@twinsearth/w2m-dsh-plugin 1.9.0 → 1.9.3

package/src/plugin/joint-dev/dispatch.mjs

@@ -0,0 +1,154 @@
+/**
+ * 联合开发：计划 → 控制面信封 → 分发（R1–R4 的生产接线点）。
+ *
+ * 只构造"任务指令 + 元数据"：任务 ID、机器、步骤、命令 hash、base commit、写范围。
+ * 任何用户代码/文件/输出字节都不允许出现在这里；发送前逐条过 redline.inspectControlMessage，
+ * 失败即拒绝并写审计（只记元数据）。本模块不做网络 I/O，sendFn 由调用方注入。
+ */
+import { createHash } from 'node:crypto';
+
+import { appendAudit } from './audit-file.mjs';
+import { createAudit, inspectControlMessage } from './redline.mjs';
+
+export const MAX_STEPS = 16;
+const DATA_KEYS = new Set(['data', 'file', 'files', 'content', 'patch', 'diff', 'blob', 'bytes', 'stdout', 'stderr', 'base64', 'text']);
+
+const sha256 = (value) => createHash('sha256').update(String(value), 'utf8').digest('hex');
+
+function scanData(value, path, hits) {
+  if (value === null || typeof value !== 'object') return;
+  if (Array.isArray(value)) { value.forEach((entry, index) => scanData(entry, path + '[' + index + ']', hits)); return; }
+  for (const [key, child] of Object.entries(value)) {
+    const keyPath = path === '' ? key : path + '.' + key;
+    if (DATA_KEYS.has(key.toLowerCase())) hits.push(keyPath);
+    scanData(child, keyPath, hits);
+  }
+}
+
+/**
+ * 校验计划：步骤唯一、依赖存在、无环、无数据字段、机器 ID 合法。
+ * @returns {{ok: true, plan: object} | {ok: false, code: string, detail: object}}
+ */
+export function buildPlan(input) {
+  if (input === null || typeof input !== 'object') return { ok: false, code: 'PLAN_INVALID', detail: {} };
+  const steps = Array.isArray(input.steps) ? input.steps : null;
+  if (steps === null || steps.length === 0 || steps.length > MAX_STEPS) {
+    return { ok: false, code: 'PLAN_STEPS_INVALID', detail: { count: steps === null ? null : steps.length } };
+  }
+  const hits = [];
+  scanData(input, '', hits);
+  if (hits.length > 0) return { ok: false, code: 'DATA_PLANE_FORBIDDEN', detail: { paths: hits.slice(0, 8) } };
+
+  const ids = new Set();
+  for (const step of steps) {
+    if (typeof step?.step_id !== 'string' || !/^[a-z][a-z0-9_-]{0,31}$/.test(step.step_id)) {
+      return { ok: false, code: 'PLAN_STEP_ID_INVALID', detail: { step_id: step?.step_id ?? null } };
+    }
+    if (ids.has(step.step_id)) return { ok: false, code: 'PLAN_STEP_DUPLICATE', detail: { step_id: step.step_id } };
+    ids.add(step.step_id);
+    if (typeof step.machine_id !== 'string' || step.machine_id === '') {
+      return { ok: false, code: 'PLAN_MACHINE_INVALID', detail: { step_id: step.step_id } };
+    }
+    if (!Array.isArray(step.command_argv) || step.command_argv.length === 0) {
+      return { ok: false, code: 'PLAN_ARGV_INVALID', detail: { step_id: step.step_id } };
+    }
+  }
+  const graph = new Map(steps.map((step) => [step.step_id, Array.isArray(step.depends_on) ? step.depends_on : []]));
+  for (const [id, deps] of graph) {
+    for (const dep of deps) {
+      if (!ids.has(dep)) return { ok: false, code: 'PLAN_DEP_UNKNOWN', detail: { step_id: id, dep } };
+    }
+  }
+  const visiting = new Set();
+  const done = new Set();
+  const visit = (id) => {
+    if (done.has(id)) return true;
+    if (visiting.has(id)) return false;
+    visiting.add(id);
+    for (const dep of graph.get(id) ?? []) if (!visit(dep)) return false;
+    visiting.delete(id);
+    done.add(id);
+    return true;
+  };
+  for (const id of ids) if (!visit(id)) return { ok: false, code: 'PLAN_CYCLE', detail: { step_id: id } };
+
+  const canonical = {
+    v: 1,
+    title: typeof input.title === 'string' ? input.title.slice(0, 200) : '',
+    base_commit: typeof input.base_commit === 'string' ? input.base_commit : null,
+    steps: steps.map((step) => ({
+      step_id: step.step_id,
+      machine_id: step.machine_id,
+      command_argv: step.command_argv.slice(0, 32),
+      command_hash: sha256(JSON.stringify(step.command_argv)),
+      write_scope: Array.isArray(step.write_scope) ? step.write_scope.slice(0, 8) : [],
