@twinsearth/w2m-dsh-plugin 1.7.7 → 1.7.9

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.7.7"
+    "version": "1.7.9"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.7.7",
+      "version": "1.7.9",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "1.7.7"
+  "version": "1.7.9"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.7.7",
+  "version": "1.7.9",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,45 @@
 
 All notable changes to this project are documented here.
 
+## [1.7.9] — 2026-10-26
+
+**GPW 三项操作性问题修复：拦截即时弹选择、名单长列表折叠、名单文件防篡改。**
+
+- **名单策略调整：文件夹包含子文件夹**：名单条目按「根目录 + 全部子文件夹」递归匹配（`E:\work` 覆盖 `E:\work\a\b\c.txt`，`E:\workshop` 不会被误匹配；嵌套黑名单仍优先）；命令工具里的相对路径按会话工作区解析后再分类。新增测试覆盖递归覆盖、同前缀兄弟目录与相对路径。
+- **发布门禁稳定性**：`test/mcp-http-live.test.mjs` 的 relay 实连用例在出口网络不可达（或 MCP 工具层报 "could not reach the relay"）时明确 `skip`，网络抖动不再把 release 门禁判红；其余用例仍覆盖本地绑定行为。
+- **拦截即审批（不再静默挂起）**：`tools/pre-execute` 挂起 C 类调用后，客户端在 **composer 行**
+  （`conversation.input.left`）新增内联提示 `GpwPrompt`：显示工具名与「允许本次 / 拒绝本次 / 打开面板」；
+  多个待审批显示数量。浮窗按钮增加待审批数量徽标，`w2m-gpw-open` 事件让内联提示直接打开面板。
+- **名单折叠**：白名单、黑名单、最近被拦截默认各显示 3 条，其余通过「另有 N 个，展开 / 收起」折叠；
+  待审批项新增「加入白名单并允许」「加入黑名单并拒绝」一键动作（服务端 pending 项补充 `folder`）。
+- **名单文件防篡改（fail-closed）**：`$DSH_HOME/xclient/gpw-folders.json` 改为 **MAC 签名 v2（HMAC-SHA256）
+  + 原子写（tmp→rename）+ 写后只读 0444**。密钥在旁路 `*.key`（0600；或配置 `foldersKey` /
+  `W2M_GPW_FOLDERS_KEY`）。
+  - 外部修改（MAC 不匹配）、删除签名文件、去掉签名 → 状态 `tampered`，门控 **fail-closed**：所有命名路径的
+    调用被直接拒绝；面板显示警告并提供「重置名单（清空并重新签名）」。
+  - 旧版无签名文件在首次启动时一次性迁移为 v2；升级后再次出现的无签名/缺失文件视为篡改。
+  - 诚实边界：DSH 与插件同用户运行时，OS 只读位可被有意的进程绕过；但签名校验使**静默改名单不可能**，
+    篡改会被检测并锁定（需操作员重置）。强隔离需独立用户/服务账号（后续项）。
+- **名单继承保证**：黑白名单与其 MAC 密钥位于 `$DSH_HOME/xclient/`（插件包之外），升级、重启、卸载重装都会原样继承；只有面板中的显式「移除 / 重置名单」会改变它。新增 `test/gpw-persistence.test.mjs`（5 项）覆盖。
+- 测试：新增 test/gpw-hardening.test.mjs（8 项：签名往返、只读拒绝直写、MAC 不匹配/删除检测、legacy 标记、reset、密钥 sidecar）
+  与 test/gpw-tamper-gate.test.mjs（4 项：篡改 fail-closed → 409 → 重置恢复 → 内联审批放行；legacy 迁移；客户端内联提示/折叠/重置静态断言）。
+  reset、密钥 sidecar）。`client-bundle` 更新为五个 composer 控件；`gpw-activation` 用临时名单文件隔离，
+  不再写真实 `~/.dsh`。
+- 证据：`gpw-hardening 8/8`、`gpw-folder-policy 9/9`、`gpw-activation 4/4`、`client-bundle 26/26`（node 进程内运行）。
+
+## [1.7.8] — 2026-10-26
+
+**GPW 启用失败修复（第二个）：`TypeError: Cannot read properties of undefined (reading 'layers')`。**
+
+- 根因：v1.7.7 为做黑名单同步拒绝，在**激活期**调用根上下文的 `ctx.tools.guard()`。tools 服务是**按 agent 组合**的，
+  根作用域实例在激活阶段还没有 layer 表，于是抛 `reading 'layers'`，dsh-gpw 仍无法激活。
+- 修复：改为在 `agent/created` 监听里对**每个 agent 自己的上下文** `agent.ctx.tools.guard(...)` 注册黑名单守卫，
+  并用 `ctx.effect` 统一释放；根上下文不再读取 tools 服务（`inject` 回到只有 `permissionPresets`）。
+- 保留 `tools/pre-execute` 三分类拦截；guard 缺失的宿主不会因此激活失败（pre-execute 仍会拒绝黑名单）。
+- 回归测试升级：`test/gpw-activation.test.mjs` 现在用严格 Cordis 语义 Proxy（读取根 `tools` 即抛错）验证激活，
+  并通过伪造 `agent/created` 断言守卫注册在 agent 上下文。
+- 同时补全 bundle patch 中 GPW v2 的配置项（requireFullAccess / whitelist / blacklist / pendingTimeoutMs）。
+- 证据：`docs/acceptance/1.7.8/GPW-AGENT-SCOPE.json`。
 ## [1.7.7] — 2026-10-26
 
 **GPW 子插件启用失败修复：`cannot get property "tools" without inject`。**

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.7.7", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.7.9", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/cordis.patch.yml

