@twinsearth/w2m-dsh-plugin 2.0.2 → 2.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 11 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "type": "module",
   "exports": {
@@ -64,7 +64,7 @@
     "pack": "node scripts/pack.mjs",
     "reachability": "node scripts/reachability-check.mjs",
     "reachability:classify": "node scripts/reachability-classify.mjs",
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs test/gpw-colors.test.mjs test/gpw-recent-fold.test.mjs test/gpw-auto-approve.test.mjs test/data-plane.test.mjs test/sealed-object.test.mjs test/joint-dev-dispatch.test.mjs test/joint-dev-loop.test.mjs test/joint-dev-audit.test.mjs test/joint-dev-redline.test.mjs test/relay-redline-guard.test.mjs test/relay-p0-projection.test.mjs test/guarded-dispatch.test.mjs test/p0-single-matcher.test.mjs test/path-policy.test.mjs test/path-policy-fs.test.mjs test/gpw-inheritance-table.test.mjs test/gpw-policy-adapter.test.mjs test/target-policy.test.mjs test/relay-redline-audit.test.mjs test/relay-repair-ledger.test.mjs test/relay-purge-blobs.test.mjs test/relay-scrub.test.mjs test/joint-dev-plan-store.test.mjs test/relay-basepath-blobs.test.mjs test/operator-token.test.mjs test/relay-health-capabilities.test.mjs test/joint-relay-dispatch.test.mjs test/operator-token-route.test.mjs test/relay-scrub-task-projection.test.mjs test/operator-key-approval.test.mjs test/relay-offer-journal.test.mjs test/joint-r5-wiring.test.mjs test/p1-hardening.test.mjs test/joint-merge-engine.test.mjs test/artifact-ref-dir-sink.test.mjs test/chat-sticker-guard.test.mjs test/relay-task-progress.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/blake2s.test.mjs test/agent.test.mjs test/plan-sec-cmd.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/fleet-merge.test.mjs test/fleet-memory-e2e.test.mjs test/fleet-concurrency.test.mjs test/fleet-merge-race.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/council-session.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/approval-gate.test.mjs test/authority-choice.test.mjs test/reachability-check.test.mjs test/reachability-classify.test.mjs test/accepted-orphans.test.mjs test/acceptance-doc.test.mjs test/layer-model.test.mjs test/cwd-containment.test.mjs test/cwd-outside-project.test.mjs test/memory.test.mjs test/tools.test.mjs test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/agent-plugins.test.mjs test/memory-layer.test.mjs test/mcp-server.test.mjs test/portable-plugins.test.mjs test/mcp-http.test.mjs test/mcp-http-live.test.mjs test/vision.test.mjs test/ilink-shape.test.mjs test/chatops-fleet-join.test.mjs test/admission.test.mjs test/admission-routes.test.mjs test/join-degradation.test.mjs test/account-identity.test.mjs test/join-challenge.test.mjs test/exec-env-injection.test.mjs test/account-join.test.mjs test/fleet-messages.test.mjs test/message-shards.test.mjs test/fleet-messages-http.test.mjs test/message-notify.test.mjs test/update-channels.test.mjs test/update-prerelease.test.mjs test/session-watch.test.mjs test/session-readonly.test.mjs test/session-sync.test.mjs test/fleet-chat-identity.test.mjs test/identity-reader.test.mjs test/intents.test.mjs test/dataflow.test.mjs test/council-fleet.test.mjs test/fleet-memory.test.mjs test/memory-view.test.mjs test/schema-spec.test.mjs test/fleet-weight-parity.test.mjs test/task-deps.test.mjs test/dataflow-wiring.test.mjs test/task-graph.test.mjs test/ask-store.test.mjs test/turn.test.mjs test/fleet-members.test.mjs test/redact.test.mjs test/policy-matrix.test.mjs test/envelope-signature.test.mjs test/chat-crypto.test.mjs test/reduce-suggestion.test.mjs test/merge-hint.test.mjs test/fleet-chat-route.test.mjs test/maintenance.test.mjs test/maintenance-ferry.test.mjs test/grant.test.mjs test/grant-gate.test.mjs test/worktree.test.mjs test/patch-artifact.test.mjs test/merge-queue.test.mjs test/m3-workflow.test.mjs test/project-room.test.mjs test/project-attribution.test.mjs test/project-locks.test.mjs test/project-reviews.test.mjs test/project-notifications.test.mjs test/blob-sessions.test.mjs test/outbox.test.mjs test/reliability-metrics.test.mjs test/evidence.test.mjs test/grant-issue.test.mjs