@starwish-ai/xingyuan-dsh 0.6.1 → 0.6.2

package/CHANGELOG.md

@@ -5,6 +5,35 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.2] - 2026-09-06
+
+### Added
+- **Fine-grained write-confirmation settings**: the master switch ("写操作二次确认")
+  now expands into six per-category detail toggles — create (incl. micro-action
+  breakdown), check-in, cancel check-in, claim, edit, memory save. Detail rows stay
+  visible under the master switch and grey out (explicit disabled styling) when it is
+  off; the delete row remains locked (always confirmed, no off switch). Defaults
+  reproduce the previous matrix: create / check-in / cancel check-in ask; claim /
+  edit / memory save run on your instruction. Claim, edit and memory-save tools
+  gained real confirmation hooks (600 s HITL timeout, validation before asking,
+  cancel exits without writing). Chat-side HITL only — page dialogs are unchanged.
+  Zero migration: absent settings resolve to the defaults.
+
+### Changed
+- `rename_wish_category` validates before asking: renaming a non-existent category
+  errors up front instead of after a confirmation; renaming a color-override-only
+  category (zero wishes) now succeeds and reports "0 wishes" instead of falsely
+  erroring "category does not exist" after the override had already been migrated.
+
+### Fixed
+- sqlite backend `close()` now actually releases the database handle (was an empty
+  implementation), so hot-reload / unload no longer keeps the file locked.
+- Bundle main row declares the previously missing
+  `storageBackendServiceKey('sqlite')` injection key.
+- StaleBanner text contrast: new `--xyd-on-warn` token pair reaches WCAG 4.5:1 on the
+  warn background in both light and dark themes (locked by a WCAG computation test).
+- README confirmation wording no longer contradicts AGENTS.md §5.5.
+
 ## [0.6.1] - 2026-09-05
 
 ### Added

package/README.en-US.md

@@ -18,7 +18,7 @@ XingYuan is a wish & habit-building companion, shipped as a DeepSeek Harness plu
 - **Session view tabs**: Today / Wishes / Tasks / Calendar / Growth / Memory — buttons call action endpoints directly; shown only in XingYuan-preset sessions by default, switchable to always show/hide and per-tab in Settings
 - **Memory**: important memories injected into context (limit configurable), full CRUD
 - **Charts**: 15 chart types rendered as cards
-- **Safe writes**: write operations confirmed by default (configurable); deletion always confirmed
+- **Safe writes**: write confirmation is per-category (create / check-in / undo / claim / edit / save memory); deletion always confirms and cannot be turned off; defaults match previous versions
 - **Theming**: light/dark follows the app theme
 
 Tools are only mounted on sessions using the XingYuan preset; other sessions are unaffected.
@@ -41,7 +41,7 @@ Business data lives at `~/.dsh/xingyuan/xingyuan.sqlite` and survives uninstall
 | --- | --- |
 | Coach style | Gentle / humorous / strict |
 | User profile | Nickname, occupation, interests |
-| Write confirmation | Whether create / check-in writes need confirmation (deletion always does) |
+| Write confirmation | Master switch + per-category toggles (create / check-in / undo / claim / edit / save memory); deletion always confirms and cannot be turned off |
 | Memory injection limit | Max memories injected per turn |
 | Tab visibility | Three modes (follow session / always show / always hide) plus per-tab toggles; defaults to follow session |
 | Confirm card language | Language of the in-chat confirmation card (Chinese / English; the platform does not expose UI language to plugins, defaults to Chinese) |

package/README.md

@@ -20,7 +20,7 @@
   默认仅星愿预设的会话显示，可在设置里切换「始终显示 / 始终隐藏」并按标签勾选
 - **记忆**：重要记忆自动注入上下文（上限可配），支持增删改查
 - **图表**：15 种统计图表自动渲染为卡片
-- **安全确认**：写操作默认二次确认（可关闭），删除始终确认
+- **安全确认**：写操作二次确认按类目细化（创建 / 打卡 / 取消打卡 / 领取 / 修改 / 保存记忆），删除始终确认不可关闭；默认与此前版本一致
 - **主题适配**：深浅色跟随应用主题
 
 工具只挂载在选择星愿 preset 的会话上，不影响其他会话。
@@ -43,7 +43,7 @@ dsh plugin --profile web add @starwish-ai/xingyuan-dsh
 | --- | --- |
 | 教练风格 | 温柔 / 幽默 / 严格 |
 | 用户画像 | 昵称、职业、兴趣 |
-| 写操作二次确认 | 创建 / 打卡类写操作是否确认（删除始终确认） |
+| 写操作二次确认 | 总开关 + 六个类目明细（创建 / 打卡 / 取消打卡 / 领取 / 修改 / 保存记忆）是否确认；删除始终确认、不可关闭 |
 | 记忆注入上限 | 每次注入上下文的记忆条数上限 |
 | 标签页显示 | 三态模式（跟随会话 / 始终显示 / 始终隐藏）+ 六个标签逐个勾选；默认跟随会话 |
 | 确认卡语言 | 对话中确认卡的显示语言（中文 / English；平台不向插件暴露界面语言，默认中文） |

