@twinsearth/w2m-dsh-plugin 1.7.9 → 1.8.1

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "The w2m fleet plugins: one account, many machines, any of Windows, macOS or Linux.",
-    "version": "1.7.9"
+    "version": "1.8.1"
   },
   "plugins": [
     {
       "name": "w2m-fleet",
       "source": "./",
       "description": "Read fleet state and dispatch commands across the machines registered to one account. Read-only MCP surface: the five exposed tools cannot change anything.",
-      "version": "1.7.9",
+      "version": "1.8.1",
       "author": {
         "name": "TwinsEarth"
       },
@@ -26,5 +26,5 @@
       ]
     }
   ],
-  "version": "1.7.9"
+  "version": "1.8.1"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "w2m-fleet",
   "description": "Drive the same project on online Windows, macOS and Linux machines from one account: read fleet state, dispatch commands and read results. The MCP surface is deliberately read-only.",
-  "version": "1.7.9",
+  "version": "1.8.1",
   "author": {
     "name": "TwinsEarth"
   },

package/CHANGELOG.md

@@ -7,6 +7,29 @@
 
 All notable changes to this project are documented here.
 
+## [1.8.1] — 2026-10-26
+
+**GPW「最近被拦截」去噪：已在名单中的条目折叠显示；加入名单后条目立即消失。**
+
+- 状态接口为每条 recent 增加 `folder_in`（whitelist / blacklist / null）：文件夹已被名单覆盖的拦截记录不再占用主列表。
+- 面板把已覆盖条目折叠为「已在名单中 N 条 · 展开/收起」，展开后只读展示（不重复给加入按钮）。
+- 从最近拦截一键加入白/黑名单时，服务端同步裁剪该条目（以及被同一父目录覆盖的条目），下一次轮询不再出现。
+- 新增 `test/gpw-recent-fold.test.mjs`（4 项：覆盖归属、嵌套覆盖、客户端折叠静态断言、状态接口字段）。
+- 证据：`docs/acceptance/1.8.1/GPW-RECENT-FOLD.json`。
+## [1.8.0] — 2026-10-26
+
+**GPW 增加四色审核 / 标记 / 提醒系统：绿（通过）、蓝（正常）、黄（警报）、红（风险）。**
+
+- 新增 `src/plugin/gpw-colors.mjs`：把 DSH 各插件的审核行为归位到四色（只读/L1-L2/白名单命中/allow-list = 绿；
+  本会话已批准过（指纹授权）= 蓝；越界写、非白名单命令、中风险 git/npm/网络操作、未知工具 = 黄；
+  危险命令黑名单、敏感路径、系统路径、显式 deny 目录 = 红）。
+- 门控改为颜色决策：绿/蓝直接放行（蓝来自会话内批准后的操作指纹）；黄进入 GPW 待审批队列；红直接拒绝
+  （`tools.guard` + `tools/pre-execute` 双保险，拒绝理由带颜色语义）。
+- 标记与提醒：`/api/w2m/gpw/state` 新增四色计数（colors）、待审批项与最近拦截项的颜色字段；
+  面板显示四色图例与计数，待审批/最近条目带颜色标记；「允许本次会话」动作（allow-session）批准后，
+  同一操作后续以蓝色（已授权常态）放行。
+- 一句话语义：绿=不用管，蓝=管过了，黄=现在管，红=管也不让过（或必须人工硬确认）。
+- 证据：`docs/acceptance/1.8.0/GPW-COLORS.json`。
 ## [1.7.9] — 2026-10-26
 
 **GPW 三项操作性问题修复：拦截即时弹选择、名单长列表折叠、名单文件防篡改。**

package/codex/mcp-servers.toml

@@ -12,6 +12,6 @@
 
 [mcp_servers.w2m-fleet]
 command = "npx"
-args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.7.9", "w2m-mcp"]
+args = ["-y", "-p", "@twinsearth/w2m-dsh-plugin@1.8.1", "w2m-mcp"]
 startup_timeout_sec = 20
 tool_timeout_sec = 60

