savedToProject': '已保存到当前项目',
 				'panel.all': '(全部)',
 				'panel.sandboxSaved': '底层沙箱已保存（{t}）：{v}',
+				'panel.fallbackSaved': '兜底策略已保存（{t}）：{v}',
+				'panel.fallback': '兜底策略（未匹配任何规则）',
+				'panel.fallbackHint': '以上各分类之外、且不在快捷工具清单里的调用（如 mcp__*、cordis_run）如何处理。默认「询问」：每个未匹配的调用都会弹出审批。',
 				'panel.needValue': '请先输入例外匹配',
+				'panel.excRemaining': '该路径仍有 {n} 条同值例外，可继续逐条删除',
+				'panel.delFailed': '删除失败',
 				'panel.needTool': '请输入工具名',
 				'panel.excCount': '例外（{n}）',
 				'panel.excCmdHint': '：匹配命令子串/glob，优先于分类默认',
 				'panel.excPathHint': '：路径 glob，优先于分类默认',
 				'panel.excNone': '无例外',
+				'quick.web_search': '网页搜索',
+				'quick.skill': '加载技能',
+				'quick.grep': '内容检索',
+				'quick.glob': '按名查找文件',
+				'quick.web_fetch': '抓取网页内容',
+				'quick.ask_user_question': '向你提问',
+				'quick.todo_write': '任务清单',
+				'quick.list_agents': '列出子代理',
+				'quick.job_list': '后台任务列表',
+				'quick.job_output': '读取任务输出',
+				'quick.job_kill': '终止后台任务',
+				'quick.get_goal': '查看当前目标',
+				'quick.create_goal': '创建目标',
+				'quick.update_goal': '更新目标状态',
+				'quick.send_message': '给子代理发消息',
+				'quick.interrupt_agent': '打断子代理',
+				'quick.present': '声明交付文件',
+				'quick.exit_plan_mode': '退出计划模式',
+				'quick.cordis_define': '定义动态插件',
+				'quick.cordis_inspect_list': '检视能力清单',
+				'quick.cordis_inspect_query': '执行只读检视',
+				'quick.cordis_inspect_self': '检视本会话插件',
 				'panel.excExpand': '展开',
 				'panel.excCollapse': '折叠',
 				'panel.excListLink': '例外列表',
@@ -825,6 +874,10 @@ window.__ModuleLoader__.load({
 				'app.diffMore': '{n} more lines',
 				'app.diffLoading': 'Loading…',
 				'app.diffErr': 'Cannot build comparison',
+				'app.imageTag': 'Image',
+				'app.imageTooLarge': 'Image too large; thumbnail not generated',
+				'app.imageSizeUnknown': 'Image size could not be determined; thumbnail not generated',
+				'app.imageNoPreview': 'No thumbnail available',
 				'app.uiErr': 'UI render error',
 				'app.eolNote': 'Line endings normalized to LF for matching (CRLF/CR file with LF args): preview is indicative only; the actual edit may fail on line-ending mismatch',
 				'app.diffGapShow': 'Show {n} unchanged lines',
@@ -849,13 +902,17 @@ window.__ModuleLoader__.load({
 				'cat.directory': 'Directory access (outside workspace)',
 				'cat.command': 'Run command',
 				'cat.read': 'Read file',
+				'cat.image': 'Read image',
 				'cat.edit': 'Edit file',
+				'cat.undo': 'Undo edit (revert last edit)',
 				'cat.subagent': 'Spawn subagent',
 				'cat.doomloop': 'Doom Loop',
 				'catS.directory': 'Dir',
 				'catS.command': 'Cmd',
 				'catS.read': 'Read',
+				'catS.image': 'Image',
 				'catS.edit': 'Edit',
+				'catS.undo': 'Undo',
 				'catS.subagent': 'Sub',
 				'catS.doomloop': 'Loop',
 				'mode.ask': 'Ask',
@@ -889,11 +946,10 @@ window.__ModuleLoader__.load({
 				'sandbox.desc.fa': 'File operations are not workspace-restricted',
 				'sandbox.desc.inherit': 'Follows global (currently: {g})',
 				'panel.quick': 'Quick tools (other tools)',
-				'panel.quickHint': 'For uncategorized tools like web search, skills, grep/glob; changes apply immediately.',
+				'panel.quickHint': 'Tools without file/command semantics: set a default per tool name; anything outside this list follows the fallback policy. Changes apply immediately.',
