dsh-eval-guard 0.1.3 → 0.2.0

package/README.md

@@ -6,21 +6,26 @@
 - 禁止联网、子代理、Agent Team/跨 agent 通信、读取其它工作区。
 - 工具黑名单可配置；未知工具默认放行，但 DSH 内置与 dsh-ops 的工具会做参数路径审计。
 - 每个用户消息后的单轮有可配置的最长时长（默认 90 分钟）；到点只终止当前轮次，并递归清理子代理与后台任务。
-- 设置页可安装“第 6 集 · 坦克大战”任务：空工作区 → 复制素材 → 新会话填入提示词（由用户发送）。
+- 设置页可安装五个任务包：**第 6 集 · 坦克大战**、**第 5 集 · 仓储调度**、**第 1 集 · 圈地**、**第 2 集 · 炸弹人**、**第 3 集 · 夺旗**：空工作区 → 放入打包好的 `workspace.zip` → 新会话填入提示词（由用户发送）。
 
 插件默认关闭；关闭时不做任何行为。所有 run 记录、usage、violations 写入
-$DSH_HOME/eval-guard/runs/<run-id>/，供独立的 ../tank-eval 评测程序读取。
+$DSH_HOME/eval-guard/runs/<run-id>/，供独立的 ../tank-eval 与 ../warehouse-eval 评测程序读取。
 
 ## 任务来源
 
-安装的评测任务来自开源项目 **meow-ai-arena** 的第 6 集 · 坦克大战：
+安装的评测任务来自开源项目 **meow-ai-arena**（MIT License，commit `6bd738b`，2026-10-16）：
 
-- 仓库：<https://github.com/chen-006/meow-ai-arena>
-- 任务目录：<https://github.com/chen-006/meow-ai-arena/tree/main/tank>
-- 使用版本：commit `6bd738b`（2026-10-16）
-- 素材来源：该仓库的 `tank/workspace/`（MIT License）
+- 第 1 集 · 圈地：<https://github.com/chen-006/meow-ai-arena/tree/main/land>，素材 `land/workspace/`
+- 第 2 集 · 炸弹人：<https://github.com/chen-006/meow-ai-arena/tree/main/bomberman>，素材 `bomberman/workspace/`
+- 第 3 集 · 夺旗：<https://github.com/chen-006/meow-ai-arena/tree/main/ctf>，素材 `ctf/workspace/`
+- 第 5 集 · 仓储调度：<https://github.com/chen-006/meow-ai-arena/tree/main/warehouse>，素材 `warehouse/workspace/` 的第 1 轮主程包，改编为单人单次 90 分钟
+- 第 6 集 · 坦克大战：<https://github.com/chen-006/meow-ai-arena/tree/main/tank>，素材 `tank/workspace/`
 
-本插件打包的 Linux 版 `workspace.zip` 在原素材基础上做了两处适配：把 `baseline.cpp` 编译为 Linux 可执行文件并移出源码；把 `clock.py` 改为单次 90 分钟版本。规则、引擎、本地裁判、模板等其余文件保持原样。
+仓库：<https://github.com/chen-006/meow-ai-arena>
+
+本插件打包的 Linux 版 `workspace.zip` 在原素材基础上做了三处适配：把 `baseline.cpp` 编译为 Linux ELF 可执行文件并移出源码，文件名改为 `baseline`（不带 `.exe`）；把 `clock.py` 改为单次 90 分钟版本；`README.md` 中对应的 baseline 示例同步改名。规则、引擎、本地裁判、模板等其余文件保持原样。安装任务时只把 `workspace.zip` 放入工作区，不再散装解压。
+
+仓储调度任务包同样只放 `workspace.zip`；包内 `TASK.md` 已改写成单人单次 90 分钟版本，保留了原 `baseline/`、`src/`、`workloads/` 和 `tools/`。
 
 ## 构建
 

package/lib/client/index.js

@@ -111,6 +111,7 @@ window.__ModuleLoader__.load({
 			const [notice, setNotice] = (0, react.useState)("");
 			const [error, setError] = (0, react.useState)("");
 			const [workspaceId, setWorkspaceId] = (0, react.useState)("");
+			const [taskId, setTaskId] = (0, react.useState)("");
 			const [check, setCheck] = (0, react.useState)(null);
 			const [manual, setManual] = (0, react.useState)(null);
 			const [prompt, setPrompt] = (0, react.useState)("");
@@ -135,6 +136,9 @@ window.__ModuleLoader__.load({
 				}, 2e3);
 				return () => clearInterval(timer);
 			}, []);
+			(0, react.useEffect)(() => {
+				if (taskId === "" && state !== null && state.tasks.length > 0) setTaskId(state.tasks[0].id);
+			}, [state, taskId]);
 			const ready = snapshot.status === "ready" && snapshot.writable;
 			const save = async (patch) => {
 				if (!ready || snapshot.revision === void 0) return;
@@ -183,7 +187,7 @@ window.__ModuleLoader__.load({
 				setPendingEnable(false);
 				save({ enabled: true });
 			};
-			const loadManual = (id) => {
+			const loadManual = (id, task) => {
 				if (id === "") {
 					setCheck(null);
 					setManual(null);
@@ -192,14 +196,14 @@ window.__ModuleLoader__.load({
 				}
 				fetch(CHECK_ROUTE + "?workspaceId=" + encodeURIComponent(id)).then(readJson).then((result) => {
 					setCheck(result);
-					if (result.ok) fetch("/api/eval-guard/manual?workspaceId=" + encodeURIComponent(id)).then(readJson).then((paths) => {
+					if (result.ok) fetch("/api/eval-guard/manual?workspaceId=" + encodeURIComponent(id) + "&task=" + encodeURIComponent(task)).then(readJson).then((paths) => {
 						setManual(paths);
 						setPrompt(paths.prompt);
 					}).catch(() => void 0);
 				}).catch((reason) => setError(reason instanceof Error ? reason.message : String(reason)));
 			};
 			const install = async () => {
-				if (workspaceId === "") return;
+				if (workspaceId === "" || taskId === "") return;
 				setError("");
 				setNotice("");
 				const checked = await fetch(CHECK_ROUTE + "?workspaceId=" + encodeURIComponent(workspaceId)).then(readJson);
@@ -211,7 +215,10 @@ window.__ModuleLoader__.load({
 				const result = await fetch(INSTALL_ROUTE, {
 					method: "POST",
 					headers: { "content-type": "application/json" },
-					body: JSON.stringify({ workspaceId })
+					body: JSON.stringify({
+						workspaceId,
+						task: taskId
+					})
 				}).then(readJson);
 				if (!result.ok || result.prompt === void 0) {
 					setError(result.error ?? "安装失败");
@@ -401,9 +408,28 @@ window.__ModuleLoader__.load({
 							style: note,
 							children: t("settings.taskHint")
 						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							style: row,
-							children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", { children: [t("settings.taskLabel"), ": 第 6 集 · 坦克大战"] })
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", { children: [t("settings.taskLabel"), ":"] }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("select", {
+								value: taskId,
+								disabled: state === null || state.tasks.length === 0,
+								onChange: (event) => {
+									const next = event.target.value;
+									setTaskId(next);
+									setCheck(null);
+									setManual(null);
+									setPrompt("");
+									if (workspaceId !== "") loadManual(workspaceId, next);
+								},
+								children: (state?.tasks ?? []).map((task) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+									value: task.id,
+									children: task.label
+								}, task.id))
+							})]
+						}),
+						state !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							style: note,
+							children: state.tasks.find((task) => task.id === taskId)?.description ?? ""
 						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							style: row,
@@ -413,7 +439,7 @@ window.__ModuleLoader__.load({
 									value: workspaceId,
 									onChange: (event) => {
 										setWorkspaceId(event.target.value);
-										loadManual(event.target.value);
+										loadManual(event.target.value, taskId);
 									},
 									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
 										value: "",
@@ -425,7 +451,7 @@ window.__ModuleLoader__.load({
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 									style: primary,
-									disabled: workspaceId === "",
+									disabled: workspaceId === "" || taskId === "",
 									onClick: () => void install(),
 									children: t("settings.check")
 								})