package/lib/client/i18n.js

@@ -275,7 +275,17 @@ export const ZH_DICT = {
     'settings.pref.notRegistered': '偏好暂不可用（组件未就绪），请稍后重试。',
     'settings.pref.readOnly': '当前设置为只读，无法保存修改。',
     'settings.pref.confirmWrites': '写操作二次确认',
-    'settings.pref.confirmWritesHint': '创建愿望/任务、打卡、取消打卡时先弹应用内确认卡（删除始终确认）；关闭后对话中的这类操作将直接执行。',
+    'settings.pref.confirmWritesHint': '总开关：开启后按下方类目决定是否弹确认卡，关闭后除删除（始终确认）外一律直接执行。',
+    'settings.pref.confirmOps.group': '确认类目',
+    'settings.pref.confirmOps.create': '创建愿望/任务（含微行动拆解）',
+    'settings.pref.confirmOps.checkin': '打卡',
+    'settings.pref.confirmOps.cancelCheckin': '取消打卡',
+    'settings.pref.confirmOps.claim': '领取任务',
+    'settings.pref.confirmOps.update': '修改愿望/任务/分类',
+    'settings.pref.confirmOps.memorySave': '保存记忆',
+    'settings.pref.confirmOps.delete': '删除（含批量、微行动重开）',
+    'settings.pref.confirmOps.deleteHint': '始终确认，不可关闭：删除不可恢复。',
+    'settings.pref.confirmOps.hint': '类目明细在总开关开启时生效；默认与之前版本一致。',
     'settings.pref.memoryLimit': '记忆注入上限',
     'settings.pref.memoryLimitHint': '每次对话自动注入上下文的记忆条数上限（5-200，默认 40）；失焦后保存。',
     'settings.pref.limitInvalid': '请输入 5-200 的整数',
@@ -694,7 +704,17 @@ const EN_DICT = {
     'settings.pref.notRegistered': 'Preferences are unavailable right now (component not ready); please retry later.',
     'settings.pref.readOnly': 'Settings are read-only; changes cannot be saved.',
     'settings.pref.confirmWrites': 'Confirm write actions',
-    'settings.pref.confirmWritesHint': 'Show an in-app confirmation before creating wishes/tasks, checking in or canceling (deletes always confirm). Turn off to execute directly.',
+    'settings.pref.confirmWritesHint': 'Master switch: when on, confirmations follow the categories below; when off, everything except deletes (always confirmed) runs directly.',
+    'settings.pref.confirmOps.group': 'Confirmation categories',
+    'settings.pref.confirmOps.create': 'Create wishes/tasks (incl. micro-action plans)',
+    'settings.pref.confirmOps.checkin': 'Check-ins',
+    'settings.pref.confirmOps.cancelCheckin': 'Cancel check-ins',
+    'settings.pref.confirmOps.claim': 'Claiming tasks',
+    'settings.pref.confirmOps.update': 'Editing wishes/tasks/categories',
+    'settings.pref.confirmOps.memorySave': 'Saving memories',
+    'settings.pref.confirmOps.delete': 'Deletes (incl. batch & restarts)',
+    'settings.pref.confirmOps.deleteHint': 'Always confirms and cannot be turned off; deletes are irreversible.',
+    'settings.pref.confirmOps.hint': 'Category switches apply while the master switch is on; defaults match previous versions.',
     'settings.pref.memoryLimit': 'Memory injection limit',
     'settings.pref.memoryLimitHint': 'Max memories auto-injected per chat (5-200, default 40); saved when you leave the field.',
     'settings.pref.limitInvalid': 'Enter an integer between 5 and 200',