+      depends_on: Array.isArray(step.depends_on) ? step.depends_on.slice(0, 8) : [],
+      timeout_ms: Number.isInteger(step.timeout_ms) ? step.timeout_ms : null,
+    })),
+  };
+  return { ok: true, plan: { ...canonical, plan_sha256: sha256(JSON.stringify(canonical)) } };
+}
+
+/** 计划 → 控制面信封（每个步骤一条 joint.dispatch，只含元数据）。 */
+export function buildControlEnvelopes(plan) {
+  return plan.steps.map((step) => ({
+    v: 1,
+    type: 'joint.dispatch',
+    body: {
+      plan_sha256: plan.plan_sha256,
+      step_id: step.step_id,
+      machine_id: step.machine_id,
+      base_commit: plan.base_commit,
+      command_argv: step.command_argv,
+      command_hash: step.command_hash,
+      write_scope: step.write_scope,
+      depends_on: step.depends_on,
+      ...(step.timeout_ms === null ? {} : { timeout_ms: step.timeout_ms }),
+    },
+  }));
+}
+
+/**
+ * 分发：逐条过红线 → 审计 → sendFn。失败即停，返回已完成与失败原因。
+ * @param {{plan: object, sendFn: Function, dryRun?: boolean, audit?: object}} input
+ */
+export async function dispatchPlan({ plan, sendFn, dryRun = false, audit = null, auditFile = null }) {
+  if (plan === null || typeof plan !== 'object' || typeof plan.plan_sha256 !== 'string') {
+    return { ok: false, code: 'PLAN_NOT_BUILT', sent: [], audits: [] };
+  }
+  const auditLog = audit ?? createAudit();
+  const envelopes = buildControlEnvelopes(plan);
+  const sent = [];
+  const audits = [];
+  for (const envelope of envelopes) {
+    const check = inspectControlMessage(envelope);
+    const bytes = Buffer.byteLength(JSON.stringify(envelope), 'utf8');
+    if (check.ok !== true) {
+      const record = { event: 'joint.dispatch.refused', plan_sha256: plan.plan_sha256, step_id: envelope.body.step_id, machine_id: envelope.body.machine_id, outcome: 'denied', reason_code: check.code, control_bytes: bytes, control_sha256: sha256(JSON.stringify(envelope)) };
+      auditLog.append(record);
+      audits.push(record);
+      return { ok: false, code: check.code, detail: check.detail, sent, audits };
+    }
+    if (dryRun) { sent.push({ step_id: envelope.body.step_id, bytes, dispatched: false }); continue; }
+    if (typeof auditFile === 'string') {
+      let written;
+      try { written = appendAudit(auditFile, { event: 'joint.dispatch.sending', plan_sha256: plan.plan_sha256, step_id: envelope.body.step_id, machine_id: envelope.body.machine_id, control_bytes: bytes, control_sha256: sha256(JSON.stringify(envelope)) }); } catch (error) { written = { ok: false, detail: String(error) }; }
+      if (written.ok !== true) return { ok: false, code: 'AUDIT_UNAVAILABLE', detail: written, sent, audits };
+    }
+    let response;
+    try {
+      response = await sendFn(envelope, { stepId: envelope.body.step_id, machineId: envelope.body.machine_id, bytes });
+    } catch (error) {
+      const record = { event: 'joint.dispatch.failed', plan_sha256: plan.plan_sha256, step_id: envelope.body.step_id, machine_id: envelope.body.machine_id, outcome: 'error', reason_code: 'SEND_FAILED', control_bytes: bytes, control_sha256: sha256(JSON.stringify(envelope)) };
+      auditLog.append(record);
+      audits.push(record);
+      return { ok: false, code: 'SEND_FAILED', detail: { step_id: envelope.body.step_id, error: String(error).slice(0, 120) }, sent, audits };
+    }
+    const record = { event: 'joint.dispatch.sent', plan_sha256: plan.plan_sha256, step_id: envelope.body.step_id, machine_id: envelope.body.machine_id, outcome: response?.ok === true ? 'ok' : 'rejected', reason_code: response?.code ?? null, control_bytes: bytes, control_sha256: sha256(JSON.stringify(envelope)) };
+    auditLog.append(record);
+    audits.push(record);
+    sent.push({ step_id: envelope.body.step_id, bytes, dispatched: true });
+    if (response?.ok !== true) return { ok: false, code: response?.code ?? 'DISPATCH_REJECTED', detail: { step_id: envelope.body.step_id }, sent, audits };
+  }
+  return { ok: true, sent, audits, auditHead: auditLog.head(), dryRun };
+}