package/lib/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["useSyncExternalStore","useState","useState"],"sources":["../../src/shared.ts","../../src/client/bridge.ts","../../src/client/Settings.tsx","../../src/client/Toast.tsx","../../src/client/locales.ts","../../src/client/index.ts"],"sourcesContent":["/**\n * Wire types shared by the host and browser halves. Keep this module import-free:\n * the client bundle includes it without pulling host code.\n * @module dsh-eval-guard/shared\n */\n\n/** Settings namespace; also the Loader row id in cordis.patch.yml. */\nexport const SETTINGS_NS = 'eval-guard'\n\n/** Route paths owned by this plugin. */\nexport const STATE_ROUTE = '/api/eval-guard/state'\nexport const CHECK_ROUTE = '/api/eval-guard/check'\nexport const INSTALL_ROUTE = '/api/eval-guard/install'\nexport const PROMPT_ROUTE = '/api/eval-guard/prompt'\nexport const EVENTS_ROUTE = '/api/eval-guard/events'\nexport const REVEAL_ROUTE = '/api/eval-guard/reveal'\nexport const MANUAL_ROUTE = '/api/eval-guard/manual'\n\n/** The only task implemented today. */\nexport const TANK_TASK = 'tank'\nexport const TANK_TASK_LABEL = '第 6 集 · 坦克大战'\n\n/** One task offered by the installer. */\nexport interface TaskInfo {\n  id: string\n  label: string\n  description: string\n}\n\n/** A live conversation the enable-time warning has to mention. */\nexport interface RunningSession {\n  sessionId: string\n  title: string\n  cwd: string\n  running: boolean\n  jobs: number\n}\n\n/** One warning surfaced to the browser. */\nexport interface GuardEvent {\n  seq: number\n  at: number\n  sessionId?: string\n  runId?: string\n  kind: 'tool-blocked' | 'path-denied' | 'process-denied' | 'wait-blocked' | 'timeout' | 'notice'\n  tool?: string\n  detail: string\n}\n\n/** Host answer for the enable pre-check. */\nexport interface GuardState {\n  enabled: boolean\n  running: RunningSession[]\n  tasks: TaskInfo[]\n  defaultBlacklist: string\n  generatedDefault: boolean\n  workspaceRoot: string\n  runsRoot: string\n}\n\n/** Result of checking one workspace before install. */\nexport interface CheckResult {\n  ok: boolean\n  workspaceId: string\n  path: string\n  empty: boolean\n  entries: string[]\n  error?: string\n}\n\n/** Result of installing the task pack. */\nexport interface InstallResult {\n  ok: boolean\n  error?: string\n  runId?: string\n  workspaceId?: string\n  workspacePath?: string\n  prompt?: string\n}\n\n/** Manual-channel material locations. */\nexport interface ManualPaths {\n  source: string\n  prompt: string\n}\n\n/** Usage record written next to one run. */\nexport interface RunUsage {\n  inputTokens: number\n  outputTokens: number\n  cacheReadTokens: number\n  cacheWriteTokens: number\n  reasoningTokens: number\n  toolCalls: number\n  turns: number\n  steps: number\n  wallTimeMs: number\n  startedAt: number | null\n  updatedAt: number\n}\n\n/** Metadata for one guarded task run. */\nexport interface RunRecord {\n  runId: string\n  task: string\n  workspaceId: string\n  workspacePath: string\n  sessionId: string | null\n  createdAt: number\n  startedAt: number | null\n  endedAt: number | null\n  status: 'prepared' | 'active' | 'timeout' | 'ended'\n  prompt: string\n  timeLimitMinutes: number\n  provider?: string\n  model?: string\n  title?: string\n}\n","/** Shell capabilities published to the Settings panel. */\nexport interface EvalWorkspace { id: string; label: string }\nexport interface EvalBridge {\n  startSession(workspaceId: string, prompt: string): void\n  workspaces(): readonly EvalWorkspace[]\n}\nlet current: EvalBridge | undefined\nexport function configureEvalBridge(next: EvalBridge | undefined): void { current = next }\nexport function evalBridge(): EvalBridge | undefined { return current }\n","/**\n * Settings panel for the evaluation guard.\n * @module dsh-eval-guard/client/Settings\n */\nimport { useEffect, useState, useSyncExternalStore, type CSSProperties, type ReactElement } from 'react'\nimport {\n  CHECK_ROUTE, EVENTS_ROUTE, INSTALL_ROUTE, MANUAL_ROUTE, REVEAL_ROUTE, STATE_ROUTE,\n  type CheckResult, type GuardEvent, type GuardState, type InstallResult, type ManualPaths,\n} from '../shared.ts'\nimport { evalBridge } from './bridge.ts'\n\ntype Snapshot = {\n  status: 'loading' | 'ready' | 'unavailable'\n  value?: Record<string, unknown>\n  revision?: number\n  writable: boolean\n}\ntype Form = {\n  getSnapshot: () => Snapshot\n  subscribe: (listener: () => void) => () => void\n  mutate: (ops: readonly { op: 'set'; path: string[]; value: unknown }[], revision?: number) => Promise<boolean>\n}\ntype Props = { form: Form; t: (key: string) => string }\n\ninterface Draft {\n  enabled: boolean\n  timeLimitEnabled: boolean\n  timeLimitMinutes: number\n  forbiddenPaths: string\n  toolBlacklistUseDefault: boolean\n  toolBlacklist: string\n}\n\nconst EMPTY: Draft = {\n  enabled: false,\n  timeLimitEnabled: true,\n  timeLimitMinutes: 90,\n  forbiddenPaths: '',\n  toolBlacklistUseDefault: true,\n  toolBlacklist: '',\n}\n\nconst box: CSSProperties = { border: '1px solid var(--vscode-panel-border, #3c3c3c)', borderRadius: 8, padding: 14, marginBottom: 14 }\nconst row: CSSProperties = { display: 'flex', gap: 10, alignItems: 'center', flexWrap: 'wrap', marginBottom: 8 }\nconst note: CSSProperties = { opacity: 0.72, fontSize: 12, lineHeight: 1.5, margin: '6px 0' }\nconst textarea: CSSProperties = { width: '100%', minHeight: 110, fontFamily: 'monospace', fontSize: 12, padding: 8, boxSizing: 'border-box' }\nconst button: CSSProperties = { padding: '5px 12px', borderRadius: 6, cursor: 'pointer' }\nconst primary: CSSProperties = { ...button, background: '#2f6fd0', color: '#fff', border: 'none' }\nconst danger: CSSProperties = { ...button, background: '#a33', color: '#fff', border: 'none' }\n\nasync function readJson<T>(response: Response): Promise<T> { return await response.json() as T }\n\nfunction normalize(value: Record<string, unknown> | undefined): Draft {\n  return {\n    enabled: value?.enabled === true,\n    timeLimitEnabled: value?.timeLimitEnabled !== false,\n    timeLimitMinutes: typeof value?.timeLimitMinutes === 'number' ? value.timeLimitMinutes : 90,\n    forbiddenPaths: typeof value?.forbiddenPaths === 'string' ? value.forbiddenPaths : '',\n    toolBlacklistUseDefault: value?.toolBlacklistUseDefault !== false,\n    toolBlacklist: typeof value?.toolBlacklist === 'string' ? value.toolBlacklist : '',\n  }\n}\n\n/** The settings card. */\nexport function EvalGuardSettings({ form, t }: Props): ReactElement {\n  const snapshot = useSyncExternalStore(form.subscribe, form.getSnapshot, form.getSnapshot)\n  const [draft, setDraft] = useState<Draft>(EMPTY)\n  const [dirty, setDirty] = useState(false)\n  const [state, setState] = useState<GuardState | null>(null)\n  const [events, setEvents] = useState<GuardEvent[]>([])\n  const [pendingEnable, setPendingEnable] = useState(false)\n  const [notice, setNotice] = useState('')\n  const [error, setError] = useState('')\n  const [workspaceId, setWorkspaceId] = useState('')\n  const [check, setCheck] = useState<CheckResult | null>(null)\n  const [manual, setManual] = useState<ManualPaths | null>(null)\n  const [prompt, setPrompt] = useState('')\n  const [copied, setCopied] = useState('')\n  const workspaces = evalBridge()?.workspaces() ?? []\n\n  useEffect(() => {\n    if (snapshot.status !== 'ready' || snapshot.value === undefined || dirty) return\n    setDraft(normalize(snapshot.value))\n  }, [snapshot, dirty])\n\n  const loadState = (): void => {\n    fetch(STATE_ROUTE).then(readJson<GuardState>).then(setState).catch(() => setState(null))\n  }\n  useEffect(() => {\n    loadState()\n    let since = 0\n    const timer = setInterval(() => {\n      fetch(EVENTS_ROUTE + '?since=' + String(since)).then(readJson<{ events: GuardEvent[] }>).then(data => {\n        if (data.events.length === 0) return\n        since = data.events[data.events.length - 1]!.seq\n        setEvents(current => [...data.events, ...current].slice(0, 12))\n      }).catch(() => undefined)\n    }, 2000)\n    return () => clearInterval(timer)\n  }, [])\n\n  const ready = snapshot.status === 'ready' && snapshot.writable\n  const save = async (patch: Partial<Draft>): Promise<void> => {\n    if (!ready || snapshot.revision === undefined) return\n    const next = { ...draft, ...patch }\n    const ops: { op: 'set'; path: string[]; value: unknown }[] = []\n    for (const key of Object.keys(patch) as (keyof Draft)[]) ops.push({ op: 'set', path: [key], value: next[key] })\n    try {\n      const accepted = await form.mutate(ops, snapshot.revision)\n      if (!accepted) { setError('保存冲突，请刷新后重试。'); return }\n      setDraft(next)\n      setDirty(false)\n      setError('')\n      loadState()\n    } catch (reason: unknown) {\n      setError(reason instanceof Error ? reason.message : String(reason))\n    }\n  }\n  const edit = (patch: Partial<Draft>): void => {\n    setDraft(current => ({ ...current, ...patch }))\n    setDirty(true)\n  }\n\n  const toggleEnabled = (next: boolean): void => {\n    if (!next) { void save({ enabled: false }); return }\n    fetch(STATE_ROUTE).then(readJson<GuardState>).then(latest => {\n      setState(latest)\n      if (latest.running.length > 0) setPendingEnable(true)\n      else void save({ enabled: true })\n    }).catch(() => void save({ enabled: true }))\n  }\n\n  const forceEnable = (): void => {\n    setPendingEnable(false)\n    void save({ enabled: true })\n  }\n\n  const loadManual = (id: string): void => {\n    if (id === '') { setCheck(null); setManual(null); setPrompt(''); return }\n    fetch(CHECK_ROUTE + '?workspaceId=' + encodeURIComponent(id)).then(readJson<CheckResult>).then(result => {\n      setCheck(result)\n      if (result.ok) {\n        fetch(MANUAL_ROUTE + '?workspaceId=' + encodeURIComponent(id)).then(readJson<ManualPaths>).then(paths => {\n          setManual(paths)\n          setPrompt(paths.prompt)\n        }).catch(() => undefined)\n      }\n    }).catch((reason: unknown) => setError(reason instanceof Error ? reason.message : String(reason)))\n  }\n\n  const install = async (): Promise<void> => {\n    if (workspaceId === '') return\n    setError(''); setNotice('')\n    const checked = await fetch(CHECK_ROUTE + '?workspaceId=' + encodeURIComponent(workspaceId)).then(readJson<CheckResult>)\n    setCheck(checked)\n    if (!checked.ok || !checked.empty) {\n      setError(checked.error ?? t('settings.nonEmpty'))\n      return\n    }\n    const result = await fetch(INSTALL_ROUTE, {\n      method: 'POST', headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ workspaceId }),\n    }).then(readJson<InstallResult>)\n    if (!result.ok || result.prompt === undefined) { setError(result.error ?? '安装失败'); return }\n    setPrompt(result.prompt)\n    setNotice(t('settings.installOk'))\n    evalBridge()?.startSession(workspaceId, result.prompt)\n    loadState()\n  }\n\n  const copy = async (label: string, text: string): Promise<void> => {\n    try {\n      await navigator.clipboard.writeText(text)\n      setCopied(label)\n      setTimeout(() => setCopied(''), 1500)\n    } catch { setError('复制失败') }\n  }\n  const reveal = (target: string): void => {\n    void fetch(REVEAL_ROUTE, {\n      method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ path: target }),\n    })\n  }\n  const blacklistText = draft.toolBlacklistUseDefault ? state?.defaultBlacklist ?? '' : draft.toolBlacklist\n\n  if (snapshot.status === 'loading') return <div style={box}>{t('settings.loading')}</div>\n  return <div>\n    {pendingEnable && <div style={{ ...box, borderColor: '#caa23a' }}>\n      <strong>{t('settings.warningTitle')}</strong>\n      <p style={note}>{t('settings.runningWarning')}</p>\n      <ul style={{ ...note, paddingLeft: 18 }}>{(state?.running ?? []).map(item =>\n        <li key={item.sessionId}>{item.title} · {item.cwd}{item.jobs > 0 ? ' · jobs: ' + String(item.jobs) : ''}</li>)}</ul>\n      <div style={row}>\n        <button style={button} onClick={() => { setPendingEnable(false); loadState() }}>{t('settings.runningCancel')}</button>\n        <button style={danger} onClick={forceEnable}>{t('settings.runningForce')}</button>\n      </div>\n    </div>}\n\n    <section style={box}>\n      <div style={row}>\n        <label><input type=\"checkbox\" checked={draft.enabled} disabled={!ready} onChange={event => toggleEnabled(event.target.checked)} /> {t('settings.enabled')}</label>\n      </div>\n      <p style={note}>{t('settings.enabledHint')}</p>\n    </section>\n\n    <section style={box}>\n      <div style={row}>\n        <label><input type=\"checkbox\" checked={draft.timeLimitEnabled} disabled={!ready} onChange={event => void save({ timeLimitEnabled: event.target.checked })} /> {t('settings.timeLimit')}</label>\n        <input type=\"number\" min={1} max={1440} value={draft.timeLimitMinutes} disabled={!ready}\n          style={{ width: 90 }} onChange={event => edit({ timeLimitMinutes: Number(event.target.value) })}\n          onBlur={() => void save({ timeLimitMinutes: draft.timeLimitMinutes })} />\n        <span style={note}>{t('settings.minutes')}</span>\n      </div>\n      <p style={note}>{t('settings.timeLimitHint')}</p>\n    </section>\n\n    <section style={box}>\n      <strong>{t('settings.forbidden')}</strong>\n      <p style={note}>{t('settings.forbiddenHint')}</p>\n      <textarea style={textarea} value={draft.forbiddenPaths} disabled={!ready}\n        onChange={event => edit({ forbiddenPaths: event.target.value })}\n        onBlur={() => void save({ forbiddenPaths: draft.forbiddenPaths })} />\n    </section>\n\n    <section style={box}>\n      <div style={row}>\n        <strong>{t('settings.blacklist')}</strong>\n        <button style={button} disabled={!ready} onClick={() => void save({ toolBlacklistUseDefault: true, toolBlacklist: '' })}>{t('settings.reset')}</button>\n      </div>\n      <p style={note}>{t('settings.blacklistHint')}</p>\n      <textarea style={textarea} value={blacklistText} disabled={!ready}\n        onChange={event => edit({ toolBlacklistUseDefault: false, toolBlacklist: event.target.value })}\n        onBlur={() => void save({ toolBlacklistUseDefault: draft.toolBlacklistUseDefault, toolBlacklist: draft.toolBlacklist })} />\n      {draft.toolBlacklistUseDefault && <p style={note}>{t('settings.editingDefault')}</p>}\n    </section>\n\n    <section style={box}>\n      <strong>{t('settings.task')}</strong>\n      <p style={note}>{t('settings.taskHint')}</p>\n      <div style={row}>\n        <span>{t('settings.taskLabel')}: 第 6 集 · 坦克大战</span>\n      </div>\n      <div style={row}>\n        <span>{t('settings.workspace')}:</span>\n        <select value={workspaceId} onChange={event => { setWorkspaceId(event.target.value); loadManual(event.target.value) }}>\n          <option value=\"\">{t('settings.pickWorkspace')}</option>\n          {workspaces.map(workspace => <option key={workspace.id} value={workspace.id}>{workspace.label}</option>)}\n        </select>\n        <button style={primary} disabled={workspaceId === ''} onClick={() => void install()}>{t('settings.check')}</button>\n      </div>\n      {workspaces.length === 0 && <p style={note}>{t('settings.noWorkspaces')}</p>}\n      {check !