@sparkelf/dsh-plus 0.2.1-rc.2.4 → 0.2.2-alpha.2.2

package/patches/approval-allow-policy.patch

@@ -0,0 +1,108 @@
+diff --git a/packages/bundle/base/cordis.patch.yml b/packages/bundle/base/cordis.patch.yml
+index 863d194bf5..2d1a7d4c40 100644
+--- a/packages/bundle/base/cordis.patch.yml
++++ b/packages/bundle/base/cordis.patch.yml
+@@ -259,7 +259,7 @@
+     - id: approval
+       name: '@deepseek-ai/dsh-user-approval'
+       config:
+-        policy: !!js "(process.env.DSH_PERMISSION_MODE ?? 'workspace-write') === 'danger-full-access' ? 'never' : 'ask'"
++        policy: !!js "(process.env.DSH_PERMISSION_MODE ?? 'workspace-write') === 'danger-full-access' ? 'allow' : 'ask'"
+ 
+     - id: permission
+       name: '@deepseek-ai/dsh-permission-presets'
+@@ -273,7 +273,7 @@
+             approval: ask
+           danger-full-access:
+             sandbox: danger-full-access
+-            approval: never
++            approval: allow
+ 
+     - id: shell-env
+       name: '@deepseek-ai/dsh-shell-env'
+diff --git a/packages/interaction/permission-presets/src/index.ts b/packages/interaction/permission-presets/src/index.ts
+index b071d0297a..628f8f42ea 100644
+--- a/packages/interaction/permission-presets/src/index.ts
++++ b/packages/interaction/permission-presets/src/index.ts
+@@ -111,7 +111,7 @@ const permissionStateSchema: zod.ZodType<PermissionProjectionState> = zod.object
+     zod.literal('workspace-write'),
+     zod.literal('danger-full-access'),
+   ]).nullable(),
+-  approval: zod.union([zod.literal('ask'), zod.literal('never')]).nullable(),
++  approval: zod.union([zod.literal('ask'), zod.literal('never'), zod.literal('allow')]).nullable(),
+   seeded: zod.boolean(),
+ }).strict()
+ 
+diff --git a/packages/interaction/user-approval/src/index.ts b/packages/interaction/user-approval/src/index.ts
+index df48aca514..82c3f39f19 100644
+--- a/packages/interaction/user-approval/src/index.ts
++++ b/packages/interaction/user-approval/src/index.ts
+@@ -64,20 +64,27 @@ const OUTCOMES: readonly ApprovalOutcome[] = ['allowed-once', 'rejected', 'cance
+  * - `'never'` — never prompt anyone: every ask resolves `'rejected'`
+  *   deterministically. The strict headless stance (CI, unattended runs) and
+  *   the policy whose outcome is knowable without asking.
++ * - `'allow'` — never prompt anyone either, and resolve every ask
++ *   `'allowed-once'` instead. The full-access stance: an operation that
++ *   would have asked is admitted, which is what `danger-full-access` means
++ *   and what `'never'` cannot express.
+  */
+-export type ApprovalPolicy = 'ask' | 'never'
++export type ApprovalPolicy = 'ask' | 'never' | 'allow'
+ 
+ /** Every {@link ApprovalPolicy}, for option advertisement and runtime validation of untrusted policy strings. */
+-export const APPROVAL_POLICIES: readonly ApprovalPolicy[] = ['ask', 'never']
++export const APPROVAL_POLICIES: readonly ApprovalPolicy[] = ['ask', 'never', 'allow']
+ 
+ /** Model-facing statement for the deterministic `'never'` policy. */
+ const NEVER_SENTENCE = 'Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`).'
+ /** Model-facing statement for an interactive policy that may still fail closed. */
+ const ASK_SENTENCE = 'Approval prompts are enabled in this session: operations that require approval may ask through the configured answerers; without an available answerer, the request fails closed.'
++/** Model-facing statement for the deterministic `'allow'` policy. */
++const ALLOW_SENTENCE = 'Approval policy: allow. Operations that require approval are approved automatically; no prompt is shown and sandbox escalation is permitted.'
+ /** Model-facing policy names in switch notices; a bare `never` reads as "approval is never granted". */
+ const POLICY_NOTICE_NAMES: Readonly<Record<ApprovalPolicy, string>> = {
+   ask: 'ask the user for approval',
+   never: 'never ask the user for approval',
++  allow: 'allow operations without asking',
+ }
+ 
+ interface ApprovalState {
+@@ -90,7 +97,7 @@ const approvalStateDefinition = {
+   key: 'approvalState',
+   stateVersion: 1,
+   stateSchema: zod.object({
+-    policy: zod.enum(['ask', 'never']).nullable(),
++    policy: zod.enum(['ask', 'never', 'allow']).nullable(),
+     turnOpen: zod.boolean(),
+   }),
+   init: (): ApprovalState => ({ policy: null, turnOpen: false }),
+@@ -168,7 +175,7 @@ export class ApprovalService extends Service {
+   static inject = ['sessionProjections']
+ 
+   static Config: z<Config> = z.object({
+-    policy: z.union(['ask', 'never'] as const).default('ask'),
++    policy: z.union(['ask', 'never', 'allow'] as const).default('ask'),
+   })
+ 
+   private approvalProjectionHandle!: ProjectionHandle<ApprovalState>
+@@ -195,7 +202,8 @@ export class ApprovalService extends Service {
+           // A bare assemble() (tests, diagnostics) has no session to state.
+           if (agent === undefined) return ''
+           const policy = effective(agent)
+-          return policy === 'never' ? NEVER_SENTENCE : ASK_SENTENCE
++          if (policy === 'never') return NEVER_SENTENCE
++          return policy === 'allow' ? ALLOW_SENTENCE : ASK_SENTENCE
+         },
+       })
+     })
+@@ -299,6 +307,10 @@ export class ApprovalService extends Service {
+     // documented promise that 'never' rejects deterministically regardless
+     // of registration order — only the service's own request path can.
+     if (this.effectivePolicy(session) === 'never') return 'rejected'
++    // 'allow' is the mirror of 'never' and is decided at the same point for the same
++    // reason: the outcome must not depend on which answerers happen to be composed or on
++    // listener registration order.
++    if (this.effectivePolicy(session) === 'allow') return 'allowed-once'
+     // Enter the promise chain BEFORE dispatching: a listener that throws
+     // SYNCHRONOUSLY (before its first await) must land in the same rejection
+     // path as an async one — `Promise.resolve(call())` would let it escape