 				'panel.quickAdd': 'New tool name (e.g. todo_write, wildcards allowed)',
-				'panel.quickAddBtn': 'Add (allow by default)',
+				'panel.quickAddBtn': 'Add',
 				'panel.rules': 'Custom rules (generic matching)',
-				'panel.rulesHint': 'Priority: custom rules > category exceptions > category default / quick tools.',
 				'panel.actionDeny': 'deny Deny',
 				'panel.actionAsk': 'ask Ask',
 				'panel.actionAllow': 'allow Allow',
@@ -912,12 +968,39 @@ window.__ModuleLoader__.load({
 				'panel.openConfigDone': 'Opened with default editor',
 				'panel.saved': 'Saved',
 				'panel.sandboxSaved': 'Sandbox saved ({t}): {v}',
+				'panel.fallbackSaved': 'Fallback policy saved ({t}): {v}',
+				'panel.fallback': 'Fallback policy (no rule matched)',
+				'panel.fallbackHint': 'How calls outside the categories above and not listed as quick tools (e.g. mcp__*, cordis_run) are handled. Default Ask: every unmatched call prompts for approval.',
 				'panel.needValue': 'Enter a match value first',
+				'panel.excRemaining': '{n} exception(s) with the same value remain on this path; delete them individually if not wanted',
+				'panel.delFailed': 'Delete failed',
 				'panel.needTool': 'Enter a tool name',
 				'panel.excCount': 'Exceptions ({n})',
 				'panel.excCmdHint': ': command substring/glob, overrides category default',
 				'panel.excPathHint': ': path glob, overrides category default',
 				'panel.excNone': 'No exceptions',
+				'quick.web_search': 'web search',
+				'quick.skill': 'load skill',
+				'quick.grep': 'content search',
+				'quick.glob': 'find files by name',
+				'quick.web_fetch': 'fetch page content',
+				'quick.ask_user_question': 'ask you a question',
+				'quick.todo_write': 'todo list',
+				'quick.list_agents': 'list subagents',
+				'quick.job_list': 'list background jobs',
+				'quick.job_output': 'read job output',
+				'quick.job_kill': 'kill a background job',
+				'quick.get_goal': 'view current goal',
+				'quick.create_goal': 'create a goal',
+				'quick.update_goal': 'update goal state',
+				'quick.send_message': 'message a subagent',
+				'quick.interrupt_agent': 'interrupt a subagent',
+				'quick.present': 'present deliverable files',
+				'quick.exit_plan_mode': 'exit plan mode',
+				'quick.cordis_define': 'define a dynamic plugin',
+				'quick.cordis_inspect_list': 'list inspect capabilities',
+				'quick.cordis_inspect_query': 'run a read-only inspect query',
+				'quick.cordis_inspect_self': 'inspect session plugins',
 				'panel.excExpand': 'Expand',
 				'panel.excCollapse': 'Collapse',
 				'panel.excListLink': 'Exception list',
@@ -946,6 +1029,23 @@ window.__ModuleLoader__.load({
 		function catLabel(c) { return T('cat.' + c); }
 		function catShort(c) { return T('catS.' + c); }
 		function modeLabel(m) { return T('mode.' + m); }
+		// 快捷工具的用途说明：仅当 i18n 有对应文案时显示（用户自加的工具名不显示说明）
+		function quickDesc(t) {
+			const k = 'quick.' + t;
+			const d = T(k);
+			return d && d !== k ? d : '';
+		}
+
+		// 只认「配置里自己写入的键」：不能用 o[k] !== undefined 判断，那会把 Object.prototype 的成员
+		// （constructor/toString 等）当成「该层已配置」，与服务端 hasOwnProperty 的口径分叉。
+		function hasOwnKey(o, k) { return !!(o && Object.prototype.hasOwnProperty.call(o, k)); }
+