== null && !check.empty && <p style={{ ...note, color: '#d99' }}>{t('settings.nonEmpty')} ({check.entries.slice(0, 6).join(', ')})</p>}\n      {notice !== '' && <p style={{ ...note, color: '#7c7' }}>{notice}</p>}\n      {error !== '' && <p style={{ ...note, color: '#d77' }}>{error}</p>}\n    </section>\n\n    <section style={box}>\n      <strong>{t('settings.manual')}</strong>\n      <p style={note}>{t('settings.manualHint')}</p>\n      <div style={row}><span>{t('settings.source')}:</span><code style={{ wordBreak: 'break-all' }}>{manual?.source ?? '—'}</code>\n        {manual !== null && <button style={button} onClick={() => reveal(manual.source)}>{t('settings.reveal')}</button>}</div>\n      <div style={row}><span>{t('settings.target')}:</span><code style={{ wordBreak: 'break-all' }}>{check?.path ?? '—'}</code>\n        {check?.path !== undefined && check.path !== '' && <button style={button} onClick={() => reveal(check.path)}>{t('settings.reveal')}</button>}</div>\n      <div style={row}><button style={button} disabled={prompt === ''} onClick={() => void copy('prompt', prompt)}>{copied === 'prompt' ? t('settings.copied') : t('settings.copy')}</button></div>\n      <textarea style={{ ...textarea, minHeight: 160 }} readOnly value={prompt} placeholder={t('settings.prompt')} />\n    </section>\n\n    <section style={box}>\n      <strong>{t('settings.recent')}</strong>\n      {events.length === 0 && <p style={note}>{t('settings.none')}</p>}\n      {events.map(event => <div key={event.seq} style={{ ...note, borderTop: '1px solid #333', paddingTop: 4 }}>\n        <strong>[{event.kind}]</strong> {event.tool !== undefined ? event.tool + ' · ' : ''}{event.detail}\n      </div>)}\n    </section>\n  </div>\n}\n","/**\n * Frame-wide warning toasts fed by the host event route.\n * @module dsh-eval-guard/client/Toast\n */\nimport { useEffect, useState, type ReactElement } from 'react'\nimport { EVENTS_ROUTE, type GuardEvent } from '../shared.ts'\n\n/** One toast with a dismiss deadline. */\ninterface Shown { event: GuardEvent; until: number }\n\n/** Poll the host event feed and show new warnings. */\nexport function GuardToast({ t }: { t: (key: string) => string }): ReactElement | null {\n  const [shown, setShown] = useState<Shown[]>([])\n  useEffect(() => {\n    let since = 0\n    let alive = true\n    const poll = (): void => {\n      fetch(EVENTS_ROUTE + '?since=' + String(since)).then(async response => await response.json() as { events: GuardEvent[] }).then(data => {\n        if (!alive || data.events.length === 0) return\n        since = data.events[data.events.length - 1]!.seq\n        const warnings = data.events.filter(event => event.kind !== 'notice')\n        if (warnings.length === 0) return\n        const now = Date.now()\n        setShown(current => [...warnings.map(event => ({ event, until: now + 8000 })), ...current].slice(0, 5))\n      }).catch(() => undefined)\n    }\n    const timer = setInterval(() => {\n      poll()\n      const now = Date.now()\n      setShown(current => current.filter(item => item.until > now))\n    }, 1500)\n    poll()\n    return () => { alive = false; clearInterval(timer) }\n  }, [])\n  if (shown.length === 0) return null\n  return <div style={{ position: 'fixed', right: 18, bottom: 18, zIndex: 9999, display: 'flex', flexDirection: 'column', gap: 8, maxWidth: 420 }}>\n    {shown.map(item => <div key={item.event.seq} style={{\n      background: '#3a2a12', color: '#ffdca8', border: '1px solid #8a6a2a', borderRadius: 8,\n      padding: '10px 12px', fontSize: 12, lineHeight: 1.5, boxShadow: '0 6px 24px rgba(0,0,0,.45)',\n    }}>\n      <strong>{t('settings.warningTitle')}</strong>\n      <div>{item.event.detail}</div>\n    </div>)}\n  </div>\n}\n","/** Locale namespace and dictionaries for the browser half. */\nexport const NS = 'evalGuard'\n\nexport const zh = {\n  'settings.nav': '评测守护',\n  'settings.title': '评测守护',\n  'settings.enabled': '启用评测守护',\n  'settings.enabledHint': '启用后，所有用户主对话只能读写自己的工作区，禁止联网、子代理与跨 agent 通信，并按任务时限强制终止。默认关闭。',\n  'settings.runningWarning': '当前有正在运行的对话。启用评测守护会立即约束它们，是否强行开启？',\n  'settings.runningCancel': '放弃',\n  'settings.runningForce': '强行开启',\n  'settings.timeLimit': '开启最长时长',\n  'settings.timeLimitHint': '从每条用户消息发送时开始计时；到点只终止当前轮次，并递归清理子代理与后台任务。',\n  'settings.minutes': '分钟',\n  'settings.forbidden': '额外禁止路径',\n  'settings.forbiddenHint': '每行一个绝对路径；# 开头为注释；! 开头表示在禁止范围内放开该子路径；按行顺序生效。默认空。',\n  'settings.blacklist': '工具黑名单',\n  'settings.blacklistHint': '每行一个工具名；默认内容按当前已安装工具生成，不存在的工具会被忽略。',\n  'settings.reset': '恢复默认黑名单',\n  'settings.editingDefault': '编辑后将以自定义黑名单保存。',\n  'settings.task': '安装评测任务',\n  'settings.taskHint': '选择一个空的工作区，复制坦克大战素材并把初始提示词填入新会话输入框。',\n  'settings.taskLabel': '任务',\n  'settings.workspace': '工作区',\n  'settings.pickWorkspace': '请选择工作区',\n  'settings.check': '检测并安装',\n  'settings.nonEmpty': '工作区不是空的；未执行任何操作。',\n  'settings.manual': '手动通道',\n  'settings.manualHint': '手动复制素材：自己把素材目录内容复制到工作区根目录；手动填充提示词：复制下面的提示词。',\n  'settings.source': '素材路径',\n  'settings.target': '工作区路径',\n  'settings.copy': '复制',\n  'settings.copied': '已复制',\n  'settings.prompt': '初始提示词',\n  'settings.reveal': '在文件管理器中打开',\n  'settings.noWorkspaces': '没有可选的工作区。',\n  'settings.installOk': '任务素材已安装，提示词已填入新会话，请自行发送。',\n  'settings.loading': '加载中…',\n  'settings.recent': '最近事件',\n  'settings.none': '暂无。',\n  'settings.warningTitle': '评测守护警告',\n  'settings.close': '关闭',\n} as const\n\nexport type Key = keyof typeof zh\n\nexport const en: Record<Key, string> = {\n  'settings.nav': 'Eval Guard',\n  'settings.title': 'Eval Guard',\n  'settings.enabled': 'Enable evaluation guard',\n  'settings.enabledHint': 'When on, every user main conversation may only read/write its own workspace, with network, subagents and cross-agent channels blocked, and a wall-clock limit. Off by default.',\n  'settings.runningWarning': 'Conversations are running right now. Enabling the guard will constrain them immediately. Force enable?',\n  'settings.runningCancel': 'Cancel',\n  'settings.runningForce': 'Force enable',\n  'settings.timeLimit': 'Enable time limit',\n  'settings.timeLimitHint': 'The clock starts at each user message; at the deadline only the current turn is cancelled, and subagents/jobs are cleaned up recursively.',\n  'settings.minutes': 'minutes',\n  'settings.forbidden': 'Extra forbidden paths',\n  'settings.forbiddenHint': 'One absolute path per line; # comments; ! re-allows a subpath; later lines win. Empty by default.',\n  'settings.blacklist': 'Tool blacklist',\n  'settings.blacklistHint': 'One tool name per line; the default is generated from the tools installed now and missing tools are ignored.',\n  'settings.reset': 'Reset default blacklist',\n  'settings.editingDefault': 'Editing switches this to a custom blacklist.',\n  'settings.task': 'Install evaluation task',\n  'settings.taskHint': 'Pick an empty workspace, copy the tank pack in, and seed the initial prompt into a new conversation.',\n  'settings.taskLabel': 'Task',\n  'settings.workspace': 'Workspace',\n  'settings.pickWorkspace': 'Pick a workspace',\n  'settings.check': 'Check and install',\n  'settings.nonEmpty': 'The workspace is not empty; nothing was changed.',\n  'settings.manual': 'Manual channel',\n  'settings.manualHint': 'Manual material copy: copy the source folder contents into the workspace root yourself. Manual prompt: copy the text below.',\n  'settings.source': 'Material path',\n  'settings.target': 'Workspace path',\n  'settings.copy': 'Copy',\n  'settings.copied': 'Copied',\n  'settings.prompt': 'Initial prompt',\n  'settings.reveal': 'Open in file manager',\n  'settings.noWorkspaces': 'No workspace is available.',\n  'settings.installOk': 'Task installed and the prompt was seeded into a new conversation; send it yourself.',\n  'settings.loading': 'Loading…',\n  'settings.recent': 'Recent events',\n  'settings.none': 'None.',\n  'settings.warningTitle': 'Eval Guard warning',\n  'settings.close': 'Close',\n}\n","/**\n * Evaluation guard, browser half: the Settings section, the warning toast, and\n * the shell bridge used to seed a new conversation with the task prompt.\n * @module dsh-eval-guard/client\n */\nimport type { Context } from '@deepseek-ai/cordis'\nimport { SETTINGS_NS } from '../shared.ts'\nimport { EvalGuardSettings } from './Settings.tsx'\nimport { GuardToast } from './Toast.tsx'\nimport { configureEvalBridge } from './bridge.ts'\nimport { en, NS, zh, type Key } from './locales.ts'\n\ndeclare module '@deepseek-ai/dsh-client-ui-slots' {\n  interface LocaleNamespaceMap {\n    evalGuard: Key\n  }\n}\n\nexport const inject = ['slots', 'locale', 'configForms', 'uiWorkspace']\n\nexport function apply(ctx: Context): void {\n  ctx.effect(() => ctx.locale.register(NS, { zh, en }))\n  configureEvalBridge({\n    startSession: (workspaceId, prompt) => {\n      ctx.uiWorkspace.startSession(workspaceId as Parameters<typeof ctx.uiWorkspace.startSession>[0], { prompt })\n    },\n    workspaces: () => {\n      const service = (ctx as unknown as { get(key: string): unknown }).get('workspaces') as\n        { list?: { getSnapshot(): { items?: readonly Record<string, unknown>[] } } } | undefined\n      const items = service?.list?.getSnapshot().items ?? []\n      return items.map((item, index) => ({\n        id: typeof item['workspaceId'] === 'string' ? item['workspaceId'] : String(item['id'] ?? index),\n        label: typeof item['title'] === 'string' && item['title'] !== ''\n          ? item['title']\n          : String(item['path'] ?? item['workspaceId'] ?? ('workspace ' + String(index + 1))),\n      }))\n    },\n  })\n  ctx.effect(() => () => { configureEvalBridge(undefined) })\n  const t = ctx.locale.bind(NS)\n  const form = ctx.configForms.get(SETTINGS_NS) as {\n    getSnapshot(): unknown\n    subscribe(listener: () => void): () => void\n    mutate(ops: never, revision?: number): unknown\n  }\n  const formFace = {\n    getSnapshot: () => form.getSnapshot(),\n    subscribe: (listener: () => void) => form.subscribe(listener),\n    mutate: (ops: never, revision?: number) => form.mutate(ops, revision),\n  }\n  ctx.slots.inject('settings.section', () => ctx.slots.register({\n    name: 'settings.section', id: SETTINGS_NS, order: 41,\n    label: () => t('settings.nav'), locale: NS,\n    inject: () => ({ form: formFace }),\n  }, EvalGuardSettings))\n  ctx.slots.inject('shell.overlay', () => ctx.slots.register({\n    name: 'shell.overlay', id: SETTINGS_NS + '.toast', locale: NS,\n    inject: () => ({ t }),\n  }, GuardToast))\n}\n"],"mappings":";;;;;;;;;;;;;;;EAOA,MAAa,cAAc;;EAG3B,MAAa,cAAc;EAC3B,MAAa,cAAc;EAC3B,MAAa,gBAAgB;EAE7B,MAAa,eAAe;EAC5B,MAAa,eAAe;;;ECT5B,IAAI;EACJ,SAAgB,oBAAoB,MAAoC;GAAE,UAAU;EAAK;EACzF,SAAgB,aAAqC;GAAE,OAAO;EAAQ;;;;;;;ECyBtE,MAAM,QAAe;GACnB,SAAS;GACT,kBAAkB;GAClB,kBAAkB;GAClB,gBAAgB;GAChB,yBAAyB;GACzB,eAAe;EACjB;EAEA,MAAM,MAAqB;GAAE,QAAQ;GAAiD,cAAc;GAAG,SAAS;GAAI,cAAc;EAAG;EACrI,MAAM,MAAqB;GAAE,SAAS;GAAQ,KAAK;GAAI,YAAY;GAAU,UAAU;GAAQ,cAAc;EAAE;EAC/G,MAAM,OAAsB;GAAE,SAAS;GAAM,UAAU;GAAI,YAAY;GAAK,QAAQ;EAAQ;EAC5F,MAAM,WAA0B;GAAE,OAAO;GAAQ,WAAW;GAAK,YAAY;GAAa,UAAU;GAAI,SAAS;GAAG,WAAW;EAAa;EAC5I,MAAM,SAAwB;GAAE,SAAS;GAAY,cAAc;GAAG,QAAQ;EAAU;EACxF,MAAM,UAAyB;GAAE,GAAG;GAAQ,YAAY;GAAW,OAAO;GAAQ,QAAQ;EAAO;EACjG,MAAM,SAAwB;GAAE,GAAG;GAAQ,YAAY;GAAQ,OAAO;GAAQ,QAAQ;EAAO;EAE7F,eAAe,SAAY,UAAgC;GAAE,OAAO,MAAM,SAAS,KAAK;EAAO;EAE/F,SAAS,UAAU,OAAmD;GACpE,OAAO;IACL,SAAS,OAAO,YAAY;IAC5B,kBAAkB,OAAO,qBAAqB;IAC9C,kBAAkB,OAAO,OAAO,qBAAqB,WAAW,MAAM,mBAAmB;IACzF,gBAAgB,OAAO,OAAO,mBAAmB,WAAW,MAAM,iBAAiB;IACnF,yBAAyB,OAAO,4BAA4B;IAC5D,eAAe,OAAO,OAAO,kBAAkB,WAAW,MAAM,gBAAgB;GAClF;EACF;;EAGA,SAAgB,kBAAkB,EAAE,MAAM,KAA0B;GAClE,MAAM,YAAA,GAAWA,MAAAA,qBAAAA,CAAqB,KAAK,WAAW,KAAK,aAAa,KAAK,WAAW;GACxF,MAAM,CAAC,OAAO,aAAA,GAAYC,MAAAA,SAAAA,CAAgB,KAAK;GAC/C,MAAM,CAAC,OAAO,aAAA,GAAYA,MAAAA,SAAAA,CAAS,KAAK;GACxC,MAAM,CAAC,OAAO,aAAA,GAAYA,MAAAA,SAAAA,CAA4B,IAAI;GAC1D,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAuB,CAAC,CAAC;GACrD,MAAM,CAAC,eAAe,qBAAA,GAAoBA,MAAAA,SAAAA,CAAS,KAAK;GACxD,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAS,EAAE;GACvC,MAAM,CAAC,OAAO,aAAA,GAAYA,MAAAA,SAAAA,CAAS,EAAE;GACrC,MAAM,CAAC,aAAa,mBAAA,GAAkBA,MAAAA,SAAAA,CAAS,EAAE;GACjD,MAAM,CAAC,OAAO,aAAA,GAAYA,MAAAA,SAAAA,CAA6B,IAAI;GAC3D,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAA6B,IAAI;GAC7D,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAS,EAAE;GACvC,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAS,EAAE;GACvC,MAAM,aAAa,WAAW,CAAC,EAAE,WAAW,KAAK,CAAC;GAElD,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,IAAI,SAAS,WAAW,WAAW,SAAS,UAAU,KAAA,KAAa,OAAO;IAC1E,SAAS,UAAU,SAAS,KAAK,CAAC;GACpC,GAAG,CAAC,UAAU,KAAK,CAAC;GAEpB,MAAM,kBAAwB;IAC5B,MAAM,WAAW,CAAC,CAAC,KAAK,QAAoB,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,YAAY,SAAS,IAAI,CAAC;GACzF;GACA,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,UAAU;IACV,IAAI,QAAQ;IACZ,MAAM,QAAQ,kBAAkB;KAC9B,MAAM,eAAe,YAAY,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAkC,CAAC,CAAC,MAAK,SAAQ;MACpG,IAAI,KAAK,OAAO,WAAW,GAAG;MAC9B,QAAQ,KAAK,OAAO,KAAK,OAAO,SAAS,EAAE,CAAE;MAC7C,WAAU,YAAW,CAAC,GAAG,KAAK,QAAQ,GAAG,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;KAChE,