package/lib/client/pages/settings.js

@@ -6,7 +6,7 @@ import { getJson, postJson } from '../api.js';
 import { toastError } from '../ui.js';
 import { useXyT, activeLocale } from '../i18n.js';
 import { TAB_IDS } from '../../tab-policy.js';
-import { MEMORY_LIMIT_MAX, MEMORY_LIMIT_MIN, PREF_DEFAULTS, parseMemoryLimit, } from '../../pref-policy.js';
+import { CONFIRM_OPS, MEMORY_LIMIT_MAX, MEMORY_LIMIT_MIN, PREF_DEFAULTS, normalizeConfirmOps, parseMemoryLimit, } from '../../pref-policy.js';
 const COACH_IDS = ['gentle', 'strict', 'humorous'];
 const COACH_KEYS = ['settings.coach.gentle', 'settings.coach.strict', 'settings.coach.humorous'];
 /** 显隐三态（顺序即分段按钮顺序；与 tab-policy 字面量同源）。 */
@@ -24,6 +24,15 @@ const TAB_LABEL_KEYS = {
     growth: 'tab.growth',
     memory: 'tab.memory',
 };
+/** 确认类目的显示名键（与 pref-policy CONFIRM_OPS 一一对应）。 */
+const CONFIRM_OP_LABEL_KEYS = {
+    create: 'settings.pref.confirmOps.create',
+    checkin: 'settings.pref.confirmOps.checkin',
+    cancelCheckin: 'settings.pref.confirmOps.cancelCheckin',
+    claim: 'settings.pref.confirmOps.claim',
+    update: 'settings.pref.confirmOps.update',
+    memorySave: 'settings.pref.confirmOps.memorySave',
+};
 export function SettingsSection(props) {
     const t = useXyT();
     const scope = props.scope;
@@ -52,6 +61,8 @@ export function SettingsSection(props) {
     const [savedMsg, setSavedMsg] = useState('');
     // 二次确认开关：本地乐观值（undefined=跟随远端快照）——写入在途时 UI 立即响应，失败回滚
     const [pendingToggle, setPendingToggle] = useState(undefined);
+    // 确认类目明细：乐观值为「合并后的完整对象」（每次写整体下发），失败回滚
+    const [pendingOps, setPendingOps] = useState(undefined);
     // 标签页显隐：模式与勾选各自乐观（写入在途时禁用对应控件，失败回滚 + toast）
     const [pendingMode, setPendingMode] = useState(undefined);
     const [pendingHidden, setPendingHidden] = useState(undefined);
@@ -67,6 +78,8 @@ export function SettingsSection(props) {
     // 开关显示值：乐观本地值优先（写入在途），否则远端快照，值缺席回落 schema 默认。
     // 不可写成 `!== false`——那样「值未知」会被渲染成「已开启」，安全策略类开关尤其不能撒谎。
     const confirmWrites = pendingToggle ?? snap.value?.confirmWrites ?? PREF_DEFAULTS.confirmWrites;
+    // 确认类目显示值：乐观优先 → 快照（脏键容错回落默认）→ 全默认
+    const confirmOps = pendingOps ?? normalizeConfirmOps(snap.value?.confirmOps);
     // 偏好区提示：判定顺序不可换——memory 模式下 status 同样是 unavailable，
     // 先判 mode 才不会把「远程/临时模式」误报成「命名空间未就绪」
     const prefNoticeKey = snap.status === 'loading' ? 'settings.pref.loading'
@@ -165,7 +178,13 @@ export function SettingsSection(props) {
     const verifyWritten = (seq, field, value) => {
         if (seq !== writeSeqRef.current)
             return;
-        if (scope.getSnapshot().value?.[field] !== value)
+        const current = scope.getSnapshot().value?.[field];
+        // 对象字段（confirmOps）按 CONFIRM_OPS 逐键比对（对键序不敏感；JSON.stringify
+        // 比对会依赖两侧对象键序巧合一致）；标量直接全等
+        const same = typeof value === 'object'
+            ? CONFIRM_OPS.every((key) => current?.[key] === value[key])
+            : current === value;
+        if (!same)
             toastError(new Error(t('settings.pref.writeFailed')));
     };
     /** 标签页显隐命名空间的写后校验（与 verifyWritten 同款，命名空间独立故写队列与序号独立）。 */
@@ -195,6 +214,26 @@ export function SettingsSection(props) {
             toastError(err);
         });
     };
+    /**
+     * 切换单个确认类目：整体写合并后的 confirmOps 对象（与 hiddenTabs 整组写入同款），
+     * 乐观值顶住回显、失败回滚 + toast。总开关关闭时明细行禁用（不弹卡由总开关决定）。
+     */
+    const toggleConfirmOp = (op, next) => {
+        if (!writable || pendingOps !== undefined || !confirmWrites || confirmOps[op] === next)
+            return;
+        const merged = { ...confirmOps, [op]: next };
+        setPendingOps(merged);
+        const seq = ++writeSeqRef.current;
+        void scope.set('confirmOps', merged)
+            .then(() => {
+            setPendingOps(undefined);
+            verifyWritten(seq, 'confirmOps', merged);
+        })
+            .catch((err) => {
+            setPendingOps(undefined);
+            toastError(err);
+        });
+    };
     const commitLimit = () => {
         const raw = limitDraft;
         setLimitDraft(null);
@@ -319,7 +358,32 @@ export function SettingsSection(props) {
                 toastError(err);
             });
         },
-    }), t('settings.pref.confirmWrites')), createElement('p', { className: 'xy-hint' }, t('settings.pref.confirmWritesHint'))), createElement('label', { className: 'xy-field' }, createElement('span', { className: 'xy-field-head' }, t('settings.pref.memoryLimit')), createElement('input', {
+    }), t('settings.pref.confirmWrites')), createElement('p', { className: 'xy-hint' }, t('settings.pref.confirmWritesHint'))), 
+    // 确认类目明细（锁定删除行恒展示）：总开关关闭时整组禁用置灰——不弹卡由总开关
+    // 决定；禁用原因由组尾 hint 承担（aria-describedby 关联），不在每行重复
+    createElement('div', {
+        className: 'xy-confirm-ops',
+        role: 'group',
+        'aria-labelledby': 'xy-confirm-ops-head',
+        'aria-describedby': 'xy-confirm-ops-hint',
+    }, createElement('span', { className: 'xy-op-group-head', id: 'xy-confirm-ops-head' }, t('settings.pref.confirmOps.group')), ...CONFIRM_OPS.map((op) => createElement('label', { className: 'xy-op-row', key: op }, createElement('input', {
+        type: 'checkbox',
+        className: 'xy-toggle',
+        name: `confirmOps.${op}`,
+        checked: confirmOps[op],
+        disabled: !writable || pendingOps !== undefined || !confirmWrites,
+        onChange: (e) => toggleConfirmOp(op, e.target.checked),
+    }), t(CONFIRM_OP_LABEL_KEYS[op]))), 
+    // 锁定类目：div + 只读开关（不可交互故不用 label），说明单独一行与文字对齐
+    createElement('div', { className: 'xy-op-row xy-op-row-locked' }, createElement('input', {
+        type: 'checkbox',
+        className: 'xy-toggle',
+        name: 'confirmOps.deleteLocked',
+        checked: true,
+        readOnly: true,
+        disabled: true,
+        'aria-label': t('settings.pref.confirmOps.delete'),
+    }), createElement('span', null, t('settings.pref.confirmOps.delete'))), createElement('span', { className: 'xy-hint xy-op-locked-hint' }, t('settings.pref.confirmOps.deleteHint')), createElement('span', { className: 'xy-hint', id: 'xy-confirm-ops-hint' }, t('settings.pref.confirmOps.hint'))), createElement('label', { className: 'xy-field' }, createElement('span', { className: 'xy-field-head' }, t('settings.pref.memoryLimit')), createElement('input', {
         type: 'number', min: MEMORY_LIMIT_MIN, max: MEMORY_LIMIT_MAX,
         className: 'xy-input xy-input-num', name: 'memoryInjectLimit', inputMode: 'numeric',
         'aria-label': t('settings.pref.memoryLimit'),