+		// 未显式配置工具的全局列显示值：与服务端 quickAction 同一条链（全局键 → 预设默认 → 会话兜底）
+		function quickGlobalValue(t, gq) {
+			if (hasOwnKey(gq, t)) return gq[t];
+			if (hasOwnKey(QUICK_DEFAULTS, t)) return QUICK_DEFAULTS[t];
+			return QUICK_FALLBACK;
+		}
 		const FONT = 'system-ui, -apple-system, "Segoe UI", "PingFang SC", "Microsoft YaHei", sans-serif';
 		const card = { border: '1px solid rgba(128,128,128,0.35)', borderRadius: 8, padding: 12, marginBottom: 12 };
 		const rowStyle = { display: 'flex', alignItems: 'center', gap: 8, padding: '6px 0', borderBottom: '1px solid rgba(128,128,128,0.15)', flexWrap: 'wrap' };
@@ -981,8 +1081,11 @@ window.__ModuleLoader__.load({
 				for (const key of diffFetching) if (!aliveIds.has(key)) diffFetching.delete(key);
 				for (const p of pending) {
 					if (!p.hasDiff || diffCache.has(p.id) || diffFetching.has(p.id)) continue
-					const open = openDetail[p.id] === undefined ? true : openDetail[p.id] === true
+					const userOpened = openDetail[p.id] === true
+					const open = openDetail[p.id] === undefined ? true : userOpened
 					if (!open) continue
+					// 图片详情是整图 data URL（体积大）：不做自动预取，只有用户主动展开该条时才拉取
+					if (p.imagePreview && !userOpened) continue
 					diffFetching.add(p.id)
 					schedulePrismIdle()
 					call('permgate:file-diff', { id: p.id }).then((r) => {
@@ -1007,24 +1110,36 @@ window.__ModuleLoader__.load({
 				else next[candId] = v;
 				setSel(next);
 			};
+			const pickedRules = (p) => (p.candidates || []).filter((c) => sel[c.id]).map((c) => ({ id: c.id, value: c.value, kind: c.kind, decision: sel[c.id] }));
+			// 拒绝语义下只接受 deny 方向的规则：候选行残留的「允许此项」勾选绝不能变成持久 allow
+			const pickedDenyRules = (p) => pickedRules(p).filter((r) => r.decision === 'deny');
 			const submit = (p, action) => {
-				const rules = (p.candidates || []).filter((c) => sel[c.id]).map((c) => ({ value: c.value, kind: c.kind, decision: sel[c.id] }));
-				decide(p.id, action, rules);
+				decide(p.id, action, pickedRules(p));
 			};
 			// 两段式拒绝：确认阶段提交（携带意见）或取消返回
 			const confirmDeny = (p) => {
 				const reason = (denyText[p.id] || '').trim();
 				setDenyMode(Object.assign({}, denyMode, { [p.id]: false }));
-				decide(p.id, 'deny', [], reason || undefined);
+				decide(p.id, 'deny', pickedDenyRules(p), reason || undefined);
 			};
 			const cancelDeny = (p) => setDenyMode(Object.assign({}, denyMode, { [p.id]: false }));
-			const radio = (p, c, v, label, cls) => React.createElement('button', {
-				className: 'pg-radio' + (sel[c.id] === v ? ' ' + cls : ''),
-				disabled: busyId === p.id,
-				onClick: () => pick(c.id, v),
-			}, label);
+			// 进入拒绝态：只切状态，不动用户已勾选的内容。拒绝语义下「允许此项」由 radio 置灰，
+			// 确认拒绝时也只提交 deny 方向（pickedDenyRules），因此点「取消」能原样回到进入前的勾选。
+			const enterDeny = (p) => setDenyMode(Object.assign({}, denyMode, { [p.id]: true }));
+			const radio = (p, c, v, label, cls) => {
+				// 拒绝态下「允许此项」不生效（confirmDeny 只提交 deny 方向）：置灰禁用而不是清除勾选，
+				// 这样点「取消」保留进入前选择，点「确认拒绝」也不会把 allow 方向写进配置。
+				const muted = v === 'allow' && !!denyMode[p.id];
+				return React.createElement('button', {
+					className: 'pg-radio' + (sel[c.id] === v ? ' ' + cls : ''),
+					disabled: busyId === p.id || muted,
+					style: muted ? { opacity: 0.45, cursor: 'not-allowed' } : undefined,
+					onClick: () => pick(c.id, v),
+				}, label);