test/project-refs.test.mjs test/exec-capability.test.mjs test/secondary-link.test.mjs test/bootstrap-cli.test.mjs test/bootstrap.test.mjs test/windows-hidden-task.test.mjs test/relay-failover.test.mjs test/npm-update.test.mjs test/agent-start-nonblocking.test.mjs test/fleet-chat-capture.test.mjs test/capture-route.test.mjs test/update-resolver.test.mjs test/agent-identity-safe.test.mjs test/re-pair-stale-token.test.mjs test/gpw-folder-policy.test.mjs test/gpw-activation.test.mjs test/gpw-hardening.test.mjs test/gpw-tamper-gate.test.mjs test/gpw-persistence.test.mjs test/gpw-colors.test.mjs test/gpw-recent-fold.test.mjs test/gpw-auto-approve.test.mjs test/data-plane.test.mjs test/sealed-object.test.mjs test/joint-dev-dispatch.test.mjs test/joint-dev-loop.test.mjs test/joint-dev-audit.test.mjs test/joint-dev-redline.test.mjs test/relay-redline-guard.test.mjs test/relay-p0-projection.test.mjs test/guarded-dispatch.test.mjs test/p0-single-matcher.test.mjs test/path-policy.test.mjs test/path-policy-fs.test.mjs test/gpw-inheritance-table.test.mjs test/gpw-policy-adapter.test.mjs test/target-policy.test.mjs test/relay-redline-audit.test.mjs test/relay-repair-ledger.test.mjs test/relay-purge-blobs.test.mjs test/relay-scrub.test.mjs test/joint-dev-plan-store.test.mjs test/relay-basepath-blobs.test.mjs test/operator-token.test.mjs test/relay-health-capabilities.test.mjs test/joint-relay-dispatch.test.mjs test/operator-token-route.test.mjs test/relay-scrub-task-projection.test.mjs test/operator-key-approval.test.mjs test/relay-offer-journal.test.mjs test/joint-r5-wiring.test.mjs test/p1-hardening.test.mjs test/joint-merge-engine.test.mjs test/artifact-ref-dir-sink.test.mjs test/chat-sticker-guard.test.mjs test/relay-task-progress.test.mjs test/gpw-modes.test.mjs",
     "test:acceptance-doc": "node --test --test-force-exit test/acceptance-doc.test.mjs",
     "test:account-identity": "node --test --test-force-exit test/account-identity.test.mjs",
     "test:account-join": "node --test --test-force-exit test/account-join.test.mjs",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "twinsearth-w2m-dsh",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "Run one project across your own Windows and macOS machines from a single DeepSeek account, through 12 w2m_* tools. Four coordination modes (replicate, split, broadcast, pipeline) and six aggregate verdicts (consistent, divergent, divergent-platform, failed, partial, unverifiable). P2P hole punching by default, with a bundled relay, STUN responder and ledger fallback, so the fleet needs no third-party service. Joining needs a pairing code plus autoStartAgent: true; installing alone does not join.",
   "license": "MIT",
   "keywords": [

package/src/plugin/gpw.mjs

@@ -95,7 +95,21 @@ export const GPW_PICK_ROUTE = '/api/w2m/gpw/pick';
 export const GPW_RESET_ROUTE = '/api/w2m/gpw/reset';
 
 const DEFAULT_BUDGET = { maxPerWindow: 10, windowMs: 60_000, minGapMs: 3_000 };
-const DEFAULT_PENDING_TIMEOUT_MS = 100_000;
+const DEFAULT_PENDING_TIMEOUT_MS = 10_000;
+
+/** Two policy strategies; novice is the product default. */
+export const GPW_MODES = Object.freeze(['novice', 'advanced']);
+export const DEFAULT_GPW_MODE = 'novice';
+/** At most one path-naming auto-pass per 3 s in novice mode. */
+export const NOVICE_APPROVE_GAP_MS = 3000;
+/** Always refused in novice mode, even with an empty operator blacklist. */
+export const DEFAULT_PROTECTED_FOLDERS = Object.freeze([
+  'C:\\Windows',
+  'C:\\Program Files',
+  'D:\\Program Files',
+  'C:\\Program Files (x86)',
+  'D:\\Program Files (x86)',
+]);
 const RECENT_LIMIT = 20;
 const NO_STORE = { 'cache-control': 'no-store' };
 /** v1.7.9: lists are MAC-signed (v2) so an external edit is detectable instead of silently trusted. */
@@ -164,29 +178,30 @@ export function readFolders(file, key = null, options = {}) {
     raw = readFileSync(file, 'utf8');
   } catch (error) {
     if (error?.code === 'ENOENT' && key !== null && options.allowMissing !== true) {
-      return { whitelist: [], blacklist: [], tampered: true, reason: 'folder lists file is missing' };
+      return { whitelist: [], blacklist: [], mode: 'novice', tampered: true, reason: 'folder lists file is missing' };