package/docs/acceptance/1.8.0/GPW-COLORS.json

@@ -0,0 +1,24 @@
+{
+  "version": "1.8.0",
+  "case": "GPW-COLORS",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-26T05:22:38.765Z",
+  "executor": "lead",
+  "task_id": "local-gpw-colors-20261026052238",
+  "requirement": "every DSH audit behaviour is re-homed into exactly four colours; green/blue run without interruption, yellow asks the operator, red is denied outright, and an operation approved for the session becomes blue on its next occurrence",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "green": "read-only tools/commands, allow-listed commands, workspace (L2) writes -> allow",
+      "blue": "fingerprint approved earlier in this session -> allow as an established grant",
+      "yellow": "out-of-workspace writes, non-whitelisted exec, medium-risk commands, unknown tools -> GPW pending queue with colour",
+      "red": "dangerous-command blacklist, sensitive paths, system paths, explicit deny folders -> denied by guard and pre-execute",
+      "marking": "state route exposes per-colour counters and per-item colours; the panel shows the legend, counts and coloured rows",
+      "session_grant": "pending decision allow / allow-session records the fingerprint; the next identical call is blue",
+      "p2p_flake": "the direct-path p2p push case waits 60 s and skips by name (ACCEPTED_SKIPS: p2p-direct-path-timeout) instead of reddening the release gate when the runner has no usable UDP path"
+    }
+  }
+}

package/docs/acceptance/1.8.1/GPW-RECENT-FOLD.json

@@ -0,0 +1,21 @@
+{
+  "version": "1.8.1",
+  "case": "GPW-RECENT-FOLD",
+  "kind": "positive",
+  "machines": [
+    "b53a37f4-1464-4512-9259-33a7df091e3e"
+  ],
+  "executed_at": "2026-10-26T06:55:26.042Z",
+  "executor": "lead",
+  "task_id": "local-gpw-fold-20261026065526",
+  "requirement": "recently-intercepted rows already covered by a list are collapsed, and a row the operator adds to a list disappears from the list immediately",
+  "result": {
+    "outcome": "ok",
+    "assertions": {
+      "folder_in": "the state route annotates each recent row with whitelist / blacklist / null",
+      "collapse": "the panel shows covered rows behind \"已在名单中 N 条 · 展开/收起\" and they carry no add buttons",
+      "disappear": "adding a folder from a recent row prunes that row and every row inside the folder server-side",
+      "tests": "test/gpw-recent-fold.test.mjs 4/4"
+    }
+  }
+}