+			};
 			// 编辑/写入审批（有 diff）：详情默认展开、参数默认收起；无 diff 时参数照常显示
-			const detailOpen = (p) => (openDetail[p.id] === undefined ? !!p.hasDiff : openDetail[p.id]);
+			// 图片详情是整图 data URL（体积大）：默认收起，用户点开该条时才拉取
+			const detailOpen = (p) => (openDetail[p.id] === undefined ? (!!p.hasDiff && !p.imagePreview) : openDetail[p.id]);
 			const argsOpen = (p) => (openArgs[p.id] === undefined ? !p.hasDiff : openArgs[p.id]);
 			const toggle = (map, setMap, p, v) => setMap(Object.assign({}, map, { [p.id]: v }));
 			// 点击文件名 → 打开右侧对比抽屉（父组件 OverlayRoot 持有 pin 状态）
@@ -1066,9 +1181,7 @@ window.__ModuleLoader__.load({
 							const c = diffCache.get(p.id)
 							if (!c) return React.createElement('div', { className: 'pg2-load' }, T('app.diffLoading'))
 							if (!c.ok) return React.createElement('div', { className: 'pg2-err' }, (c.error || T('app.diffErr')))
-							return c.kind === 'read'
-								? React.createElement(PGErrorBoundary, { resetKey: payloadKey(c), fallback: T('app.diffErr') }, React.createElement(ReadBlockMemo, { data: c, onOpenFile: (f) => openFile(p, f) }))
-								: React.createElement(PGErrorBoundary, { resetKey: payloadKey(c), fallback: T('app.diffErr') }, React.createElement(DiffBlockMemo, { data: c, onOpenFile: (f) => openFile(p, f), changesOnly: true }))
+							return detailBody(c, { onOpenFile: (f) => openFile(p, f), changesOnly: true, resetKey: payloadKey(c) })
 						})() : null,
 					) : null,
 					(p.candidates || []).length ? React.createElement('div', null,
@@ -1093,7 +1206,7 @@ window.__ModuleLoader__.load({
 							React.createElement('button', { className: 'pg-action', disabled: busyId === p.id, onClick: () => cancelDeny(p) }, T('panel.cancel')),
 						),
 					) : React.createElement('div', { className: 'pg-footer' },
-						React.createElement('button', { className: 'pg-action pg-action-deny', disabled: busyId === p.id, onClick: () => setDenyMode(Object.assign({}, denyMode, { [p.id]: true })) }, T('app.deny')),
+						React.createElement('button', { className: 'pg-action pg-action-deny', disabled: busyId === p.id, onClick: () => enterDeny(p) }, T('app.deny')),
 						React.createElement('button', { className: 'pg-action pg-action-allow', disabled: busyId === p.id, onClick: () => submit(p, 'allow') }, T('app.allow')),
 					),
 				)),
@@ -1323,6 +1436,49 @@ window.__ModuleLoader__.load({
 		const diffPropsEqual = (a, b) => a.data === b.data && a.changesOnly === b.changesOnly;
 		const DiffBlockMemo = React.memo(DiffBlock, diffPropsEqual);
 		const ReadBlockMemo = React.memo(ReadBlock, diffPropsEqual);
+
+		// kind → 详情组件 分派单点：待审批内联详情与右侧对比抽屉共用，新增 kind（如 image）只改这一处，
+		// 避免两处漏改导致某处把数据落到 DiffBlock，被错误边界兜成「无法生成对比」。
+		function detailBody(data, opts) {
+			const o = opts || {};
+			const fb = T('app.diffErr');
+			const boundaryProps = o.resetKey !== undefined ? { resetKey: o.resetKey, fallback: fb } : { fallback: fb };
+			if (data.kind === 'image') return React.createElement(PGErrorBoundary, boundaryProps, React.createElement(ImageBlock, { data }));
+			if (data.kind === 'read') return React.createElement(PGErrorBoundary, boundaryProps, React.createElement(ReadBlockMemo, { data, onOpenFile: o.onOpenFile || null, onCollapse: o.onCollapse }));