package/src/plugin/joint-dev/loop.mjs

@@ -0,0 +1,73 @@
+/**
+ * 联合开发闭环（纯函数 + 注入传输）：collect → merge → verify。
+ * 数据字节只经直连 fetchFn；relay 只出现在控制面（dispatch.mjs）。
+ */
+
+/** 收集：按 ref 直连拉取，校验 sha256；缺失/不匹配即记为问题。 */
+export async function collectArtifacts({ refs, fetchFn, crypto }) {
+  const digest = (value) => crypto.createHash('sha256').update(value).digest('hex');
+  const artifacts = [];
+  const problems = [];
+  for (const ref of refs) {
+    if (ref === null || typeof ref !== 'object' || typeof ref.machine !== 'string') {
+      problems.push({ machine: ref?.machine ?? null, file: ref?.file ?? null, reason: 'REF_INVALID' });
+      continue;
+    }
+    let bytes;
+    try {
+      bytes = await fetchFn(ref);
+    } catch (error) {
+      problems.push({ machine: ref.machine, file: ref.file ?? null, reason: 'FETCH_FAILED', detail: String(error).slice(0, 80) });
+      continue;
+    }
+    if (bytes === undefined || bytes === null) {
+      problems.push({ machine: ref.machine, file: ref.file ?? null, reason: 'REF_MISSING' });
+      continue;
+    }
+    const hash = digest(Buffer.from(bytes));
+    if (ref.sha256 !== hash) {
+      problems.push({ machine: ref.machine, file: ref.file ?? null, reason: 'HASH_MISMATCH', expected: ref.sha256, actual: hash });
+      continue;
+    }
+    artifacts.push({ machine: ref.machine, file: ref.file, path: ref.path ?? ref.file, bytes: Buffer.from(bytes), sha256: hash });
+  }
+  return { ok: problems.length === 0, artifacts, problems };
+}
+
+/** 合并：按 (path) 检测同文件双改冲突；冲突时 head 不动，返回冲突明细。 */
+export function mergeArtifacts({ artifacts }) {
+  const byPath = new Map();
+  const conflicts = [];
+  for (const artifact of artifacts) {
+    const path = artifact.path ?? artifact.file;
+    const key = String(path).toLowerCase();
+    const existing = byPath.get(key);
+    if (existing === undefined) {
+      byPath.set(key, { path, machines: [artifact.machine], bytes: artifact.bytes, sha256: artifact.sha256 });
+      continue;
+    }
+    if (existing.sha256 === artifact.sha256) {
+      if (!existing.machines.includes(artifact.machine)) existing.machines.push(artifact.machine);
+      continue;
+    }
+    conflicts.push({ path, machines: [...new Set([...existing.machines, artifact.machine])], reason: 'CONTENT_CONFLICT', left: existing.sha256, right: artifact.sha256 });
+  }
+  if (conflicts.length > 0) return { ok: false, code: 'MERGE_CONFLICT', conflicts, files: [] };
+  const files = [...byPath.values()].map((entry) => ({ path: entry.path, sha256: entry.sha256, bytes: entry.bytes, machines: entry.machines }));
+  return { ok: true, files, conflicts: [] };
+}
+
+/** 复核：对合并结果逐机比对期望文件；只回结论与差异摘要。 */
+export function verifyReview({ merged, expectations }) {
+  const present = new Map(merged.files.map((file) => [String(file.path).toLowerCase(), file.sha256]));
+  const results = [];
+  for (const expectation of expectations) {
+    const actual = present.get(String(expectation.file).toLowerCase()) ?? null;
+    const pass = actual !== null && (expectation.sha256 === undefined || actual === expectation.sha256);
+    results.push(pass
+      ? { machine: expectation.machine, file: expectation.file, status: 'PASS' }
+      : { machine: expectation.machine, file: expectation.file, status: 'FAIL', reason: actual === null ? 'FILE_MISSING' : 'HASH_MISMATCH', expected: expectation.sha256 ?? null, actual });
+  }
+  const failed = results.filter((entry) => entry.status === 'FAIL');
+  return { ok: failed.length === 0, verdict: failed.length === 0 ? 'PASS' : 'FAIL', results, failed };
+}