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;IAC1B,GAAG,GAAI;IACP,aAAa,cAAc,KAAK;GAClC,GAAG,CAAC,CAAC;GAEL,MAAM,QAAQ,SAAS,WAAW,WAAW,SAAS;GACtD,MAAM,OAAO,OAAO,UAAyC;IAC3D,IAAI,CAAC,SAAS,SAAS,aAAa,KAAA,GAAW;IAC/C,MAAM,OAAO;KAAE,GAAG;KAAO,GAAG;IAAM;IAClC,MAAM,MAAuD,CAAC;IAC9D,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GAAsB,IAAI,KAAK;KAAE,IAAI;KAAO,MAAM,CAAC,GAAG;KAAG,OAAO,KAAK;IAAK,CAAC;IAC9G,IAAI;KAEF,IAAI,CAAC,MADkB,KAAK,OAAO,KAAK,SAAS,QAAQ,GAC1C;MAAE,SAAS,cAAc;MAAG;KAAO;KAClD,SAAS,IAAI;KACb,SAAS,KAAK;KACd,SAAS,EAAE;KACX,UAAU;IACZ,SAAS,QAAiB;KACxB,SAAS,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM,CAAC;IACpE;GACF;GACA,MAAM,QAAQ,UAAgC;IAC5C,UAAS,aAAY;KAAE,GAAG;KAAS,GAAG;IAAM,EAAE;IAC9C,SAAS,IAAI;GACf;GAEA,MAAM,iBAAiB,SAAwB;IAC7C,IAAI,CAAC,MAAM;KAAE,KAAU,EAAE,SAAS,MAAM,CAAC;KAAG;IAAO;IACnD,MAAM,WAAW,CAAC,CAAC,KAAK,QAAoB,CAAC,CAAC,MAAK,WAAU;KAC3D,SAAS,MAAM;KACf,IAAI,OAAO,QAAQ,SAAS,GAAG,iBAAiB,IAAI;UAC/C,KAAU,EAAE,SAAS,KAAK,CAAC;IAClC,CAAC,CAAC,CAAC,YAAY,KAAK,KAAK,EAAE,SAAS,KAAK,CAAC,CAAC;GAC7C;GAEA,MAAM,oBAA0B;IAC9B,iBAAiB,KAAK;IACtB,KAAU,EAAE,SAAS,KAAK,CAAC;GAC7B;GAEA,MAAM,cAAc,OAAqB;IACvC,IAAI,OAAO,IAAI;KAAE,SAAS,IAAI;KAAG,UAAU,IAAI;KAAG,UAAU,EAAE;KAAG;IAAO;IACxE,MAAM,cAAc,kBAAkB,mBAAmB,EAAE,CAAC,CAAC,CAAC,KAAK,QAAqB,CAAC,CAAC,MAAK,WAAU;KACvG,SAAS,MAAM;KACf,IAAI,OAAO,IACT,MAAM,wCAAiC,mBAAmB,EAAE,CAAC,CAAC,CAAC,KAAK,QAAqB,CAAC,CAAC,MAAK,UAAS;MACvG,UAAU,KAAK;MACf,UAAU,MAAM,MAAM;KACxB,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;IAE5B,CAAC,CAAC,CAAC,OAAO,WAAoB,SAAS,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM,CAAC,CAAC;GACnG;GAEA,MAAM,UAAU,YAA2B;IACzC,IAAI,gBAAgB,IAAI;IACxB,SAAS,EAAE;IAAG,UAAU,EAAE;IAC1B,MAAM,UAAU,MAAM,MAAM,cAAc,kBAAkB,mBAAmB,WAAW,CAAC,CAAC,CAAC,KAAK,QAAqB;IACvH,SAAS,OAAO;IAChB,IAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,OAAO;KACjC,SAAS,QAAQ,SAAS,EAAE,mBAAmB,CAAC;KAChD;IACF;IACA,MAAM,SAAS,MAAM,MAAM,eAAe;KACxC,QAAQ;KAAQ,SAAS,EAAE,gBAAgB,mBAAmB;KAC9D,MAAM,KAAK,UAAU,EAAE,YAAY,CAAC;IACtC,CAAC,CAAC,CAAC,KAAK,QAAuB;IAC/B,IAAI,CAAC,OAAO,MAAM,OAAO,WAAW,KAAA,GAAW;KAAE,SAAS,OAAO,SAAS,MAAM;KAAG;IAAO;IAC1F,UAAU,OAAO,MAAM;IACvB,UAAU,EAAE,oBAAoB,CAAC;IACjC,WAAW,CAAC,EAAE,aAAa,aAAa,OAAO,MAAM;IACrD,UAAU;GACZ;GAEA,MAAM,OAAO,OAAO,OAAe,SAAgC;IACjE,IAAI;KACF,MAAM,UAAU,UAAU,UAAU,IAAI;KACxC,UAAU,KAAK;KACf,iBAAiB,UAAU,EAAE,GAAG,IAAI;IACtC,QAAQ;KAAE,SAAS,MAAM;IAAE;GAC7B;GACA,MAAM,UAAU,WAAyB;IACvC,MAAW,cAAc;KACvB,QAAQ;KAAQ,SAAS,EAAE,gBAAgB,mBAAmB;KAAG,MAAM,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC;IACxG,CAAC;GACH;GACA,MAAM,gBAAgB,MAAM,0BAA0B,OAAO,oBAAoB,KAAK,MAAM;GAE5F,IAAI,SAAS,WAAW,WAAW,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;IAAK,OAAO;IAAM,UAAA,EAAE,kBAAkB;GAAO,CAAA;GACvF,OAAO,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD,EAAA,UAAA;IACJ,iBAAiB,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;KAAK,OAAO;MAAE,GAAG;MAAK,aAAa;KAAU;KAA7C,UAAA;MAChB,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,uBAAuB,EAAU,CAAA;MAC5C,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,yBAAyB;MAAK,CAAA;MACjD,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD;OAAI,OAAO;QAAE,GAAG;QAAM,aAAa;OAAG;OAAK,WAAA,OAAO,WAAW,CAAC,EAAA,CAAG,KAAI,SACnE,iBAAA,GAAA,kBAAA,KAAA,CAAC,MAAD,EAAA,UAAA;QAA0B,KAAK;QAAM;QAAI,KAAK;QAAK,KAAK,OAAO,IAAI,cAAc,OAAO,KAAK,IAAI,IAAI;OAAO,EAAA,GAAnG,KAAK,SAA8F,CAAC;MAAM,CAAA;MACrH,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO;OAAZ,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;QAAQ,OAAO;QAAQ,eAAe;SAAE,iBAAiB,KAAK;SAAG,UAAU;QAAE;QAAI,UAAA,EAAE,wBAAwB;OAAU,CAAA,GACrH,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;QAAQ,OAAO;QAAQ,SAAS;QAAc,UAAA,EAAE,uBAAuB;OAAU,CAAA,CAC9E;;KACF;;IAEL,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;MAAK,OAAO;MACV,UAAA,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD,EAAA,UAAA;OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QAAO,MAAK;QAAW,SAAS,MAAM;QAAS,UAAU,CAAC;QAAO,WAAU,UAAS,cAAc,MAAM,OAAO,OAAO;OAAI,CAAA;OAAC;OAAE,EAAE,kBAAkB;MAAS,EAAA,CAAA;KAC9J,CAAA,GACL,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,OAAO;MAAO,UAAA,EAAE,sBAAsB;KAAK,CAAA,CACvC;;IAET,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,OAAO;MAAZ,UAAA;OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD,EAAA,UAAA;QAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SAAO,MAAK;SAAW,SAAS,MAAM;SAAkB,UAAU,CAAC;SAAO,WAAU,UAAS,KAAK,KAAK,EAAE,kBAAkB,MAAM,OAAO,QAAQ,CAAC;QAAI,CAAA;QAAC;QAAE,EAAE,oBAAoB;OAAS,EAAA,CAAA;OAC9L,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QAAO,MAAK;QAAS,KAAK;QAAG,KAAK;QAAM,OAAO,MAAM;QAAkB,UAAU,CAAC;QAChF,OAAO,EAAE,OAAO,GAAG;QAAG,WAAU,UAAS,KAAK,EAAE,kBAAkB,OAAO,MAAM,OAAO,KAAK,EAAE,CAAC;QAC9F,cAAc,KAAK,KAAK,EAAE,kBAAkB,MAAM,iBAAiB,CAAC;OAAI,CAAA;OAC1E,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO;QAAO,UAAA,EAAE,kBAAkB;OAAQ,CAAA;MAC7C;KACL,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,OAAO;MAAO,UAAA,EAAE,wBAAwB;KAAK,CAAA,CACzC;;IAET,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA;MACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,oBAAoB,EAAU,CAAA;MACzC,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,wBAAwB;MAAK,CAAA;MAChD,iBAAA,GAAA,kBAAA,IAAA,CAAC,YAAD;OAAU,OAAO;OAAU,OAAO,MAAM;OAAgB,UAAU,CAAC;OACjE,WAAU,UAAS,KAAK,EAAE,gBAAgB,MAAM,OAAO,MAAM,CAAC;OAC9D,cAAc,KAAK,KAAK,EAAE,gBAAgB,MAAM,eAAe,CAAC;MAAI,CAAA;KAC/D;;IAET,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA;MACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO;OAAZ,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,oBAAoB,EAAU,CAAA,GACzC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;QAAQ,OAAO;QAAQ,UAAU,CAAC;QAAO,eAAe,KAAK,KAAK;SAAE,yBAAyB;SAAM,eAAe;QAAG,CAAC;QAAI,UAAA,EAAE,gBAAgB;OAAU,CAAA,CACnJ;;MACL,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,wBAAwB;MAAK,CAAA;MAChD,iBAAA,GAAA,kBAAA,IAAA,CAAC,YAAD;OAAU,OAAO;OAAU,OAAO;OAAe,UAAU,CAAC;OAC1D,WAAU,UAAS,KAAK;QAAE,yBAAyB;QAAO,eAAe,MAAM,OAAO;OAAM,CAAC;OAC7F,cAAc,KAAK,KAAK;QAAE,yBAAyB,MAAM;QAAyB,eAAe,MAAM;OAAc,CAAC;MAAI,CAAA;MAC3H,MAAM,2BAA2B,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,yBAAyB;MAAK,CAAA;KAC5E;;IAET,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA;MACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,eAAe,EAAU,CAAA;MACpC,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,mBAAmB;MAAK,CAAA;MAC3C,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;OAAK,OAAO;OACV,UAAA,iBAAA,GAAA,kBAAA,KAAA,CAAC,QAAD,EAAA,UAAA,CAAO,EAAE,oBAAoB,GAAE,gBAAoB,EAAA,CAAA;MAChD,CAAA;MACL,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO;OAAZ,UAAA;QACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,QAAD,EAAA,UAAA,CAAO,EAAE,oBAAoB,GAAE,GAAO,EAAA,CAAA;QACtC,iBAAA,GAAA,kBAAA,KAAA,CAAC,UAAD;SAAQ,OAAO;SAAa,WAAU,UAAS;UAAE,eAAe,MAAM,OAAO,KAAK;UAAG,WAAW,MAAM,OAAO,KAAK;SAAE;SAApH,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAAQ,OAAM;UAAI,UAAA,EAAE,wBAAwB;SAAU,CAAA,GACrD,WAAW,KAAI,cAAa,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAA2B,OAAO,UAAU;UAAK,UAAA,UAAU;SAAc,GAA5D,UAAU,EAAkD,CAAC,CACjG;;QACR,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SAAQ,OAAO;SAAS,UAAU,gBAAgB;SAAI,eAAe,KAAK,QAAQ;SAAI,UAAA,EAAE,gBAAgB;QAAU,CAAA;OAC/G;;MACJ,WAAW,WAAW,KAAK,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,uBAAuB;MAAK,CAAA;MAC1E,UAAU,QAAQ,CAAC,MAAM,SAAS,iBAAA,GAAA,kBAAA,KAAA,CAAC,KAAD;OAAG,OAAO;QAAE,GAAG;QAAM,OAAO;OAAO;OAAnC,UAAA;QAAuC,EAAE,mBAAmB;QAAE;QAAG,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE;OAAI;;MAC5I,WAAW,MAAM,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;QAAE,GAAG;QAAM,OAAO;OAAO;OAAI,UAAA;MAAU,CAAA;MAClE,UAAU,MAAM,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;QAAE,GAAG;QAAM,OAAO;OAAO;OAAI,UAAA;MAAS,CAAA;KAC1D;;IAET,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA;MACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,iBAAiB,EAAU,CAAA;MACtC,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,qBAAqB;MAAK,CAAA;MAC7C,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO;OAAZ,UAAA;QAAiB,iBAAA,GAAA,kBAAA,KAAA,CAAC,QAAD,EAAA,UAAA,CAAO,EAAE,iBAAiB,GAAE,GAAO,EAAA,CAAA;QAAC,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,OAAO,EAAE,WAAW,YAAY;SAAI,UAAA,QAAQ,UAAU;QAAU,CAAA;QACxH,WAAW,QAAQ,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SAAQ,OAAO;SAAQ,eAAe,OAAO,OAAO,MAAM;SAAI,UAAA,EAAE,iBAAiB;QAAU,CAAA;OAAO;;MACxH,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO;OAAZ,UAAA;QAAiB,iBAAA,GAAA,kBAAA,KAAA,CAAC,QAAD,EAAA,UAAA,CAAO,EAAE,iBAAiB,GAAE,GAAO,EAAA,CAAA;QAAC,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,OAAO,EAAE,WAAW,YAAY;SAAI,UAAA,OAAO,QAAQ;QAAU,CAAA;QACrH,OAAO,SAAS,KAAA,KAAa,MAAM,SAAS,MAAM,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SAAQ,OAAO;SAAQ,eAAe,OAAO,MAAM,IAAI;SAAI,UAAA,EAAE,iBAAiB;QAAU,CAAA;OAAO;;MACpJ,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;OAAK,OAAO;OAAK,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;QAAQ,OAAO;QAAQ,UAAU,WAAW;QAAI,eAAe,KAAK,KAAK,UAAU,MAAM;QAAI,UAAA,WAAW,WAAW,EAAE,iBAAiB,IAAI,EAAE,eAAe;OAAU,CAAA;MAAM,CAAA;MAC5L,iBAAA,GAAA,kBAAA,IAAA,CAAC,YAAD;OAAU,OAAO;QAAE,GAAG;QAAU,WAAW;OAAI;OAAG,UAAA;OAAS,OAAO;OAAQ,aAAa,EAAE,iBAAiB;MAAI,CAAA;KACvG;;IAET,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA;MACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,iBAAiB,EAAU,CAAA;MACrC,OAAO,WAAW,KAAK,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,eAAe;MAAK,CAAA;MAC9D,OAAO,KAAI,UAAS,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAqB,OAAO;QAAE,GAAG;QAAM,WAAW;QAAkB,YAAY;OAAE;OAAlF,UAAA;QACnB,iBAAA,GAAA,kBAAA,KAAA,CAAC,UAAD,EAAA,UAAA;SAAQ;SAAE,MAAM;SAAK;QAAS,EAAA,CAAA;QAAC;QAAE,MAAM,SAAS,KAAA,IAAY,MAAM,OAAO,QAAQ;QAAI,MAAM;OACxF;MAF0B,GAAA,MAAM,GAEhC,CAAC;KACC;;GACN,EAAA,CAAA;EACP;;;;;;;;ECvQA,SAAgB,WAAW,EAAE,KAA0D;GACrF,MAAM,CAAC,OAAO,aAAA,GAAYC,MAAAA,SAAAA,CAAkB,CAAC,CAAC;GAC9C,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,IAAI,QAAQ;IACZ,IAAI,QAAQ;IACZ,MAAM,aAAmB;KACvB,MAAM,eAAe,YAAY,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,OAAM,aAAY,MAAM,SAAS,KAAK,CAA6B,CAAC,CAAC,MAAK,SAAQ;MACrI,IAAI,CAAC,SAAS,KAAK,OAAO,WAAW,GAAG;MACxC,QAAQ,KAAK,OAAO,KAAK,OAAO,SAAS,EAAE,CAAE;MAC7C,MAAM,WAAW,KAAK,OAAO,QAAO,UAAS,MAAM,SAAS,QAAQ;MACpE,IAAI,SAAS,WAAW,GAAG;MAC3B,MAAM,MAAM,KAAK,IAAI;MACrB,UAAS,YAAW,CAAC,GAAG,SAAS,KAAI,WAAU;OAAE;OAAO,OAAO,MAAM;MAAK,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;KACxG,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;IAC1B;IACA,MAAM,QAAQ,kBAAkB;KAC9B,KAAK;KACL,MAAM,MAAM,KAAK,IAAI;KACrB,UAAS,YAAW,QAAQ,QAAO,SAAQ,KAAK,QAAQ,GAAG,CAAC;IAC9D,GAAG,IAAI;IACP,KAAK;IACL,aAAa;KAAE,QAAQ;KAAO,cAAc,KAAK;IAAE;GACrD,GAAG,CAAC,CAAC;GACL,IAAI,MAAM,WAAW,GAAG,OAAO;GAC/B,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;IAAK,OAAO;KAAE,UAAU;KAAS,OAAO;KAAI,QAAQ;KAAI,QAAQ;KAAM,SAAS;KAAQ,eAAe;KAAU,KAAK;KAAG,UAAU;IAAI;IAC1I,UAAA,MAAM,KAAI,SAAQ,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;KAA0B,OAAO;MAClD,YAAY;MAAW,OAAO;MAAW,QAAQ;MAAqB,cAAc;MACpF,SAAS;MAAa,UAAU;MAAI,YAAY;MAAK,WAAW;KAClE;KAHmB,UAAA,CAIjB,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,uBAAuB,EAAU,CAAA,GAC5C,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD,EAAA,UAAM,KAAK,MAAM,OAAY,CAAA,CAC1B;IANwB,GAAA,KAAK,MAAM,GAMnC,CAAC;GACH,CAAA;EACP;;;;EC3CA,MAAa,KAAK;EAElB,MAAa,KAAK;GAChB,gBAAgB;GAChB,kBAAkB;GAClB,oBAAoB;GACpB,wBAAwB;GACxB,2BAA2B;GAC3B,0BAA0B;GAC1B,yBAAyB;GACzB,sBAAsB;GACtB,0BAA0B;GAC1B,oBAAoB;GACpB,sBAAsB;GACtB,0BAA0B;GAC1B,sBAAsB;GACtB,0BAA0B;GAC1B,kBAAkB;GAClB,2BAA2B;GAC3B,iBAAiB;GACjB,qBAAqB;GACrB,sBAAsB;GACtB,sBAAsB;GACtB,0BAA0B;GAC1B,kBAAkB;GAClB,qBAAqB;GACrB,mBAAmB;GACnB,uBAAuB;GACvB,mBAAmB;GACnB,mBAAmB;GACnB,iBAAiB;GACjB,mBAAmB;GACnB,mBAAmB;GACnB,mBAAmB;GACnB,yBAAyB;GACzB,sBAAsB;GACtB,oBAAoB;GACpB,mBAAmB;GACnB,iBAAiB;GACjB,yBAAyB;GACzB,kBAAkB;EACpB;EAIA,MAAa,KAA0B;GACrC,gBAAgB;GAChB,kBAAkB;GAClB,oBAAoB;GACpB,wBAAwB;GACxB,2BAA2B;GAC3B,0BAA0B;GAC1B,yBAAyB;GACzB,sBAAsB;GACtB,0BAA0B;GAC1B,oBAAoB;GACpB,sBAAsB;GACtB,0BAA0B;GAC1B,sBAAsB;GACtB,0BAA0B;GAC1B,kBAAkB;GAClB,2BAA2B;GAC3B,iBAAiB;GACjB,qBAAqB;GACrB,sBAAsB;GACtB,sBAAsB;GACtB,0BAA0B;GAC1B,kBAAkB;GAClB,qBAAqB;GACrB,mBAAmB;GACnB,uBAAuB;GACvB,mBAAmB;GACnB,mBAAmB;GACnB,iBAAiB;GACjB,mBAAmB;GACnB,mBAAmB;GACnB,mBAAmB;GACnB,yBAAyB;GACzB,sBAAsB;GACtB,oBAAoB;GACpB,mBAAmB;GACnB,iBAAiB;GACjB,yBAAyB;GACzB,kBAAkB;EACpB;;;ECnEA,MAAa,SAAS;GAAC;GAAS;GAAU;GAAe;EAAa;EAEtE,SAAgB,MAAM,KAAoB;GACxC,IAAI,aAAa,IAAI,OAAO,SAAS,IAAI;IAAE;IAAI;GAAG,CAAC,CAAC;GACpD,oBAAoB;IAClB,eAAe,aAAa,WAAW;KACrC,IAAI,YAAY,aAAa,aAAmE,EAAE,OAAO,CAAC;IAC5G;IACA,kBAAkB;KAIhB,QAHiB,IAAiD,IAAI,YAElD,CAAC,EAAE,MAAM,YAAY,CAAC,CAAC,SAAS,CAAC,EAAA,CACxC,KAAK,MAAM,WAAW;MACjC,IAAI,OAAO,KAAK,mBAAmB,WAAW,KAAK,iBAAiB,OAAO,KAAK,SAAS,KAAK;MAC9F,OAAO,OAAO,KAAK,aAAa,YAAY,KAAK,aAAa,KAC1D,KAAK,WACL,OAAO,KAAK,WAAW,KAAK,kBAAmB,eAAe,OAAO,QAAQ,CAAC,CAAE;KACtF,EAAE;IACJ;GACF,CAAC;GACD,IAAI,mBAAmB;IAAE,oBAAoB,KAAA,CAAS;GAAE,CAAC;GACzD,MAAM,IAAI,IAAI,OAAO,KAAK,EAAE;GAC5B,MAAM,OAAO,IAAI,YAAY,IAAI,WAAW;GAK5C,MAAM,WAAW;IACf,mBAAmB,KAAK,YAAY;IACpC,YAAY,aAAyB,KAAK,UAAU,QAAQ;IAC5D,SAAS,KAAY,aAAsB,KAAK,OAAO,KAAK,QAAQ;GACtE;GACA,IAAI,MAAM,OAAO,0BAA0B,IAAI,MAAM,SAAS;IAC5D,MAAM;IAAoB,IAAI;IAAa,OAAO;IAClD,aAAa,EAAE,cAAc;IAAG,QAAQ;IACxC,eAAe,EAAE,MAAM,SAAS;GAClC,GAAG,iBAAiB,CAAC;GACrB,IAAI,MAAM,OAAO,uBAAuB,IAAI,MAAM,SAAS;IACzD,MAAM;IAAiB,IAAI;IAAwB,QAAQ;IAC3D,eAAe,EAAE,EAAE;GACrB,GAAG,UAAU,CAAC;EAChB"}