package/lib/client/styles.js

@@ -60,6 +60,9 @@ export const STYLE_TEXT = `
   --xyd-on-c2:#7c4a03;
   --xyd-on-c3:#065f46;
   --xyd-on-dcell:#0b3d26;
+  /* warn-soft 底的前景伙伴（StaleBanner 文字）：壳通用次要色对琥珀柔底浅 4.19 /
+     深 2.95，跌破 WCAG 1.4.3 AA——按 ≥4.5:1 校准的专用对（on-c2 同族暖琥珀前景） */
+  --xyd-on-warn:#7c4a03;
   /* 阴影对（卡片悬停/toast/弹窗/英雄卡）：深浅各自配档，禁止正文区裸写 rgba */
   --xyd-shadow-card:0 2px 10px rgba(15,23,42,.07);
   --xyd-shadow-toast:0 8px 24px -8px rgba(15,23,42,.2),0 2px 8px -2px rgba(15,23,42,.1);
@@ -109,6 +112,7 @@ body[data-ds-dark-theme]{
   --xyd-on-c2:#ffd9a8;
   --xyd-on-c3:#a7f3c9;
   --xyd-on-dcell:#a7f3c9;
+  --xyd-on-warn:#ffd9a8;
   --xyd-shadow-card:0 2px 10px rgba(0,0,0,.32);
   --xyd-shadow-toast:0 8px 24px -8px rgba(0,0,0,.5),0 2px 8px -2px rgba(0,0,0,.35);
   --xyd-shadow-modal:0 24px 48px -16px rgba(0,0,0,.55),0 4px 12px -4px rgba(0,0,0,.4);
@@ -276,6 +280,9 @@ body[data-ds-dark-theme] .xy-badge-cat{background:hsl(var(--cat-h,275) calc(var(
 .xy-banner-ok{margin-top:10px;padding:10px 12px;border-radius:var(--xyd-r-inner);background:var(--xyd-ok-soft);border:1px solid var(--xyd-ok-border);font-size:13px}
 /* 刷新失败但旧数据仍在的诚实降级横幅：琥珀虚线面板（警示但不恐吓——动作已成功） */
 .xy-stalerow{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin-top:10px;padding:8px 12px;border:1px dashed var(--xyd-warn-border);border-radius:var(--xyd-r-inner);background:var(--xyd-warn-soft)}
+/* 提示文字用琥珀柔底的专用前景对（--xyd-on-warn）：次要通用色在此底上浅 4.19 / 深
+ * 2.95，深色远低于 AA；重试键保持 label-primary（对琥珀柔底 >10:1），无需处理 */
+.xy-stalerow .xy-meta{color:var(--xyd-on-warn)}
 .xy-stalerow .xy-btn-inline{margin-left:0}
 
 /* ===== 分组卡（任务页状态分桶 / 今日页待打卡·已完成共用）=====
@@ -518,6 +525,16 @@ button.xy-growth-col.xy-hover{box-shadow:inset 0 0 0 2px var(--xyd-accent-ring)}
 .xy-toggle::after{content:'';position:absolute;top:2px;left:2px;width:16px;height:16px;border-radius:50%;background:var(--dsw-alias-label-primary);transition:transform .15s}
 .xy-toggle:checked::after{transform:translateX(16px);background:var(--xyd-on-accent)}
 .xy-hint{color:var(--dsw-alias-label-secondary);font-size:12px;margin:0}
+/* 确认类目明细：缩进嵌在总开关下（与「总开关 + 明细」分层同构），行 = 开关 + 名称；
+ * 锁定行（删除）为只读展示，其说明行缩进与文字对齐（开关 38px + 间距 8px） */
+.xy-confirm-ops{display:flex;flex-direction:column;gap:8px;margin-left:22px}
+/* 禁用弱化必须显式写：自定义外观的 toggle 不吃原生禁用变灰，总开关关闭时明细行
+ * 否则与可用态无法区分；锁定的删除行恒禁用，常态弱化即「冻结在开启态」的语义 */
+.xy-confirm-ops .xy-toggle:disabled{opacity:.4;cursor:default}
+.xy-op-group-head{font-weight:600;font-size:13px}
+.xy-op-row{display:flex;align-items:center;gap:8px;cursor:pointer;font-size:13px}
+.xy-op-row-locked{color:var(--dsw-alias-label-secondary);cursor:default}
+.xy-op-locked-hint{padding-left:46px}
 
 /* ===== 详情聚合视图 ===== */
 /* 段间 10px 呼吸；每段内部「标签 → 内容」固定 5px 纵向节奏（label 不再与内容文字挤行）。