package/patches/atomic-write-zombie-lock-holder.patch

@@ -0,0 +1,53 @@
+diff --git a/packages/util/atomic-write/src/index.ts b/packages/util/atomic-write/src/index.ts
+index 60e2c67b8c..cfe7c7824f 100644
+--- a/packages/util/atomic-write/src/index.ts
++++ b/packages/util/atomic-write/src/index.ts
+@@ -12,6 +12,7 @@
+  */
+ 
+ import { createHash, randomBytes } from 'node:crypto'
++import { readFileSync } from 'node:fs'
+ import { lstat, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
+ import { dirname } from 'node:path'
+ import { setTimeout as wait } from 'node:timers/promises'
+@@ -119,13 +120,39 @@ function holderExited(record: string): boolean {
+   if (pid === process.pid) return false
+   try {
+     process.kill(pid, 0)
+-    return false
++    // The signal probe accepts a zombie: its PID is still issued, so `kill` succeeds even
++    // though the holder has exited and will never release the lock. `/proc` reports that
++    // state directly, and a zombie proves the holder is gone.
++    return zombieState(pid)
+   } catch (error) {
+     // EPERM means the process exists under another user.
+     return (error as NodeJS.ErrnoException).code === 'ESRCH'
+   }
+ }
+ 
++/**
++ * Whether `pid` is a zombie: a holder that exited but was not reaped yet.
++ *
++ * Only Linux exposes this, and only through `/proc`: elsewhere the signal probe stays the
++ * whole answer. A read failure proves nothing about the holder, so it reads as "still alive"
++ * and leaves the lock alone, because taking a live holder's lock is the worse misjudgement.
++ * @param pid - the positive int32 PID the lock record names.
++ * @returns true only when `/proc/<pid>/stat` says the process is `Z`.
++ */
++function zombieState(pid: number): boolean {
++  let stat: string
++  try {
++    stat = readFileSync('/proc/' + String(pid) + '/stat', 'utf8')
++  } catch {
++    return false
++  }
++  // The command name sits in parentheses and may contain spaces or parentheses, so the
++  // fields after it are located from the LAST ")" rather than by splitting the whole line.
++  const close = stat.lastIndexOf(')')
++  if (close < 0 || close + 2 >= stat.length) return false
++  return stat.charAt(close + 2) === 'Z'
++}
++
+ /** The lock file's content, or undefined when it cannot be read. */
+ async function readLockRecord(lockPath: string): Promise<string | undefined> {
+   try {