+			return React.createElement(PGErrorBoundary, boundaryProps, React.createElement(DiffBlockMemo, { data, onOpenFile: o.onOpenFile || null, onCollapse: o.onCollapse, changesOnly: o.changesOnly }));
+		}
+
+		// 图片详情块：头部显示 格式 · 像素尺寸 · 体积，下面给缩略图；
+		// 超过上限或读取失败时不给图片本体，改显示说明文本（宿主下发的 error 由外层按 .pg2-err 渲染）。
+		function ImageBlock({ data }) {
+			const fmtBytes = (n) => {
+				const v = Number(n) || 0;
+				if (v < 1024) return v + ' B';
+				if (v < 1024 * 1024) return (v / 1024).toFixed(1) + ' KB';
+				return (v / (1024 * 1024)).toFixed(2) + ' MB';
+			};
+			const meta = [
+				String(data.format || '').toUpperCase(),
+				data.width && data.height ? data.width + '×' + data.height : '',
+				data.size ? fmtBytes(data.size) : '',
+			].filter(Boolean).join(' · ');
+			const note = data.sizeUnknown
+				? T('app.imageSizeUnknown')
+				: data.tooLarge
+					? T('app.imageTooLarge') + (data.limit ? '（' + fmtBytes(data.limit) + '）' : '')
+					: T('app.imageNoPreview');
+			return React.createElement('div', { className: 'pg2-block' },
+				React.createElement('div', { className: 'pg2-header' },
+					React.createElement('span', { className: 'pg2-status pg2-status-read' }, T('app.imageTag')),
+					React.createElement('span', { className: 'pg2-path', title: data.file }, data.file),
+					meta ? React.createElement('span', { style: { marginLeft: 'auto', color: 'rgba(128,128,128,0.9)' } }, meta) : null,
+				),
+				data.dataUrl
+					? React.createElement('div', { style: { padding: 10, display: 'flex', justifyContent: 'center', alignItems: 'center', overflow: 'auto', background: 'rgba(128,128,128,0.06)' } },
+						React.createElement('img', { src: data.dataUrl, alt: data.file, style: { maxWidth: '100%', maxHeight: 320, objectFit: 'contain', borderRadius: 4, display: 'block' } }))
+					: React.createElement('div', { className: 'pg2-foot' }, note),
+			);
+		}
 		function CompareDrawer({ pin, onClose }) {
 			const [data, setData] = React.useState(null);
 			const [err, setErr] = React.useState('');
@@ -1388,9 +1544,7 @@ window.__ModuleLoader__.load({
 			};
 			let body;
 			if (data) {
-				body = data.kind === 'read'
-					? React.createElement(PGErrorBoundary, { fallback: T('app.diffErr') }, React.createElement(ReadBlockMemo, { data, onOpenFile: null, onCollapse: onClose }))
-					: React.createElement(PGErrorBoundary, { fallback: T('app.diffErr') }, React.createElement(DiffBlockMemo, { data, onOpenFile: null, onCollapse: onClose }));
+				body = detailBody(data, { onCollapse: onClose })
 			} else if (err) {
 				body = React.createElement('div', { className: 'pg2-err' }, err);
 			} else {
@@ -1477,7 +1631,7 @@ window.__ModuleLoader__.load({
 			return React.createElement('div', { style: { display: 'flex', alignItems: 'center', gap: 8, fontSize: 12, color: 'rgba(128,128,128,0.95)', padding: '2px 0' } },
 				React.createElement('span', { style: { fontWeight: 600 } }, T('dock.title')),
 				React.createElement('span', { style: { display: 'flex', gap: 6, flexWrap: 'wrap' } },
-					chip(catShort('directory'), eff.directory), chip(catShort('command'), eff.command), chip(catShort('read'), eff.read), chip(catShort('edit'), eff.edit), chip(catShort('subagent'), eff.subagent), chip(catShort('doomloop'), eff.doomloop),