package/lib/client.js

@@ -268,7 +268,17 @@ const ZH_DICT = {
 	"settings.pref.notRegistered": "偏好暂不可用（组件未就绪），请稍后重试。",
 	"settings.pref.readOnly": "当前设置为只读，无法保存修改。",
 	"settings.pref.confirmWrites": "写操作二次确认",
-	"settings.pref.confirmWritesHint": "创建愿望/任务、打卡、取消打卡时先弹应用内确认卡（删除始终确认）；关闭后对话中的这类操作将直接执行。",
+	"settings.pref.confirmWritesHint": "总开关：开启后按下方类目决定是否弹确认卡，关闭后除删除（始终确认）外一律直接执行。",
+	"settings.pref.confirmOps.group": "确认类目",
+	"settings.pref.confirmOps.create": "创建愿望/任务（含微行动拆解）",
+	"settings.pref.confirmOps.checkin": "打卡",
+	"settings.pref.confirmOps.cancelCheckin": "取消打卡",
+	"settings.pref.confirmOps.claim": "领取任务",
+	"settings.pref.confirmOps.update": "修改愿望/任务/分类",
+	"settings.pref.confirmOps.memorySave": "保存记忆",
+	"settings.pref.confirmOps.delete": "删除（含批量、微行动重开）",
+	"settings.pref.confirmOps.deleteHint": "始终确认，不可关闭：删除不可恢复。",
+	"settings.pref.confirmOps.hint": "类目明细在总开关开启时生效；默认与之前版本一致。",
 	"settings.pref.memoryLimit": "记忆注入上限",
 	"settings.pref.memoryLimitHint": "每次对话自动注入上下文的记忆条数上限（5-200，默认 40）；失焦后保存。",
 	"settings.pref.limitInvalid": "请输入 5-200 的整数",
@@ -675,7 +685,17 @@ const EN_DICT = {
 	"settings.pref.notRegistered": "Preferences are unavailable right now (component not ready); please retry later.",
 	"settings.pref.readOnly": "Settings are read-only; changes cannot be saved.",
 	"settings.pref.confirmWrites": "Confirm write actions",
-	"settings.pref.confirmWritesHint": "Show an in-app confirmation before creating wishes/tasks, checking in or canceling (deletes always confirm). Turn off to execute directly.",
+	"settings.pref.confirmWritesHint": "Master switch: when on, confirmations follow the categories below; when off, everything except deletes (always confirmed) runs directly.",
+	"settings.pref.confirmOps.group": "Confirmation categories",
+	"settings.pref.confirmOps.create": "Create wishes/tasks (incl. micro-action plans)",
+	"settings.pref.confirmOps.checkin": "Check-ins",
+	"settings.pref.confirmOps.cancelCheckin": "Cancel check-ins",
+	"settings.pref.confirmOps.claim": "Claiming tasks",
+	"settings.pref.confirmOps.update": "Editing wishes/tasks/categories",
+	"settings.pref.confirmOps.memorySave": "Saving memories",
+	"settings.pref.confirmOps.delete": "Deletes (incl. batch & restarts)",
+	"settings.pref.confirmOps.deleteHint": "Always confirms and cannot be turned off; deletes are irreversible.",
+	"settings.pref.confirmOps.hint": "Category switches apply while the master switch is on; defaults match previous versions.",
 	"settings.pref.memoryLimit": "Memory injection limit",
 	"settings.pref.memoryLimitHint": "Max memories auto-injected per chat (5-200, default 40); saved when you leave the field.",
 	"settings.pref.limitInvalid": "Enter an integer between 5 and 200",
@@ -1368,6 +1388,9 @@ const STYLE_TEXT = `
   --xyd-on-c2:#7c4a03;
   --xyd-on-c3:#065f46;
   --xyd-on-dcell:#0b3d26;
+  /* warn-soft 底的前景伙伴（StaleBanner 文字）：壳通用次要色对琥珀柔底浅 4.19 /
+     深 2.95，跌破 WCAG 1.4.3 AA——按 ≥4.5:1 校准的专用对（on-c2 同族暖琥珀前景） */
+  --xyd-on-warn:#7c4a03;
   /* 阴影对（卡片悬停/toast/弹窗/英雄卡）：深浅各自配档，禁止正文区裸写 rgba */
   --xyd-shadow-card:0 2px 10px rgba(15,23,42,.07);
   --xyd-shadow-toast:0 8px 24px -8px rgba(15,23,42,.2),0 2px 8px -2px rgba(15,23,42,.1);
@@ -1417,6 +1440,7 @@ body[data-ds-dark-theme]{
   --xyd-on-c2:#ffd9a8;
   --xyd-on-c3:#a7f3c9;
   --xyd-on-dcell:#a7f3c9;
+  --xyd-on-warn:#ffd9a8;
   --xyd-shadow-card:0 2px 10px rgba(0,0,0,.32);
   --xyd-shadow-toast:0 8px 24px -8px rgba(0,0,0,.5),0 2px 8px -2px rgba(0,0,0,.35);
   --xyd-shadow-modal:0 24px 48px -16px rgba(0,0,0,.55),0 4px 12px -4px rgba(0,0,0,.4);
@@ -1584,6 +1608,9 @@ body[data-ds-dark-theme] .xy-badge-cat{background:hsl(var(--cat-h,275) calc(var(
 .xy-banner-ok{margin-top:10px;padding:10px 12px;border-radius:var(--xyd-r-inner);background:var(--xyd-ok-soft);border:1px solid var(--xyd-ok-border);font-size:13px}
 /* 刷新失败但旧数据仍在的诚实降级横幅：琥珀虚线面板（警示但不恐吓——动作已成功） */
 .xy-stalerow{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin-top:10px;padding:8px 12px;border:1px dashed var(--xyd-warn-border);border-radius:var(--xyd-r-inner);background:var(--xyd-warn-soft)}
+/* 提示文字用琥珀柔底的专用前景对（--xyd-on-warn）：次要通用色在此底上浅 4.19 / 深
+ * 2.95，深色远低于 AA；重试键保持 label-primary（对琥珀柔底 >10:1），无需处理 */
+.xy-stalerow .xy-meta{color:var(--xyd-on-warn)}
 .xy-stalerow .xy-btn-inline{margin-left:0}
 
 /* ===== 分组卡（任务页状态分桶 / 今日页待打卡·已完成共用）=====
@@ -1826,6 +1853,16 @@ button.xy-growth-col.xy-hover{box-shadow:inset 0 0 0 2px var(--xyd-accent-ring)}
 .xy-toggle::after{content:'';position:absolute;top:2px;left:2px;width:16px;height:16px;border-radius:50%;background:var(--dsw-alias-label-primary);transition:transform .15s}
 .xy-toggle:checked::after{transform:translateX(16px);background:var(--xyd-on-accent)}
 .xy-hint{color:var(--dsw-alias-label-secondary);font-size:12px;margin:0}
+/* 确认类目明细：缩进嵌在总开关下（与「总开关 + 明细」分层同构），行 = 开关 + 名称；
+ * 锁定行（删除）为只读展示，其说明行缩进与文字对齐（开关 38px + 间距 8px） */
+.xy-confirm-ops{display:flex;flex-direction:column;gap:8px;margin-left:22px}
+/* 禁用弱化必须显式写：自定义外观的 toggle 不吃原生禁用变灰，总开关关闭时明细行
+ * 否则与可用态无法区分；锁定的删除行恒禁用，常态弱化即「冻结在开启态」的语义 */
+.xy-confirm-ops .xy-toggle:disabled{opacity:.4;cursor:default}
+.xy-op-group-head{font-weight:600;font-size:13px}
+.xy-op-row{display:flex;align-items:center;gap:8px;cursor:pointer;font-size:13px}
+.xy-op-row-locked{color:var(--dsw-alias-label-secondary);cursor:default}
+.xy-op-locked-hint{padding-left:46px}
 