     }
     if (error?.code !== 'ENOENT') {
       return { whitelist: [], blacklist: [], tampered: true, reason: `folder lists unreadable: ${error?.message ?? error}` };
     }
-    return { whitelist: [], blacklist: [], tampered: false, reason: null, legacy: false };
+    return { whitelist: [], blacklist: [], mode: 'novice', tampered: false, reason: null, legacy: false };
   }
   let parsed = null;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    return { whitelist: [], blacklist: [], tampered: true, reason: 'folder lists file is not valid JSON' };
+    return { whitelist: [], blacklist: [], mode: 'novice', tampered: true, reason: 'folder lists file is not valid JSON' };
   }
   const whitelist = Array.isArray(parsed?.whitelist) ? parsed.whitelist.filter((v) => typeof v === 'string' && v !== '') : [];
   const blacklist = Array.isArray(parsed?.blacklist) ? parsed.blacklist.filter((v) => typeof v === 'string' && v !== '') : [];
   if (parsed?.version !== FOLDERS_VERSION || typeof parsed?.mac !== 'string') {
-    return { whitelist, blacklist, tampered: false, reason: null, legacy: true };
+    return { whitelist, blacklist, mode: 'novice', tampered: false, reason: null, legacy: true };
   }
-  if (key === null) return { whitelist, blacklist, tampered: false, reason: null, legacy: false };
+  const storedMode = parsed?.mode === 'advanced' ? 'advanced' : 'novice';
+  if (key === null) return { whitelist, blacklist, mode: storedMode, tampered: false, reason: null, legacy: false };
   if (macOfFolders(whitelist, blacklist, key) !== parsed.mac) {
-    return { whitelist, blacklist, tampered: true, reason: 'folder lists were modified outside GPW (MAC mismatch)' };
+    return { whitelist, blacklist, mode: storedMode, tampered: true, reason: 'folder lists were modified outside GPW (MAC mismatch)' };
   }
-  return { whitelist, blacklist, tampered: false, reason: null, legacy: false };
+  return { whitelist, blacklist, mode: storedMode, tampered: false, reason: null, legacy: false };
 }
 
 /**
@@ -200,7 +215,8 @@ export function writeFolders(file, folders, key = null) {
   mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
   const whitelist = [...new Set((folders?.whitelist ?? []).filter((v) => typeof v === 'string' && v.trim() !== ''))];
   const blacklist = [...new Set((folders?.blacklist ?? []).filter((v) => typeof v === 'string' && v.trim() !== ''))];
-  const next = { version: FOLDERS_VERSION, whitelist, blacklist };
+  const mode = folders?.mode === 'advanced' ? 'advanced' : 'novice';
+  const next = { version: FOLDERS_VERSION, whitelist, blacklist, mode };
   if (key !== null) {
     next.algo = FOLDERS_MAC_ALGO;
     next.mac = macOfFolders(whitelist, blacklist, key);
@@ -213,12 +229,12 @@ export function writeFolders(file, folders, key = null) {
   try { chmodSync(tmp, 0o600); } catch { /* best effort */ }
   renameSync(tmp, file);
   try { chmodSync(file, 0o444); } catch { /* read-only is best effort on Windows, MAC still verifies */ }
-  return { whitelist, blacklist };
+  return { whitelist, blacklist, mode };
 }
 
 /** Operator reset: drop every entry and re-sign. Used only after a tamper report. */
 export function resetFolders(file, key) {
-  return writeFolders(file, { whitelist: [], blacklist: [] }, key);
+  return writeFolders(file, { whitelist: [], blacklist: [], mode: 'novice' }, key);
 }
 
 /**
@@ -363,6 +379,7 @@ export function apply(ctx, config = {}) {
   const minGapMs = positiveInt(config.minGapMs, DEFAULT_BUDGET.minGapMs);
   const pendingTimeoutMs = positiveInt(config.pendingTimeoutMs, DEFAULT_PENDING_TIMEOUT_MS);
   const requireFullAccess = config.requireFullAccess !== false;
+  const configuredMode = config.gpwMode === 'advanced' ? 'advanced' : DEFAULT_GPW_MODE;
   const foldersFile = foldersFileOf(config);
   const keyInfo = ensureFoldersKey(foldersFile, config);
   const foldersKey = keyInfo.key;
@@ -384,6 +401,8 @@ export function apply(ctx, config = {}) {
     noteTamper(initialFolders.reason);
   } else {
     // Always leave a signed v2 file behind (first run creates the empty one; later runs re-sign it).