package/patches/bootstrap-exempt-names.patch

@@ -0,0 +1,32 @@
+diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts
+index 22332c3..ae00ae0 100644
+--- a/packages/boot/app-boot/src/index.ts
++++ b/packages/boot/app-boot/src/index.ts
+@@ -156,6 +156,19 @@ const BOOTSTRAP_NAMES = new Set([
+ /** Name prefixes no discovered file may set. */
+ const BOOTSTRAP_PREFIXES = ['DSH_', 'XDG_', 'DYLD_', 'BASH_FUNC_']
+ 
++/**
++ * Names the prefix rule must not refuse, because they decide nothing about process launch,
++ * module resolution, VCS hooks, or network trust. The rule protects what a variable controls;
++ * a shared prefix is a proxy for that property rather than the property itself, so the names
++ * that lack it are listed here instead of the prefix being narrowed for every deployment.
++ *
++ * DSH_OFFICE_FONT_DIR names the directory the office-to-pdf provider indexes for document
++ * fonts. The deployment that ships the provider declares that row in its own bundle, so the
++ * value belongs with the bundle configuration and must be settable from a .env like any other
++ * deployment value. The launch-critical names (DSH_HOME, DSH_SNAPSHOT) stay refused.
++ */
++const BOOTSTRAP_EXEMPT_NAMES = new Set(['DSH_OFFICE_FONT_DIR'])
++
+ /**
+  * The bootstrap names the Harness-home `.env` alone may set. A proxy chooses the route every
+  * request takes, so the invoking directory's file — which arrives with a clone — keeps refusing
+@@ -174,6 +187,7 @@ const HOME_LAYER_PROXY_NAMES = new Set(['HTTP_PROXY', 'HTTPS_PROXY', 'ALL_PROXY'
+  */
+ function isBootstrapOnly(name: string): boolean {
+   const upper = name.toUpperCase()
++  if (BOOTSTRAP_EXEMPT_NAMES.has(upper)) return false
+   return BOOTSTRAP_NAMES.has(upper) || BOOTSTRAP_PREFIXES.some(prefix => upper.startsWith(prefix))
+ }
+ 