+{"version":3,"file":"index.js","names":["useSyncExternalStore","useState","useState"],"sources":["../../src/shared.ts","../../src/client/bridge.ts","../../src/client/Settings.tsx","../../src/client/Toast.tsx","../../src/client/locales.ts","../../src/client/index.ts"],"sourcesContent":["/**\n * Wire types shared by the host and browser halves. Keep this module import-free:\n * the client bundle includes it without pulling host code.\n * @module dsh-eval-guard/shared\n */\n\n/** Settings namespace; also the Loader row id in cordis.patch.yml. */\nexport const SETTINGS_NS = 'eval-guard'\n\n/** Route paths owned by this plugin. */\nexport const STATE_ROUTE = '/api/eval-guard/state'\nexport const CHECK_ROUTE = '/api/eval-guard/check'\nexport const INSTALL_ROUTE = '/api/eval-guard/install'\nexport const PROMPT_ROUTE = '/api/eval-guard/prompt'\nexport const EVENTS_ROUTE = '/api/eval-guard/events'\nexport const REVEAL_ROUTE = '/api/eval-guard/reveal'\nexport const MANUAL_ROUTE = '/api/eval-guard/manual'\n\n/** Supported task ids. */\nexport const TANK_TASK = 'tank'\nexport const TANK_TASK_LABEL = '第 6 集 · 坦克大战'\nexport const WAREHOUSE_TASK = 'warehouse'\nexport const WAREHOUSE_TASK_LABEL = '第 5 集 · 仓储调度'\nexport const LAND_TASK = 'land'\nexport const LAND_TASK_LABEL = '第 1 集 · 圈地'\nexport const BOMBERMAN_TASK = 'bomberman'\nexport const BOMBERMAN_TASK_LABEL = '第 2 集 · 炸弹人'\nexport const CTF_TASK = 'ctf'\nexport const CTF_TASK_LABEL = '第 3 集 · 夺旗'\n\n/** One task offered by the installer. */\nexport interface TaskInfo {\n  id: string\n  label: string\n  description: string\n}\n\n/** A live conversation the enable-time warning has to mention. */\nexport interface RunningSession {\n  sessionId: string\n  title: string\n  cwd: string\n  running: boolean\n  jobs: number\n}\n\n/** One warning surfaced to the browser. */\nexport interface GuardEvent {\n  seq: number\n  at: number\n  sessionId?: string\n  runId?: string\n  kind: 'tool-blocked' | 'path-denied' | 'process-denied' | 'wait-blocked' | 'timeout' | 'notice'\n  tool?: string\n  detail: string\n}\n\n/** Host answer for the enable pre-check. */\nexport interface GuardState {\n  enabled: boolean\n  running: RunningSession[]\n  tasks: TaskInfo[]\n  defaultBlacklist: string\n  generatedDefault: boolean\n  workspaceRoot: string\n  runsRoot: string\n}\n\n/** Result of checking one workspace before install. */\nexport interface CheckResult {\n  ok: boolean\n  workspaceId: string\n  path: string\n  empty: boolean\n  entries: string[]\n  error?: string\n}\n\n/** Result of installing the task pack. */\nexport interface InstallResult {\n  ok: boolean\n  error?: string\n  runId?: string\n  workspaceId?: string\n  workspacePath?: string\n  prompt?: string\n}\n\n/** Manual-channel material locations. */\nexport interface ManualPaths {\n  source: string\n  prompt: string\n}\n\n/** Usage record written next to one run. */\nexport interface RunUsage {\n  inputTokens: number\n  outputTokens: number\n  cacheReadTokens: number\n  cacheWriteTokens: number\n  reasoningTokens: number\n  toolCalls: number\n  turns: number\n  steps: number\n  wallTimeMs: number\n  startedAt: number | null\n  updatedAt: number\n}\n\n/** Metadata for one guarded task run. */\nexport interface RunRecord {\n  runId: string\n  task: string\n  workspaceId: string\n  workspacePath: string\n  sessionId: string | null\n  createdAt: number\n  startedAt: number | null\n  endedAt: number | null\n  status: 'prepared' | 'active' | 'timeout' | 'ended'\n  prompt: string\n  timeLimitMinutes: number\n  provider?: string\n  model?: string\n  title?: string\n}\n","/** Shell capabilities published to the Settings panel. */\nexport interface EvalWorkspace { id: string; label: string }\nexport interface EvalBridge {\n  startSession(workspaceId: string, prompt: string): void\n  workspaces(): readonly EvalWorkspace[]\n}\nlet current: EvalBridge | undefined\nexport function configureEvalBridge(next: EvalBridge | undefined): void { current = next }\nexport function evalBridge(): EvalBridge | undefined { return current }\n","/**\n * Settings panel for the evaluation guard.\n * @module dsh-eval-guard/client/Settings\n */\nimport { useEffect, useState, useSyncExternalStore, type CSSProperties, type ReactElement } from 'react'\nimport {\n  CHECK_ROUTE, EVENTS_ROUTE, INSTALL_ROUTE, MANUAL_ROUTE, REVEAL_ROUTE, STATE_ROUTE,\n  type CheckResult, type GuardEvent, type GuardState, type InstallResult, type ManualPaths,\n} from '../shared.ts'\nimport { evalBridge } from './bridge.ts'\n\ntype Snapshot = {\n  status: 'loading' | 'ready' | 'unavailable'\n  value?: Record<string, unknown>\n  revision?: number\n  writable: boolean\n}\ntype Form = {\n  getSnapshot: () => Snapshot\n  subscribe: (listener: () => void) => () => void\n  mutate: (ops: readonly { op: 'set'; path: string[]; value: unknown }[], revision?: number) => Promise<boolean>\n}\ntype Props = { form: Form; t: (key: string) => string }\n\ninterface Draft {\n  enabled: boolean\n  timeLimitEnabled: boolean\n  timeLimitMinutes: number\n  forbiddenPaths: string\n  toolBlacklistUseDefault: boolean\n  toolBlacklist: string\n}\n\nconst EMPTY: Draft = {\n  enabled: false,\n  timeLimitEnabled: true,\n  timeLimitMinutes: 90,\n  forbiddenPaths: '',\n  toolBlacklistUseDefault: true,\n  toolBlacklist: '',\n}\n\nconst box: CSSProperties = { border: '1px solid var(--vscode-panel-border, #3c3c3c)', borderRadius: 8, padding: 14, marginBottom: 14 }\nconst row: CSSProperties = { display: 'flex', gap: 10, alignItems: 'center', flexWrap: 'wrap', marginBottom: 8 }\nconst note: CSSProperties = { opacity: 0.72, fontSize: 12, lineHeight: 1.5, margin: '6px 0' }\nconst textarea: CSSProperties = { width: '100%', minHeight: 110, fontFamily: 'monospace', fontSize: 12, padding: 8, boxSizing: 'border-box' }\nconst button: CSSProperties = { padding: '5px 12px', borderRadius: 6, cursor: 'pointer' }\nconst primary: CSSProperties = { ...button, background: '#2f6fd0', color: '#fff', border: 'none' }\nconst danger: CSSProperties = { ...button, background: '#a33', color: '#fff', border: 'none' }\n\nasync function readJson<T>(response: Response): Promise<T> { return await response.json() as T }\n\nfunction normalize(value: Record<string, unknown> | undefined): Draft {\n  return {\n    enabled: value?.enabled === true,\n    timeLimitEnabled: value?.timeLimitEnabled !== false,\n    timeLimitMinutes: typeof value?.timeLimitMinutes === 'number' ? value.timeLimitMinutes : 90,\n    forbiddenPaths: typeof value?.forbiddenPaths === 'string' ? value.forbiddenPaths : '',\n    toolBlacklistUseDefault: value?.toolBlacklistUseDefault !== false,\n    toolBlacklist: typeof value?.toolBlacklist === 'string' ? value.toolBlacklist : '',\n  }\n}\n\n/** The settings card. */\nexport function EvalGuardSettings({ form, t }: Props): ReactElement {\n  const snapshot = useSyncExternalStore(form.subscribe, form.getSnapshot, form.getSnapshot)\n  const [draft, setDraft] = useState<Draft>(EMPTY)\n  const [dirty, setDirty] = useState(false)\n  const [state, setState] = useState<GuardState | null>(null)\n  const [events, setEvents] = useState<GuardEvent[]>([])\n  const [pendingEnable, setPendingEnable] = useState(false)\n  const [notice, setNotice] = useState('')\n  const [error, setError] = useState('')\n  const [workspaceId, setWorkspaceId] = useState('')\n  const [taskId, setTaskId] = useState('')\n  const [check, setCheck] = useState<CheckResult | null>(null)\n  const [manual, setManual] = useState<ManualPaths | null>(null)\n  const [prompt, setPrompt] = useState('')\n  const [copied, setCopied] = useState('')\n  const workspaces = evalBridge()?.workspaces() ?? []\n\n  useEffect(() => {\n    if (snapshot.status !== 'ready' || snapshot.value === undefined || dirty) return\n    setDraft(normalize(snapshot.value))\n  }, [snapshot, dirty])\n\n  const loadState = (): void => {\n    fetch(STATE_ROUTE).then(readJson<GuardState>).then(setState).catch(() => setState(null))\n  }\n  useEffect(() => {\n    loadState()\n    let since = 0\n    const timer = setInterval(() => {\n      fetch(EVENTS_ROUTE + '?since=' + String(since)).then(readJson<{ events: GuardEvent[] }>).then(data => {\n        if (data.events.length === 0) return\n        since = data.events[data.events.length - 1]!.seq\n        setEvents(current => [...data.events, ...current].slice(0, 12))\n      }).catch(() => undefined)\n    }, 2000)\n    return () => clearInterval(timer)\n  }, [])\n\n  useEffect(() => {\n    if (taskId === '' && state !== null && state.tasks.length > 0) setTaskId(state.tasks[0]!.id)\n  }, [state, taskId])\n\n  const ready = snapshot.status === 'ready' && snapshot.writable\n  const save = async (patch: Partial<Draft>): Promise<void> => {\n    if (!ready || snapshot.revision === undefined) return\n    const next = { ...draft, ...patch }\n    const ops: { op: 'set'; path: string[]; value: unknown }[] = []\n    for (const key of Object.keys(patch) as (keyof Draft)[]) ops.push({ op: 'set', path: [key], value: next[key] })\n    try {\n      const accepted = await form.mutate(ops, snapshot.revision)\n      if (!accepted) { setError('保存冲突，请刷新后重试。'); return }\n      setDraft(next)\n      setDirty(false)\n      setError('')\n      loadState()\n    } catch (reason: unknown) {\n      setError(reason instanceof Error ? reason.message : String(reason))\n    }\n  }\n  const edit = (patch: Partial<Draft>): void => {\n    setDraft(current => ({ ...current, ...patch }))\n    setDirty(true)\n  }\n\n  const toggleEnabled = (next: boolean): void => {\n    if (!next) { void save({ enabled: false }); return }\n    fetch(STATE_ROUTE).then(readJson<GuardState>).then(latest => {\n      setState(latest)\n      if (latest.running.length > 0) setPendingEnable(true)\n      else void save({ enabled: true })\n    }).catch(() => void save({ enabled: true }))\n  }\n\n  const forceEnable = (): void => {\n    setPendingEnable(false)\n    void save({ enabled: true })\n  }\n\n  const loadManual = (id: string, task: string): void => {\n    if (id === '') { setCheck(null); setManual(null); setPrompt(''); return }\n    fetch(CHECK_ROUTE + '?workspaceId=' + encodeURIComponent(id)).then(readJson<CheckResult>).then(result => {\n      setCheck(result)\n      if (result.ok) {\n        fetch(MANUAL_ROUTE + '?workspaceId=' + encodeURIComponent(id) + '&task=' + encodeURIComponent(task)).then(readJson<ManualPaths>).then(paths => {\n          setManual(paths)\n          setPrompt(paths.prompt)\n        }).catch(() => undefined)\n      }\n    }).catch((reason: unknown) => setError(reason instanceof Error ? reason.message : String(reason)))\n  }\n\n  const install = async (): Promise<void> => {\n    if (workspaceId === '' || taskId === '') return\n    setError(''); setNotice('')\n    const checked = await fetch(CHECK_ROUTE + '?workspaceId=' + encodeURIComponent(workspaceId)).then(readJson<CheckResult>)\n    setCheck(checked)\n    if (!checked.ok || !checked.empty) {\n      setError(checked.error ?? t('settings.nonEmpty'))\n      return\n    }\n    const result = await fetch(INSTALL_ROUTE, {\n      method: 'POST', headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ workspaceId, task: taskId }),\n    }).then(readJson<InstallResult>)\n    if (!result.ok || result.prompt === undefined) { setError(result.error ?? '安装失败'); return }\n    setPrompt(result.prompt)\n    setNotice(t('settings.installOk'))\n    evalBridge()?.startSession(workspaceId, result.prompt)\n    loadState()\n  }\n\n  const copy = async (label: string, text: string): Promise<void> => {\n    try {\n      await navigator.clipboard.writeText(text)\n      setCopied(label)\n      setTimeout(() => setCopied(''), 1500)\n    } catch { setError('复制失败') }\n  }\n  const reveal = (target: string): void => {\n    void fetch(REVEAL_ROUTE, {\n      method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ path: target }),\n    })\n  }\n  const blacklistText = draft.toolBlacklistUseDefault ? state?.defaultBlacklist ?? '' : draft.toolBlacklist\n\n  if (snapshot.status === 'loading') return <div style={box}>{t('settings.loading')}</div>\n  return <div>\n    {pendingEnable && <div style={{ ...box, borderColor: '#caa23a' }}>\n      <strong>{t('settings.warningTitle')}</strong>\n      <p style={note}>{t('settings.runningWarning')}</p>\n      <ul style={{ ...note, paddingLeft: 18 }}>{(state?.running ?? []).map(item =>\n        <li key={item.sessionId}>{item.title} · {item.cwd}{item.jobs > 0 ? ' · jobs: ' + String(item.jobs) : ''}</li>)}</ul>\n      <div style={row}>\n        <button style={button} onClick={() => { setPendingEnable(false); loadState() }}>{t('settings.runningCancel')}</button>\n        <button style={danger} onClick={forceEnable}>{t('settings.runningForce')}</button>\n      </div>\n    </div>}\n\n    <section style={box}>\n      <div style={row}>\n        <label><input type=\"checkbox\" checked={draft.enabled} disabled={!ready} onChange={event => toggleEnabled(event.target.checked)} /> {t('settings.enabled')}</label>\n      </div>\n      <p style={note}>{t('settings.enabledHint')}</p>\n    </section>\n\n    <section style={box}>\n      <div style={row}>\n        <label><input type=\"checkbox\" checked={draft.timeLimitEnabled} disabled={!ready} onChange={event => void save({ timeLimitEnabled: event.target.checked })} /> {t('settings.timeLimit')}</label>\n        <input type=\"number\" min={1} max={1440} value={draft.timeLimitMinutes} disabled={!ready}\n          style={{ width: 90 }} onChange={event => edit({ timeLimitMinutes: Number(event.target.value) })}\n          onBlur={() => void save({ timeLimitMinutes: draft.timeLimitMinutes })} />\n        <span style={note}>{t('settings.minutes')}</span>\n      </div>\n      <p style={note}>{t('settings.timeLimitHint')}</p>\n    </section>\n\n    <section style={box}>\n      <strong>{t('settings.forbidden')}</strong>\n      <p style={note}>{t('settings.forbiddenHint')}</p>\n      <textarea style={textarea} value={draft.forbiddenPaths} disabled={!ready}\n        onChange={event => edit({ forbiddenPaths: event.target.value })}\n        onBlur={() => void save({ forbiddenPaths: draft.forbiddenPaths })} />\n    </section>\n\n    <section style={box}>\n      <div style={row}>\n        <strong>{t('settings.blacklist')}</strong>\n        <button style={button} disabled={!ready} onClick={() => void save({ toolBlacklistUseDefault: true, toolBlacklist: '' })}>{t('settings.reset')}</button>\n      </div>\n      <p style={note}>{t('settings.blacklistHint')}</p>\n      <textarea style={textarea} value={blacklistText} disabled={!ready}\n        onChange={event => edit({ toolBlacklistUseDefault: false, toolBlacklist: event.target.value })}\n        onBlur={() => void save({ toolBlacklistUseDefault: draft.toolBlacklistUseDefault, toolBlacklist: draft.toolBlacklist })} />\n      {draft.toolBlacklistUseDefault && <p style={note}>{t('settings.editingDefault')}</p>}\n    </section>\n\n    <section style={box}>\n      <strong>{t('settings.task')}</strong>\n      <p style={note}>{t('settings.taskHint')}</p>\n      <div style={row}>\n        <span>{t('settings.taskLabel')}:</span>\n        <select value={taskId} disabled={state === null || state.tasks.length === 0}\n          onChange={event => {\n            const next = event.target.value\n            setTaskId(next); setCheck(null); setManual(null); setPrompt('')\n            if (workspaceId !