package/src/plugin/joint-dev/plan-store.mjs

@@ -0,0 +1,66 @@
+/**
+ * joint-dev 计划持久化与人工审批门（本地文件，0600）。
+ * 未审批的计划禁止 dispatch；审批绑定 plan_sha256 与候选人。
+ */
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const sha256 = (text) => createHash('sha256').update(text, 'utf8').digest('hex');
+const planDir = (stateDir) => join(stateDir, 'joint-dev', 'plans');
+const approvalDir = (stateDir) => join(stateDir, 'joint-dev', 'approvals');
+
+export function savePlan({ stateDir, plan, now = Date.now() }) {
+  if (typeof plan?.plan_sha256 !== 'string' || plan.plan_sha256.length !== 64) return { ok: false, code: 'PLAN_INVALID' };
+  mkdirSync(planDir(stateDir), { recursive: true });
+  const path = join(planDir(stateDir), plan.plan_sha256 + '.json');
+  if (existsSync(path)) return { ok: true, path, reused: true };
+  writeFileSync(path, JSON.stringify({ plan, saved_at: new Date(now).toISOString() }, null, 2), { encoding: 'utf8', mode: 0o600 });
+  return { ok: true, path, reused: false };
+}
+
+export function loadPlan({ stateDir, planSha }) {
+  const path = join(planDir(stateDir), planSha + '.json');
+  if (!existsSync(path)) return { ok: false, code: 'PLAN_NOT_FOUND' };
+  return { ok: true, ...JSON.parse(readFileSync(path, 'utf8')), path };
+}
+
+/**
+ * 人工审批。authority 建议 ≥70；审批只由操作员 CLI/UI 写入，不暴露给 agent 工具。
+ */
+export function approvePlan({ stateDir, planSha, approver, authority, note = '', now = Date.now() }) {
+  if (typeof planSha !== 'string' || planSha.length !== 64) return { ok: false, code: 'PLAN_SHA_INVALID' };
+  if (typeof approver !== 'string' || approver === '') return { ok: false, code: 'APPROVER_REQUIRED' };
+  if (!Number.isInteger(authority) || authority < 70) return { ok: false, code: 'APPROVAL_AUTHORITY_TOO_LOW', detail: { authority } };
+  if (!existsSync(join(planDir(stateDir), planSha + '.json'))) return { ok: false, code: 'PLAN_NOT_FOUND' };
+  mkdirSync(approvalDir(stateDir), { recursive: true });
+  const body = {
+    v: 1,
+    plan_sha256: planSha,
+    approver,
+    authority,
+    note: String(note).slice(0, 200),
+    approved_at: new Date(now).toISOString(),
+  };
+  const record = { ...body, approval_sha256: sha256(JSON.stringify(body)) };
+  const path = join(approvalDir(stateDir), planSha + '.json');
+  writeFileSync(path, JSON.stringify(record, null, 2), { encoding: 'utf8', mode: 0o600 });
+  return { ok: true, approval: record, path };
+}
+
+export function loadApproval({ stateDir, planSha }) {
+  const path = join(approvalDir(stateDir), planSha + '.json');
+  if (!existsSync(path)) return { ok: false, code: 'APPROVAL_REQUIRED' };
+  const record = JSON.parse(readFileSync(path, 'utf8'));
+  if (record.plan_sha256 !== planSha) return { ok: false, code: 'APPROVAL_STALE' };
+  return { ok: true, approval: record };
+}
+
+/** dispatch 前置门：计划必须存在且已审批。 */
+export function assertDispatchAllowed({ stateDir, planSha }) {
+  const plan = loadPlan({ stateDir, planSha });
+  if (plan.ok !== true) return { ok: false, code: 'PLAN_NOT_FOUND' };
+  const approval = loadApproval({ stateDir, planSha });
+  if (approval.ok !== true) return { ok: false, code: 'APPROVAL_REQUIRED' };
+  return { ok: true, plan: plan.plan, approval: approval.approval };
+}

package/src/plugin/joint-dev/redline.mjs

@@ -0,0 +1,16 @@
+/**
+ * 兼容入口：红线判据的唯一实现在 src/util/redline-core.mjs（relay 与插件共用）。
+ * 保留此文件是为了既有引用（joint-dev/*、测试）不发生破坏性改动。
+ */
+export {
+  MAX_CONTROL_BYTES,
+  CONTROL_VERSION,
+  CONTROL_TYPES,
+  DATA_PLANES,
+  CONTROL_ALLOWED_KEYS,
+  BODY_ALLOWED_KEYS,
+  FORBIDDEN_DATA_KEYS,
+  inspectControlMessage,
+  assertPlane,
+  createAudit,
+} from '../../util/redline-core.mjs';

package/src/plugin/npm-update.mjs

@@ -14,6 +14,7 @@ import { compareVersions } from './update-source.mjs';
 export const PLUGIN_PACKAGE_NAME = '@twinsearth/w2m-dsh-plugin';
 /** npm mirrors are fine here: the answer is only "which version is latest", and the tarball is verified separately. */
 export const DEFAULT_NPM_LATEST_URL = `https://registry.npmmirror.com/${encodeURIComponent(PLUGIN_PACKAGE_NAME)}/latest`;
+export const DEFAULT_NPM_LATEST_FALLBACK_URL = `https://registry.npmjs.org/${encodeURIComponent(PLUGIN_PACKAGE_NAME)}/latest`;
 export const NPM_CHECK_TIMEOUT_MS = 15_000;
 