 /* ===== 详情聚合视图 ===== */
 /* 段间 10px 呼吸；每段内部「标签 → 内容」固定 5px 纵向节奏（label 不再与内容文字挤行）。
@@ -4838,9 +4875,12 @@ function installTabVisibility(ctx) {
 * `@deepseek-ai/dsh-settings`，绝不可进浏览器包；而设置页需要上下界与默认值
 * 做输入夹取、回显兜底与不可用态兜底。形态对标 tab-policy.ts。
 *
-* 决策口径：
-* - confirmWrites：创建/打卡/取消打卡类写操作是否二次确认，默认开；
-*   删除类始终确认，不受此开关控制（破坏性操作不设开关）。
+* 决策口径（确认分层模型见 AGENTS.md §10 决策 8）：
+* - confirmWrites：写操作总开关。关闭时除锁定类目（删除）外所有类目一律不弹确认卡；
+*   开启时按 confirmOps 各类目明细决定。默认开。
+* - confirmOps：六个可配确认类目的明细开关（创建/打卡/取消打卡/领取/修改/记忆保存），
+*   默认值 = 总开关粒度时代的现行矩阵（创建/打卡/取消默认确认，其余默认不确认）；
+*   删除为锁定类目，不设开关、始终确认（破坏性操作不设开关）。
 * - memoryInjectLimit：记忆注入条数上限，默认 40，合法区间 [5,200] 的整数。
 *   越界输入夹取到区间内并回显；非整数/非数字/空一律拒绝，不静默改值。
 * - confirmLang：对话内确认卡（HITL 卡头/按钮/问题文案）的显示语言，默认 zh。
@@ -4852,9 +4892,43 @@ function installTabVisibility(ctx) {
 const MEMORY_LIMIT_MIN = 5;
 /** 记忆注入上限的上界（含）。 */
 const MEMORY_LIMIT_MAX = 200;
+/**
+* 可配确认类目（与工具面确认挂点、设置页明细行、i18n 键三方同源，勿改语义）：
+* - create：创建愿望/任务（含批量）+ 微行动拆解；
+* - checkin / cancelCheckin：打卡 / 取消打卡；
+* - claim：领取任务（误领取不可逆，恢复 = 删除重建，故提供可开确认的档位）；
+* - update：修改愿望/任务/分类改名/记忆更新；
+* - memorySave：记忆保存。
+* 删除（含批量、微行动重开）为锁定类目，不在其中——始终确认，见 ADR-0001。
+*/
+const CONFIRM_OPS = [
+	"create",
+	"checkin",
+	"cancelCheckin",
+	"claim",
+	"update",
+	"memorySave"
+];
+/** 各类目默认值（= 2026-09 分层化之前的现行矩阵）。 */
+const CONFIRM_OP_DEFAULTS = {
+	create: true,
+	checkin: true,
+	cancelCheckin: true,
+	claim: false,
+	update: false,
+	memorySave: false
+};
+/** 脏值容错：confirmOps 快照缺键/非布尔键一律回落类目默认（与 confirmLang 同口径）。 */
+function normalizeConfirmOps(value) {
+	const source = typeof value === "object" && value !== null ? value : {};
+	const out = {};
+	for (const op of CONFIRM_OPS) out[op] = typeof source[op] === "boolean" ? source[op] : CONFIRM_OP_DEFAULTS[op];
+	return out;
+}
 /** 命名空间缺省（与 xingyuan-pref schema 默认值同源，见 src/pref-settings.ts）。 */
 const PREF_DEFAULTS = {
 	confirmWrites: true,
+	confirmOps: { ...CONFIRM_OP_DEFAULTS },
 	memoryInjectLimit: 40,
 	confirmLang: "zh"
 };
@@ -4914,6 +4988,15 @@ const TAB_LABEL_KEYS = {
 	growth: "tab.growth",
 	memory: "tab.memory"
 };
+/** 确认类目的显示名键（与 pref-policy CONFIRM_OPS 一一对应）。 */
+const CONFIRM_OP_LABEL_KEYS = {
+	create: "settings.pref.confirmOps.create",
+	checkin: "settings.pref.confirmOps.checkin",
+	cancelCheckin: "settings.pref.confirmOps.cancelCheckin",
+	claim: "settings.pref.confirmOps.claim",
+	update: "settings.pref.confirmOps.update",
+	memorySave: "settings.pref.confirmOps.memorySave"
+};
 function SettingsSection(props) {
 	const t = useXyT();
 	const scope = props.scope;
@@ -4934,6 +5017,7 @@ function SettingsSection(props) {
 	const [saving, setSaving] = (0, react.useState)(false);
 	const [savedMsg, setSavedMsg] = (0, react.useState)("");
 	const [pendingToggle, setPendingToggle] = (0, react.useState)(void 0);
+	const [pendingOps, setPendingOps] = (0, react.useState)(void 0);
 	const [pendingMode, setPendingMode] = (0, react.useState)(void 0);
 	const [pendingHidden, setPendingHidden] = (0, react.useState)(void 0);
 	const savedTimer = (0, react.useRef)(void 0);
@@ -4941,6 +5025,7 @@ function SettingsSection(props) {
 	const writeSeqRef = (0, react.useRef)(0);
 	const uiWriteSeqRef = (0, react.useRef)(0);
 	const confirmWrites = pendingToggle ?? snap.value?.confirmWrites ?? PREF_DEFAULTS.confirmWrites;
+	const confirmOps = pendingOps ?? normalizeConfirmOps(snap.value?.confirmOps);
 	const prefNoticeKey = snap.status === "loading" ? "settings.pref.loading" : snap.mode === "memory" ? "settings.pref.unavailable" : snap.status === "unavailable" ? "settings.pref.notRegistered" : !snap.writable ? "settings.pref.readOnly" : void 0;