@@ -134,4 +134,10 @@
         maxPerWindow: 10
         windowMs: 60000
         minGapMs: 3000
+        # v1.7.5+: only act in the 完全权限 preset; the two folder lists are the gate's policy.
+        # Folders are added at runtime from the GPW panel into $DSH_HOME/xclient/gpw-folders.json.
+        requireFullAccess: true
+        whitelist: []
+        blacklist: []
+        pendingTimeoutMs: 120000
 

package/docs/acceptance/1.7.8/GPW-AGENT-SCOPE.json

@@ -0,0 +1,21 @@
+{
+  "version": "1.7.8",
+  "case": "GPW-AGENT-SCOPE",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-25T16:57:54.149Z",
+  "executor": "lead",
+  "task_id": "local-gpw-scope-20261025165754",
+  "requirement": "enabling dsh-gpw must activate it under a full CORDIS context: no root tools read, the pre-execute gate installed, and the blacklist guard registered on each agent context",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "symptom": "TypeError: Cannot read properties of undefined (reading 'layers')",
+      "cause": "ctx.tools.guard was called at activation on the root context; the tools service is composed per agent and has no layer table there",
+      "fix": "agent/created -> agent.ctx.tools.guard per agent, disposers released through ctx.effect; inject = [permissionPresets]",
+      "regression": "test/gpw-activation.test.mjs: strict Proxy throws on undeclared/root-tools reads; activation, agent/created guard installation and source checks all pass"
+    }
+  }
+}

package/docs/acceptance/1.7.9/GPW-HARDENING.json

@@ -0,0 +1,26 @@
+{
+  "version": "1.7.9",
+  "case": "GPW-HARDENING",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-25T23:26:10.976Z",
+  "executor": "lead",
+  "task_id": "local-gpw-hardening-20261025232610",
+  "requirement": "a pending class-C call is visible and answerable inline, the three folder lists collapse after three rows, and the folder lists file is MAC-signed and read-only so an external edit is detected and fails closed until the operator resets",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "inline_prompt": "GpwPrompt is mounted on conversation.input.left (id w2m-gpw-prompt): pending count + tool name + allow/deny/open-panel; the launcher shows a badge too",
+      "collapsed_lists": "whitelist / blacklist / recently intercepted each show 3 rows, then \"另有 N 个，展开/收起\" with per-list state",
+      "signing": "v2 HMAC-SHA256 covers both lists; key from foldersKey config / W2M_GPW_FOLDERS_KEY / sidecar *.key (0600); atomic tmp->rename write then 0444 read-only",
+      "tamper_fail_closed": "missing / unreadable / bad-MAC / unsigned-after-seen -> tampered: every path-bearing call is denied (409 in clients) until POST /api/w2m/gpw/reset re-signs",
+      "legacy_migration": "an unsigned pre-1.7.9 file is migrated once, then treated as tampered if it reappears",
+      "tests": "gpw-hardening 8/8; gpw-tamper-gate 4/4; gpw-persistence 5/5; gpw-activation 4/4; gpw-folder-policy 12/12 (recursive + relative cases included); client-bundle 26/26; claims/installed-version/acceptance-doc pass",
+      "pack": "scripts/pack.mjs builds the tarball deterministically; the canonical sha256 is published on the GitHub Release asset and verified equal to the npm tarball after release",
+      "list_inheritance": "lists and MAC key live under $DSH_HOME/xclient (outside the plugin package): upgrades, restarts and uninstall/reinstall reuse the same signed file; only explicit panel actions (remove row / reset) change the lists — covered by test/gpw-persistence.test.mjs",
+      "recursive_folder_lists": "a listed folder is a root covering every subfolder (E:\\work matches E:\\work\\a\\b\\c.txt; E:\\workshop does not match); a nested blacklist root still wins; relative command paths are resolved against the session workspace before classification — covered by gpw-folder-policy tests"
+    }
+  }
+}

package/lib/client.js

@@ -155,6 +155,16 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
         gpwPendingEmpty: '当前没有待审批调用',
         gpwAllowOnce: '允许本次',
         gpwDenyOnce: '拒绝本次',
+        gpwMore: '另有 {count} 个，展开',
+        gpwFold: '收起',
+        gpwAddWhiteAllow: '加入白名单并允许',
+        gpwAddBlackDeny: '加入黑名单并拒绝',
+        gpwPendingShort: 'GPW 待审批：{tool}',
+        gpwPendingCount: '有 {count} 个调用等待审批',
+        gpwOpenPanel: '打开面板',
+        gpwTampered: '名单完整性校验失败（{reason}），名单外路径已锁定。',
+        gpwReset: '重置名单（清空并重新签名）',
+        gpwResetConfirm: '确认重置？将清空白名单和黑名单的全部条目。',
       },
       en: {
         all: 'All machines',
@@ -207,6 +217,16 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
         gpwPendingEmpty: 'No calls are waiting for approval',
         gpwAllowOnce: 'Allow this call',
         gpwDenyOnce: 'Deny this call',
+        gpwMore: 'Show {count} more',
+        gpwFold: 'Show less',
+        gpwAddWhiteAllow: 'Always allow (add to whitelist)',
+        gpwAddBlackDeny: 'Always deny (add to blacklist)',
+        gpwPendingShort: 'GPW pending: {tool}',
+        gpwPendingCount: '{count} call(s) waiting for approval',
+        gpwOpenPanel: 'Open panel',
+        gpwTampered: 'Folder lists failed integrity check ({reason}); non-listed paths are locked.',
+        gpwReset: 'Reset lists (clear + re-sign)',
+        gpwResetConfirm: 'Reset the lists? Every whitelist and blacklist entry will be cleared.',
       },
     };
 