package/patches/browser-auth-mode.patch

@@ -0,0 +1,127 @@
+diff --git a/packages/client/connection/src/browser-auth.ts b/packages/client/connection/src/browser-auth.ts
+index 5c8594df6f..e5f5fa9f44 100644
+--- a/packages/client/connection/src/browser-auth.ts
++++ b/packages/client/connection/src/browser-auth.ts
+@@ -198,12 +198,40 @@ async function initializeSecret(credentials: CredentialProvider): Promise<Buffer
+   return secret
+ }
+ 
++/** Browser-session policy selected once while Connection activates. */
++export interface BrowserAuthentication {
++  /** Add any authentication input to the clean application URL. */
++  authenticatedUrl(baseUrl: string): string
++  /** Authorize one frontend index request, owning the response when denied or redirected. */
++  authorizeIndex(req: ConnectionIndexRequest, res: ConnectionIndexResponse, secure?: boolean): boolean
++  /** Authorize one connect request, owning the response when denied or redirected. */
++  authorizeConnect(
++    req: ConnectionIndexRequest,
++    res: ConnectionIndexResponse,
++    secure: boolean,
++    publish: (interactions: ConnectionInteractions) => PeerId,
++  ): void
++  /** Decide whether a trusted Host request has the required browser identity. */
++  isAuthenticated(request: ConnectionTrustRequest, secure?: boolean): boolean
++  /** Resolve the peer identity of an authenticated API request, or undefined when it is not. */
++  authenticateApi(request: ConnectionTrustRequest, secure?: boolean): PeerId | undefined
++}
++
++/** Profile-selected policy that admits every request after the independent Host/Origin fence. */
++export const DISABLED_BROWSER_AUTHENTICATION: BrowserAuthentication = {
++  authenticatedUrl: baseUrl => new URL(baseUrl).href,
++  authorizeIndex: () => true,
++  authorizeConnect: () => undefined,
++  isAuthenticated: () => true,
++  authenticateApi: () => undefined,
++}
++
+ /**
+  * Process launch-token exchange and persistent signed-cookie verification.
+  * Connection loads the credential provider's signing secret during activation
+  * and retains it for synchronous request authentication.
+  */
+-export class BrowserAuth {
++export class BrowserAuth implements BrowserAuthentication {
+   private readonly launchToken: string
+   private readonly maxAgeMilliseconds: number
+ 
+diff --git a/packages/client/connection/src/index.ts b/packages/client/connection/src/index.ts
+index d563cd40e8..0c0d2279f8 100644
+--- a/packages/client/connection/src/index.ts
++++ b/packages/client/connection/src/index.ts
+@@ -10,7 +10,7 @@ import { API_PATH } from './api-path.ts'
+ import { CONNECT_PATH } from './connect-protocol.ts'
+ import { bridge, DEFAULT_MAX_REQUEST_BODY_BYTES } from './http-bridge.ts'
+ import { assertTrustedAuthority } from './api-request-trust.ts'
+-import { BrowserAuth } from './browser-auth.ts'
++import { BrowserAuth, DISABLED_BROWSER_AUTHENTICATION } from './browser-auth.ts'
+ import { HostConnectionService } from './rpc-host.ts'
+ import { ConnectionRecoveryConfigSchema, resolveConnectionConfig, type ConnectionRecoveryConfig } from './recovery-config.ts'
+ 
+@@ -103,6 +103,8 @@ export interface ConnectionConfig {
+    * an entry here. A non-canonical or non-bare authority fails plugin load.
+    */
+   trustedHosts?: string[]
++  /** Host API browser identity policy; Host/Origin trust remains independent. Default: `required`. */
++  browserAuthentication?: 'required' | 'disabled'
+   /** Absolute browser and API cookie lifetime in days. Default: 30. */
+   cookieMaxAgeDays?: number
+   /** Maximum buffered JSON body for every `/api` request. Default: 300 MiB. */
+@@ -112,6 +114,7 @@ export interface ConnectionConfig {
+ export const Config: z<ConnectionConfig> = z.object({
+   recovery: ConnectionRecoveryConfigSchema.default({}),
+   trustedHosts: z.array(String).default([]),
++  browserAuthentication: z.union(['required', 'disabled']).default('required'),
+   cookieMaxAgeDays: z.natural().min(1).default(30),
+   maxRequestBodyBytes: z.natural().min(1).default(DEFAULT_MAX_REQUEST_BODY_BYTES),
+ })
+@@ -127,16 +130,21 @@ export async function apply(ctx: Context, config?: ConnectionConfig): Promise<vo
+   const recovery = resolveConnectionConfig(config?.recovery)
+   // The Loader resolves schema defaults; hand-built test contexts may pass none.
+   const trustedHosts = config?.trustedHosts ?? []
++  const browserAuthentication = config?.browserAuthentication ?? 'required'
+   const cookieMaxAgeDays = config?.cookieMaxAgeDays ?? 30
+   const maxRequestBodyBytes = config?.maxRequestBodyBytes ?? DEFAULT_MAX_REQUEST_BODY_BYTES
+   // Config boundary: a malformed entry fails the load loudly here rather than
+   // silently authorizing its hostname prefix at request time.
+   for (const entry of trustedHosts) assertTrustedAuthority(entry)
+   assertImageBodyCapacity(ctx, maxRequestBodyBytes)
++  // 配置在激活时只选择一次策略；disabled不会创建token或credential record。
++  const browserAuth = browserAuthentication === 'required'
++    ? await BrowserAuth.create(ctx.root, ctx.credentials, cookieMaxAgeDays)
++    : DISABLED_BROWSER_AUTHENTICATION
+   const connection = new HostConnectionService(
+     ctx,
+     trustedHosts,
+-    await BrowserAuth.create(ctx.root, ctx.credentials, cookieMaxAgeDays),
++    browserAuth,
+   )
+   ctx.inject(['webServer'], (webCtx) => {
+     assertImageBodyCapacity(webCtx, maxRequestBodyBytes)
+diff --git a/packages/client/connection/src/rpc-host.ts b/packages/client/connection/src/rpc-host.ts
+index 88e7b48baa..43a3feb74c 100644
+--- a/packages/client/connection/src/rpc-host.ts
++++ b/packages/client/connection/src/rpc-host.ts
+@@ -13,7 +13,7 @@ import { clientRequestSchema } from './rpc-schema.ts'
+ import { bridge } from './http-bridge.ts'
+ import { isRemoteAuthority, isTrustedApiRequest } from './api-request-trust.ts'
+ import { API_PATH } from './api-path.ts'
+-import type { BrowserAuth } from './browser-auth.ts'
++import type { BrowserAuthentication } from './browser-auth.ts'
+ import { Peer } from './peer.ts'
+ import type {
+   PeerAdmission,
+@@ -82,12 +82,12 @@ export class HostConnectionService extends Service implements HostConnectionHand
+    * Provide the Host half over the active HTTP server.
+    * @param ctx - owning Connection plugin context.
+    * @param trustedHosts - deployment authorities accepted by the Host/Origin fence.
+-   * @param browserAuth - process token and persistent browser-session owner.
++   * @param browserAuth - profile-selected browser-session policy.
+    */
+   constructor(
+     ctx: Context,
+     private readonly trustedHosts: readonly string[],
+-    private readonly browserAuth: BrowserAuth,
++    private readonly browserAuth: BrowserAuthentication,
+   ) {
+     super(ctx, 'connection')
+     this.owner = ctx