 	const tabMode = pendingMode ?? uisnap.value?.tabVisibilityMode ?? "follow";
 	const hiddenTabs = pendingHidden ?? uisnap.value?.hiddenTabs ?? [];
@@ -5010,7 +5095,8 @@ function SettingsSection(props) {
 	*/
 	const verifyWritten = (seq, field, value) => {
 		if (seq !== writeSeqRef.current) return;
-		if (scope.getSnapshot().value?.[field] !== value) toastError(new Error(t("settings.pref.writeFailed")));
+		const current = scope.getSnapshot().value?.[field];
+		if (!(typeof value === "object" ? CONFIRM_OPS.every((key) => current?.[key] === value[key]) : current === value)) toastError(new Error(t("settings.pref.writeFailed")));
 	};
 	/** 标签页显隐命名空间的写后校验（与 verifyWritten 同款，命名空间独立故写队列与序号独立）。 */
 	const verifyUiWritten = (seq, field, value) => {
@@ -5031,6 +5117,26 @@ function SettingsSection(props) {
 			toastError(err);
 		});
 	};
+	/**
+	* 切换单个确认类目：整体写合并后的 confirmOps 对象（与 hiddenTabs 整组写入同款），
+	* 乐观值顶住回显、失败回滚 + toast。总开关关闭时明细行禁用（不弹卡由总开关决定）。
+	*/
+	const toggleConfirmOp = (op, next) => {
+		if (!writable || pendingOps !== void 0 || !confirmWrites || confirmOps[op] === next) return;
+		const merged = {
+			...confirmOps,
+			[op]: next
+		};
+		setPendingOps(merged);
+		const seq = ++writeSeqRef.current;
+		scope.set("confirmOps", merged).then(() => {
+			setPendingOps(void 0);
+			verifyWritten(seq, "confirmOps", merged);
+		}).catch((err) => {
+			setPendingOps(void 0);
+			toastError(err);
+		});
+	};
 	const commitLimit = () => {
 		const raw = limitDraft;
 		setLimitDraft(null);
@@ -5157,7 +5263,36 @@ function SettingsSection(props) {
 				toastError(err);
 			});
 		}
-	}), t("settings.pref.confirmWrites")), (0, react.createElement)("p", { className: "xy-hint" }, t("settings.pref.confirmWritesHint"))), (0, react.createElement)("label", { className: "xy-field" }, (0, react.createElement)("span", { className: "xy-field-head" }, t("settings.pref.memoryLimit")), (0, react.createElement)("input", {
+	}), t("settings.pref.confirmWrites")), (0, react.createElement)("p", { className: "xy-hint" }, t("settings.pref.confirmWritesHint"))), (0, react.createElement)("div", {
+		className: "xy-confirm-ops",
+		role: "group",
+		"aria-labelledby": "xy-confirm-ops-head",
+		"aria-describedby": "xy-confirm-ops-hint"
+	}, (0, react.createElement)("span", {
+		className: "xy-op-group-head",
+		id: "xy-confirm-ops-head"
+	}, t("settings.pref.confirmOps.group")), ...CONFIRM_OPS.map((op) => (0, react.createElement)("label", {
+		className: "xy-op-row",
+		key: op
+	}, (0, react.createElement)("input", {
+		type: "checkbox",
+		className: "xy-toggle",
+		name: `confirmOps.${op}`,
+		checked: confirmOps[op],
+		disabled: !writable || pendingOps !== void 0 || !confirmWrites,
+		onChange: (e) => toggleConfirmOp(op, e.target.checked)
+	}), t(CONFIRM_OP_LABEL_KEYS[op]))), (0, react.createElement)("div", { className: "xy-op-row xy-op-row-locked" }, (0, react.createElement)("input", {
+		type: "checkbox",
+		className: "xy-toggle",
+		name: "confirmOps.deleteLocked",
+		checked: true,
+		readOnly: true,
+		disabled: true,
+		"aria-label": t("settings.pref.confirmOps.delete")
+	}), (0, react.createElement)("span", null, t("settings.pref.confirmOps.delete"))), (0, react.createElement)("span", { className: "xy-hint xy-op-locked-hint" }, t("settings.pref.confirmOps.deleteHint")), (0, react.createElement)("span", {
+		className: "xy-hint",
+		id: "xy-confirm-ops-hint"
+	}, t("settings.pref.confirmOps.hint"))), (0, react.createElement)("label", { className: "xy-field" }, (0, react.createElement)("span", { className: "xy-field-head" }, t("settings.pref.memoryLimit")), (0, react.createElement)("input", {
 		type: "number",
 		min: 5,
 		max: 200,