@@ -407,6 +427,9 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
       '.w2mCap_dot[data-on="true"]{background:var(--dsw-alias-state-warn-primary)}',
         '.w2mGpw_launcher{position:fixed;right:16px;bottom:96px;z-index:55;padding:6px 10px;border-radius:var(--dsw-radius-lg);border:.5px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-1);box-shadow:var(--dsw-elevation-soft);font-size:12px;line-height:18px;color:var(--dsw-alias-label-primary);cursor:pointer}',
         '.w2mGpw_launcher:hover{background:var(--dsw-alias-bg-layer-2)}',
+        '.w2mGpw_prompt{display:flex;align-items:center;gap:6px;flex-wrap:wrap;padding:2px 4px;font-size:12px;line-height:18px;color:var(--dsw-alias-label-primary)}',
+        '.w2mGpw_promptLabel{font-size:12px;color:var(--dsw-alias-state-warn-primary,var(--dsw-alias-label-primary))}',
+        '.w2mGpw_badge{display:inline-block;min-width:16px;padding:0 5px;margin-left:4px;border-radius:999px;border:.5px solid var(--dsw-alias-state-warn-primary);color:var(--dsw-alias-state-warn-primary);background:var(--dsw-alias-bg-layer-1);font-size:11px;line-height:14px;text-align:center}',
         '.w2mGpw_overlay{position:fixed;inset:0;z-index:70;background:color-mix(in srgb, var(--dsw-alias-label-primary) 24%, transparent);display:flex;align-items:flex-end;justify-content:flex-end;padding:16px}',
         '.w2mGpw_card{width:420px;max-width:calc(100vw - 32px);max-height:min(80vh,640px);overflow:auto;box-sizing:border-box;padding:10px 12px;border-radius:var(--dsw-radius-xl);border:.5px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-1);box-shadow:var(--dsw-elevation-soft);font-size:13px;line-height:20px;color:var(--dsw-alias-label-primary);display:flex;flex-direction:column;gap:6px}',
         '.w2mGpw_head{display:flex;align-items:center;justify-content:space-between}',
@@ -545,6 +568,7 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
       const [busy, setBusy] = React.useState(false);
       const [manual, setManual] = React.useState('');
       const [badPath, setBadPath] = React.useState(null);
+      const [expanded, setExpanded] = React.useState({});
       const call = React.useCallback(async (url, init) => {
         try {
           const response = await fetch(url, { credentials: 'same-origin', headers: { accept: 'application/json', ...(init?.body === undefined ? {} : { 'content-type': 'application/json' }) }, ...init });
@@ -588,13 +612,37 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
         setBusy(true);
         try { await call('/api/w2m/gpw/decide', { method: 'POST', body: JSON.stringify({ id, decision }) }); await load(); } finally { setBusy(false); }
       };
-      const folderList = (title, list) => h('div', { key: list, className: 'w2mGpw_block' }, [
-        h('div', { key: 'title', className: 'w2mGpw_title' }, title),
-        ...(state?.folders?.[list] ?? []).map((path) => h('div', { key: path, className: 'w2mGpw_row' }, [
-          h('span', { key: 'p', className: 'w2mGpw_path', title: path }, path),
-          h('button', { key: 'x', type: 'button', className: 'w2mGpw_small', disabled: busy, onClick: () => removeFolder(list, path) }, '×'),
-        ])),
-      ]);
+      /** v1.7.9: after a tamper report the signed lists are locked until the operator resets them. */
+      const resetLists = async () => {
+        if (typeof window !== 'undefined' && typeof window.confirm === 'function' && window.confirm(t('gpwResetConfirm')) !== true) return;
+        setBusy(true);
+        try { await call('/api/w2m/gpw/reset', { method: 'POST', body: JSON.stringify({ confirm: 'reset' }) }); await load(); } finally { setBusy(false); }
+      };
+      /** v1.7.9: lists show three rows by default; the rest fold behind one toggle. */
+      const foldItems = (items, key) => (expanded[key] === true ? items : items.slice(0, 3));
+      const foldRow = (items, key) => (items.length <= 3 ? null : h('button', {
+        key: 'fold-' + key,
+        type: 'button',
+        className: 'w2mGpw_btn',
+        disabled: busy,
+        onClick: () => setExpanded((prev) => ({ ...prev, [key]: prev[key] !== true })),
+      }, expanded[key] === true ? t('gpwFold') : t('gpwMore', { count: items.length - 3 })));
+      const allowWithFolder = async (item, list) => {
+        if (typeof item?.folder !== 'string' || item.folder === '') return;
+        const added = await addFolder(list, item.folder);
+        if (added === true) await decide(item.id, list === 'whitelist' ? 'allow' : 'deny');
+      };
+      const folderList = (title, list) => {
+        const items = Array.isArray(state?.folders?.[list]) ? state.folders[list] : [];
+        return h('div', { key: list, className: 'w2mGpw_block' }, [
+          h('div', { key: 'title', className: 'w2mGpw_title' }, title),
+          ...foldItems(items, list).map((path) => h('div', { key: path, className: 'w2mGpw_row' }, [
+            h('span', { key: 'p', className: 'w2mGpw_path', title: path }, path),
+            h('button', { key: 'x', type: 'button', className: 'w2mGpw_small', disabled: busy, onClick: () => removeFolder(list, path) }, '×'),
+          ])),
+          foldRow(items, list),
+        ]);
+      };
       const recent = Array.isArray(state?.recent) ? state.recent : [];
       const pending = Array.isArray(state?.pending) ? state.pending : [];
       return h('div', { className: 'w2mGpw_overlay', role: 'dialog', 'aria-label': t('gpwTitle') }, [
@@ -604,6 +652,12 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
             h('button', { key: 'close', type: 'button', className: 'w2mGpw_close', onClick: onClose }, '×'),
           ]),
           error === null ? null : h('div', { key: 'err', className: 'w2mGpw_note' }, error),
+          state?.tampered === true ? h('div', { key: 'tampered', className: 'w2mGpw_block' }, [
+            h('div', { key: 't', className: 'w2mGpw_note' }, t('gpwTampered', { reason: state?.tampered_reason ?? '' })),
+            h('div', { key: 'a', className: 'w2mGpw_actions' }, [
+              h('button', { key: 'r', type: 'button', className: 'w2mGpw_btn', disabled: busy, onClick: resetLists }, t('gpwReset')),
+            ]),
+          ]) : null,
           h('div', { key: 'manual', className: 'w2mGpw_manual' }, [
             h('div', { key: 'label', className: 'w2mGpw_title' }, t('gpwManual')),
             h('input', {
@@ -636,6 +690,7 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
                 h('button', { key: 'b', type: 'button', className: 'w2mGpw_btn', disabled: busy, onClick: () => addFolder('blacklist', item.folder) }, t('gpwAddBlackShort')),
               ]),
             ])),
+            foldRow(recent, 'recent'),
           ]),
           pending.length === 0 ? null : h('div', { key: 'pending', className: 'w2mGpw_block' }, [
             h('div', { key: 'title', className: 'w2mGpw_title' }, t('gpwPending')),
@@ -645,6 +700,8 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
               h('div', { key: 'p2', className: 'w2mGpw_actions' }, [
                 h('button', { key: 'a', type: 'button', className: 'w2mGpw_btn', disabled: busy, onClick: () => decide(item.id, 'allow') }, t('gpwAllowOnce')),
                 h('button', { key: 'd', type: 'button', className: 'w2mGpw_btn', disabled: busy, onClick: () => decide(item.id, 'deny') }, t('gpwDenyOnce')),
+                item.folder === null || item.folder === undefined ? null : h('button', { key: 'aw', type: 'button', className: 'w2mGpw_btn', disabled: busy, onClick: () => allowWithFolder(item, 'whitelist') }, t('gpwAddWhiteAllow')),
+                item.folder === null || item.folder === undefined ? null : h('button', { key: 'ab', type: 'button', className: 'w2mGpw_btn', disabled: busy, onClick: () => allowWithFolder(item, 'blacklist') }, t('gpwAddBlackDeny')),
               ]),
             ])),
           ]),
@@ -652,22 +709,107 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
       ]);
     }
 