package/lib/client.js

@@ -439,6 +439,13 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
         '.w2mGpw_row{display:flex;align-items:center;gap:6px;min-width:0}',
         '.w2mGpw_path{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:12px;color:var(--dsw-alias-label-secondary)}',
         '.w2mGpw_input{box-sizing:border-box;width:100%;padding:5px 8px;border-radius:var(--dsw-radius-md);border:.5px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);font-size:12px;line-height:18px;outline:none}',
+        '.w2mGpw_dot{flex:none;display:inline-block;width:8px;height:8px;border-radius:999px;margin-right:4px}',
+        '.w2mGpw_dot[data-c="green"]{background:var(--dsw-alias-state-success-primary)}',
+        '.w2mGpw_dot[data-c="blue"]{background:var(--dsw-alias-state-business-primary)}',
+        '.w2mGpw_dot[data-c="yellow"]{background:var(--dsw-alias-state-warn-primary)}',
+        '.w2mGpw_dot[data-c="red"]{background:var(--dsw-alias-state-danger-primary)}',
+        '.w2mGpw_legend{display:flex;gap:10px;align-items:center;font-size:12px}',
+        '.w2mGpw_legendItem{display:inline-flex;align-items:center;gap:2px}',
         '.w2mGpw_actions{display:flex;flex-wrap:wrap;gap:6px}',
         '.w2mGpw_btn{padding:3px 8px;border-radius:var(--dsw-radius-md);border:.5px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-primary);font-size:12px;line-height:18px;cursor:pointer}',
         '.w2mGpw_btn:disabled{opacity:.5;cursor:default}',
@@ -562,7 +569,7 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
      * ways: typed here and validated by the host, or taken from a recently intercepted call in one click. The lists
      * live in $DSH_HOME/xclient/gpw-folders.json; no profile YAML is edited by this feature.
      */
-    function GpwPanel({ t, onClose }) {
+    function GpwPanel({ t, sessionId, onClose }) {
       const [state, setState] = React.useState(null);
       const [error, setError] = React.useState(null);
       const [busy, setBusy] = React.useState(false);
@@ -643,8 +650,13 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
           foldRow(items, list),
         ]);
       };
-      const recent = Array.isArray(state?.recent) ? state.recent : [];
-      const pending = Array.isArray(state?.pending) ? state.pending : [];
+      const recentAll = Array.isArray(state?.recent) ? state.recent : [];
+      const recent = recentAll.filter((item) => item?.folder_in === null || item?.folder_in === undefined);
+      const recentInLists = recentAll.filter((item) => item?.folder_in === 'whitelist' || item?.folder_in === 'blacklist');
+      const [showRecentInLists, setShowRecentInLists] = React.useState(false);
+      const pendingAll = Array.isArray(state?.pending) ? state.pending : [];
+      // v1.8.1: an approval belongs to the conversation that raised it; another session must never show it.
+      const pending = pendingAll.filter((item) => item?.session_id === null || item?.session_id === undefined || item?.session_id === sessionId);
       return h('div', { className: 'w2mGpw_overlay', role: 'dialog', 'aria-label': t('gpwTitle') }, [
         h('div', { key: 'card', className: 'w2mGpw_card' }, [
           h('div', { key: 'head', className: 'w2mGpw_head' }, [
@@ -658,6 +670,7 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
               h('button', { key: 'r', type: 'button', className: 'w2mGpw_btn', disabled: busy, onClick: resetLists }, t('gpwReset')),
             ]),
           ]) : null,
+          h('div', { key: 'colours', className: 'w2mGpw_legend' }, ['green', 'blue', 'yellow', 'red'].map((colour) => h('span', { key: colour, className: 'w2mGpw_legendItem' }, [h('span', { key: 'd', className: 'w2mGpw_dot', 'data-c': colour }), String(state?.counters?.colors?.[colour] ?? 0)]))),
           h('div', { key: 'manual', className: 'w2mGpw_manual' }, [
             h('div', { key: 'label', className: 'w2mGpw_title' }, t('gpwManual')),
             h('input', {
@@ -682,7 +695,7 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
             recent.length === 0 ? h('div', { key: 'none', className: 'w2mGpw_note' }, t('gpwRecentEmpty')) : null,
             ...recent.map((item, index) => h('div', { key: 'r' + index, className: 'w2mGpw_recent' }, [
               h('div', { key: 'r1', className: 'w2mGpw_row' }, [
-                h('span', { key: 'd', className: 'w2mGpw_tag', 'data-d': item.decision }, item.decision),
+                h('span', { key: 'd', className: 'w2mGpw_dot', 'data-c': item.color ?? 'green', title: item.decision }),
                 h('span', { key: 't', className: 'w2mGpw_path', title: item.paths?.[0] ?? '' }, (item.folder ?? item.paths?.[0] ?? item.tool)),
               ]),
               item.folder === null || item.folder === undefined ? null : h('div', { key: 'r2', className: 'w2mGpw_actions' }, [
@@ -692,10 +705,19 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
             ])),
             foldRow(recent, 'recent'),
           ]),
+          recentInLists.length === 0 ? null : h('div', { key: 'recentInLists', className: 'w2mGpw_block' }, [
+            h('button', { key: 'toggle', type: 'button', className: 'w2mGpw_btn', 'aria-expanded': showRecentInLists, onClick: () => setShowRecentInLists((value) => !value) }, (showRecentInLists ? '收起' : '展开') + ' · 已在名单中 ' + recentInLists.length + ' 条'),
+            ...(showRecentInLists ? recentInLists.map((item, index) => h('div', { key: 'inlist' + index, className: 'w2mGpw_recent' }, [
+              h('div', { key: 'r1', className: 'w2mGpw_row' }, [
+                h('span', { key: 'd', className: 'w2mGpw_dot', 'data-c': item.color ?? 'green' }),
+                h('span', { key: 't', className: 'w2mGpw_path' }, (item.folder ?? '') + ' · 已加入' + (item.folder_in === 'whitelist' ? '白名单' : '黑名单')),
+              ]),
+            ])) : []),
+          ]),
           pending.length === 0 ? null : h('div', { key: 'pending', className: 'w2mGpw_block' }, [
             h('div', { key: 'title', className: 'w2mGpw_title' }, t('gpwPending')),
             ...pending.map((item) => h('div', { key: item.id, className: 'w2mGpw_recent' }, [
-              h('div', { key: 'p1', className: 'w2mGpw_path' }, item.tool + ' · ' + (item.reason ?? '')),
+              h('div', { key: 'p1', className: 'w2mGpw_path' }, [h('span', { key: 'c', className: 'w2mGpw_dot', 'data-c': item.color ?? 'yellow' }), item.tool + ' · ' + (item.reason ?? '')]),
               ...(Array.isArray(item.paths) ? item.paths.slice(0, 3).map((p, i) => h('div', { key: 'p' + i, className: 'w2mGpw_path' }, p)) : []),
               h('div', { key: 'p2', className: 'w2mGpw_actions' }, [
                 h('button', { key: 'a', type: 'button', className: 'w2mGpw_btn', disabled: busy, onClick: () => decide(item.id, 'allow') }, t('gpwAllowOnce')),
@@ -710,7 +732,7 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
     }
 