 /**
@@ -61,19 +62,24 @@ export function decideNpmUpdate({ latest, currentVersion }) {
 export async function checkNpmUpdate(input) {
   const fetchImpl = input?.fetchImpl ?? globalThis.fetch;
   const url = input?.url ?? DEFAULT_NPM_LATEST_URL;
+  const urls = input?.url !== undefined ? [url] : [url, DEFAULT_NPM_LATEST_FALLBACK_URL];
   const timeoutMs = Number.isInteger(input?.timeoutMs) ? input.timeoutMs : NPM_CHECK_TIMEOUT_MS;
-  let doc;
-  try {
-    const response = await fetchImpl(url, {
-      headers: { accept: 'application/json' },
-      signal: typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function' ? AbortSignal.timeout(timeoutMs) : undefined,
-    });
-    if (response?.ok !== true) {
-      return decideNpmUpdate({ latest: { ok: false, error: `npm registry answered HTTP ${response?.status ?? '?'}` }, currentVersion: input?.currentVersion ?? null });
+  let last = { ok: false, error: 'npm latest could not be read' };
+  for (const candidate of urls) {
+    try {
+      const response = await fetchImpl(candidate, {
+        headers: { accept: 'application/json' },
+        signal: typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function' ? AbortSignal.timeout(timeoutMs) : undefined,
+      });
+      if (response?.ok !== true) { last = { ok: false, error: `npm registry answered HTTP ${response?.status ?? '?'}` }; continue; }
+      const doc = await response.json();
+      const parsed = parseNpmLatest(doc);
+      if (parsed.ok === true) return decideNpmUpdate({ latest: parsed, currentVersion: input?.currentVersion ?? null });
+      last = parsed;
+    } catch (error) {
+      last = { ok: false, error: error instanceof Error ? error.message : String(error) };
     }
-    doc = await response.json();
-  } catch (error) {
-    return decideNpmUpdate({ latest: { ok: false, error: error instanceof Error ? error.message : String(error) }, currentVersion: input?.currentVersion ?? null });
   }
-  return decideNpmUpdate({ latest: parseNpmLatest(doc), currentVersion: input?.currentVersion ?? null });
+  return decideNpmUpdate({ latest: last, currentVersion: input?.currentVersion ?? null });
 }
+