-    /** The floating launcher: the panel is fixed to the lower-right corner and does not consume composer space. */
+    /** The floating launcher: a pending badge, and the panel fixed to the lower-right corner. */
     function GpwLauncher({ t }) {
       const [open, setOpen] = React.useState(false);
+      const [pendingCount, setPendingCount] = React.useState(0);
+      React.useEffect(() => {
+        let alive = true;
+        const load = async () => {
+          try {
+            const response = await fetch('/api/w2m/gpw/state', { credentials: 'same-origin', headers: { accept: 'application/json' } });
+            const body = response.ok ? await response.json() : null;
+            if (alive) setPendingCount(body?.ok === true && Array.isArray(body.pending) ? body.pending.length : 0);
+          } catch {
+            if (alive) setPendingCount(0);
+          }
+        };
+        load();
+        const timer = setInterval(load, 3000);
+        const onOpen = () => setOpen(true);
+        window.addEventListener('w2m-gpw-open', onOpen);
+        return () => {
+          alive = false;
+          clearInterval(timer);
+          window.removeEventListener('w2m-gpw-open', onOpen);
+        };
+      }, []);
       return h(React.Fragment, null, [
         h('button', {
           key: 'launcher',
           type: 'button',
           className: 'w2mGpw_launcher',
-          title: t('gpwLauncher'),
+          title: pendingCount > 0 ? t('gpwPendingCount', { count: pendingCount }) : t('gpwLauncher'),
           'aria-expanded': open,
           onClick: () => setOpen((wasOpen) => !wasOpen),
-        }, t('gpwLauncher')),
+        }, [
+          t('gpwLauncher'),
+          pendingCount > 0 ? h('span', { key: 'badge', className: 'w2mGpw_badge' }, String(pendingCount)) : null,
+        ]),
         open ? h(GpwPanel, { key: 'panel', t, onClose: () => setOpen(false) }) : null,
       ]);
     }
 
+    /**
+     * v1.7.9: the inline approval prompt -- an interception asks a question in the composer row
+     * (allow once / deny once / open the panel) instead of waiting silently for the operator.
+     */
+    function GpwPrompt({ t }) {
+      const [state, setState] = React.useState(null);
+      const [busy, setBusy] = React.useState(false);
+      React.useEffect(() => {
+        let alive = true;
+        const load = async () => {
+          try {
+            const response = await fetch('/api/w2m/gpw/state', { credentials: 'same-origin', headers: { accept: 'application/json' } });
+            const body = response.ok ? await response.json() : null;
+            if (alive) setState(body);
+          } catch {
+            if (alive) setState(null);
+          }
+        };
+        load();
+        const timer = setInterval(load, 2000);
+        return () => {
+          alive = false;
+          clearInterval(timer);
+        };
+      }, []);
+      const pending = Array.isArray(state?.pending) ? state.pending : [];
+      if (pending.length === 0) return null;
+      const item = pending[0];
+      const decide = async (decision) => {
+        setBusy(true);
+        try {
+          await fetch('/api/w2m/gpw/decide', {
+            method: 'POST',
+            credentials: 'same-origin',
+            headers: { accept: 'application/json', 'content-type': 'application/json' },
+            body: JSON.stringify({ id: item.id, decision }),
+          });
+        } catch {
+          /* the next poll shows the queue again */
+        } finally {
+          setBusy(false);
+        }
+      };
+      const openPanel = () => {
+        try {
+          window.dispatchEvent(new CustomEvent('w2m-gpw-open'));
+        } catch {
+          /* no window in a headless render */
+        }
+      };
+      return h('div', { className: 'w2mGpw_prompt', 'data-w2m-gpw-prompt': 'inline' }, [
+        h('span', { key: 'label', className: 'w2mGpw_promptLabel' }, pending.length > 1
+          ? t('gpwPendingCount', { count: pending.length })
+          : t('gpwPendingShort', { tool: item.tool ?? 'tool' })),
+        h('button', { key: 'a', type: 'button', className: 'w2mGpw_btn', disabled: busy, onClick: () => decide('allow') }, t('gpwAllowOnce')),
+        h('button', { key: 'd', type: 'button', className: 'w2mGpw_btn', disabled: busy, onClick: () => decide('deny') }, t('gpwDenyOnce')),
+        h('button', { key: 'o', type: 'button', className: 'w2mGpw_btn', disabled: busy, onClick: openPanel }, t('gpwOpenPanel')),
+      ]);
+    }
+
     /** v1.6.8: one button beside the relay rows: check npm for a newer plugin, install it, ask for a restart. */
 function PluginUpdate({ t }) {
   const [state, setState] = React.useState({ status: 'idle', info: null, error: null });
@@ -1543,6 +1685,19 @@ function TargetSelect({ sessionId, locked: _locked, t }) {
         } catch (error) {
           console.error('@twinsearth/w2m-dsh-plugin: the GPW folder panel was not mounted; the rest of the page is unaffected', error);
         }
+        // v1.7.9: the inline pending prompt, mounted in the same composer row so an interception
+        // asks allow/deny immediately instead of waiting silently in the panel.
+        try {
+          slots.inject('conversation.input.left', () => slots.register({
+            name: 'conversation.input.left',
+            id: 'w2m-gpw-prompt',
+            order: 44,
+            label: 'GPW pending prompt',
+            inject: () => ({ t }),
+          }, GpwPrompt));
+        } catch (error) {
+          console.error('@twinsearth/w2m-dsh-plugin: the GPW approval prompt was not mounted; the panel still works', error);
+        }
         try {
           slots.inject('conversation.input.left', () => slots.register({
             name: 'conversation.input.left',
@@ -1601,6 +1756,7 @@ function TargetSelect({ sessionId, locked: _locked, t }) {
     exports.inject = inject;
     exports.TargetSelect = TargetSelect;
     exports.GpwLauncher = GpwLauncher;
+    exports.GpwPrompt = GpwPrompt;
       exports.FleetChat = FleetChat;
     exports.injectStyle = injectStyle;
     exports.makeTranslator = makeTranslator;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.7.7",
+  "version": "1.7.9",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {
@@ -64,7 +64,7 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:account-join": "node --test --test-force-exit test/account-join.test.mjs",
@@ -82,7 +82,7 @@
     "test:council-session": "node --test --test-force-exit test/council-session.test.mjs",
     "test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
     "test:crypto-blake2s": "node --test --test-force-exit test/crypto-blake2s.test.mjs",
-    "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs",
+    "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs",
     "test:exec-env": "node --test --test-force-exit test/exec-env-injection.test.mjs",
     "test:exit-channel": "node --test --test-force-exit test/exit-channel.test.mjs",
     "test:field-authority": "node --test --test-force-exit test/field-authority.test.mjs",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.7.7",
+  "version": "1.7.9",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/folder-policy.mjs