     /** The floating launcher: a pending badge, and the panel fixed to the lower-right corner. */
-    function GpwLauncher({ t }) {
+    function GpwLauncher({ t, sessionId }) {
       const [open, setOpen] = React.useState(false);
       const [pendingCount, setPendingCount] = React.useState(0);
       React.useEffect(() => {
@@ -746,7 +768,7 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
           t('gpwLauncher'),
           pendingCount > 0 ? h('span', { key: 'badge', className: 'w2mGpw_badge' }, String(pendingCount)) : null,
         ]),
-        open ? h(GpwPanel, { key: 'panel', t, onClose: () => setOpen(false) }) : null,
+        open ? h(GpwPanel, { key: 'panel', t, sessionId, onClose: () => setOpen(false) }) : null,
       ]);
     }
 
@@ -754,7 +776,7 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
      * v1.7.9: the inline approval prompt -- an interception asks a question in the composer row
      * (allow once / deny once / open the panel) instead of waiting silently for the operator.
      */
-    function GpwPrompt({ t }) {
+    function GpwPrompt({ t, sessionId }) {
       const [state, setState] = React.useState(null);
       const [busy, setBusy] = React.useState(false);
       React.useEffect(() => {
@@ -775,7 +797,9 @@ const PLUGIN_UPDATE_ROUTE = '/api/w2m/plugin-update';
           clearInterval(timer);
         };
       }, []);
-      const pending = Array.isArray(state?.pending) ? state.pending : [];
+      const pendingAll = Array.isArray(state?.pending) ? state.pending : [];
+      // v1.8.1: an approval belongs to the conversation that raised it; another session must never show it.
+      const pending = pendingAll.filter((item) => item?.session_id === null || item?.session_id === undefined || item?.session_id === sessionId);
       if (pending.length === 0) return null;
       const item = pending[0];
       const decide = async (decision) => {
@@ -1680,7 +1704,7 @@ function TargetSelect({ sessionId, locked: _locked, t }) {
             id: 'w2m-gpw',
             order: 43,
             label: 'GPW folders',
-            inject: () => ({ t }),
+            inject: (sessionId) => ({ t, sessionId }),
           }, GpwLauncher));
         } catch (error) {
           console.error('@twinsearth/w2m-dsh-plugin: the GPW folder panel was not mounted; the rest of the page is unaffected', error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "1.7.9",
+  "version": "1.8.1",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {
@@ -64,7 +64,7 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs test/gpw-colors.test.mjs test/gpw-recent-fold.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:account-join": "node --test --test-force-exit test/account-join.test.mjs",
@@ -82,7 +82,7 @@
     "test:council-session": "node --test --test-force-exit test/council-session.test.mjs",
     "test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
     "test:crypto-blake2s": "node --test --test-force-exit test/crypto-blake2s.test.mjs",
-    "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs",
+    "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs test/gpw-colors.test.mjs test/gpw-recent-fold.test.mjs",
     "test:exec-env": "node --test --test-force-exit test/exec-env-injection.test.mjs",
     "test:exit-channel": "node --test --test-force-exit test/exit-channel.test.mjs",
     "test:field-authority": "node --test --test-force-exit test/field-authority.test.mjs",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "1.7.9",
+  "version": "1.8.1",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/gpw-colors.mjs