package/src/plugin/path-policy.mjs

@@ -0,0 +1,214 @@
+/**
+ * GPW 路径继承语义（单一判定点）。
+ *
+ * 白名单 = 子树许可（向下任意深度、不向上、分段比较、自反）。
+ * 黑名单 = 子树拒绝，默认优先；同深度 deny 胜。
+ * 父黑名单下的子目录默认 deny；唯一通道是显式例外：
+ *   严格更深、仅配置来源、带 TTL、效果 approve（每次人工确认）。
+ * 删除还需父目录写权限；敏感底线不可被白名单覆盖。
+ * 未在名单内 → pass（问人），绝不自动 allow。
+ */
+
+const SENSITIVE_SEGMENTS = new Set(['.ssh', '.aws', '.gnupg', '.kube', '.docker', 'credentials']);
+const SENSITIVE_EXT = /\.(pem|key|pfx|p12|jks|kdbx)$/i;
+const SENSITIVE_NAMES = new Set(['.env', 'id_rsa', 'id_ed25519', 'wallet.dat', 'login data', 'gpw-folders.json', 'gpw-folders.json.key']);
+
+export const DECISION = Object.freeze({ ALLOW: 'allow', DENY: 'deny', APPROVE: 'approve', PASS: 'pass' });
+
+const isWindows = (platform) => platform === 'win32';
+
+/** 词法规范化：别名、尾点/空格、. / ..、分隔符；Win32 只折 ASCII。 */
+export function canonicalKey(raw, { platform = process.platform } = {}) {
+  if (typeof raw !== 'string') return null;
+  let text = raw.trim();
+  if (text === '' || text.includes('\u0000')) return null;
+  const win = isWindows(platform);
+  if (win) {
+    text = text.replace(/^\\\\[?.]\\UNC\\(.*)$/i, '\\\\$1').replace(/^\\\\[?.]\\(?=[A-Za-z]:)/, '');
+    text = text.replace(/\//g, '\\');
+  }
+  const segments = [];
+  const drive = win ? /^([A-Za-z]):(.*)$/.exec(text) : null;
+  let rest = text;
+  if (drive !== null) {
+    if (drive[2].startsWith('\\') === false) return null; // C:foo 盘符相对不可判定
+    rest = drive[2];
+  }
+  for (const part of rest.split(/[\\/]+/)) {
+    if (part === '' || part === '.') continue;
+    if (part === '..') { segments.pop(); continue; }
+    let segment = part;
+    if (win) segment = segment.replace(/[. ]+$/g, ''); // Win32 去尾点/空格
+    if (segment !== '') segments.push(win ? segment.replace(/[A-Z]/g, (c) => c.toLowerCase()) : segment);
+  }
+  if (win) return (drive === null ? '' : drive[1].toLowerCase() + ':\\') + segments.join('\\');
+  return '/' + segments.join('/');
+}
+
+function segmentsOf(key, platform) {
+  if (typeof key !== 'string' || key === '') return null;
+  if (isWindows(platform)) {
+    const match = /^([A-Za-z]):\\(.*)$/.exec(key);
+    return match === null ? null : [match[1] + ':', ...match[2].split('\\').filter(Boolean)];
+  }
+  return key.split('/').filter(Boolean);
+}
+
+/** 分段包含：自反；C:\work 不含 C:\workshop。 */
+export function inside(targetKey, rootKey, platform = process.platform) {
+  const target = segmentsOf(targetKey, platform);
+  const root = segmentsOf(rootKey, platform);
+  if (target === null || root === null || target.length < root.length) return false;
+  for (let index = 0; index < root.length; index += 1) {
+    if (target[index] !== root[index]) return false;
+  }
+  return true;
+}
+
+/** 敏感底线：段名/文件名/扩展名命中即 deny，任何白名单不能覆盖。 */
+export function sensitiveMatch(raw) {
+  const lowered = String(raw).toLowerCase();
+  for (const segment of lowered.split(/[\\/]+/)) {
+    if (SENSITIVE_SEGMENTS.has(segment)) return { hit: true, reason: 'SENSITIVE_SEGMENT', segment };
+    if (SENSITIVE_NAMES.has(segment)) return { hit: true, reason: 'SENSITIVE_NAME', segment };
+    if (SENSITIVE_EXT.test(segment)) return { hit: true, reason: 'SENSITIVE_EXTENSION', segment };
+  }
+  return { hit: false };
+}
+
+function ruleDepth(rule, target, platform) {
+  const root = canonicalKey(rule.path, { platform });
+  if (root === null || !inside(target, root, platform)) return -1;
+  return segmentsOf(root, platform).length;
+}
+
+/**
+ * 判定。规则：{path, effect:'allow'|'deny', source:'config'|'panel', expiresAt?, ops?}
+ * @returns {{decision: string, source: string, reason: string, rule?: object}}
+ */
+export function decidePath({ target, rules = [], exceptions = [], workspace = null, platform = process.platform, now = Date.now() }) {
+  const key = canonicalKey(target, { platform });
+  if (key === null) return { decision: DECISION.PASS, source: 'canonicalize', reason: 'UNRESOLVABLE' };
+
+  const sensitive = sensitiveMatch(target);
+  if (sensitive.hit) return { decision: DECISION.DENY, source: 'floor', reason: sensitive.reason };
+
+  const covering = [];
+  for (const rule of rules) {
+    const depth = ruleDepth(rule, key, platform);
+    if (depth >= 0) covering.push({ rule, depth });
+  }
+  const denies = covering.filter((entry) => entry.rule.effect === 'deny');
+  if (denies.length > 0) {
+    const deepestDeny = Math.max(...denies.map((entry) => entry.depth));
+    const exception = exceptions.find((entry) => entry.source === 'config'
+      && (entry.expiresAt === undefined || entry.expiresAt > now)
+      && ruleDepth(entry, key, platform) > deepestDeny);
+    if (exception !== undefined) {
+      return { decision: DECISION.APPROVE, source: 'exception', reason: 'EXCEPTION_REQUIRES_APPROVAL', rule: exception };