@@ -107,7 +107,7 @@ const COMMAND_TOOL = /^(bash|pwsh|powershell|shell|terminal|run_command|exec)$/i
  * @param {{name?: string, arguments?: string|object}} call
  * @returns {string[]} raw (not yet normalised) path candidates
  */
-export function pathsOfToolCall(call) {
+export function pathsOfToolCall(call, options = {}) {
   let args = call?.arguments;
   if (typeof args === 'string') {
     if (args.trim() === '') return [];
@@ -137,8 +137,20 @@ export function pathsOfToolCall(call) {
           : typeof call?.arguments === 'string'
             ? call.arguments
             : JSON.stringify(args ?? '');
-    const matches = text.match(/(?:[A-Za-z]:[\\/][^"'\s|;&<>]*|\\\\[^"'\s|;&<>]+|\/(?:[^"'\s|;&<>]+\/?)+)/g) ?? [];
+    const matches = text.match(/(?<![^\s"'=(])(?:[A-Za-z]:[\\/][^"'\s|;&<>]*|\\\\[^"'\s|;&<>]+|\/(?:[^"'\s|;&<>]+\/?)+)/g) ?? [];
     for (const m of matches) push(m);
+    // v1.7.9: relative tokens (sub/file.txt, ./x, ..\y) are resolved against the workspace base below, so a command
+    // that names a subfolder is classified instead of passing through as "names no path". Only tokens that actually
+    // contain a separator are taken; URLs, flags and bare words are left alone.
+    if (options.allowRelative === true) {
+      for (const token of text.split(/\s+/)) {
+        const cleaned = token.replace(/^["'(=]+|["'),;]+$/g, '');
+        if (cleaned === '' || cleaned.startsWith('-') || /^[A-Za-z][A-Za-z0-9+.-]*:/.test(cleaned)) continue;
+        if (!/[\\/]/.test(cleaned)) continue;
+        if (/[\\/]$/.test(cleaned) && cleaned.length === 1) continue;
+        push(cleaned);
+      }
+    }
   }
   return out;
 }
@@ -149,11 +161,11 @@ export function pathsOfToolCall(call) {
  * the ordinary one.
  *
  * @param {{name?: string, arguments?: string|object, whitelist?: string[], blacklist?: string[],
- *          workspace?: string|null, base?: string, platform?: string}} call
+ *          workspace?: string|null, base?: string, platform?: string, allowRelative?: boolean}} call
  * @returns {{decision: 'deny'|'allow'|'pass', path: string|null, folder: string|null, reason: string, paths: string[]}}
  */
 export function classifyToolCall(call) {
-  const candidates = pathsOfToolCall(call);
+  const candidates = pathsOfToolCall(call, { allowRelative: call.allowRelative === true });
   let weakest = { decision: 'pass', path: null, folder: null, reason: 'this call names no path', paths: [] };
   for (const candidate of candidates) {
     const result = classifyPath({

package/src/plugin/gpw.mjs

@@ -3,7 +3,7 @@
  *
  * ## The three classes and who answers
  *
- *   A. blacklist  -> denied. A synchronous `ctx.tools.guard()` is registered as well, so the denial holds no matter
+ *   A. blacklist  -> denied. A synchronous guard is registered on each agent (agent.ctx.tools.guard), so the denial holds no matter
  *                    which other pre-execute listener runs first.
  *   B. whitelist  -> allowed without a human. The whitelist is an explicit extension of the workspace (same decision,
  *                    plus the auto-approval budget below).
@@ -25,35 +25,41 @@
  *
  * ## Operator surface
  *
- * The panel is rendered by the w2m client (`lib/client.js`): a floating "GPW 文件夹" button opens the three sections
- * (whitelist / blacklist / recently intercepted) plus the pending queue. Folders can be typed (validated against the
- * filesystem here) or taken from the recently-intercepted list in one click. Lists live in a JSON file under
- * `$DSH_HOME/xclient/`, never in the profile patch.
+ * The panel is rendered by the w2m client (`lib/client.js`): a pending prompt sits inline in the composer row,
+ * and a floating "GPW 文件夹" button opens the three sections (whitelist / blacklist / recently intercepted)
+ * plus the pending queue. Folders can be typed (validated against the filesystem here) or taken from the
+ * recently-intercepted list in one click. Lists live in a MAC-signed v2 JSON file under `$DSH_HOME/xclient/`
+ * (written read-only 0444), never in the profile patch; an external edit is detected and locks class-B/C paths
+ * until the operator resets the lists.
  */
 
 import { spawn } from 'node:child_process';
-import { mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
-import { randomUUID } from 'node:crypto';
+import { createHmac, randomBytes, randomUUID } from 'node:crypto';
 
 import { classifyToolCall } from './folder-policy.mjs';
 
 export const name = 'dsh-gpw';
 
 /** Services this plugin cannot work without. `connection` is used only for the operator routes. */
-export const inject = ['permissionPresets', 'tools'];
+export const inject = ['permissionPresets'];
 
 export const FULL_ACCESS_PRESET = 'danger-full-access';
 export const GPW_ROUTE = '/api/w2m/gpw/state';
 export const GPW_FOLDERS_ROUTE = '/api/w2m/gpw/folders';
 export const GPW_DECIDE_ROUTE = '/api/w2m/gpw/decide';
 export const GPW_PICK_ROUTE = '/api/w2m/gpw/pick';
+export const GPW_RESET_ROUTE = '/api/w2m/gpw/reset';
 
 const DEFAULT_BUDGET = { maxPerWindow: 10, windowMs: 60_000, minGapMs: 3_000 };
 const DEFAULT_PENDING_TIMEOUT_MS = 120_000;
 const RECENT_LIMIT = 20;
 const NO_STORE = { 'cache-control': 'no-store' };
+/** v1.7.9: lists are MAC-signed (v2) so an external edit is detectable instead of silently trusted. */
+const FOLDERS_VERSION = 2;
+const FOLDERS_MAC_ALGO = 'sha256';
 
 /** Resolve the folders file: config first, then `$DSH_HOME/xclient/gpw-folders.json`. */
 export function foldersFileOf(config = {}) {
@@ -62,28 +68,116 @@ export function foldersFileOf(config = {}) {
   return join(home, 'xclient', 'gpw-folders.json');
 }
 