== '') loadManual(workspaceId, next)\n          }}>\n          {(state?.tasks ?? []).map(task => <option key={task.id} value={task.id}>{task.label}</option>)}\n        </select>\n      </div>\n      {state !== null && <p style={note}>{state.tasks.find(task => task.id === taskId)?.description ?? ''}</p>}\n      <div style={row}>\n        <span>{t('settings.workspace')}:</span>\n        <select value={workspaceId} onChange={event => { setWorkspaceId(event.target.value); loadManual(event.target.value, taskId) }}>\n          <option value=\"\">{t('settings.pickWorkspace')}</option>\n          {workspaces.map(workspace => <option key={workspace.id} value={workspace.id}>{workspace.label}</option>)}\n        </select>\n        <button style={primary} disabled={workspaceId === '' || taskId === ''} onClick={() => void install()}>{t('settings.check')}</button>\n      </div>\n      {workspaces.length === 0 && <p style={note}>{t('settings.noWorkspaces')}</p>}\n      {check !== null && !check.empty && <p style={{ ...note, color: '#d99' }}>{t('settings.nonEmpty')} ({check.entries.slice(0, 6).join(', ')})</p>}\n      {notice !== '' && <p style={{ ...note, color: '#7c7' }}>{notice}</p>}\n      {error !== '' && <p style={{ ...note, color: '#d77' }}>{error}</p>}\n    </section>\n\n    <section style={box}>\n      <strong>{t('settings.manual')}</strong>\n      <p style={note}>{t('settings.manualHint')}</p>\n      <div style={row}><span>{t('settings.source')}:</span><code style={{ wordBreak: 'break-all' }}>{manual?.source ?? '—'}</code>\n        {manual !== null && <button style={button} onClick={() => reveal(manual.source)}>{t('settings.reveal')}</button>}</div>\n      <div style={row}><span>{t('settings.target')}:</span><code style={{ wordBreak: 'break-all' }}>{check?.path ?? '—'}</code>\n        {check?.path !== undefined && check.path !== '' && <button style={button} onClick={() => reveal(check.path)}>{t('settings.reveal')}</button>}</div>\n      <div style={row}><button style={button} disabled={prompt === ''} onClick={() => void copy('prompt', prompt)}>{copied === 'prompt' ? t('settings.copied') : t('settings.copy')}</button></div>\n      <textarea style={{ ...textarea, minHeight: 160 }} readOnly value={prompt} placeholder={t('settings.prompt')} />\n    </section>\n\n    <section style={box}>\n      <strong>{t('settings.recent')}</strong>\n      {events.length === 0 && <p style={note}>{t('settings.none')}</p>}\n      {events.map(event => <div key={event.seq} style={{ ...note, borderTop: '1px solid #333', paddingTop: 4 }}>\n        <strong>[{event.kind}]</strong> {event.tool !== undefined ? event.tool + ' · ' : ''}{event.detail}\n      </div>)}\n    </section>\n  </div>\n}\n","/**\n * Frame-wide warning toasts fed by the host event route.\n * @module dsh-eval-guard/client/Toast\n */\nimport { useEffect, useState, type ReactElement } from 'react'\nimport { EVENTS_ROUTE, type GuardEvent } from '../shared.ts'\n\n/** One toast with a dismiss deadline. */\ninterface Shown { event: GuardEvent; until: number }\n\n/** Poll the host event feed and show new warnings. */\nexport function GuardToast({ t }: { t: (key: string) => string }): ReactElement | null {\n  const [shown, setShown] = useState<Shown[]>([])\n  useEffect(() => {\n    let since = 0\n    let alive = true\n    const poll = (): void => {\n      fetch(EVENTS_ROUTE + '?since=' + String(since)).then(async response => await response.json() as { events: GuardEvent[] }).then(data => {\n        if (!alive || data.events.length === 0) return\n        since = data.events[data.events.length - 1]!.seq\n        const warnings = data.events.filter(event => event.kind !== 'notice')\n        if (warnings.length === 0) return\n        const now = Date.now()\n        setShown(current => [...warnings.map(event => ({ event, until: now + 8000 })), ...current].slice(0, 5))\n      }).catch(() => undefined)\n    }\n    const timer = setInterval(() => {\n      poll()\n      const now = Date.now()\n      setShown(current => current.filter(item => item.until > now))\n    }, 1500)\n    poll()\n    return () => { alive = false; clearInterval(timer) }\n  }, [])\n  if (shown.length === 0) return null\n  return <div style={{ position: 'fixed', right: 18, bottom: 18, zIndex: 9999, display: 'flex', flexDirection: 'column', gap: 8, maxWidth: 420 }}>\n    {shown.map(item => <div key={item.event.seq} style={{\n      background: '#3a2a12', color: '#ffdca8', border: '1px solid #8a6a2a', borderRadius: 8,\n      padding: '10px 12px', fontSize: 12, lineHeight: 1.5, boxShadow: '0 6px 24px rgba(0,0,0,.45)',\n    }}>\n      <strong>{t('settings.warningTitle')}</strong>\n      <div>{item.event.detail}</div>\n    </div>)}\n  </div>\n}\n","/** Locale namespace and dictionaries for the browser half. */\nexport const NS = 'evalGuard'\n\nexport const zh = {\n  'settings.nav': '评测守护',\n  'settings.title': '评测守护',\n  'settings.enabled': '启用评测守护',\n  'settings.enabledHint': '启用后，所有用户主对话只能读写自己的工作区，禁止联网、子代理与跨 agent 通信，并按任务时限强制终止。默认关闭。',\n  'settings.runningWarning': '当前有正在运行的对话。启用评测守护会立即约束它们，是否强行开启？',\n  'settings.runningCancel': '放弃',\n  'settings.runningForce': '强行开启',\n  'settings.timeLimit': '开启最长时长',\n  'settings.timeLimitHint': '从每条用户消息发送时开始计时；到点只终止当前轮次，并递归清理子代理与后台任务。',\n  'settings.minutes': '分钟',\n  'settings.forbidden': '额外禁止路径',\n  'settings.forbiddenHint': '每行一个绝对路径；# 开头为注释；! 开头表示在禁止范围内放开该子路径；按行顺序生效。默认空。',\n  'settings.blacklist': '工具黑名单',\n  'settings.blacklistHint': '每行一个工具名；默认内容按当前已安装工具生成，不存在的工具会被忽略。',\n  'settings.reset': '恢复默认黑名单',\n  'settings.editingDefault': '编辑后将以自定义黑名单保存。',\n  'settings.task': '安装评测任务',\n  'settings.taskHint': '选择一个空的工作区，复制坦克大战素材并把初始提示词填入新会话输入框。',\n  'settings.taskLabel': '任务',\n  'settings.workspace': '工作区',\n  'settings.pickWorkspace': '请选择工作区',\n  'settings.check': '检测并安装',\n  'settings.nonEmpty': '工作区不是空的；未执行任何操作。',\n  'settings.manual': '手动通道',\n  'settings.manualHint': '手动复制素材：自己把素材目录内容复制到工作区根目录；手动填充提示词：复制下面的提示词。',\n  'settings.source': '素材路径',\n  'settings.target': '工作区路径',\n  'settings.copy': '复制',\n  'settings.copied': '已复制',\n  'settings.prompt': '初始提示词',\n  'settings.reveal': '在文件管理器中打开',\n  'settings.noWorkspaces': '没有可选的工作区。',\n  'settings.installOk': '任务素材已安装，提示词已填入新会话，请自行发送。',\n  'settings.loading': '加载中…',\n  'settings.recent': '最近事件',\n  'settings.none': '暂无。',\n  'settings.warningTitle': '评测守护警告',\n  'settings.close': '关闭',\n} as const\n\nexport type Key = keyof typeof zh\n\nexport const en: Record<Key, string> = {\n  'settings.nav': 'Eval Guard',\n  'settings.title': 'Eval Guard',\n  'settings.enabled': 'Enable evaluation guard',\n  'settings.enabledHint': 'When on, every user main conversation may only read/write its own workspace, with network, subagents and cross-agent channels blocked, and a wall-clock limit. Off by default.',\n  'settings.runningWarning': 'Conversations are running right now. Enabling the guard will constrain them immediately. Force enable?',\n  'settings.runningCancel': 'Cancel',\n  'settings.runningForce': 'Force enable',\n  'settings.timeLimit': 'Enable time limit',\n  'settings.timeLimitHint': 'The clock starts at each user message; at the deadline only the current turn is cancelled, and subagents/jobs are cleaned up recursively.',\n  'settings.minutes': 'minutes',\n  'settings.forbidden': 'Extra forbidden paths',\n  'settings.forbiddenHint': 'One absolute path per line; # comments; ! re-allows a subpath; later lines win. Empty by default.',\n  'settings.blacklist': 'Tool blacklist',\n  'settings.blacklistHint': 'One tool name per line; the default is generated from the tools installed now and missing tools are ignored.',\n  'settings.reset': 'Reset default blacklist',\n  'settings.editingDefault': 'Editing switches this to a custom blacklist.',\n  'settings.task': 'Install evaluation task',\n  'settings.taskHint': 'Pick an empty workspace, copy the tank pack in, and seed the initial prompt into a new conversation.',\n  'settings.taskLabel': 'Task',\n  'settings.workspace': 'Workspace',\n  'settings.pickWorkspace': 'Pick a workspace',\n  'settings.check': 'Check and install',\n  'settings.nonEmpty': 'The workspace is not empty; nothing was changed.',\n  'settings.manual': 'Manual channel',\n  'settings.manualHint': 'Manual material copy: copy the source folder contents into the workspace root yourself. Manual prompt: copy the text below.',\n  'settings.source': 'Material path',\n  'settings.target': 'Workspace path',\n  'settings.copy': 'Copy',\n  'settings.copied': 'Copied',\n  'settings.prompt': 'Initial prompt',\n  'settings.reveal': 'Open in file manager',\n  'settings.noWorkspaces': 'No workspace is available.',\n  'settings.installOk': 'Task installed and the prompt was seeded into a new conversation; send it yourself.',\n  'settings.loading': 'Loading…',\n  'settings.recent': 'Recent events',\n  'settings.none': 'None.',\n  'settings.warningTitle': 'Eval Guard warning',\n  'settings.close': 'Close',\n}\n","/**\n * Evaluation guard, browser half: the Settings section, the warning toast, and\n * the shell bridge used to seed a new conversation with the task prompt.\n * @module dsh-eval-guard/client\n */\nimport type { Context } from '@deepseek-ai/cordis'\nimport { SETTINGS_NS } from '../shared.ts'\nimport { EvalGuardSettings } from './Settings.tsx'\nimport { GuardToast } from './Toast.tsx'\nimport { configureEvalBridge } from './bridge.ts'\nimport { en, NS, zh, type Key } from './locales.ts'\n\ndeclare module '@deepseek-ai/dsh-client-ui-slots' {\n  interface LocaleNamespaceMap {\n    evalGuard: Key\n  }\n}\n\nexport const inject = ['slots', 'locale', 'configForms', 'uiWorkspace']\n\nexport function apply(ctx: Context): void {\n  ctx.effect(() => ctx.locale.register(NS, { zh, en }))\n  configureEvalBridge({\n    startSession: (workspaceId, prompt) => {\n      ctx.uiWorkspace.startSession(workspaceId as Parameters<typeof ctx.uiWorkspace.startSession>[0], { prompt })\n    },\n    workspaces: () => {\n      const service = (ctx as unknown as { get(key: string): unknown }).get('workspaces') as\n        { list?: { getSnapshot(): { items?: readonly Record<string, unknown>[] } } } | undefined\n      const items = service?.list?.getSnapshot().items ?? []\n      return items.map((item, index) => ({\n        id: typeof item['workspaceId'] === 'string' ? item['workspaceId'] : String(item['id'] ?? index),\n        label: typeof item['title'] === 'string' && item['title'] !== ''\n          ? item['title']\n          : String(item['path'] ?? item['workspaceId'] ?? ('workspace ' + String(index + 1))),\n      }))\n    },\n  })\n  ctx.effect(() => () => { configureEvalBridge(undefined) })\n  const t = ctx.locale.bind(NS)\n  const form = ctx.configForms.get(SETTINGS_NS) as {\n    getSnapshot(): unknown\n    subscribe(listener: () => void): () => void\n    mutate(ops: never, revision?: number): unknown\n  }\n  const formFace = {\n    getSnapshot: () => form.getSnapshot(),\n    subscribe: (listener: () => void) => form.subscribe(listener),\n    mutate: (ops: never, revision?: number) => form.mutate(ops, revision),\n  }\n  ctx.slots.inject('settings.section', () => ctx.slots.register({\n    name: 'settings.section', id: SETTINGS_NS, order: 41,\n    label: () => t('settings.nav'), locale: NS,\n    inject: () => ({ form: formFace }),\n  }, EvalGuardSettings))\n  ctx.slots.inject('shell.overlay', () => ctx.slots.register({\n    name: 'shell.overlay', id: SETTINGS_NS + '.toast', locale: NS,\n    inject: () => ({ t }),\n  }, GuardToast))\n}\n"],"mappings":";;;;;;;;;;;;;;;EAOA,MAAa,cAAc;;EAG3B,MAAa,cAAc;EAC3B,MAAa,cAAc;EAC3B,MAAa,gBAAgB;EAE7B,MAAa,eAAe;EAC5B,MAAa,eAAe;;;ECT5B,IAAI;EACJ,SAAgB,oBAAoB,MAAoC;GAAE,UAAU;EAAK;EACzF,SAAgB,aAAqC;GAAE,OAAO;EAAQ;;;;;;;ECyBtE,MAAM,QAAe;GACnB,SAAS;GACT,kBAAkB;GAClB,kBAAkB;GAClB,gBAAgB;GAChB,yBAAyB;GACzB,eAAe;EACjB;EAEA,MAAM,MAAqB;GAAE,QAAQ;GAAiD,cAAc;GAAG,SAAS;GAAI,cAAc;EAAG;EACrI,MAAM,MAAqB;GAAE,SAAS;GAAQ,KAAK;GAAI,YAAY;GAAU,UAAU;GAAQ,cAAc;EAAE;EAC/G,MAAM,OAAsB;GAAE,SAAS;GAAM,UAAU;GAAI,YAAY;GAAK,QAAQ;EAAQ;EAC5F,MAAM,WAA0B;GAAE,OAAO;GAAQ,WAAW;GAAK,YAAY;GAAa,UAAU;GAAI,SAAS;GAAG,WAAW;EAAa;EAC5I,MAAM,SAAwB;GAAE,SAAS;GAAY,cAAc;GAAG,QAAQ;EAAU;EACxF,MAAM,UAAyB;GAAE,GAAG;GAAQ,YAAY;GAAW,OAAO;GAAQ,QAAQ;EAAO;EACjG,MAAM,SAAwB;GAAE,GAAG;GAAQ,YAAY;GAAQ,OAAO;GAAQ,QAAQ;EAAO;EAE7F,eAAe,SAAY,UAAgC;GAAE,OAAO,MAAM,SAAS,KAAK;EAAO;EAE/F,SAAS,UAAU,OAAmD;GACpE,OAAO;IACL,SAAS,OAAO,YAAY;IAC5B,kBAAkB,OAAO,qBAAqB;IAC9C,kBAAkB,OAAO,OAAO,qBAAqB,WAAW,MAAM,mBAAmB;IACzF,gBAAgB,OAAO,OAAO,mBAAmB,WAAW,MAAM,iBAAiB;IACnF,yBAAyB,OAAO,4BAA4B;IAC5D,eAAe,OAAO,OAAO,kBAAkB,WAAW,MAAM,gBAAgB;GAClF;EACF;;EAGA,SAAgB,kBAAkB,EAAE,MAAM,KAA0B;GAClE,MAAM,YAAA,GAAWA,MAAAA,qBAAAA,CAAqB,KAAK,WAAW,KAAK,aAAa,KAAK,WAAW;GACxF,MAAM,CAAC,OAAO,aAAA,GAAYC,MAAAA,SAAAA,CAAgB,KAAK;GAC/C,MAAM,CAAC,OAAO,aAAA,GAAYA,MAAAA,SAAAA,CAAS,KAAK;GACxC,MAAM,CAAC,OAAO,aAAA,GAAYA,MAAAA,SAAAA,CAA4B,IAAI;GAC1D,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAuB,CAAC,CAAC;GACrD,MAAM,CAAC,eAAe,qBAAA,GAAoBA,MAAAA,SAAAA,CAAS,KAAK;GACxD,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAS,EAAE;GACvC,MAAM,CAAC,OAAO,aAAA,GAAYA,MAAAA,SAAAA,CAAS,EAAE;GACrC,MAAM,CAAC,aAAa,mBAAA,GAAkBA,MAAAA,SAAAA,CAAS,EAAE;GACjD,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAS,EAAE;GACvC,MAAM,CAAC,OAAO,aAAA,GAAYA,MAAAA,SAAAA,CAA6B,IAAI;GAC3D,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAA6B,IAAI;GAC7D,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAS,EAAE;GACvC,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAS,EAAE;GACvC,MAAM,aAAa,WAAW,CAAC,EAAE,WAAW,KAAK,CAAC;GAElD,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,IAAI,SAAS,WAAW,WAAW,SAAS,UAAU,KAAA,KAAa,OAAO;IAC1E,SAAS,UAAU,SAAS,KAAK,CAAC;GACpC,GAAG,CAAC,UAAU,KAAK,CAAC;GAEpB,MAAM,kBAAwB;IAC5B,MAAM,WAAW,CAAC,CAAC,KAAK,QAAoB,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,YAAY,SAAS,IAAI,CAAC;GACzF;GACA,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,UAAU;IACV,IAAI,QAAQ;IACZ,MAAM,QAAQ,kBAAkB;KAC9B,MAAM,eAAe,YAAY,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAkC,CAAC,CAAC,MAAK,SAAQ;MACpG,IAAI,KAAK,OAAO,WAAW,GAAG;MAC9B,QAAQ,KAAK,OAAO,KAAK,OAAO,SAAS,EAAE,CAAE;MAC7C,WAAU,YAAW,CAAC,GAAG,KAAK,QAAQ,GAAG,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;KAChE,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;IAC1B,GAAG,GAAI;IACP,aAAa,cAAc,KAAK;GAClC,GAAG,CAAC,CAAC;GAEL,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,IAAI,WAAW,MAAM,UAAU,QAAQ,MAAM,MAAM,SAAS,GAAG,UAAU,MAAM,MAAM,EAAE,CAAE,EAAE;GAC7F,GAAG,CAAC,OAAO,MAAM,CAAC;GAElB,MAAM,QAAQ,SAAS,WAAW,WAAW,SAAS;GACtD,MAAM,OAAO,OAAO,UAAyC;IAC3D,IAAI,CAAC,SAAS,SAAS,aAAa,KAAA,GAAW;IAC/C,MAAM,OAAO;KAAE,GAAG;KAAO,GAAG;IAAM;IAClC,MAAM,MAAuD,CAAC;IAC9D,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GAAsB,IAAI,KAAK;KAAE,IAAI;KAAO,MAAM,CAAC,GAAG;KAAG,OAAO,KAAK;IAAK,CAAC;IAC9G,IAAI;KAEF,IAAI,CAAC,MADkB,KAAK,OAAO,KAAK,SAAS,QAAQ,GAC1C;MAAE,SAAS,cAAc;MAAG;KAAO;KAClD,SAAS,IAAI;KACb,SAAS,KAAK;KACd,SAAS,EAAE;KACX,UAAU;IACZ,SAAS,QAAiB;KACxB,SAAS,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM,CAAC;IACpE;GACF;GACA,MAAM,QAAQ,UAAgC;IAC5C,UAAS,aAAY;KAAE,GAAG;KAAS,GAAG;IAAM,EAAE;IAC9C,SAAS,IAAI;GACf;GAEA,MAAM,iBAAiB,SAAwB;IAC7C,IAAI,CAAC,MAAM;KAAE,KAAU,EAAE,SAAS,MAAM,CAAC;KAAG;IAAO;IACnD,MAAM,WAAW,CAAC,CAAC,KAAK,QAAoB,CAAC,CAAC,MAAK,WAAU;KAC3D,SAAS,MAAM;KACf,IAAI,OAAO,QAAQ,SAAS,GAAG,iBAAiB,IAAI;UAC/C,KAAU,EAAE,SAAS,KAAK,CAAC;IAClC,CAAC,CAAC,CAAC,YAAY,KAAK,KAAK,EAAE,SAAS,KAAK,CAAC,CAAC;GAC7C;GAEA,MAAM,oBAA0B;IAC9B,iBAAiB,KAAK;IACtB,KAAU,EAAE,SAAS,KAAK,CAAC;GAC7B;GAEA,MAAM,cAAc,IAAY,SAAuB;IACrD,IAAI,OAAO,IAAI;KAAE,SAAS,IAAI;KAAG,UAAU,IAAI;KAAG,UAAU,EAAE;KAAG;IAAO;IACxE,MAAM,cAAc,kBAAkB,mBAAmB,EAAE,CAAC,CAAC,CAAC,KAAK,QAAqB,CAAC,CAAC,MAAK,WAAU;KACvG,SAAS,MAAM;KACf,IAAI,OAAO,IACT,MAAM,wCAAiC,mBAAmB,EAAE,IAAI,WAAW,mBAAmB,IAAI,CAAC,CAAC,CAAC,KAAK,QAAqB,CAAC,CAAC,MAAK,UAAS;MAC7I,UAAU,KAAK;MACf,UAAU,MAAM,MAAM;KACxB,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;IAE5B,CAAC,CAAC,CAAC,OAAO,WAAoB,SAAS,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM,CAAC,CAAC;GACnG;GAEA,MAAM,UAAU,YAA2B;IACzC,IAAI,gBAAgB,MAAM,WAAW,IAAI;IACzC,SAAS,EAAE;IAAG,UAAU,EAAE;IAC1B,MAAM,UAAU,MAAM,MAAM,cAAc,kBAAkB,mBAAmB,WAAW,CAAC,CAAC,CAAC,KAAK,QAAqB;IACvH,SAAS,OAAO;IAChB,IAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,OAAO;KACjC,SAAS,QAAQ,SAAS,EAAE,mBAAmB,CAAC;KAChD;IACF;IACA,MAAM,SAAS,MAAM,MAAM,eAAe;KACxC,QAAQ;KAAQ,SAAS,EAAE,gBAAgB,mBAAmB;KAC9D,MAAM,KAAK,UAAU;MAAE;MAAa,MAAM;KAAO,CAAC;IACpD,CAAC,CAAC,CAAC,KAAK,QAAuB;IAC/B,IAAI,CAAC,OAAO,MAAM,OAAO,WAAW,KAAA,GAAW;KAAE,SAAS,OAAO,SAAS,MAAM;KAAG;IAAO;IAC1F,UAAU,OAAO,MAAM;IACvB,UAAU,EAAE,oBAAoB,CAAC;IACjC,WAAW,CAAC,EAAE,aAAa,aAAa,OAAO,MAAM;IACrD,UAAU;GACZ;GAEA,MAAM,OAAO,OAAO,OAAe,SAAgC;IACjE,IAAI;KACF,MAAM,UAAU,UAAU,UAAU,IAAI;KACxC,UAAU,KAAK;KACf,iBAAiB,UAAU,EAAE,GAAG,IAAI;IACtC,QAAQ;KAAE,SAAS,MAAM;IAAE;GAC7B;GACA,MAAM,UAAU,WAAyB;IACvC,MAAW,cAAc;KACvB,QAAQ;KAAQ,SAAS,EAAE,gBAAgB,mBAAmB;KAAG,MAAM,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC;IACxG,CAAC;GACH;GACA,MAAM,gBAAgB,MAAM,0BAA0B,OAAO,oBAAoB,KAAK,MAAM;GAE5F,IAAI,SAAS,WAAW,WAAW,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;IAAK,OAAO;IAAM,UAAA,EAAE,kBAAkB;GAAO,CAAA;GACvF,OAAO,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD,EAAA,UAAA;IACJ,iBAAiB,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;KAAK,OAAO;MAAE,GAAG;MAAK,aAAa;KAAU;KAA7C,UAAA;MAChB,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,uBAAuB,EAAU,CAAA;MAC5C,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,yBAAyB;MAAK,CAAA;MACjD,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD;OAAI,OAAO;QAAE,GAAG;QAAM,aAAa;OAAG;OAAK,WAAA,OAAO,WAAW,CAAC,EAAA,CAAG,KAAI,SACnE,iBAAA,GAAA,kBAAA,KAAA,CAAC,MAAD,EAAA,UAAA;QAA0B,KAAK;QAAM;QAAI,KAAK;QAAK,KAAK,OAAO,IAAI,cAAc,OAAO,KAAK,IAAI,IAAI;OAAO,EAAA,GAAnG,KAAK,SAA8F,CAAC;MAAM,CAAA;MACrH,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO;OAAZ,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;QAAQ,OAAO;QAAQ,eAAe;SAAE,iBAAiB,KAAK;SAAG,UAAU;QAAE;QAAI,UAAA,EAAE,wBAAwB;OAAU,CAAA,GACrH,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;QAAQ,OAAO;QAAQ,SAAS;QAAc,UAAA,EAAE,uBAAuB;OAAU,CAAA,CAC9E;;KACF;;IAEL,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;MAAK,OAAO;MACV,UAAA,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD,EAAA,UAAA;OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QAAO,MAAK;QAAW,SAAS,MAAM;QAAS,UAAU,CAAC;QAAO,WAAU,UAAS,cAAc,MAAM,OAAO,OAAO;OAAI,CAAA;OAAC;OAAE,EAAE,kBAAkB;MAAS,EAAA,CAAA;KAC9J,CAAA,GACL,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,OAAO;MAAO,UAAA,EAAE,sBAAsB;KAAK,CAAA,CACvC;;IAET,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,OAAO;MAAZ,UAAA;OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD,EAAA,UAAA;QAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SAAO,MAAK;SAAW,SAAS,MAAM;SAAkB,UAAU,CAAC;SAAO,WAAU,UAAS,KAAK,KAAK,EAAE,kBAAkB,MAAM,OAAO,QAAQ,CAAC;QAAI,CAAA;QAAC;QAAE,EAAE,oBAAoB;OAAS,EAAA,CAAA;OAC9L,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QAAO,MAAK;QAAS,KAAK;QAAG,KAAK;QAAM,OAAO,MAAM;QAAkB,UAAU,CAAC;QAChF,OAAO,EAAE,OAAO,GAAG;QAAG,WAAU,UAAS,KAAK,EAAE,kBAAkB,OAAO,MAAM,OAAO,KAAK,EAAE,CAAC;QAC9F,cAAc,KAAK,KAAK,EAAE,kBAAkB,MAAM,iBAAiB,CAAC;OAAI,CAAA;OAC1E,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO;QAAO,UAAA,EAAE,kBAAkB;OAAQ,CAAA;MAC7C;KACL,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,OAAO;MAAO,UAAA,EAAE,wBAAwB;KAAK,CAAA,CACzC;;IAET,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA;MACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,oBAAoB,EAAU,CAAA;MACzC,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,wBAAwB;MAAK,CAAA;MAChD,iBAAA,GAAA,kBAAA,IAAA,CAAC,YAAD;OAAU,OAAO;OAAU,OAAO,MAAM;OAAgB,UAAU,CAAC;OACjE,WAAU,UAAS,KAAK,EAAE,gBAAgB,MAAM,OAAO,MAAM,CAAC;OAC9D,cAAc,KAAK,KAAK,EAAE,gBAAgB,MAAM,eAAe,CAAC;MAAI,CAAA;KAC/D;;IAET,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA;MACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO;OAAZ,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,oBAAoB,EAAU,CAAA,GACzC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;QAAQ,OAAO;QAAQ,UAAU,CAAC;QAAO,eAAe,KAAK,KAAK;SAAE,yBAAyB;SAAM,eAAe;QAAG,CAAC;QAAI,UAAA,EAAE,gBAAgB;OAAU,CAAA,CACnJ;;MACL,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,wBAAwB;MAAK,CAAA;MAChD,iBAAA,GAAA,kBAAA,IAAA,CAAC,YAAD;OAAU,OAAO;OAAU,OAAO;OAAe,UAAU,CAAC;OAC1D,WAAU,UAAS,KAAK;QAAE,yBAAyB;QAAO,eAAe,MAAM,OAAO;OAAM,CAAC;OAC7F,cAAc,KAAK,KAAK;QAAE,yBAAyB,MAAM;QAAyB,eAAe,MAAM;OAAc,CAAC;MAAI,CAAA;MAC3H,MAAM,2BAA2B,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,yBAAyB;MAAK,CAAA;KAC5E;;IAET,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA;MACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,eAAe,EAAU,CAAA;MACpC,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,mBAAmB;MAAK,CAAA;MAC3C,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO;OAAZ,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,QAAD,EAAA,UAAA,CAAO,EAAE,oBAAoB,GAAE,GAAO,EAAA,CAAA,GACtC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;QAAQ,OAAO;QAAQ,UAAU,UAAU,QAAQ,MAAM,MAAM,WAAW;QACxE,WAAU,UAAS;SACjB,MAAM,OAAO,MAAM,OAAO;SAC1B,UAAU,IAAI;SAAG,SAAS,IAAI;SAAG,UAAU,IAAI;SAAG,UAAU,EAAE;SAC9D,IAAI,gBAAgB,IAAI,WAAW,aAAa,IAAI;QACtD;QACE,WAAA,OAAO,SAAS,CAAC,EAAA,CAAG,KAAI,SAAQ,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SAAsB,OAAO,KAAK;SAAK,UAAA,KAAK;QAAc,GAA7C,KAAK,EAAwC,CAAC;OACvF,CAAA,CACL;;MACJ,UAAU,QAAQ,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,MAAM,MAAM,MAAK,SAAQ,KAAK,OAAO,MAAM,CAAC,EAAE,eAAe;MAAM,CAAA;MACvG,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO;OAAZ,UAAA;QACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,QAAD,EAAA,UAAA,CAAO,EAAE,oBAAoB,GAAE,GAAO,EAAA,CAAA;QACtC,iBAAA,GAAA,kBAAA,KAAA,CAAC,UAAD;SAAQ,OAAO;SAAa,WAAU,UAAS;UAAE,eAAe,MAAM,OAAO,KAAK;UAAG,WAAW,MAAM,OAAO,OAAO,MAAM;SAAE;SAA5H,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAAQ,OAAM;UAAI,UAAA,EAAE,wBAAwB;SAAU,CAAA,GACrD,WAAW,KAAI,cAAa,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAA2B,OAAO,UAAU;UAAK,UAAA,UAAU;SAAc,GAA5D,UAAU,EAAkD,CAAC,CACjG;;QACR,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SAAQ,OAAO;SAAS,UAAU,gBAAgB,MAAM,WAAW;SAAI,eAAe,KAAK,QAAQ;SAAI,UAAA,EAAE,gBAAgB;QAAU,CAAA;OAChI;;MACJ,WAAW,WAAW,KAAK,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,uBAAuB;MAAK,CAAA;MAC1E,UAAU,QAAQ,CAAC,MAAM,SAAS,iBAAA,GAAA,kBAAA,KAAA,CAAC,KAAD;OAAG,OAAO;QAAE,GAAG;QAAM,OAAO;OAAO;OAAnC,UAAA;QAAuC,EAAE,mBAAmB;QAAE;QAAG,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE;OAAI;;MAC5I,WAAW,MAAM,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;QAAE,GAAG;QAAM,OAAO;OAAO;OAAI,UAAA;MAAU,CAAA;MAClE,UAAU,MAAM,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;QAAE,GAAG;QAAM,OAAO;OAAO;OAAI,UAAA;MAAS,CAAA;KAC1D;;IAET,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA;MACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,iBAAiB,EAAU,CAAA;MACtC,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,qBAAqB;MAAK,CAAA;MAC7C,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO;OAAZ,UAAA;QAAiB,iBAAA,GAAA,kBAAA,KAAA,CAAC,QAAD,EAAA,UAAA,CAAO,EAAE,iBAAiB,GAAE,GAAO,EAAA,CAAA;QAAC,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,OAAO,EAAE,WAAW,YAAY;SAAI,UAAA,QAAQ,UAAU;QAAU,CAAA;QACxH,WAAW,QAAQ,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SAAQ,OAAO;SAAQ,eAAe,OAAO,OAAO,MAAM;SAAI,UAAA,EAAE,iBAAiB;QAAU,CAAA;OAAO;;MACxH,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO;OAAZ,UAAA;QAAiB,iBAAA,GAAA,kBAAA,KAAA,CAAC,QAAD,EAAA,UAAA,CAAO,EAAE,iBAAiB,GAAE,GAAO,EAAA,CAAA;QAAC,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,OAAO,EAAE,WAAW,YAAY;SAAI,UAAA,OAAO,QAAQ;QAAU,CAAA;QACrH,OAAO,SAAS,KAAA,KAAa,MAAM,SAAS,MAAM,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SAAQ,OAAO;SAAQ,eAAe,OAAO,MAAM,IAAI;SAAI,UAAA,EAAE,iBAAiB;QAAU,CAAA;OAAO;;MACpJ,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;OAAK,OAAO;OAAK,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;QAAQ,OAAO;QAAQ,UAAU,WAAW;QAAI,eAAe,KAAK,KAAK,UAAU,MAAM;QAAI,UAAA,WAAW,WAAW,EAAE,iBAAiB,IAAI,EAAE,eAAe;OAAU,CAAA;MAAM,CAAA;MAC5L,iBAAA,GAAA,kBAAA,IAAA,CAAC,YAAD;OAAU,OAAO;QAAE,GAAG;QAAU,WAAW;OAAI;OAAG,UAAA;OAAS,OAAO;OAAQ,aAAa,EAAE,iBAAiB;MAAI,CAAA;KACvG;;IAET,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;KAAS,OAAO;KAAhB,UAAA;MACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,iBAAiB,EAAU,CAAA;MACrC,OAAO,WAAW,KAAK,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,OAAO;OAAO,UAAA,EAAE,eAAe;MAAK,CAAA;MAC9D,OAAO,KAAI,UAAS,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAqB,OAAO;QAAE,GAAG;QAAM,WAAW;QAAkB,YAAY;OAAE;OAAlF,UAAA;QACnB,iBAAA,GAAA,kBAAA,KAAA,CAAC,UAAD,EAAA,UAAA;SAAQ;SAAE,MAAM;SAAK;QAAS,EAAA,CAAA;QAAC;QAAE,MAAM,SAAS,KAAA,IAAY,MAAM,OAAO,QAAQ;QAAI,MAAM;OACxF;MAF0B,GAAA,MAAM,GAEhC,CAAC;KACC;;GACN,EAAA,CAAA;EACP;;;;;;;;ECrRA,SAAgB,WAAW,EAAE,KAA0D;GACrF,MAAM,CAAC,OAAO,aAAA,GAAYC,MAAAA,SAAAA,CAAkB,CAAC,CAAC;GAC9C,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,IAAI,QAAQ;IACZ,IAAI,QAAQ;IACZ,MAAM,aAAmB;KACvB,MAAM,eAAe,YAAY,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,OAAM,aAAY,MAAM,SAAS,KAAK,CAA6B,CAAC,CAAC,MAAK,SAAQ;MACrI,IAAI,CAAC,SAAS,KAAK,OAAO,WAAW,GAAG;MACxC,QAAQ,KAAK,OAAO,KAAK,OAAO,SAAS,EAAE,CAAE;MAC7C,MAAM,WAAW,KAAK,OAAO,QAAO,UAAS,MAAM,SAAS,QAAQ;MACpE,IAAI,SAAS,WAAW,GAAG;MAC3B,MAAM,MAAM,KAAK,IAAI;MACrB,UAAS,YAAW,CAAC,GAAG,SAAS,KAAI,WAAU;OAAE;OAAO,OAAO,MAAM;MAAK,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;KACxG,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;IAC1B;IACA,MAAM,QAAQ,kBAAkB;KAC9B,KAAK;KACL,MAAM,MAAM,KAAK,IAAI;KACrB,UAAS,YAAW,QAAQ,QAAO,SAAQ,KAAK,QAAQ,GAAG,CAAC;IAC9D,GAAG,IAAI;IACP,KAAK;IACL,aAAa;KAAE,QAAQ;KAAO,cAAc,KAAK;IAAE;GACrD,GAAG,CAAC,CAAC;GACL,IAAI,MAAM,WAAW,GAAG,OAAO;GAC/B,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;IAAK,OAAO;KAAE,UAAU;KAAS,OAAO;KAAI,QAAQ;KAAI,QAAQ;KAAM,SAAS;KAAQ,eAAe;KAAU,KAAK;KAAG,UAAU;IAAI;IAC1I,UAAA,MAAM,KAAI,SAAQ,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;KAA0B,OAAO;MAClD,YAAY;MAAW,OAAO;MAAW,QAAQ;MAAqB,cAAc;MACpF,SAAS;MAAa,UAAU;MAAI,YAAY;MAAK,WAAW;KAClE;KAHmB,UAAA,CAIjB,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,uBAAuB,EAAU,CAAA,GAC5C,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD,EAAA,UAAM,KAAK,MAAM,OAAY,CAAA,CAC1B;IANwB,GAAA,KAAK,MAAM,GAMnC,CAAC;GACH,CAAA;EACP;;;;EC3CA,MAAa,KAAK;EAElB,MAAa,KAAK;GAChB,gBAAgB;GAChB,kBAAkB;GAClB,oBAAoB;GACpB,wBAAwB;GACxB,2BAA2B;GAC3B,0BAA0B;GAC1B,yBAAyB;GACzB,sBAAsB;GACtB,0BAA0B;GAC1B,oBAAoB;GACpB,sBAAsB;GACtB,0BAA0B;GAC1B,sBAAsB;GACtB,0BAA0B;GAC1B,kBAAkB;GAClB,2BAA2B;GAC3B,iBAAiB;GACjB,qBAAqB;GACrB,sBAAsB;GACtB,sBAAsB;GACtB,0BAA0B;GAC1B,kBAAkB;GAClB,qBAAqB;GACrB,mBAAmB;GACnB,uBAAuB;GACvB,mBAAmB;GACnB,mBAAmB;GACnB,iBAAiB;GACjB,mBAAmB;GACnB,mBAAmB;GACnB,mBAAmB;GACnB,yBAAyB;GACzB,sBAAsB;GACtB,oBAAoB;GACpB,mBAAmB;GACnB,iBAAiB;GACjB,yBAAyB;GACzB,kBAAkB;EACpB;EAIA,MAAa,KAA0B;GACrC,gBAAgB;GAChB,kBAAkB;GAClB,oBAAoB;GACpB,wBAAwB;GACxB,2BAA2B;GAC3B,0BAA0B;GAC1B,yBAAyB;GACzB,sBAAsB;GACtB,0BAA0B;GAC1B,oBAAoB;GACpB,sBAAsB;GACtB,0BAA0B;GAC1B,sBAAsB;GACtB,0BAA0B;GAC1B,kBAAkB;GAClB,2BAA2B;GAC3B,iBAAiB;GACjB,qBAAqB;GACrB,sBAAsB;GACtB,sBAAsB;GACtB,0BAA0B;GAC1B,kBAAkB;GAClB,qBAAqB;GACrB,mBAAmB;GACnB,uBAAuB;GACvB,mBAAmB;GACnB,mBAAmB;GACnB,iBAAiB;GACjB,mBAAmB;GACnB,mBAAmB;GACnB,mBAAmB;GACnB,yBAAyB;GACzB,sBAAsB;GACtB,oBAAoB;GACpB,mBAAmB;GACnB,iBAAiB;GACjB,yBAAyB;GACzB,kBAAkB;EACpB;;;ECnEA,MAAa,SAAS;GAAC;GAAS;GAAU;GAAe;EAAa;EAEtE,SAAgB,MAAM,KAAoB;GACxC,IAAI,aAAa,IAAI,OAAO,SAAS,IAAI;IAAE;IAAI;GAAG,CAAC,CAAC;GACpD,oBAAoB;IAClB,eAAe,aAAa,WAAW;KACrC,IAAI,YAAY,aAAa,aAAmE,EAAE,OAAO,CAAC;IAC5G;IACA,kBAAkB;KAIhB,QAHiB,IAAiD,IAAI,YAElD,CAAC,EAAE,MAAM,YAAY,CAAC,CAAC,SAAS,CAAC,EAAA,CACxC,KAAK,MAAM,WAAW;MACjC,IAAI,OAAO,KAAK,mBAAmB,WAAW,KAAK,iBAAiB,OAAO,KAAK,SAAS,KAAK;MAC9F,OAAO,OAAO,KAAK,aAAa,YAAY,KAAK,aAAa,KAC1D,KAAK,WACL,OAAO,KAAK,WAAW,KAAK,kBAAmB,eAAe,OAAO,QAAQ,CAAC,CAAE;KACtF,EAAE;IACJ;GACF,CAAC;GACD,IAAI,mBAAmB;IAAE,oBAAoB,KAAA,CAAS;GAAE,CAAC;GACzD,MAAM,IAAI,IAAI,OAAO,KAAK,EAAE;GAC5B,MAAM,OAAO,IAAI,YAAY,IAAI,WAAW;GAK5C,MAAM,WAAW;IACf,mBAAmB,KAAK,YAAY;IACpC,YAAY,aAAyB,KAAK,UAAU,QAAQ;IAC5D,SAAS,KAAY,aAAsB,KAAK,OAAO,KAAK,QAAQ;GACtE;GACA,IAAI,MAAM,OAAO,0BAA0B,IAAI,MAAM,SAAS;IAC5D,MAAM;IAAoB,IAAI;IAAa,OAAO;IAClD,aAAa,EAAE,cAAc;IAAG,QAAQ;IACxC,eAAe,EAAE,MAAM,SAAS;GAClC,GAAG,iBAAiB,CAAC;GACrB,IAAI,MAAM,OAAO,uBAAuB,IAAI,MAAM,SAAS;IACzD,MAAM;IAAiB,IAAI;IAAwB,QAAQ;IAC3D,eAAe,EAAE,EAAE;GACrB,GAAG,UAAU,CAAC;EAChB"}