+    }
+    return { decision: DECISION.DENY, source: 'rule', reason: 'DENY_RULE', rule: denies.sort((a, b) => b.depth - a.depth)[0].rule };
+  }
+
+  const allows = covering.filter((entry) => entry.rule.effect === 'allow').sort((a, b) => b.depth - a.depth);
+  if (allows.length > 0) return { decision: DECISION.ALLOW, source: 'rule', reason: 'ALLOW_RULE', rule: allows[0].rule };
+  if (workspace !== null) {
+    const root = canonicalKey(workspace, { platform });
+    if (root !== null && inside(key, root, platform)) return { decision: DECISION.ALLOW, source: 'workspace', reason: 'ALLOW_WORKSPACE' };
+  }
+  return { decision: DECISION.PASS, source: 'unlisted', reason: 'NO_RULE' };
+}
+
+/**
+ * 操作维度：delete/rename 需要父目录写权限。
+ * @param {{target: string, operation: 'read'|'write'|'delete'|'exec', ...decidePathInput}} input
+ */
+export function decideOperation(input) {
+  const verdict = decidePath(input);
+  if (verdict.decision !== DECISION.ALLOW || input.operation !== 'delete') return verdict;
+  const parent = canonicalKey(input.target, { platform: input.platform });
+  if (parent === null) return verdict;
+  const parentPath = parent.replace(/[\\/][^\\/]+$/, '');
+  const parentVerdict = decidePath({ ...input, target: parentPath, operation: 'write' });
+  if (parentVerdict.decision !== DECISION.ALLOW) {
+    return { decision: DECISION.APPROVE, source: 'parent', reason: 'PARENT_WRITE_REQUIRED', parent: parentVerdict };
+  }
+  return verdict;
+}
+
+/** 写入期：不允许在黑名单子树内添加白名单（避免静默开洞）。 */
+export function assertRuleWritable({ path, rules = [], platform = process.platform }) {
+  const key = canonicalKey(path, { platform });
+  if (key === null) return { ok: false, code: 'RULE_PATH_INVALID' };
+  for (const rule of rules) {
+    if (rule.effect !== 'deny') continue;
+    const depth = ruleDepth(rule, key, platform);
+    if (depth >= 0) return { ok: false, code: 'RULE_CONFLICT_DENY_ANCESTOR', detail: { ancestor: rule.path } };
+  }
+  return { ok: true };
+}
+
+/**
+ * 多路径聚合（C36 语义）：任一 deny → deny；全部 allow → allow；否则 approve。
+ * 现状 gpw 的 classifyToolCall 是"任一 allow 就 allow"（fail-open），这里是修正版。
+ */
+export function decideMany({ targets, ...input }) {
+  if (!Array.isArray(targets) || targets.length === 0) {
+    return { decision: DECISION.PASS, source: 'unlisted', reason: 'NO_PATHS', results: [] };
+  }
+  const results = targets.map((target) => decidePath({ ...input, target }));
+  if (results.some((entry) => entry.decision === DECISION.DENY)) {
+    return { decision: DECISION.DENY, source: 'aggregate', reason: 'ANY_DENY', results };
+  }
+  if (results.every((entry) => entry.decision === DECISION.PASS)) {
+    return { decision: DECISION.PASS, source: 'aggregate', reason: 'NO_RULE', results };
+  }
+  if (results.every((entry) => entry.decision === DECISION.ALLOW)) {
+    return { decision: DECISION.ALLOW, source: 'aggregate', reason: 'ALL_ALLOW', results };
+  }
+  return { decision: DECISION.APPROVE, source: 'aggregate', reason: 'NEEDS_APPROVAL', results };
+}
+
+/** P0-2：判定 → 颜色（颜色只做渲染，不参与判定）。 */
+export function colorOf(decision) {
+  if (decision === DECISION.ALLOW) return 'green';
+  if (decision === DECISION.DENY) return 'red';
+  return 'yellow';
+}
+
+import { realpathSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+/**
+ * FS 层：对最长已存在前缀取 realpath，剩余不存在尾部按词法拼回。
+ * 返回 { real, key, rest }；无法解析时 real=null（调用方按更严处理）。
+ */
+export function realpathPrefix(raw, { platform = process.platform } = {}) {
+  const key = canonicalKey(raw, { platform });
+  if (key === null) return null;
+  let probe = key;
+  for (;;) {
+    try {
+      const real = realpathSync.native(probe);
+      const normalized = canonicalKey(real, { platform });
+      if (normalized === null) return { real: null, key, rest: key };
+      const rest = key.slice(probe.length);
+      return { real, key: normalized + rest, rest };
+    } catch {
+      const parent = dirname(probe);
+      if (parent === probe) return { real: null, key, rest: key };
+      probe = parent;
+    }
+  }
+}
+
+const SEVERITY = { allow: 0, pass: 1, approve: 2, deny: 3 };
+
+/** 词法与 FS 两层取更严（更严者胜）；FS 不可用则用词法。 */
+export function decidePathSecure(input) {
+  const lexical = decidePath(input);
+  const resolved = realpathPrefix(input.target, { platform: input.platform ?? process.platform });
+  if (resolved === null || resolved.real === null || resolved.key === canonicalKey(input.target, { platform: input.platform ?? process.platform })) return lexical;
+  const real = decidePath({ ...input, target: resolved.key });
+  return SEVERITY[real.decision] > SEVERITY[lexical.decision] ? real : lexical;
+}