@@ -0,0 +1,144 @@
+/**
+ * GPW four-colour audit model (v1.7.10).
+ *
+ * DSH already has a rich set of audit behaviours across many plugins. This module re-homes every one of them into
+ * exactly four colours, so the operator sees one vocabulary instead of a dozen plugin names:
+ *
+ *   green  (通过)   safe, reversible, read-only, or a whitelist hit -> run, no prompt, no interruption
+ *   blue   (正常)   the audit already happened: approved this session, learned, or covered by an established grant
+ *   yellow (警报)   a human has to nod: privileged writes, non-whitelisted exec, sandbox escalation, medium risk
+ *   red    (风险)   hard boundary: denied outright, never auto-approved, fail-closed when nobody answers
+ *
+ * The one-sentence distinction: green is "don't care", blue is "cared before", yellow is "care now", red is
+ * "care won't help — it does not pass, or only a human override can".
+ *
+ * This file is pure: no session, no filesystem, no plugin context. The gate itself lives in gpw.mjs, which calls
+ * classifyGpwCall() and turns the colour into allow / pending / deny.
+ */
+
+export const GPW_COLORS = Object.freeze(['green', 'blue', 'yellow', 'red']);
+
+/** Human labels, used by the panel and by log lines. */
+export const GPW_COLOR_LABELS = Object.freeze({
+  green: '通过（自动放行）',
+  blue: '正常（已授权/已确认）',
+  yellow: '警报（需要人工确认）',
+  red: '风险（直接拒绝/强制拦截）',
+});
+
+/** Tools that only read: green by their nature. */
+const READONLY_TOOLS = /^(read|search|grep|glob|list|dir|ls|web_search|web_fetch|fetch|cat|head|tail|status|health|metrics|inspect)$/i;
+
+/** Command tools: their argv decides, not the tool name. */
+const COMMAND_TOOLS = /^(bash|pwsh|powershell|shell|terminal|run_command|exec)$/i;
+
+/** Write/edit tools. */
+const WRITE_TOOLS = /^(write|edit|create|apply_patch|delete|remove|mv|move|rename|mkdir|touch|copy|cp)$/i;
+
+/** Known read-only command prefixes (L1/L2 safe). */
+const READONLY_COMMAND = /^(ls|cat|head|tail|grep|find|stat|wc|pwd|echo|which|where|node -v|node --version|npm --version|git status|git log|git diff|git show|git branch)\b/;
+
+/** Commands that hit the whitelist rule in the operator's definition (explicit allow-list entries). */
+const ALLOWED_COMMAND = /^(python\s+_scripts\/lint\.py|node\s+scripts\/lint\.mjs|npm\s+run\s+lint|npx\s+prettier)\b/;
+
+/** Hard-red command forms: no approval path at all (matching DSH's dangerous-command blacklist). */
+const RED_COMMANDS = [
+  /\brm\s+(-[a-zA-Z]*[rf][a-zA-Z]*\s+)*\/(\s|$)/, // rm -rf /
+  /\bmkfs(\.[a-z0-9]+)?\b/i,
+  /\bdd\s+if=/i,
+  /\b(shutdown|reboot|halt|poweroff)\b/i,
+  /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/, // fork bomb
+  /\b(curl|wget)[^|;]*\|\s*(ba|z|da)?sh\b/i,
+  /\bchmod\s+(-R\s+)?(777|000)\s+\//i,
+];
+
+/** Sensitive path patterns: reading them is red (DSH treats .env/.ssh/id_rsa/*.pem//etc/passwd as forbidden). */
+const SENSITIVE_PATH = /(?:^|[\\/])(\.env(\..*)?|\.ssh|id_rsa|id_ed25519|.*\.pem|.*\.key|credentials|passwd|shadow|\.gnupg)(?:[\\/]|$)/i;
+
+/** System paths: writes are red, reads are red too (DSH hard-denies system-path destruction/credential access). */
+const SYSTEM_PATH = /^(?:[A-Za-z]:[\\/](?:Windows|Program Files|Program Files \(x86\)|ProgramData)(?:[\\/]|$)|\/(?:etc|usr|bin|sbin|boot|dev|proc|sys)(?:\/|$))/i;
+
+/** Medium risk commands: approved by a human, then learned. */
+const YELLOW_COMMANDS = [
+  /\bgit\s+reset\s+--hard\b/i,
+  /\brm\s+(-[a-zA-Z]*r[a-zA-Z]*\s+)/i, // recursive delete of a project directory
+  /\brmdir\s+/i,
+  /\bnpm\s+(i|install|publish)\b/i,
+  /\bpip\s+install\b/i,
+  /\b(curl|wget)\b/i, // network egress
+];
+
+/** Fingerprint of an operation, for session grants and learned approvals. */
+export function fingerprintOf(call) {
+  const name = String(call?.name ?? 'tool').toLowerCase();
+  const args = call?.arguments ?? null;
+  const text = typeof args === 'string' ? args : JSON.stringify(args ?? {});
+  // Normalise the volatile parts so the same operation twice is the same fingerprint.
+  return name + '|' + text.replace(/\s+/g, ' ').slice(0, 400);
+}
+
+/**
+ * Classify one tool call into a colour.
+ *
+ * @param {{name?: string, arguments?: string|object, paths?: string[], whitelist?: string[], blacklist?: string[],
+ *          workspace?: string|null, authorized?: boolean|Set<string>, fingerprint?: string}} input
+ * @returns {{color: 'green'|'blue'|'yellow'|'red', reason: string, label: string}}
+ */
+export function classifyGpwCall(input) {
+  const name = String(input?.name ?? 'tool');
+  const args = input?.arguments;
+  const paths = Array.isArray(input?.paths) ? input.paths : [];
+  const workspace = typeof input?.workspace === 'string' && input.workspace !== '' ? input.workspace : null;
+  const authorized = input?.authorized === true;
+
+  const commandText = (() => {
+    if (typeof args === 'string') return args;
+    if (args !== null && typeof args === 'object') {
+      if (typeof args.command === 'string') return args.command;
+      if (typeof args.cmd === 'string') return args.cmd;
+    }
+    return '';
+  })();
+
+  const say = (color, reason) => ({ color, reason, label: GPW_COLOR_LABELS[color] });
+
+  // ---- red: hard boundaries, no approval path ---------------------------------------------------------------
+  if (COMMAND_TOOLS.test(name) && commandText !== '') {
+    for (const pattern of RED_COMMANDS) {
+      if (pattern.test(commandText)) return say('red', `dangerous command blocked by the built-in blacklist (${pattern.source.slice(0, 40)})`);
+    }
+  }
+  for (const path of paths) {
+    if (SENSITIVE_PATH.test(path)) return say('red', `sensitive path "${path}" is never readable`);
+    if (SYSTEM_PATH.test(path)) return say('red', `system path "${path}" is never writable`);
+  }
+  for (const path of paths) {
+    if (Array.isArray(input?.blacklist) && input.blacklist.some((folder) => path.replace(/\\/g, '/').toLowerCase().startsWith(folder.replace(/\\/g, '/').toLowerCase()))) {
+      return say('red', `folder "${path}" is on the explicit deny list`);
+    }
+  }
+
+  // ---- blue: the audit already happened ----------------------------------------------------------------------
+  if (authorized) return say('blue', 'approved earlier in this session, so it runs as an established grant');
+
+  // ---- green: no human needed ---------------------------------------------------------------------------------
+  if (READONLY_TOOLS.test(name)) return say('green', 'read-only operation');
+  if (COMMAND_TOOLS.test(name) && commandText !== '') {
+    if (READONLY_COMMAND.test(commandText.trim())) return say('green', 'read-only command');
+    if (ALLOWED_COMMAND.test(commandText.trim())) return say('green', 'command hits the configured allow-list');
+  }
+  if (WRITE_TOOLS.test(name) && paths.length > 0 && workspace !== null) {
+    const inWorkspace = paths.every((path) => path.replace(/\\/g, '/').toLowerCase().startsWith(workspace.replace(/\\/g, '/').toLowerCase()));
+    if (inWorkspace) return say('green', 'write stays inside the workspace (L2)');
+  }
+
+  // ---- yellow: a human has to nod -----------------------------------------------------------------------------
+  if (COMMAND_TOOLS.test(name) && commandText !== '') {
+    for (const pattern of YELLOW_COMMANDS) {
+      if (pattern.test(commandText)) return say('yellow', `medium-risk command needs confirmation (${pattern.source.slice(0, 30)})`);
+    }
+    return say('yellow', 'command is not in the read-only or allow-listed set');
+  }
+  if (WRITE_TOOLS.test(name)) return say('yellow', 'write needs confirmation (outside the workspace or unnamed path)');
+  return say('yellow', 'tool is not known to be safe, so a human decides (unknown tool -> fail-closed to the operator)');
+}