+					chip(catShort('directory'), eff.directory), chip(catShort('command'), eff.command), chip(catShort('read'), eff.read), chip(catShort('image'), eff.image), chip(catShort('edit'), eff.edit), chip(catShort('undo'), eff.undo), chip(catShort('subagent'), eff.subagent), chip(catShort('doomloop'), eff.doomloop),
 				),
 				React.createElement('span', { style: { cursor: 'pointer', padding: '0 4px' }, onClick: refresh, title: T('dock.refresh') }, '↻'),
 			);
@@ -1498,6 +1652,7 @@ window.__ModuleLoader__.load({
 			const [exAction, setExAction] = React.useState('allow');
 			const [exReasonVal, setExReasonVal] = React.useState('');
 			const [newTool, setNewTool] = React.useState('');
+			const [newToolAction, setNewToolAction] = React.useState('allow');
 			const [form, setForm] = React.useState({ action: 'deny', tool: '', path: '', args: '', reason: '' });
 			const [confirm, setConfirm] = React.useState(null);
 			const [excCollapsed, setExcCollapsed] = React.useState({});
@@ -1508,8 +1663,13 @@ window.__ModuleLoader__.load({
 				return () => clearTimeout(id);
 			}, [confirm]);
 
+			// 切换全局/项目 tab 时清掉未完成的二次确认：确认的对象是「某一层的某个键」，换层后不能沿用
+			// 同一确认态，否则再点会删掉另一层。
+			React.useEffect(() => { setConfirm(null); }, [tab]);
+
 			const applyStatus = (s) => {
 				if (!s) return;
+				applyStatusLists(s);
 				setStatus(s);
 				const cs = { global: {}, project: {} };
 				for (const t of ['global', 'project']) {
@@ -1522,12 +1682,15 @@ window.__ModuleLoader__.load({
 				const qs = {};
 				const gq = s.quickTools ? s.quickTools.global : {};
 				const pq = s.quickTools ? s.quickTools.project : {};
+				// 会话兜底只作最后一级（预设之外、且未配置的工具）；宿主 statusView 恒下发合法的
+				// fallback.effective，下面的 `|| 'ask'` 只是协议异常兜底，不是决策链的一环。
+				QUICK_FALLBACK = (s.fallback && s.fallback.effective) || 'ask';
 				const names = {};
 				for (const t of QUICK_PRESET) names[t] = 1;
 				for (const k of Object.keys(gq)) names[k] = 1;
 				for (const k of Object.keys(pq)) names[k] = 1;
 				for (const t of Object.keys(names)) {
-					qs[t] = { g: gq[t] || 'allow', p: pq[t] && pq[t] !== 'inherit' ? pq[t] : 'inherit' };
+					qs[t] = { g: quickGlobalValue(t, gq), p: hasOwnKey(pq, t) && pq[t] !== 'inherit' ? pq[t] : 'inherit' };
 				}
 				setQuickSel(qs);
 			};
@@ -1577,7 +1740,14 @@ window.__ModuleLoader__.load({
 
 			const addQuick = () => {
 				if (!newTool || !String(newTool).trim()) { setMsg(T('panel.needTool')); return; }
-				invoke('permgate:set-quick', { target: tab, tool: String(newTool).trim(), action: 'allow' }, () => setNewTool(''));
+				invoke('permgate:set-quick', { target: tab, tool: String(newTool).trim(), action: newToolAction }, () => setNewTool(''));
+			};
+
+			// 删除该行在当前 tab 的快捷工具设置（服务端收到 action=inherit 即删除该键）；
+			// 只发请求、不做本地乐观删除：quickSel 完全由服务端返回的 status 收敛，请求失败时
+			// 不会留下「面板已删、服务端仍生效」的漂移（与例外/规则的删除入口一致）。
+			const removeQuick = (tool) => {
+				invoke('permgate:set-quick', { target: tab, tool, action: 'inherit' });
 			};
 
 			const addException = (c) => {
@@ -1588,7 +1758,18 @@ window.__ModuleLoader__.load({
 				invoke('permgate:add-exception', { target: tab, category: c, match: v, action: exAction, reason: exAction === 'deny' ? (String(exReasonVal || '').trim() || undefined) : undefined });
 			};
 
-			const removeException = (c, id) => invoke('permgate:remove-exception', { target: tab, category: c, id });