package/lib/index.js

@@ -4,7 +4,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
-import { execFileSync, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 //#region src/config.ts
 /**
 * Plugin configuration. The Settings page writes this document through the
@@ -42,9 +42,16 @@ const PROMPT_ROUTE = "/api/eval-guard/prompt";
 const EVENTS_ROUTE = "/api/eval-guard/events";
 const REVEAL_ROUTE = "/api/eval-guard/reveal";
 const MANUAL_ROUTE = "/api/eval-guard/manual";
-/** The only task implemented today. */
+/** Supported task ids. */
 const TANK_TASK = "tank";
 const TANK_TASK_LABEL = "第 6 集 · 坦克大战";
+const WAREHOUSE_TASK = "warehouse";
+const WAREHOUSE_TASK_LABEL = "第 5 集 · 仓储调度";
+const LAND_TASK = "land";
+const LAND_TASK_LABEL = "第 1 集 · 圈地";
+const BOMBERMAN_TASK = "bomberman";
+const BOMBERMAN_TASK_LABEL = "第 2 集 · 炸弹人";
+const CTF_TASK_LABEL = "第 3 集 · 夺旗";
 //#endregion
 //#region src/policy.ts
 /**
@@ -379,7 +386,8 @@ const SYSTEM_READ_DIRS = [
 	"/libx32",
 	"/etc",
 	"/opt",
-	"/sys"
+	"/sys",
+	"/var/lib"
 ];
 /** Ancestors of a path, outermost first. */
 function ancestorsOf(target) {
@@ -483,7 +491,10 @@ function writePolicy(workspace, rules) {
 	const lines = [];
 	lines.push(line("workspace", workspace));
 	for (const system of SYSTEM_READ_DIRS) try {
-		if (fs.statSync(system).isDirectory()) lines.push(line("read", system));
+		if (fs.statSync(system).isDirectory()) {
+			lines.push(line("read", system));
+			for (const ancestor of ancestorsOf(system)) lines.push(line("exact", ancestor));
+		}
 	} catch {}
 	lines.push(line("read", "/proc"));
 	lines.push(line("exact", "/"));
@@ -507,6 +518,7 @@ function writePolicy(workspace, rules) {
 	}
 	for (const manifest of manifests) lines.push(line("read", manifest));
 	for (const dev of [
+		"/dev",
 		"/dev/null",
 		"/dev/zero",
 		"/dev/full",
@@ -1268,10 +1280,10 @@ var Guard = class {
 		});
 	}
 	/** Build the prompt for one task with only installed tools listed. */
-	promptFor(workspacePath, source) {
+	promptFor(workspacePath, source, task = this.task) {
 		const present = new Set(this.toolCache);
 		const blacklist = parseBlacklist(this.blacklistText()).filter((name) => isBaseBlacklistName(name) || present.has(name));
-		return this.task.prompt(blacklist, {
+		return task.prompt(blacklist, {
 			source,
 			workspacePath,
 			minutes: this.configuration.timeLimitMinutes
@@ -1287,169 +1299,53 @@ var Guard = class {
 	}
 };
 //#endregion
-//#region src/routes.ts
-/**
-* Browser-facing routes: enable pre-check, workspace check, task install,
-* manual-channel paths, and the warning event feed.
-* @module dsh-eval-guard/routes
-*/
-/** One JSON reply. */
-function json(value, status = 200) {
-	return new Response(JSON.stringify(value), {
-		status,
-		headers: {
-			"content-type": "application/json",
-			"cache-control": "no-store"
-		}
-	});
-}
-/** Read a query parameter. */
-function query(request, key) {
-	return new URL(request.url).searchParams.get(key) ?? "";
-}
-/** Whether one path is inside another. */
-function under(target, root) {
-	const relative = path.relative(root, target);
-	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
-}
-/**
-* Register every route this plugin owns.
-* @param ctx - host context.
-* @param guard - the guard instance.
-* @param tasks - task service.
-*/
-function registerRoutes(ctx, guard, tasks) {
-	ctx.inject(["connection"], (child) => {
-		const connection = child.get("connection");
-		const register = connection?.fetch?.register?.bind(connection.fetch);
-		if (register === void 0) {
-			ctx.logger.warn("eval-guard: connection.fetch is unavailable; the Settings page cannot reach the host");
-			return;
-		}
-		const add = (route) => {
-			child.effect(() => register(route), "eval-guard: route " + route.path);
-		};
-		add({
-			path: STATE_ROUTE,
-			methods: ["GET"],
-			requestBody: "buffered",
-			fetch: async () => {
-				return json({
-					enabled: guard.active,
-					running: guard.runningSessions(),
-					tasks: [{
-						id: "tank",
-						label: "第 6 集 · 坦克大战",
-						description: "1v1 坦克大战 bot；提交 submission/bot.cpp。"
-					}],
-					defaultBlacklist: guard.defaultBlacklist(),
-					generatedDefault: guard.configuration.toolBlacklistUseDefault,
-					workspaceRoot: dshHome(),
-					runsRoot: path.join(guardRoot(), "runs")
-				});
-			}
-		});
-		add({
-			path: CHECK_ROUTE,
-			methods: ["GET"],
-			requestBody: "buffered",
-			fetch: async (request) => {
-				const workspaceId = query(request, "workspaceId");
-				if (workspaceId === "") return json({ error: "workspaceId is required" }, 400);
-				return json(tasks.check(workspaceId));
-			}
-		});
-		add({
-			path: INSTALL_ROUTE,
-			methods: ["POST"],
-			requestBody: "buffered",
-			fetch: async (request) => {
-				let body = {};
-				try {
-					body = await request.json();
-				} catch {
-					return json({ error: "invalid body" }, 400);
-				}
-				const workspaceId = typeof body.workspaceId === "string" ? body.workspaceId : "";
-				if (workspaceId === "") return json({ error: "workspaceId is required" }, 400);
-				return json(tasks.install(workspaceId));
-			}
-		});
-		add({
-			path: PROMPT_ROUTE,
-			methods: ["GET"],
-			requestBody: "buffered",
-			fetch: async (request) => {
-				const workspaceId = query(request, "workspaceId");
-				return json({ prompt: tasks.prompt(workspaceId) });
-			}
-		});
-		add({
-			path: MANUAL_ROUTE,
-			methods: ["GET"],
-			requestBody: "buffered",
-			fetch: async (request) => {
-				const workspaceId = query(request, "workspaceId");
-				return json(tasks.manualPaths(workspaceId));
-			}
-		});
-		add({
-			path: EVENTS_ROUTE,
-			methods: ["GET"],
-			requestBody: "buffered",
-			fetch: async (request) => {
-				const since = Number(query(request, "since"));
-				return json({ events: guard.recent(Number.isFinite(since) ? since : 0) });
-			}
-		});
-		add({
-			path: REVEAL_ROUTE,
-			methods: ["POST"],
-			requestBody: "buffered",
-			fetch: async (request) => {
-				let body = {};
-				try {
-					body = await request.json();
-				} catch {
-					return json({ error: "invalid body" }, 400);
-				}
-				const target = typeof body.path === "string" ? path.resolve(body.path) : "";
-				if (target === "") return json({ error: "path is required" }, 400);
-				const material = path.resolve(guardRoot(), "material");
-				const workspaces = child.get("workspaceRegistry")?.list?.() ?? [];
-				if (!(under(target, material) || workspaces.some((workspace) => under(target, workspace.path)))) return json({ error: "path is not revealable" }, 403);
-				if (!fs.existsSync(target)) return json({ error: "path does not exist" }, 404);
-				try {
-					spawn("xdg-open", [target], {
-						detached: true,
-						stdio: "ignore"
-					}).unref();
-				} catch (error) {
-					return json({ error: error instanceof Error ? error.message : String(error) }, 500);
-				}
-				return json({ ok: true });
-			}
-		});
-	});
-}
-//#endregion
 //#region src/task.ts
 /**
-* The tank task pack: workspace extraction, prompt construction, and the one
+* The tank task pack: packaged workspace.zip install, prompt construction, and the one
 * run record the evaluator later reads.
 * @module dsh-eval-guard/task
 */
-/** The only task offered today. */
-const TASKS = [{
-	id: TANK_TASK,
-	label: TANK_TASK_LABEL,
-	description: "1v1 坦克大战 bot：编写 submission/bot.cpp，评测时与基准及其它提交打循环赛。"
-}];
+/** Tasks offered by the installer. */
+const TASKS = [
+	{
+		id: TANK_TASK,
+		label: TANK_TASK_LABEL,
+		description: "1v1 坦克大战 bot：解压 workspace.zip 后编写 workspace/submission/bot.cpp，评测时与基准及其它提交打循环赛。"
+	},
+	{
+		id: WAREHOUSE_TASK,
+		label: WAREHOUSE_TASK_LABEL,
+		description: "单人单次仓储调度优化：解压 workspace.zip 后改写 workspace/src/，在输出逐字节不变的前提下尽量提速。"
+	},
+	{
+		id: LAND_TASK,
+		label: LAND_TASK_LABEL,
+		description: "圈地 1v1/4 人混战 bot：解压 workspace.zip 后编写 workspace/submission/bot.cpp。"
+	},
+	{
+		id: BOMBERMAN_TASK,
+		label: BOMBERMAN_TASK_LABEL,
+		description: "炸弹人 2–10 人 bot：解压 workspace.zip 后编写 workspace/submission/bot.cpp。"
+	},
+	{
+		id: "ctf",
+		label: CTF_TASK_LABEL,
+		description: "夺旗 2–15 人 bot：解压 workspace.zip 后编写 workspace/submission/bot.cpp。"
+	}
+];
 /** Format a blacklist for the prompt. */
 function blacklistBlock(blacklist) {
 	if (blacklist.length === 0) return "（当前没有需要特别列出的工具。）";
 	return blacklist.join("\n");
 }
+/** Wording shared by every task: difficulty, strong-agent comparison, no early submit. */
+const COMPETITION_LINES = [
+	"## 竞争强度",
+	"",
+	"- 这个任务并不像看起来那么简单，不要低估隐藏边界、正确性细节和对手强度。",
+	"- 你的结果会与 meow-ai-arena 中其他强 agent（如 GPT-6 Astra、Opus、Kimi K3 等）的提交在同一口径下比较，而不只是和基准 bot 比较；请按能进入前列的标准要求自己。",
+	"- 不要过早交卷：在时间上限内尽量多验证、迭代和完善，只有确实完成时才结束。"
+];
 /** The tank task definition. */
 const TANK_DEFINITION = {
 	id: TANK_TASK,
@@ -1469,24 +1365,165 @@ const TANK_DEFINITION = {
 			"",
 			"## 交付",
 			"",
-			"- 把最终 bot 保存到工作区内的 submission/bot.cpp（只需要这一个文件）。",
-			"- 交付前检查并关闭所有后台任务；最多 " + String(options.minutes ?? 90) + " 分钟，到点会被强制终止。",
+			"- 解压工作区里的 workspace.zip，把最终 bot 保存到解压后的 workspace/submission/bot.cpp（只需要这一个文件）。",
 			"- 最后用几句话说明你的策略。",
 			"",
+			"## 时间规则",
+			"",
+			"- 本次是**连续 " + String(options.minutes ?? 90) + " 分钟的单次任务**，从对话开始时开始计时。",
+			"- 交付前检查并关闭所有后台任务；到点会被强制终止。",
+			"- clock.py 从解压那一刻开始计算，而实际计时从对话开始计算；它**只能作为参考**，请尽快解压以减小误差。实际时间以评测守护为准。",
+			"",
+			"## 本次评测禁止调用的工具",
+			"",
+			blacklistBlock(blacklist),
+			"",
+			"## 工作区内容",
+			"",
+			"工作区里有一个 workspace.zip；解压后进入 workspace/ 目录，先读 README.md 和 RULES.md，规则引擎是 tank.hpp。",
+			"本地工具（arena.py、check、play、batch、vs 等）和起步模板都在解压后的 workspace/ 里，可直接使用。",
+			"",
+			...COMPETITION_LINES,
+			"",
+			"开始吧。"
+		].join("\n");
+	}
+};
+/** The warehouse single-run optimization task. */
+const WAREHOUSE_DEFINITION = {
+	id: WAREHOUSE_TASK,
+	label: WAREHOUSE_TASK_LABEL,
+	description: TASKS[1].description,
+	asset: path.join(packageRoot(), "assets", "warehouse", "workspace.zip"),
+	prompt(blacklist, options) {
+		return [
+			"这是一场用于评测 AI agent 能力的仓储调度优化任务。你需要在当前工作区里独立完成它。",
+			"",
+			"## 环境与限制",
+			"",
+			"- 你只能读写当前工作区内的文件；工作区以外的任何位置都不能访问，包括 /tmp。",
+			"- 禁止联网、禁止调用其他 AI 或子代理、禁止与其他 agent 通信或读取其他工作区。",
+			"- 评测守护会阻止并记录违规行为；违规可能导致本次评测无效。",
+			"- 任务必须自主完成：不要向用户提问、不要请求审批、不要等待任何用户输入。",
+			"",
+			"## 交付",
+			"",
+			"- 解压工作区里的 workspace.zip，进入解压后的 workspace/ 目录；只能修改 workspace/src/ 下的文件。",
+			"- 结束时 workspace/src/ 整个目录就是提交；不要修改 baseline/、workloads/、tools/。",
+			"- 最后用几句话说明你做了什么优化、如何验证输出不变。",
+			"",
+			"## 时间规则",
+			"",
+			"- 本次是**连续 " + String(options.minutes ?? 90) + " 分钟的单次任务**，从对话开始时开始计时。",
+			"- 交付前检查并关闭所有后台任务；到点会被强制终止，以当时的 src/ 为准。",
+			"- clock.py 从解压那一刻开始计算，而实际计时从对话开始计算；它**只能作为参考**，请尽快解压以减小误差。实际时间以评测守护为准。",
+			"",
 			"## 本次评测禁止调用的工具",
 			"",
 			blacklistBlock(blacklist),
 			"",
 			"## 工作区内容",
 			"",
-			"工作区根目录就是选手包：先读 README.md 和 RULES.md，规则引擎是 tank.hpp。",
-			"本地工具（arena.py、check、play、batch、vs 等）和起步模板都在工作区里，可直接使用。",
-			"README.md 里提到的上下半场属于原始赛制；clock.py 只是参考，本次是单次任务，以本提示词的时间规则为准。",
+			"解压后 workspace/ 里有 TASK.md、SPEC.md、baseline/、src/、workloads/public/ 和 tools/。",
+			"先读 TASK.md、baseline 代码和 SPEC.md；SPEC.md 是旧文档，与基线代码不一致时以基线代码的行为为准。",
+			"编译命令固定为 g++ -O2 -std=c++20 src/*.cpp；输出必须与 baseline 逐字节相同，包括所有能通过 tools/check_input.py --full 的输入。",
+			"用 python3 tools/bench.py 检查正确性和耗时，用 tools/gen.py 生成更多输入和基线对拍。",
+			"",
+			...COMPETITION_LINES,
 			"",
 			"开始吧。"
 		].join("\n");
 	}
 };
+/** Shared prompt for the three bot-writing tasks. */
+function botTaskPrompt(intro, submit, workspaceLines, blacklist, options) {
+	return [
+		intro,
+		"",
+		"## 环境与限制",
+		"",
+		"- 你只能读写当前工作区内的文件；工作区以外的任何位置都不能访问，包括 /tmp。",
+		"- 禁止联网、禁止调用其他 AI 或子代理、禁止与其他 agent 通信或读取其他工作区。",
+		"- 评测守护会阻止并记录违规行为；违规可能导致本次评测无效。",
+		"- 任务必须自主完成：不要向用户提问、不要请求审批、不要等待任何用户输入。",
+		"",
+		"## 交付",
+		"",
+		submit,
+		"- 最后用几句话说明你的策略。",
+		"",
+		"## 时间规则",
+		"",
+		"- 本次是**连续 " + String(options.minutes ?? 90) + " 分钟的单次任务**，从对话开始时开始计时。",
+		"- 交付前检查并关闭所有后台任务；到点会被强制终止。",
+		"- clock.py 从解压那一刻开始计算，而实际计时从对话开始计算；它**只能作为参考**，请尽快解压以减小误差。实际时间以评测守护为准。",
+		"",
+		"## 本次评测禁止调用的工具",
+		"",
+		blacklistBlock(blacklist),
+		"",
+		"## 工作区内容",
+		"",
+		...workspaceLines,
+		"",
+		...COMPETITION_LINES,
+		"",
+		"开始吧。"
+	].join("\n");
+}
+/** Land (territory) bot task. */
+const LAND_DEFINITION = {
+	id: LAND_TASK,
+	label: LAND_TASK_LABEL,
+	description: TASKS[2].description,
+	asset: path.join(packageRoot(), "assets", "land", "workspace.zip"),
+	prompt(blacklist, options) {
+		return botTaskPrompt("这是一场用于评测 AI agent 能力的圈地对战 bot 编程任务。你需要在当前工作区里独立完成它。", "- 解压工作区里的 workspace.zip，进入 workspace/；从 starter/bot.cpp 起步，最终把单文件程序保存到 workspace/submission/bot.cpp。", [
+			"解压后 workspace/ 里有 RULES.md、TASK.md、engine/、anchors/、starter/ 和 submission/。",
+			"先读 RULES.md、TASK.md、engine/game.py 和 starter/bot.cpp；规则以 engine/game.py 为准。",
+			"本地裁判：python3 engine/referee.py submission/bot.cpp anchors/greedy.cpp --games 10（单挑），也可加多个 bot 打混战。",
+			"只能提交一个 bot.cpp，编译参数固定为 g++ -O2 -std=c++20，单文件、只用 C++ 标准库。"
+		], blacklist, options);
+	}
+};
+/** Bomberman bot task. */
+const BOMBERMAN_DEFINITION = {
+	id: BOMBERMAN_TASK,
+	label: BOMBERMAN_TASK_LABEL,
+	description: TASKS[3].description,
+	asset: path.join(packageRoot(), "assets", "bomberman", "workspace.zip"),
+	prompt(blacklist, options) {
+		return botTaskPrompt("这是一场用于评测 AI agent 能力的炸弹人对战 bot 编程任务。你需要在当前工作区里独立完成它。", "- 解压工作区里的 workspace.zip，进入 workspace/；最终把单文件程序保存到 workspace/submission/bot.cpp。", [
+			"解压后 workspace/ 里有 README.md、RULES.md、engine/、baseline.cpp 和 submission/。",
+			"先读 README.md、RULES.md 和 engine/engine.py；baseline.cpp 是公开练习对手，可以编译、对战和复盘。",
+			"同一程序要支持 2–10 人；编译参数固定为 g++ -O2 -std=c++20，单文件、只用 C++ 标准库。",
+			"用 engine/arena.py 或 README 里的本地命令做对战和回放验证。"
+		], blacklist, options);
+	}
+};
+/** CTF (capture the flag) bot task. */
+const CTF_DEFINITION = {
+	id: "ctf",
+	label: CTF_TASK_LABEL,
+	description: TASKS[4].description,
+	asset: path.join(packageRoot(), "assets", "ctf", "workspace.zip"),
+	prompt(blacklist, options) {
+		return botTaskPrompt("这是一场用于评测 AI agent 能力的夺旗对战 bot 编程任务。你需要在当前工作区里独立完成它。", "- 解压工作区里的 workspace.zip，进入 workspace/；最终把单文件程序保存到 workspace/submission/bot.cpp。", [
+			"解压后 workspace/ 里有 README.md、RULES.md、arena.py、engine.py、core.py、baseline.cpp 和 submission/bot.cpp 模板。",
+			"先读 README.md、RULES.md 和 submission/bot.cpp；一个程序统一控制己方 3 个角色，支持 2–15 个阵营。",
+			"本地对战：python3 arena.py play submission/bot.cpp baseline --seed 7，或 arena.py batch；baseline.cpp 是公开练习对手。",
+			"编译参数固定为 g++ -O2 -std=c++20，单文件、只用 C++ 标准库。"
+		], blacklist, options);
+	}
+};
+/** All task definitions keyed by id. */
+const TASK_DEFINITIONS = {
+	[TANK_TASK]: TANK_DEFINITION,
+	[WAREHOUSE_TASK]: WAREHOUSE_DEFINITION,
+	[LAND_TASK]: LAND_DEFINITION,
+	[BOMBERMAN_TASK]: BOMBERMAN_DEFINITION,
+	["ctf"]: CTF_DEFINITION
+};
 /** Install, check, and prompt services for the task pack. */
 var TaskService = class {
 	guard;
@@ -1527,23 +1564,36 @@ var TaskService = class {
 			entries
 		};
 	}
-	/** Extract the task pack to a material directory the manual channel can reveal. */
-	materialDir() {
-		const dir = path.join(guardRoot(), "material", "tank");
-		const marker = path.join(guardRoot(), "material", ".tank-complete");
-		if (fs.existsSync(marker) && fs.existsSync(path.join(dir, "RULES.md"))) return dir;
-		fs.rmSync(dir, {
-			recursive: true,
-			force: true
-		});
+	/** A known task definition, or undefined. */
+	definition(taskId) {
+		return TASK_DEFINITIONS[taskId];
+	}
+	/** Copy the packaged workspace.zip to a stable material path for install/manual use. */
+	materialZip(taskId = TANK_TASK) {
+		const definition = TASK_DEFINITIONS[taskId];
+		if (definition === void 0) throw new Error("unknown task: " + taskId);
+		const dir = path.join(guardRoot(), "material", taskId);
 		fs.mkdirSync(dir, { recursive: true });
-		fs.mkdirSync(path.dirname(marker), { recursive: true });
-		this.extract(TANK_DEFINITION.asset, dir);
-		fs.writeFileSync(marker, "ok\n", "utf8");
-		return dir;
+		const target = path.join(dir, "workspace.zip");
+		const source = definition.asset;
+		if (!fs.existsSync(source)) throw new Error("task asset is missing: " + source);
+		let stale = true;
+		try {
+			stale = !fs.existsSync(target) || fs.statSync(target).size !== fs.statSync(source).size;
+		} catch {
+			stale = true;
+		}
+		if (stale) fs.copyFileSync(source, target);
+		return target;
 	}
-	/** Install the task pack into an empty workspace. */
-	install(workspaceId, promptOverride) {
+	/** Install the selected task pack into an empty workspace. */
+	install(workspaceId, taskId = TANK_TASK, promptOverride) {
+		const definition = TASK_DEFINITIONS[taskId];
+		if (definition === void 0) return {
+			ok: false,
+			workspaceId,
+			error: "未知任务：" + taskId
+		};
 		const checked = this.check(workspaceId);
 		if (!checked.ok) return {
 			ok: false,
@@ -1563,7 +1613,7 @@ var TaskService = class {
 			error: "请先启用评测守护，再安装评测任务。"
 		};
 		try {
-			this.extract(TANK_DEFINITION.asset, checked.path);
+			fs.copyFileSync(this.materialZip(taskId), path.join(checked.path, "workspace.zip"));
 		} catch (error) {
 			return {
 				ok: false,
@@ -1573,10 +1623,10 @@ var TaskService = class {
 			};
 		}
 		const runId = this.newRunId();
-		const prompt = promptOverride ?? this.guard.promptFor(checked.path, this.materialDir());
+		const prompt = promptOverride ?? this.guard.promptFor(checked.path, this.materialZip(taskId), definition);
 		const run = {
 			runId,
-			task: TANK_TASK,
+			task: definition.id,
 			workspaceId,
 			workspacePath: checked.path,
 			sessionId: null,
@@ -1597,47 +1647,178 @@ var TaskService = class {
 		};
 	}
 	/** The prompt for manual copying, without installing anything. */
-	prompt(workspaceId) {
+	prompt(workspaceId, taskId = TANK_TASK) {
+		const definition = TASK_DEFINITIONS[taskId];
+		if (definition === void 0) return "";
 		const workspace = this.registry.get(workspaceId);
-		return this.guard.promptFor(workspace?.path ?? "", this.materialDir());
+		return this.guard.promptFor(workspace?.path ?? "", this.materialZip(taskId), definition);
 	}
 	/** Filesystem paths for the manual channel. */
-	manualPaths(workspaceId) {
+	manualPaths(workspaceId, taskId = TANK_TASK) {
+		const definition = TASK_DEFINITIONS[taskId];
+		if (definition === void 0) return {
+			source: "",
+			prompt: ""
+		};
 		const workspace = this.registry.get(workspaceId);
 		return {
-			source: this.materialDir(),
-			prompt: this.guard.promptFor(workspace?.path ?? "", this.materialDir())
+			source: this.materialZip(taskId),
+			prompt: this.guard.promptFor(workspace?.path ?? "", this.materialZip(taskId), definition)
 		};
 	}
-	/** Extract a workspace.zip into a destination, stripping the workspace/ prefix. */
-	extract(zip, destination) {
-		if (!fs.existsSync(zip)) throw new Error("task asset is missing: " + zip);
-		fs.mkdirSync(path.join(guardRoot(), "tmp"), { recursive: true });
-		const temporary = fs.mkdtempSync(path.join(guardRoot(), "tmp", "extract-"));
-		try {
-			execFileSync("unzip", [
-				"-q",
-				"-o",
-				zip,
-				"-d",
-				temporary
-			], { stdio: "ignore" });
-			const inner = path.join(temporary, "workspace");
-			if (!fs.existsSync(inner)) throw new Error("task asset has no workspace/ root");
-			fs.cpSync(inner, destination, { recursive: true });
-		} finally {
-			fs.rmSync(temporary, {
-				recursive: true,
-				force: true
-			});
-		}
-	}
 	/** A unique run id. */
 	newRunId() {
 		return (/* @__PURE__ */ new Date()).toISOString().replace(/[-:.TZ]/g, "").slice(0, 14) + "-" + Math.random().toString(16).slice(2, 8);
 	}
 };
 //#endregion
+//#region src/routes.ts
+/**
+* Browser-facing routes: enable pre-check, workspace check, task install,
+* manual-channel paths, and the warning event feed.
+* @module dsh-eval-guard/routes
+*/
+/** One JSON reply. */
+function json(value, status = 200) {
+	return new Response(JSON.stringify(value), {
+		status,
+		headers: {
+			"content-type": "application/json",
+			"cache-control": "no-store"
+		}
+	});
+}
+/** Read a query parameter. */
+function query(request, key) {
+	return new URL(request.url).searchParams.get(key) ?? "";
+}
+/** Whether one path is inside another. */
+function under(target, root) {
+	const relative = path.relative(root, target);
+	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+/**
+* Register every route this plugin owns.
+* @param ctx - host context.
+* @param guard - the guard instance.
+* @param tasks - task service.
+*/
+function registerRoutes(ctx, guard, tasks) {
+	ctx.inject(["connection"], (child) => {
+		const connection = child.get("connection");
+		const register = connection?.fetch?.register?.bind(connection.fetch);
+		if (register === void 0) {
+			ctx.logger.warn("eval-guard: connection.fetch is unavailable; the Settings page cannot reach the host");
+			return;
+		}
+		const add = (route) => {
+			child.effect(() => register(route), "eval-guard: route " + route.path);
+		};
+		add({
+			path: STATE_ROUTE,
+			methods: ["GET"],
+			requestBody: "buffered",
+			fetch: async () => {
+				return json({
+					enabled: guard.active,
+					running: guard.runningSessions(),
+					tasks: [...TASKS],
+					defaultBlacklist: guard.defaultBlacklist(),
+					generatedDefault: guard.configuration.toolBlacklistUseDefault,
+					workspaceRoot: dshHome(),
+					runsRoot: path.join(guardRoot(), "runs")
+				});
+			}
+		});
+		add({
+			path: CHECK_ROUTE,
+			methods: ["GET"],
+			requestBody: "buffered",
+			fetch: async (request) => {
+				const workspaceId = query(request, "workspaceId");
+				if (workspaceId === "") return json({ error: "workspaceId is required" }, 400);
+				return json(tasks.check(workspaceId));
+			}
+		});
+		add({
+			path: INSTALL_ROUTE,
+			methods: ["POST"],
+			requestBody: "buffered",
+			fetch: async (request) => {
+				let body = {};
+				try {
+					body = await request.json();
+				} catch {
+					return json({ error: "invalid body" }, 400);
+				}
+				const workspaceId = typeof body.workspaceId === "string" ? body.workspaceId : "";
+				const taskId = typeof body.task === "string" && body.task !== "" ? body.task : TANK_TASK;
+				if (workspaceId === "") return json({ error: "workspaceId is required" }, 400);
+				return json(tasks.install(workspaceId, taskId));
+			}
+		});
+		add({
+			path: PROMPT_ROUTE,
+			methods: ["GET"],
+			requestBody: "buffered",
+			fetch: async (request) => {
+				const workspaceId = query(request, "workspaceId");
+				const taskId = query(request, "task") || "tank";
+				if (tasks.definition(taskId) === void 0) return json({ error: "unknown task" }, 400);
+				return json({ prompt: tasks.prompt(workspaceId, taskId) });
+			}
+		});
+		add({
+			path: MANUAL_ROUTE,
+			methods: ["GET"],
+			requestBody: "buffered",
+			fetch: async (request) => {
+				const workspaceId = query(request, "workspaceId");
+				const taskId = query(request, "task") || "tank";
+				if (tasks.definition(taskId) === void 0) return json({ error: "unknown task" }, 400);
+				return json(tasks.manualPaths(workspaceId, taskId));
+			}
+		});
+		add({
+			path: EVENTS_ROUTE,
+			methods: ["GET"],
+			requestBody: "buffered",
+			fetch: async (request) => {
+				const since = Number(query(request, "since"));
+				return json({ events: guard.recent(Number.isFinite(since) ? since : 0) });
+			}
+		});
+		add({
+			path: REVEAL_ROUTE,
+			methods: ["POST"],
+			requestBody: "buffered",
+			fetch: async (request) => {
+				let body = {};
+				try {
+					body = await request.json();
+				} catch {
+					return json({ error: "invalid body" }, 400);
+				}
+				const target = typeof body.path === "string" ? path.resolve(body.path) : "";
+				if (target === "") return json({ error: "path is required" }, 400);
+				const material = path.resolve(guardRoot(), "material");
+				const workspaces = child.get("workspaceRegistry")?.list?.() ?? [];
+				if (!(under(target, material) || workspaces.some((workspace) => under(target, workspace.path)))) return json({ error: "path is not revealable" }, 403);
+				if (!fs.existsSync(target)) return json({ error: "path does not exist" }, 404);
+				try {
+					spawn("xdg-open", [target], {
+						detached: true,
+						stdio: "ignore"
+					}).unref();
+				} catch (error) {
+					return json({ error: error instanceof Error ? error.message : String(error) }, 500);
+				}
+				return json({ ok: true });
+			}
+		});
+	});
+}
+//#endregion
 //#region src/index.ts
 /** Stable Cordis plugin name. */
 const name = "eval-guard";
@@ -1691,7 +1872,7 @@ function apply(ctx, config) {
 			guard.dispose();
 		}, "eval-guard: dispose");
 		guard.update(config ?? {});
-		ctx.logger.info("eval-guard: task %s ready (%d task definition(s))", TANK_DEFINITION.id, TASKS.length);
+		ctx.logger.info("eval-guard: task %s ready (%d task definition(s))", TASKS.map((task) => task.id).join(","), TASKS.length);
 	});
 }
 //#endregion

package/native/supervisor.c

@@ -271,6 +271,13 @@ static int is_dev_path(const char *path) {
   return 0;
 }
 
+static int is_exact_policy_path(const char *path) {
+  for (int i = 0; i < g_exact_count; i++) {
+    if (strcmp(path, g_exact[i]) == 0) return 1;
+  }
+  return 0;
+}
+
 static int base_read_allowed(const char *path) {
   if (g_workspace[0] != '\0' && starts_with_seg(path, g_workspace)) return 1;
   if (is_dev_path(path)) return 1;
@@ -509,14 +516,18 @@ static int check_notification(pid_t pid, const struct seccomp_notif *req, int *w
     int domain = (int)a0;
     *write_access = 0;
     snprintf(path_out, MAX_PATH, "<network:socket>");
-    if (is_bwrap(pid) && (domain == AF_UNIX || domain == AF_NETLINK)) return 1;
+    /* AF_UNIX/AF_NETLINK stay inside the private network namespace and are
+     * needed by NSS, Python and the dynamic loader. AF_INET/AF_INET6 and raw
+     * sockets are still blocked. */
+    if (domain == AF_UNIX || domain == AF_NETLINK) return 1;
     return 0;
   }
   if (is_network_syscall(nr)) {
     *write_access = 0;
     snprintf(path_out, MAX_PATH, "<network:%s>", syscall_name(nr));
-    if (is_bwrap(pid)) return 1;
-    return 0;
+    /* Only AF_UNIX/AF_NETLINK sockets can exist now; their traffic is local
+     * to the private namespace and cannot reach the host network. */
+    return 1;
   }
   if (nr == SYS_io_uring_setup || nr == SYS_ptrace || nr == SYS_open_by_handle_at) {
     *write_access = 0;
@@ -630,6 +641,10 @@ static int check_notification(pid_t pid, const struct seccomp_notif *req, int *w
   }
   snprintf(path_out, MAX_PATH, "%s", path);
   *write_access = write;
+  /* `mkdir -p` walks every existing ancestor and calls mkdir on each one.
+   * Creating an already-existing workspace ancestor is a kernel no-op, not an
+   * out-of-workspace write. */
+  if (write && existed && (nr == SYS_mkdir || nr == SYS_mkdirat) && is_exact_policy_path(path)) return 1;
   /* bwrap writes the user-namespace uid/gid maps under /proc before it execs
    * the target. Nothing the target runs may write under /proc. */
   if (write && g_current_pid > 0 && is_bwrap(g_current_pid) && starts_with_seg(path, "/proc")) return 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-eval-guard",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "type": "module",
   "description": "Evaluation guard for DSH: workspace-only filesystem, no network/subagents, wall-clock limits, and task installation for the meow-ai-arena tank task.",
   "license": "MIT",