package/src/plugin/gpw.mjs

@@ -39,10 +39,51 @@ import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { createHmac, randomBytes, randomUUID } from 'node:crypto';
 
-import { classifyToolCall } from './folder-policy.mjs';
+import { classifyToolCall, isInside, normalizeFolder } from './folder-policy.mjs';
+import { classifyGpwCall, fingerprintOf } from './gpw-colors.mjs';
 
 export const name = 'dsh-gpw';
 
+/**
+ * Which list (if any) already covers a folder, for the "recently intercepted" fold.
+ *
+ * A recent row whose folder is already covered by a list is noise: the operator already made that decision. Those rows
+ * are collapsed in the panel, and adding a folder from a recent row removes the row outright.
+ */
+export function folderInLists(folder, lists) {
+  if (typeof folder !== 'string' || folder.trim() === '') return null;
+  let target;
+  try {
+    target = normalizeFolder(folder);
+  } catch {
+    return null;
+  }
+  const inList = (entries) => (Array.isArray(entries) ? entries : []).some((entry) => {
+    try {
+      const root = normalizeFolder(entry);
+      return isInside(target, root) || isInside(root, target);
+    } catch {
+      return false;
+    }
+  });
+  if (inList(lists?.whitelist)) return 'whitelist';
+  if (inList(lists?.blacklist)) return 'blacklist';
+  return null;
+}
+
+/** True when a recent row's folder is the folder just added, or lives inside it. */
+export function foldIsCoveredBy(addedFolder, candidate) {
+  if (typeof addedFolder !== 'string' || typeof candidate !== 'string') return false;
+  try {
+    const added = normalizeFolder(addedFolder);
+    const target = normalizeFolder(candidate);
+    return target === added || isInside(target, added);
+  } catch {
+    return false;
+  }
+}
+
+
 /** Services this plugin cannot work without. `connection` is used only for the operator routes. */
 export const inject = ['permissionPresets'];
 