-/** Read the operator-managed lists. A missing or corrupt file is empty lists, never a crash on mount. */
-export function readFolders(file) {
+/** The sidecar file that holds the MAC key. Kept next to (never inside) the lists file. */
+export function foldersKeyFileOf(file) {
+  return `${file}.key`;
+}
+
+/**
+ * Resolve the MAC key: explicit config / env first, else a generated 32-byte key in a 0600 sidecar.
+ * `created` is true only when this call generated the key, which is what lets a legacy plain-JSON
+ * file be migrated exactly once and a later unsigned file be treated as tampering instead.
+ */
+export function ensureFoldersKey(file, config = {}) {
+  const fromConfig = typeof config.foldersKey === 'string' && config.foldersKey.trim() !== '' ? config.foldersKey.trim() : null;
+  const fromEnv = typeof process.env.W2M_GPW_FOLDERS_KEY === 'string' && process.env.W2M_GPW_FOLDERS_KEY.trim() !== ''
+    ? process.env.W2M_GPW_FOLDERS_KEY.trim()
+    : null;
+  const explicit = fromConfig ?? fromEnv;
+  if (explicit !== null) return { key: explicit, created: false, source: fromConfig !== null ? 'config' : 'env' };
+  const keyFile = foldersKeyFileOf(file);
   try {
-    const parsed = JSON.parse(readFileSync(file, 'utf8'));
-    return {
-      whitelist: Array.isArray(parsed?.whitelist) ? parsed.whitelist.filter((v) => typeof v === 'string' && v !== '') : [],
-      blacklist: Array.isArray(parsed?.blacklist) ? parsed.blacklist.filter((v) => typeof v === 'string' && v !== '') : [],
-    };
+    const existing = readFileSync(keyFile, 'utf8').trim();
+    if (existing !== '') return { key: existing, created: false, source: 'file' };
   } catch {
-    return { whitelist: [], blacklist: [] };
+    /* generated below */
   }
+  mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+  const key = randomBytes(32).toString('hex');
+  writeFileSync(keyFile, `${key}\n`, { encoding: 'utf8', mode: 0o600 });
+  try { chmodSync(keyFile, 0o600); } catch { /* best effort on Windows */ }
+  return { key, created: true, source: 'file' };
 }
 
-/** Persist the operator-managed lists. */
-export function writeFolders(file, folders) {
-  mkdirSync(dirname(file), { recursive: true });
-  const next = {
-    whitelist: [...new Set((folders?.whitelist ?? []).filter((v) => typeof v === 'string' && v.trim() !== ''))],
-    blacklist: [...new Set((folders?.blacklist ?? []).filter((v) => typeof v === 'string' && v.trim() !== ''))],
-  };
-  writeFileSync(file, JSON.stringify(next, null, 2) + '\n', 'utf8');
-  return next;
+/** Canonical MAC over the two lists (order-independent, so adding/removing a row is what changes it). */
+export function macOfFolders(whitelist, blacklist, key) {
+  const canonical = JSON.stringify({
+    whitelist: [...new Set(whitelist)].sort(),
+    blacklist: [...new Set(blacklist)].sort(),
+  });
+  return createHmac(FOLDERS_MAC_ALGO, key).update(canonical).digest('hex');
+}
+
+/**
+ * Read the operator-managed lists.
+ *
+ *   - missing file + `allowMissing` -> clean empty lists (first run)
+ *   - missing file otherwise       -> `tampered` (the signed file was deleted)
+ *   - valid v2 + MAC               -> lists
+ *   - v2 with a bad MAC            -> `tampered` (edited outside GPW)
+ *   - no version/MAC (legacy)      -> `legacy: true`; the caller migrates once or treats it as tampered
+ */
+export function readFolders(file, key = null, options = {}) {
+  let raw;
+  try {
+    raw = readFileSync(file, 'utf8');
+  } catch (error) {
+    if (error?.code === 'ENOENT' && key !== null && options.allowMissing !== true) {
+      return { whitelist: [], blacklist: [], tampered: true, reason: 'folder lists file is missing' };
+    }
+    if (error?.code !== 'ENOENT') {
+      return { whitelist: [], blacklist: [], tampered: true, reason: `folder lists unreadable: ${error?.message ?? error}` };
+    }
+    return { whitelist: [], blacklist: [], tampered: false, reason: null, legacy: false };
+  }
+  let parsed = null;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { whitelist: [], blacklist: [], tampered: true, reason: 'folder lists file is not valid JSON' };
+  }
+  const whitelist = Array.isArray(parsed?.whitelist) ? parsed.whitelist.filter((v) => typeof v === 'string' && v !== '') : [];
+  const blacklist = Array.isArray(parsed?.blacklist) ? parsed.blacklist.filter((v) => typeof v === 'string' && v !== '') : [];
+  if (parsed?.version !== FOLDERS_VERSION || typeof parsed?.mac !== 'string') {
+    return { whitelist, blacklist, tampered: false, reason: null, legacy: true };
+  }
+  if (key === null) return { whitelist, blacklist, tampered: false, reason: null, legacy: false };
+  if (macOfFolders(whitelist, blacklist, key) !== parsed.mac) {
+    return { whitelist, blacklist, tampered: true, reason: 'folder lists were modified outside GPW (MAC mismatch)' };
+  }
+  return { whitelist, blacklist, tampered: false, reason: null, legacy: false };
+}
+
+/**
+ * Persist the operator-managed lists.
+ *
+ * Atomic (tmp + rename), MAC-signed when a key is supplied, and left **read-only** (0444) so an
+ * accidental or casual edit from the agent's file tools fails instead of silently changing policy.
+ * GPW itself rewrites by clearing the flag, writing a new tmp file and renaming over the target.
+ */
+export function writeFolders(file, folders, key = null) {
+  mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+  const whitelist = [...new Set((folders?.whitelist ?? []).filter((v) => typeof v === 'string' && v.trim() !== ''))];
+  const blacklist = [...new Set((folders?.blacklist ?? []).filter((v) => typeof v === 'string' && v.trim() !== ''))];
+  const next = { version: FOLDERS_VERSION, whitelist, blacklist };
+  if (key !== null) {
+    next.algo = FOLDERS_MAC_ALGO;
+    next.mac = macOfFolders(whitelist, blacklist, key);
+  }
+  const payload = `${JSON.stringify(next, null, 2)}\n`;
+  const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+  // Windows refuses to rename over a read-only target: clear it first, then the atomic replace runs.
+  try { chmodSync(file, 0o644); } catch { /* first write */ }
+  writeFileSync(tmp, payload, { encoding: 'utf8', mode: 0o600 });
+  try { chmodSync(tmp, 0o600); } catch { /* best effort */ }
+  renameSync(tmp, file);
+  try { chmodSync(file, 0o444); } catch { /* read-only is best effort on Windows, MAC still verifies */ }
+  return { whitelist, blacklist };
+}
+
+/** Operator reset: drop every entry and re-sign. Used only after a tamper report. */
+export function resetFolders(file, key) {
+  return writeFolders(file, { whitelist: [], blacklist: [] }, key);
 }
 