+			const removeException = (c, id) => {
+				setBusy(true);
+				setMsg('');
+				// 注意：invoke 是无返回值的回调式封装，这里必须用返回 promise 的 call
+				call('permgate:remove-exception', { target: tab, category: c, id }).then((r) => {
+					if (r && r.error) { setMsg(String(r.error)); return; }
+					applyStatus(r && r.status ? r.status : r);
+					// 删除只作用于选中行：明确反馈结果；同路径若仍有例外则提示剩余条数，否则清掉旧提示
+					if (r && r.removed === false) setMsg(r.reason ? String(r.reason) : T('panel.delFailed'));
+					else setMsg(r && r.remaining > 0 ? T('panel.excRemaining').replace('{n}', String(r.remaining)) : '');
+				}).catch((e) => setMsg(String((e && e.message) || e))).then(() => setBusy(false));
+			};
 
 			const setFormKey = (key) => (e) => setForm(Object.assign({}, form, { [key]: e.target.value }));
 			const addRule = () => invoke('permgate:add-rule', { target: tab, action: form.action, tool: form.tool || undefined, path: form.path || undefined, args: form.args || undefined, reason: form.reason || undefined });
@@ -1651,13 +1832,31 @@ window.__ModuleLoader__.load({
 				);
 			};
 
-			const quickTools = Object.keys(quickSel);
+			// 行集合按 tab 区分：项目 tab 显示全集（预设 + 全局键 + 项目键），便于在项目里覆盖全局；
+			// 全局 tab 只显示「预设 + 全局配置里确实存在的键」，避免项目层专有的键在这里冒充全局设置。
+			const quickGq = status && status.quickTools ? status.quickTools.global : null;
+			const quickTools = Object.keys(quickSel).filter((t) => {
+				if (tab === 'project') return true;
+				if (QUICK_PRESET.indexOf(t) !== -1) return true;
+				return hasOwnKey(quickGq, t);
+			});
 			const quickRow = (t) => {
 				const key = tab === 'global' ? 'g' : 'p';
-				const mode = quickSel[t] ? (quickSel[t][key] || (tab === 'project' ? 'inherit' : 'allow')) : (tab === 'project' ? 'inherit' : 'allow');
+				const gqMap = status && status.quickTools ? status.quickTools.global : null;
+				const pqMap = status && status.quickTools ? status.quickTools.project : null;
+				const mode = quickSel[t] && quickSel[t][key] ? quickSel[t][key] : (tab === 'project' ? 'inherit' : quickGlobalValue(t, gqMap));
+				// 删除按钮只给「用户自己添加的名字」（不在 22 个预设清单里的行），且本行在当前 tab 的配置里
+				// 确实存在该键时才显示：预设行始终会列出，删掉配置键也只是回退默认值，容易被误读成「收紧」。
+				const isPreset = QUICK_PRESET.indexOf(t) !== -1;
+				const hasKey = key === 'g' ? hasOwnKey(gqMap, t) : hasOwnKey(pqMap, t);
+				const desc = quickDesc(t);
 				return React.createElement('div', { key: t, style: rowStyle },
-					React.createElement('span', { style: { fontFamily: 'monospace', fontSize: 13, width: 150 } }, t),
+					React.createElement('span', { style: { display: 'flex', alignItems: 'baseline', gap: 6, minWidth: 260 } },
+						React.createElement('span', { style: { fontFamily: 'monospace', fontSize: 13 } }, t),
+						desc ? React.createElement('span', { style: { fontSize: 12, color: 'rgba(128,128,128,0.9)' } }, desc) : null,
+					),
 					sel(mode, changeQuick(t), tab === 'project' ? ALL_MODES : MODES, busy),
+					(!isPreset && hasKey) ? React.createElement('button', { className: 'pg-btn pg-btn-danger' + (confirm === 'quick:' + tab + ':' + t ? ' pg-btn-confirm' : ''), disabled: busy, onClick: () => confirmDelete('quick:' + tab + ':' + t, () => removeQuick(t)) }, confirm === 'quick:' + tab + ':' + t ? T('panel.confirmDel') : T('panel.del')) : null,