@@ -361,6 +402,10 @@ export function apply(ctx, config = {}) {
   const pending = new Map();
   /** Newest-first record of calls the gate saw, so the panel can offer "add this folder" in one click. */
   const recent = [];
+  /** Four-colour counters: every decision lands in exactly one bucket (v1.7.10). */
+  const colorCounts = { green: 0, blue: 0, yellow: 0, red: 0 };
+  /** Operation fingerprints approved earlier in this session -> the blue ("正常") state. */
+  const sessionGrants = new Set();
 
   const noteRecent = (entry) => {
     recent.unshift({ at: Date.now(), ...entry });
@@ -419,6 +464,9 @@ export function apply(ctx, config = {}) {
       tool: String(toolCallOf(exec).name ?? 'tool'),
       reason,
       paths,
+      color: 'yellow',
+      fingerprint: fingerprintOf(toolCallOf(exec)),
+      sessionId: String(exec?.agent?.session?.header?.id ?? ''),
     };
     pending.set(id, entry);
     pendingTotal += 1;
@@ -441,9 +489,10 @@ export function apply(ctx, config = {}) {
     } catch {
       /* already fired */
     }
-    if (decision === 'allow') {
+    if (decision === 'allow' || decision === 'allow-session') {
       allowedTotal += 1;
-      entry.resolve({ kind: 'allow', reason: 'GPW: allowed by the operator' });
+      if (typeof entry.fingerprint === 'string' && entry.fingerprint !== '') sessionGrants.add(entry.fingerprint);
+      entry.resolve({ kind: 'allow', reason: decision === 'allow-session' ? 'GPW: allowed for this session (blue)' : 'GPW: allowed by the operator' });
     } else {
       deniedTotal += 1;
       entry.resolve({ kind: 'deny', reason: 'GPW: denied by the operator' });
@@ -521,7 +570,6 @@ export function apply(ctx, config = {}) {
       ctx.logger?.warn?.(`dsh-gpw: refused ${String(call.name ?? 'tool')} -- lists locked (${lists.reason})`);
       return { kind: 'deny', reason: `GPW: folder lists failed integrity check (${lists.reason}); reset them in the GPW panel` };
     }
-    if (lists.blacklist.length === 0 && lists.whitelist.length === 0) return next();
     let cwd = null;
     try {
       cwd = await ctx.workingDirectory?.ensure?.(exec.agent, exec.signal);
@@ -531,21 +579,52 @@ export function apply(ctx, config = {}) {
     // A listed folder covers its subfolders; relative command paths are resolved against the workspace so a
     // subfolder reference is classified rather than treated as "names no path".
     const classification = classifyToolCall({ ...call, whitelist: lists.whitelist, blacklist: lists.blacklist, workspace: cwd ?? null, base: cwd ?? undefined, allowRelative: cwd !== null });
-    if (classification.decision === 'pass' && classification.paths.length === 0) return next();
+    // v1.7.10: one four-colour decision in front of the folder plan, so every audit behaviour in DSH has one home.
+    const fingerprint = fingerprintOf(call);
+    const colour = classifyGpwCall({
+      name: call.name,
+      arguments: call.arguments,
+      paths: classification.paths,
+      whitelist: lists.whitelist,
+      blacklist: lists.blacklist,
+      workspace: cwd ?? null,
+      authorized: sessionGrants.has(fingerprint),
+    });
+    if (colour.color === 'red') {
+      deniedTotal += 1;
+      colorCounts.red += 1;
+      noteRecent({ tool: String(call.name ?? 'tool'), decision: 'deny', color: 'red', reason: colour.reason, paths: classification.paths });
+      ctx.logger?.warn?.(`dsh-gpw: red -- refused ${String(call.name ?? 'tool')} -- ${colour.reason}`);
+      return { kind: 'deny', reason: `GPW red: ${colour.reason}` };
+    }
+    if (colour.color === 'green' || colour.color === 'blue') {
+      colorCounts[colour.color] += 1;
+      noteRecent({ tool: String(call.name ?? 'tool'), decision: 'allow', color: colour.color, reason: colour.reason, paths: classification.paths });
+      ctx.logger?.info?.(`dsh-gpw: ${colour.color} -- ${String(call.name ?? 'tool')} -- ${colour.reason}`);
+      return { kind: 'allow' };
+    }
+    if (classification.decision === 'pass' && classification.paths.length === 0) {
+      colorCounts.yellow += 1;
+      noteRecent({ tool: String(call.name ?? 'tool'), decision: 'pending', color: 'yellow', reason: colour.reason, paths: [] });
+      return waitForOperator(exec, colour.reason, []);
+    }
     const budget = classification.decision === 'allow' ? takeBudgetSlot() : false;
     const plan = planGate({ classification, autoAllowBudgetRemaining: classification.decision === 'allow' ? budget !== false : undefined });
     if (plan.kind === 'deny') {
       deniedTotal += 1;
-      noteRecent({ tool: String(call.name ?? 'tool'), decision: 'deny', reason: plan.reason, paths: classification.paths });
+      colorCounts.red += 1;
+      noteRecent({ tool: String(call.name ?? 'tool'), decision: 'deny', color: 'red', reason: plan.reason, paths: classification.paths });
       ctx.logger?.warn?.(`dsh-gpw: refused ${String(call.name ?? 'tool')} -- ${plan.reason}`);
       return { kind: 'deny', reason: `GPW: ${plan.reason}` };
     }
     if (plan.kind === 'allow') {
-      noteRecent({ tool: String(call.name ?? 'tool'), decision: 'allow', reason: plan.reason, paths: classification.paths });
+      colorCounts.green += 1;
+      noteRecent({ tool: String(call.name ?? 'tool'), decision: 'allow', color: 'green', reason: plan.reason, paths: classification.paths });
       ctx.logger?.info?.(`dsh-gpw: auto-allowed ${String(call.name ?? 'tool')} -- ${plan.reason}`);
       return { kind: 'allow' };
     }
-    noteRecent({ tool: String(call.name ?? 'tool'), decision: 'pending', reason: plan.reason, paths: classification.paths });
+    colorCounts.yellow += 1;
+    noteRecent({ tool: String(call.name ?? 'tool'), decision: 'pending', color: 'yellow', reason: plan.reason, paths: classification.paths });
     ctx.logger?.info?.(`dsh-gpw: holding ${String(call.name ?? 'tool')} for operator -- ${plan.reason}`);
     return waitForOperator(exec, plan.reason, classification.paths);
   });
@@ -569,15 +648,20 @@ export function apply(ctx, config = {}) {
           folders: { whitelist: lists.whitelist, blacklist: lists.blacklist },
           tampered: lists.tampered,
           tampered_reason: lists.reason,
-          counters: { allowedTotal, pendingTotal, deniedTotal, budgetWindow: approvals.length, maxPerWindow },
-          recent: recent.map((entry) => ({
-            at: entry.at,
-            tool: entry.tool,
-            decision: entry.decision,
-            reason: entry.reason,
-            paths: entry.paths,
-            folder: entry.paths.length > 0 ? folderForPath(entry.paths[0]) : null,
-          })),
+          counters: { allowedTotal, pendingTotal, deniedTotal, budgetWindow: approvals.length, maxPerWindow, colors: { ...colorCounts }, grants: sessionGrants.size },
+          recent: recent.map((entry) => {
+            const folder = entry.paths.length > 0 ? folderForPath(entry.paths[0]) : null;
+            return {
+              at: entry.at,
+              tool: entry.tool,
+              decision: entry.decision,
+              color: entry.color ?? null,
+              reason: entry.reason,
+              paths: entry.paths,
+              folder,
+              folder_in: folderInLists(folder, lists),
+            };
+          }),
           pending: [...pending.entries()].map(([id, entry]) => ({
             id,
             tool: entry.tool,
@@ -667,8 +751,8 @@ export function apply(ctx, config = {}) {
         } catch {
           /* refused below */
         }
-        if (typeof body?.id !== 'string' || (body?.decision !== 'allow' && body?.decision !== 'deny')) {
-          return json({ ok: false, error: 'id and decision (allow|deny) are required' }, 400);
+        if (typeof body?.id !== 'string' || (body?.decision !== 'allow' && body?.decision !== 'deny' && body?.decision !== 'allow-session')) {
+          return json({ ok: false, error: 'id and decision (allow|allow-session|deny) are required' }, 400);
         }
         const result = decidePending(body.id, body.decision);
         return json(result.ok ? { ok: true } : { ok: false, error: result.error }, result.ok ? 200 : 404);

package/src/plugin/tools.mjs

@@ -283,7 +283,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '1.7.9';
+const PLUGIN_VERSION = '1.8.1';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;