 /**
@@ -229,6 +323,33 @@ export function apply(ctx, config = {}) {
   const pendingTimeoutMs = positiveInt(config.pendingTimeoutMs, DEFAULT_PENDING_TIMEOUT_MS);
   const requireFullAccess = config.requireFullAccess !== false;
   const foldersFile = foldersFileOf(config);
+  const keyInfo = ensureFoldersKey(foldersFile, config);
+  const foldersKey = keyInfo.key;
+  /** Set once the signed file has been read cleanly; a later disappearance then reads as tampering. */
+  let foldersSeen = false;
+  /** Non-null until the operator resets the lists; class-B/C paths are locked while it is set. */
+  let tamperedReason = null;
+
+  const noteTamper = (reason) => {
+    const next = reason ?? 'folder lists failed integrity check';
+    if (tamperedReason === null) ctx.logger?.warn?.(`dsh-gpw: ${next}; class-B/C paths are locked until the operator resets the lists`);
+    tamperedReason = next;
+  };
+
+  // First read: migrate a legacy plain-JSON file exactly once; after that an unsigned/missing file is tampering.
+  const initialFolders = readFolders(foldersFile, foldersKey, { allowMissing: keyInfo.created || !existsSync(foldersFile) });
+  if (initialFolders.legacy) ctx.logger?.info?.('dsh-gpw: migrating legacy folder lists to MAC-signed v2 (read-only)');
+  if (initialFolders.tampered) {
+    noteTamper(initialFolders.reason);
+  } else {
+    // Always leave a signed v2 file behind (first run creates the empty one; later runs re-sign it).
+    try {
+      writeFolders(foldersFile, initialFolders, foldersKey);
+      foldersSeen = true;
+    } catch (error) {
+      noteTamper(`folder lists could not be initialized: ${error?.message ?? error}`);
+    }
+  }
 
   /** Timestamps of auto-approvals in the current window. */
   const approvals = [];
@@ -247,11 +368,20 @@ export function apply(ctx, config = {}) {
   };
 
   const folderLists = () => {
-    const stored = readFolders(foldersFile);
+    const stored = readFolders(foldersFile, foldersKey, { allowMissing: keyInfo.created && !foldersSeen });
+    if (stored.legacy) {
+      noteTamper('folder lists lost their integrity signature (edited outside GPW?)');
+    } else if (stored.tampered) {
+      noteTamper(stored.reason);
+    } else {
+      foldersSeen = true;
+    }
     const merge = (a, b) => [...new Set([...(Array.isArray(a) ? a : []), ...b])];
     return {
       whitelist: merge(config.whitelist, stored.whitelist),
       blacklist: merge(config.blacklist, stored.blacklist),
+      tampered: tamperedReason !== null,
+      reason: tamperedReason,
     };
   };
 
@@ -322,38 +452,85 @@ export function apply(ctx, config = {}) {
   };
 
   // --- A: the blacklist denial must hold regardless of listener order -------------------------------------------------
-  let guard = null;
-  try {
-    guard = ctx.tools?.guard;
-  } catch {
-    guard = null; // older host without the guard extension: pre-execute still denies
-  }
-  guard?.((exec) => {
+  //
+  // v1.7.8: the guard is registered on each agent's own context, from an `agent/created` listener.
+  //
+  // Registering it on the root context (ctx.tools.guard at activation) crashed dsh-gpw with
+  //   TypeError: Cannot read properties of undefined (reading 'layers')
+  // because the tools service is composed per agent: the root-scope instance has no layer table yet at activation time.
+  // The documented shape for per-agent behavior is agent.ctx obtained in agent/created; the disposer is kept so an
+  // unloaded plugin cannot leave guards behind.
+  /** @type {Map<object, () => void>} */
+  const agentGuards = new Map();
+  const blacklistGuard = () => (exec) => {
     if (!isFullAccess(exec?.agent)) return undefined;
     const lists = folderLists();
-    if (lists.blacklist.length === 0) return undefined;
     const call = toolCallOf(exec);
+    if (lists.tampered) {
+      // Fail closed: while the lists cannot be trusted, every path-naming call is refused outright.
+      const probe = classifyToolCall({ ...call, whitelist: [], blacklist: [] });
+      if (probe.paths.length === 0) return undefined;
+      deniedTotal += 1;
+      noteRecent({ tool: String(call.name ?? 'tool'), decision: 'deny', reason: lists.reason, paths: probe.paths });
+      ctx.logger?.warn?.(`dsh-gpw: refused ${String(call.name ?? 'tool')} -- lists locked (${lists.reason})`);
+      return `GPW: folder lists failed integrity check (${lists.reason}); reset them in the GPW panel`;
+    }
+    if (lists.blacklist.length === 0) return undefined;
     const result = classifyToolCall({ ...call, blacklist: lists.blacklist });
     if (result.decision !== 'deny') return undefined;
     deniedTotal += 1;
     noteRecent({ tool: String(call.name ?? 'tool'), decision: 'deny', reason: result.reason, paths: result.paths });
     ctx.logger?.warn?.(`dsh-gpw: refused ${String(call.name ?? 'tool')} -- ${result.reason}`);
     return `GPW: ${result.reason}; the call was not executed`;
+  };
+  ctx.on('agent/created', ({ agent } = {}) => {
+    try {
+      const guard = agent?.ctx?.tools?.guard;
+      if (typeof guard !== 'function') return; // host without the guard extension: pre-execute still denies
+      const dispose = guard(blacklistGuard());
+      if (typeof dispose === 'function') agentGuards.set(agent, dispose);
+    } catch {
+      /* the pre-execute branch below still enforces the blacklist */
+    }
   });
+  if (typeof ctx.effect === 'function') {
+    ctx.effect(() => () => {
+      for (const dispose of agentGuards.values()) {
+        try {
+          dispose();
+        } catch {
+          /* already disposed with its agent */
+        }
+      }
+      agentGuards.clear();
+    }, 'dsh-gpw: per-agent blacklist guards');
+  }
+
 