 				);
 			};
 
@@ -1687,6 +1886,11 @@ window.__ModuleLoader__.load({
 
 			const sandboxLabel = (m) => (m === 'workspace-write' ? T('sandbox.ww') : m === 'danger-full-access' ? T('sandbox.fa') : T('sandbox.inherit'));
 			const sandboxVal = tab === 'global' ? sandbox.global : sandbox.project;
+			const fbVal = status && status.fallback ? (tab === 'global' ? status.fallback.global : status.fallback.project) : (tab === 'global' ? 'ask' : 'inherit');
+			const changeFallback = (e) => {
+				const mode = e.target.value;
+				invoke('permgate:set-fallback', { target: tab, mode }, () => setMsg(T('panel.fallbackSaved').replace('{t}', T(tab === 'global' ? 'panel.tabGlobal' : 'panel.tabProject')).replace('{v}', modeLabel(mode))));
+			};
 			const sandboxOptions = tab === 'global' ? ['workspace-write', 'danger-full-access'] : ['workspace-write', 'danger-full-access', 'inherit'];
 			const changeSandbox = (e) => {
 				const mode = e.target.value;
@@ -1745,12 +1949,12 @@ window.__ModuleLoader__.load({
 					quickTools.map(quickRow),
 					React.createElement('div', { style: { display: 'flex', gap: 6, marginTop: 6, flexWrap: 'wrap' } },
 						React.createElement('input', { className: 'pg-field', placeholder: T('panel.quickAdd'), value: newTool, onChange: (e) => setNewTool(e.target.value), disabled: busy }),
+						sel(newToolAction, (e) => setNewToolAction(e.target.value), MODES, busy),
 						React.createElement('button', { className: 'pg-btn', disabled: busy, onClick: addQuick }, T('panel.quickAddBtn')),
 					),
 				),
 				React.createElement('div', { style: card },
 					React.createElement('div', { style: h() }, T('panel.rules')),
-					React.createElement('div', { style: { fontSize: 12, color: 'rgba(128,128,128,0.8)', marginBottom: 8 } }, T('panel.rulesHint')),
 					React.createElement('div', { style: { display: 'flex', gap: 8, flexWrap: 'wrap', alignItems: 'center', marginBottom: 8 } },
 						React.createElement('select', { value: form.action, onChange: setFormKey('action'), className: 'pg-field', disabled: busy },
 							React.createElement('option', { value: 'deny' }, T('panel.actionDeny')), React.createElement('option', { value: 'ask' }, T('panel.actionAsk')), React.createElement('option', { value: 'allow' }, T('panel.actionAllow')),
@@ -1766,6 +1970,13 @@ window.__ModuleLoader__.load({
 						customList && customList.length ? customList.map(ruleRow) : React.createElement('div', { style: { fontSize: 12, color: 'rgba(128,128,128,0.8)' } }, T('panel.noRules')),
 					),
 				),
+				React.createElement('div', { style: card },
+					React.createElement('div', { style: { display: 'flex', alignItems: 'center', justifyContent: 'space-between', marginBottom: 4 } },
+						React.createElement('span', { style: { fontSize: 13, fontWeight: 600 } }, T('panel.fallback')),
+						sel(fbVal, changeFallback, tab === 'global' ? MODES : ALL_MODES, busy),
+					),
+					React.createElement('div', { style: { fontSize: 12, color: 'rgba(128,128,128,0.85)' } }, T('panel.fallbackHint')),
+				),
 				React.createElement('div', { style: card },
 					React.createElement('div', { style: h() }, T('panel.decisions')),
 					decisions.length ? decisions.map((d, i) => React.createElement('div', { key: i, style: rowStyle },