+    // A configured mode is the bootstrap choice when the file carries none yet (tests and first run).
+    if (config.gpwMode !== undefined) initialFolders.mode = configuredMode;
     try {
       writeFolders(foldersFile, initialFolders, foldersKey);
       foldersSeen = true;
@@ -398,6 +417,7 @@ export function apply(ctx, config = {}) {
   let allowedTotal = 0;
   let pendingTotal = 0;
   let deniedTotal = 0;
+  let lastNovicePassAt = 0;
   /** id -> { resolve, createdAt, tool, reason, paths } */
   const pending = new Map();
   /** Newest-first record of calls the gate saw, so the panel can offer "add this folder" in one click. */
@@ -422,9 +442,13 @@ export function apply(ctx, config = {}) {
       foldersSeen = true;
     }
     const merge = (a, b) => [...new Set([...(Array.isArray(a) ? a : []), ...b])];
+    const mode = config.gpwMode !== undefined ? configuredMode : (stored.mode ?? configuredMode);
+    const storedBlacklist = merge(config.blacklist, stored.blacklist);
     return {
+      mode,
       whitelist: merge(config.whitelist, stored.whitelist),
-      blacklist: merge(config.blacklist, stored.blacklist),
+      blacklist: storedBlacklist,
+      effectiveBlacklist: mode === 'novice' ? [...new Set([...DEFAULT_PROTECTED_FOLDERS, ...storedBlacklist])] : storedBlacklist,
       tampered: tamperedReason !== null,
       reason: tamperedReason,
     };
@@ -529,8 +553,8 @@ export function apply(ctx, config = {}) {
       ctx.logger?.warn?.(`dsh-gpw: refused ${String(call.name ?? 'tool')} -- lists locked (${lists.reason})`);
       return `GPW: folder lists failed integrity check (${lists.reason}); reset them in the GPW panel`;
     }
-    if (lists.blacklist.length === 0) return undefined;
-    const result = classifyToolCall({ ...call, blacklist: lists.blacklist });
+    if (lists.effectiveBlacklist.length === 0) return undefined;
+    const result = classifyToolCall({ ...call, blacklist: lists.effectiveBlacklist });
     if (result.decision !== 'deny') return undefined;
     deniedTotal += 1;
     noteRecent({ tool: String(call.name ?? 'tool'), decision: 'deny', reason: result.reason, paths: result.paths });
@@ -575,6 +599,34 @@ export function apply(ctx, config = {}) {
       ctx.logger?.warn?.(`dsh-gpw: refused ${String(call.name ?? 'tool')} -- lists locked (${lists.reason})`);
       return { kind: 'deny', reason: `GPW: folder lists failed integrity check (${lists.reason}); reset them in the GPW panel` };
     }
+    if (lists.mode === 'novice') {
+      // 小白模式: only the blacklist restricts anything; every other call passes.
+      // At most one path-naming call per 3 s is auto-passed, so a burst cannot do unbounded damage.