   // --- B/C: the pre-execute gate ---------------------------------------------------------------------------------------
   ctx.on('tools/pre-execute', async (exec, next) => {
     if (requireFullAccess && !isFullAccess(exec?.agent)) return next();
     const lists = folderLists();
-    if (lists.blacklist.length === 0 && lists.whitelist.length === 0) return next();
     const call = toolCallOf(exec);
+    if (lists.tampered) {
+      // Fail closed: a tampered list file must not be able to silently turn policy off.
+      const probe = classifyToolCall({ ...call, whitelist: [], blacklist: [] });
+      if (probe.paths.length === 0) return next();
+      deniedTotal += 1;
+      noteRecent({ tool: String(call.name ?? 'tool'), decision: 'deny', reason: lists.reason, paths: probe.paths });
+      ctx.logger?.warn?.(`dsh-gpw: refused ${String(call.name ?? 'tool')} -- lists locked (${lists.reason})`);
+      return { kind: 'deny', reason: `GPW: folder lists failed integrity check (${lists.reason}); reset them in the GPW panel` };
+    }
+    if (lists.blacklist.length === 0 && lists.whitelist.length === 0) return next();
     let cwd = null;
     try {
       cwd = await ctx.workingDirectory?.ensure?.(exec.agent, exec.signal);
     } catch {
       cwd = null;
     }
-    const classification = classifyToolCall({ ...call, whitelist: lists.whitelist, blacklist: lists.blacklist, workspace: cwd ?? null });
+    // A listed folder covers its subfolders; relative command paths are resolved against the workspace so a
+    // subfolder reference is classified rather than treated as "names no path".
+    const classification = classifyToolCall({ ...call, whitelist: lists.whitelist, blacklist: lists.blacklist, workspace: cwd ?? null, base: cwd ?? undefined, allowRelative: cwd !== null });
     if (classification.decision === 'pass' && classification.paths.length === 0) return next();
     const budget = classification.decision === 'allow' ? takeBudgetSlot() : false;
     const plan = planGate({ classification, autoAllowBudgetRemaining: classification.decision === 'allow' ? budget !== false : undefined });
@@ -383,28 +560,34 @@ export function apply(ctx, config = {}) {
       path: GPW_ROUTE,
       methods: ['GET'],
       requestBody: 'buffered',
-      fetch: async () => json({
-        ok: true,
-        enabled: true,
-        require_full_access: requireFullAccess,
-        folders: folderLists(),
-        counters: { allowedTotal, pendingTotal, deniedTotal, budgetWindow: approvals.length, maxPerWindow },
-        recent: recent.map((entry) => ({
-          at: entry.at,
-          tool: entry.tool,
-          decision: entry.decision,
-          reason: entry.reason,
-          paths: entry.paths,
-          folder: entry.paths.length > 0 ? folderForPath(entry.paths[0]) : null,
-        })),
-        pending: [...pending.entries()].map(([id, entry]) => ({
-          id,
-          tool: entry.tool,
-          reason: entry.reason,
-          paths: entry.paths,
-          pending_ms: Date.now() - entry.createdAt,
-        })),
-      }),
+      fetch: async () => {
+        const lists = folderLists();
+        return json({
+          ok: true,
+          enabled: true,
+          require_full_access: requireFullAccess,
+          folders: { whitelist: lists.whitelist, blacklist: lists.blacklist },
+          tampered: lists.tampered,
+          tampered_reason: lists.reason,
+          counters: { allowedTotal, pendingTotal, deniedTotal, budgetWindow: approvals.length, maxPerWindow },
+          recent: recent.map((entry) => ({
+            at: entry.at,
+            tool: entry.tool,
+            decision: entry.decision,
+            reason: entry.reason,
+            paths: entry.paths,
+            folder: entry.paths.length > 0 ? folderForPath(entry.paths[0]) : null,
+          })),
+          pending: [...pending.entries()].map(([id, entry]) => ({
+            id,
+            tool: entry.tool,
+            reason: entry.reason,
+            paths: entry.paths,
+            folder: entry.paths.length > 0 ? folderForPath(entry.paths[0]) : null,
+            pending_ms: Date.now() - entry.createdAt,
+          })),
+        });
+      },
     });
 
     registry.register({
@@ -421,23 +604,58 @@ export function apply(ctx, config = {}) {
         const list = body?.list;
         if (list !== 'whitelist' && list !== 'blacklist') return json({ ok: false, error: 'list must be whitelist or blacklist' }, 400);
         if (body?.action !== 'add' && body?.action !== 'remove') return json({ ok: false, error: 'action must be add or remove' }, 400);
+        const current = folderLists();
+        if (current.tampered) {
+          return json({ ok: false, error: `folder lists are locked after an integrity failure (${current.reason}); reset them first` }, 409);
+        }
+        const stored = readFolders(foldersFile, foldersKey, { allowMissing: true });
         if (body.action === 'remove') {
           if (typeof body?.path !== 'string' || body.path.trim() === '') return json({ ok: false, error: 'path must be a non-empty string' }, 400);
-          const stored = readFolders(foldersFile);
           const next = { ...stored, [list]: stored[list].filter((entry) => entry !== body.path) };
-          writeFolders(foldersFile, next);
+          try {
+            writeFolders(foldersFile, next, foldersKey);
+          } catch (error) {
+            return json({ ok: false, error: `could not write folder lists: ${error?.message ?? error}` }, 500);
+          }
           return json({ ok: true, folders: folderLists() });
         }
         const validated = validateFolderInput(body?.path);
         if (!validated.ok) return json({ ok: false, error: validated.error }, 400);
-        const stored = readFolders(foldersFile);
         const next = { ...stored, [list]: [...new Set([...stored[list], validated.path])] };
-        writeFolders(foldersFile, next);
+        try {
+          writeFolders(foldersFile, next, foldersKey);
+        } catch (error) {
+          return json({ ok: false, error: `could not write folder lists: ${error?.message ?? error}` }, 500);
+        }
         ctx.logger?.info?.(`dsh-gpw: added ${validated.path} to ${list}`);
         return json({ ok: true, folders: folderLists() });
       },
     });
 
+    registry.register({
+      path: GPW_RESET_ROUTE,
+      methods: ['POST'],
+      requestBody: 'buffered',
+      fetch: async (request) => {
+        let body = null;
+        try {
+          body = await request.json();
+        } catch {
+          /* refused below */
+        }
+        if (body?.confirm !== 'reset') return json({ ok: false, error: "confirm must be the string 'reset'" }, 400);
+        try {
+          resetFolders(foldersFile, foldersKey);
+        } catch (error) {
+          return json({ ok: false, error: `could not reset folder lists: ${error?.message ?? error}` }, 500);
+        }
+        tamperedReason = null;
+        foldersSeen = true;
+        ctx.logger?.warn?.('dsh-gpw: folder lists were reset by the operator; all entries cleared and re-signed');
+        return json({ ok: true, tampered: false, folders: folderLists() });
+      },
+    });
+
     registry.register({
       path: GPW_DECIDE_ROUTE,
       methods: ['POST'],

package/src/plugin/tools.mjs

@@ -283,7 +283,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.7.7';
+const PLUGIN_VERSION = '1.7.9';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;