package/lib/index.js

@@ -1,4 +1,5 @@
 import z from '@deepseek-ai/schemastery';
+import { storageBackendServiceKey } from '@deepseek-ai/dsh-storage';
 import { makeXingyuanStore, xingyuanDomainSpec } from './domain.js';
 import { installPrefSettings } from './pref-settings.js';
 import { registerXingyuanRoutes } from './routes/index.js';
@@ -16,8 +17,10 @@ export const Config = z.object({
     memoryListLimit: z.number().default(500),
     repairSessionLogs: z.boolean().default(true),
 });
-/** 依赖：storageDomain（领域设施）、webServer（页面路由）、sessions（活会话枚举）。 */
-export const inject = ['webServer', 'storageDomain', 'sessions'];
+/** 依赖：storageDomain（领域设施）、webServer（页面路由）、sessions（活会话枚举）、
+ *  sqlite 后端生命周期键（官方 storage 契约：数据形式提供方注入它，使激活不与
+ *  后端注册发生竞态——不依赖 patch 的行顺序）。 */
+export const inject = ['webServer', 'storageDomain', 'sessions', storageBackendServiceKey('sqlite')];
 export async function apply(ctx, config) {
     let disposed = false;
     let domain;

package/lib/pref-policy.js

@@ -5,9 +5,12 @@
  * `@deepseek-ai/dsh-settings`，绝不可进浏览器包；而设置页需要上下界与默认值
  * 做输入夹取、回显兜底与不可用态兜底。形态对标 tab-policy.ts。
  *
- * 决策口径：
- * - confirmWrites：创建/打卡/取消打卡类写操作是否二次确认，默认开；
- *   删除类始终确认，不受此开关控制（破坏性操作不设开关）。
+ * 决策口径（确认分层模型见 AGENTS.md §10 决策 8）：
+ * - confirmWrites：写操作总开关。关闭时除锁定类目（删除）外所有类目一律不弹确认卡；
+ *   开启时按 confirmOps 各类目明细决定。默认开。
+ * - confirmOps：六个可配确认类目的明细开关（创建/打卡/取消打卡/领取/修改/记忆保存），
+ *   默认值 = 总开关粒度时代的现行矩阵（创建/打卡/取消默认确认，其余默认不确认）；
+ *   删除为锁定类目，不设开关、始终确认（破坏性操作不设开关）。
  * - memoryInjectLimit：记忆注入条数上限，默认 40，合法区间 [5,200] 的整数。
  *   越界输入夹取到区间内并回显；非整数/非数字/空一律拒绝，不静默改值。
  * - confirmLang：对话内确认卡（HITL 卡头/按钮/问题文案）的显示语言，默认 zh。
@@ -21,9 +24,40 @@ export const MEMORY_LIMIT_MIN = 5;
 export const MEMORY_LIMIT_MAX = 200;
 /** 确认卡语言的可选值（schema 枚举与设置页选项同源）。 */
 export const CONFIRM_LANGS = ['zh', 'en'];
+/**
+ * 可配确认类目（与工具面确认挂点、设置页明细行、i18n 键三方同源，勿改语义）：
+ * - create：创建愿望/任务（含批量）+ 微行动拆解；
+ * - checkin / cancelCheckin：打卡 / 取消打卡；
+ * - claim：领取任务（误领取不可逆，恢复 = 删除重建，故提供可开确认的档位）；
+ * - update：修改愿望/任务/分类改名/记忆更新；
+ * - memorySave：记忆保存。
+ * 删除（含批量、微行动重开）为锁定类目，不在其中——始终确认，见 ADR-0001。
+ */
+export const CONFIRM_OPS = ['create', 'checkin', 'cancelCheckin', 'claim', 'update', 'memorySave'];
+/** 各类目默认值（= 2026-09 分层化之前的现行矩阵）。 */
+export const CONFIRM_OP_DEFAULTS = {
+    create: true,
+    checkin: true,
+    cancelCheckin: true,
+    claim: false,
+    update: false,
+    memorySave: false,
+};
+/** 脏值容错：confirmOps 快照缺键/非布尔键一律回落类目默认（与 confirmLang 同口径）。 */
+export function normalizeConfirmOps(value) {
+    const source = typeof value === 'object' && value !== null
+        ? value
+        : {};
+    const out = {};
+    for (const op of CONFIRM_OPS) {
+        out[op] = typeof source[op] === 'boolean' ? source[op] : CONFIRM_OP_DEFAULTS[op];
+    }
+    return out;
+}
 /** 命名空间缺省（与 xingyuan-pref schema 默认值同源，见 src/pref-settings.ts）。 */
 export const PREF_DEFAULTS = {
     confirmWrites: true,
+    confirmOps: { ...CONFIRM_OP_DEFAULTS },
     memoryInjectLimit: 40,
     confirmLang: 'zh',
 };

package/lib/pref-settings.js

@@ -1,10 +1,20 @@
 import z from '@deepseek-ai/schemastery';
-import { CONFIRM_LANGS, MEMORY_LIMIT_MAX, MEMORY_LIMIT_MIN, PREF_DEFAULTS, } from './pref-policy.js';
+import { CONFIRM_LANGS, CONFIRM_OP_DEFAULTS, MEMORY_LIMIT_MAX, MEMORY_LIMIT_MIN, PREF_DEFAULTS, } from './pref-policy.js';
 /** 对话偏好命名空间（client 半侧 settingsScope 同名配对，勿改；小写连字符文法由新 API 类型校验）。 */
 export const PREF_NS = 'xingyuan-pref';
 /** 配置 schema（默认值写进 schema；step(1) 让服务端也拒绝小数，防手改文档/RPC 直写）。 */
 export const PrefSettingsSchema = z.object({
     confirmWrites: z.boolean().default(PREF_DEFAULTS.confirmWrites),
+    // 确认类目明细：对象整体作为一个命名空间字段下发（客户端每次写合并后的完整对象）；
+    // 键与 pref-policy 的 CONFIRM_OPS 一一对应（测试对拍），旧存量值缺该键由 default 兜底
+    confirmOps: z.object({
+        create: z.boolean().default(CONFIRM_OP_DEFAULTS.create),
+        checkin: z.boolean().default(CONFIRM_OP_DEFAULTS.checkin),
+        cancelCheckin: z.boolean().default(CONFIRM_OP_DEFAULTS.cancelCheckin),
+        claim: z.boolean().default(CONFIRM_OP_DEFAULTS.claim),
+        update: z.boolean().default(CONFIRM_OP_DEFAULTS.update),
+        memorySave: z.boolean().default(CONFIRM_OP_DEFAULTS.memorySave),
+    }).default({ ...CONFIRM_OP_DEFAULTS }),
     memoryInjectLimit: z.number().step(1).min(MEMORY_LIMIT_MIN).max(MEMORY_LIMIT_MAX)
         .default(PREF_DEFAULTS.memoryInjectLimit),
     // schemastery 无 z.enum，两值枚举用 const+union 表达（与 ui-settings 的显隐三态同款）