+      let noviceCwd = null;
+      try {
+        noviceCwd = await ctx.workingDirectory?.ensure?.(exec.agent, exec.signal);
+      } catch {
+        noviceCwd = null;
+      }
+      const noviceCall = toolCallOf(exec);
+      const noviceClassification = classifyToolCall({ ...noviceCall, blacklist: lists.effectiveBlacklist, workspace: noviceCwd ?? null, base: noviceCwd ?? undefined });
+      if (noviceClassification.decision === 'deny') {
+        deniedTotal += 1;
+        colorCounts.red += 1;
+        noteRecent({ tool: String(noviceCall.name ?? 'tool'), decision: 'deny', color: 'red', reason: noviceClassification.reason, paths: noviceClassification.paths });
+        ctx.logger?.warn?.('dsh-gpw: novice -- refused ' + String(noviceCall.name ?? 'tool') + ' -- ' + noviceClassification.reason);
+        return { kind: 'deny', reason: 'GPW: ' + noviceClassification.reason + '; the call was not executed' };
+      }
+      if (noviceClassification.paths.length > 0) {
+        const waitMs = NOVICE_APPROVE_GAP_MS - (Date.now() - lastNovicePassAt);
+        if (waitMs > 0) await new Promise((resolveSlot) => { setTimeout(resolveSlot, Math.min(waitMs, NOVICE_APPROVE_GAP_MS)); });
+        lastNovicePassAt = Date.now();
+      }
+      colorCounts.green += 1;
+      const noviceReason = '小白模式：黑名单外全部放行（每 3 秒最多一次路径操作）';
+      noteRecent({ tool: String(noviceCall.name ?? 'tool'), decision: 'allow', color: 'green', reason: noviceReason, paths: noviceClassification.paths });
+      return { kind: 'allow', reason: noviceReason };
+    }
     let cwd = null;
     try {
       cwd = await ctx.workingDirectory?.ensure?.(exec.agent, exec.signal);
@@ -651,6 +703,11 @@ export function apply(ctx, config = {}) {
           enabled: true,
           require_full_access: requireFullAccess,
           folders: { whitelist: lists.whitelist, blacklist: lists.blacklist },
+          mode: lists.mode,
+          modes: [...GPW_MODES],
+          protected_folders: lists.mode === 'novice' ? [...DEFAULT_PROTECTED_FOLDERS, ...lists.blacklist] : [...lists.blacklist],
+          pending_timeout_ms: pendingTimeoutMs,
+          novice_approve_gap_ms: NOVICE_APPROVE_GAP_MS,
           tampered: lists.tampered,
           tampered_reason: lists.reason,
           counters: { allowedTotal, pendingTotal, deniedTotal, budgetWindow: approvals.length, maxPerWindow, colors: { ...colorCounts }, grants: sessionGrants.size },
@@ -690,6 +747,22 @@ export function apply(ctx, config = {}) {
         } catch {
           /* refused below */
         }
+        if (body?.action === 'set-mode') {
+          const current = folderLists();
+          if (current.tampered) {
+            return json({ ok: false, error: 'folder lists are locked after an integrity failure (' + current.reason + '); reset them first' }, 409);
+          }
+          const mode = body?.mode;
+          if (mode !== 'novice' && mode !== 'advanced') return json({ ok: false, error: 'mode must be novice or advanced' }, 400);
+          const stored = readFolders(foldersFile, foldersKey, { allowMissing: true });
+          try {
+            writeFolders(foldersFile, { ...stored, mode }, foldersKey);
+          } catch (error) {
+            return json({ ok: false, error: 'could not write the policy mode: ' + (error?.message ?? error) }, 500);
+          }
+          ctx.logger?.info?.('dsh-gpw: policy mode -> ' + mode);
+          return json({ ok: true, mode, folders: folderLists() });
+        }
         const list = body?.list;
         if (list !== 'whitelist' && list !== 'blacklist') return json({ ok: false, error: 'list must be whitelist or blacklist' }, 400);
         if (body?.action !== 'add' && body?.action !== 'remove') return json({ ok: false, error: 'action must be add or remove' }, 400);
@@ -698,6 +771,17 @@ export function apply(ctx, config = {}) {
           return json({ ok: false, error: `folder lists are locked after an integrity failure (${current.reason}); reset them first` }, 409);
         }
         const stored = readFolders(foldersFile, foldersKey, { allowMissing: true });
+        if (body?.action === 'set-mode') {
+          const mode = body?.mode;
+          if (mode !== 'novice' && mode !== 'advanced') return json({ ok: false, error: 'mode must be novice or advanced' }, 400);
+          try {
+            writeFolders(foldersFile, { ...stored, mode }, foldersKey);
+          } catch (error) {
+            return json({ ok: false, error: 'could not write the policy mode: ' + (error?.message ?? error) }, 500);
+          }
+          ctx.logger?.info?.('dsh-gpw: policy mode -> ' + mode);
+          return json({ ok: true, mode, folders: folderLists() });
+        }
         if (body.action === 'remove') {
           if (typeof body?.path !== 'string' || body.path.trim() === '') return json({ ok: false, error: 'path must be a non-empty string' }, 400);
           const next = { ...stored, [list]: stored[list].filter((entry) => entry !== body.path) };
@@ -734,7 +818,7 @@ export function apply(ctx, config = {}) {
         }
         if (body?.confirm !== 'reset') return json({ ok: false, error: "confirm must be the string 'reset'" }, 400);
         try {
-          resetFolders(foldersFile, foldersKey);
+          resetFolders(foldersFile, foldersKey, folderLists().mode);
         } catch (error) {
           return json({ ok: false, error: `could not reset folder lists: ${error?.message ?? error}` }, 500);
         }

package/src/plugin/tools.mjs

@@ -286,7 +286,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '2.0.2';
+const PLUGIN_VERSION = '2.0.4';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;