package/src/plugin/target-policy.mjs

@@ -0,0 +1,90 @@
+/**
+ * 最终机器选择策略（纯函数，独立可测；尚未接线到 dispatch/tools）。
+ *
+ * 优先级：指令显式点名 > 输入框选中 > 默认本机
+ * 规则：
+ *  · 点名机器不存在/离线 → MACHINE_UNAVAILABLE，绝不换机；
+ *  · 选中机器失效（离线/退编队）→ 自动回默认本机，并返回 SELECTION_FALLBACK_LOCAL；
+ *  · 只有 online && inFleet 的机器可被选中（assertSelectable）；
+ *  · 选中“全部机器/联合开发” → fleet 模式（显式），不是本机。
+ */
+
+export const TARGET_SOURCES = Object.freeze(['explicit', 'selected', 'local', 'fleet']);
+
+function isUsable(machine) {
+  return machine !== null && typeof machine === 'object'
+    && typeof machine.id === 'string' && machine.id !== ''
+    && machine.online === true && machine.inFleet === true;
+}
+
+/** 可选择性校验：离线/不在编队的机器不能被写入选择。 */
+export function assertSelectable(machine) {
+  if (machine === null || typeof machine !== 'object') {
+    return { ok: false, code: 'SELECTION_INVALID', detail: { reason: 'not-an-object' } };
+  }
+  if (typeof machine.id !== 'string' || machine.id === '') {
+    return { ok: false, code: 'SELECTION_INVALID', detail: { reason: 'missing-id' } };
+  }
+  if (machine.online !== true) {
+    return { ok: false, code: 'SELECTION_MACHINE_OFFLINE', detail: { machine: machine.id } };
+  }
+  if (machine.inFleet !== true) {
+    return { ok: false, code: 'SELECTION_MACHINE_NOT_IN_FLEET', detail: { machine: machine.id } };
+  }
+  return { ok: true };
+}
+
+/**
+ * 解析本次调用的目标。
+ * @param {{explicitMachine?: {id,name?,online?,inFleet?}|string|null,
+ *          selected?: {mode?: 'machine'|'fleet', machine?: object|null}|null,
+ *          localMachine: {id,name?},
+ *          fleetMachines?: Array<object>}} input
+ * @returns {{ok: true, source: string, machine: object|null, warning?: string}
+ *          | {ok: false, code: string, detail: object}}
+ */
+export function resolveTarget(input) {
+  const local = input?.localMachine;
+  if (local === null || typeof local !== 'object' || typeof local.id !== 'string' || local.id === '') {
+    return { ok: false, code: 'LOCAL_MACHINE_UNKNOWN', detail: {} };
+  }
+  const fleet = Array.isArray(input?.fleetMachines) ? input.fleetMachines : [];
+  const find = (id) => fleet.find((machine) => machine.id === id) ?? null;
+
+  // 1) 显式点名：最高优先；找不到/离线即拒绝，不换机。
+  const explicit = input?.explicitMachine;
+  if (explicit !== undefined && explicit !== null && explicit !== '') {
+    const id = typeof explicit === 'string' ? explicit : explicit.id;
+    if (typeof id !== 'string' || id === '') {
+      return { ok: false, code: 'MACHINE_UNAVAILABLE', detail: { reason: 'missing-id' } };
+    }
+    if (id === local.id) return { ok: true, source: 'local', machine: { id: local.id, name: local.name ?? null } };
+    const named = find(id);
+    if (named === null) return { ok: false, code: 'MACHINE_UNAVAILABLE', detail: { machine: id, reason: 'not-in-fleet' } };
+    if (named.online !== true) return { ok: false, code: 'MACHINE_UNAVAILABLE', detail: { machine: id, reason: 'offline' } };
+    if (named.inFleet !== true) return { ok: false, code: 'MACHINE_UNAVAILABLE', detail: { machine: id, reason: 'not-in-fleet' } };
+    return { ok: true, source: 'explicit', machine: named };
+  }
+
+  // 2) 选中项：fleet 模式 → 整编队；machine 模式 → 该机；失效 → TARGET_UNAVAILABLE（不换机）。
+  const selected = input?.selected ?? null;
+  if (selected !== null && selected.mode === 'fleet') {
+    return { ok: true, source: 'fleet', machine: null };
+  }
+  if (selected !== null && selected.machine !== undefined && selected.machine !== null) {
+    const picked = selected.machine;
+    if (picked.id === local.id) return { ok: true, source: 'local', machine: { id: local.id, name: local.name ?? null } };
+    const current = typeof picked.id === 'string' ? find(picked.id) : null;
+    if (isUsable(current)) {
+      return { ok: true, source: 'selected', machine: current };
+    }
+    return { ok: false, code: 'TARGET_UNAVAILABLE', detail: { machine: picked.id ?? null, reason: 'selection-invalid' } };
+  }
+
+  // 3) 未选中：指令显式要求“全队/整编队/所有机器” → fleet；否则默认本机。
+  const phrase = typeof input?.promptText === 'string' ? input.promptText : '';
+  if (/(全队|整编队|所有机器|全部机器)/.test(phrase)) {
+    return { ok: true, source: 'fleet', machine: null };
+  }
+  return { ok: true, source: 'local', machine: { id: local.id, name: local.name ?? null } };
+}