dsh-foreman-node 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -1,3 +1,43 @@
+## 0.2.2 — 2026-11-08
+
+### 新增：任务运行的权限预设可以配置了
+
+以前设备上的 job 会话固定用 `workspace-write`。它把改动限制在声明的工作区里，但**越界时会弹审批**——
+而那台机器前面没有人，弹审批等于让任务卡住。
+
+现在可以在设备配置里指定 `jobPreset`：
+
+```yaml
+jobPreset: workspace-write-never-ask
+```
+
+推荐做法：在 DSH 里加一个 `workspace-write + never` 的预设，把它填在这里。**边界照旧限制在工作区内**，
+只是不再停下来问人。
+
+不填仍是 `workspace-write`（保持原有行为）。这个选择属于那台机器的操作者，因为风险落在他们的机器上。
+
+## 0.2.1 — 2026-11-08
+
+### 修复：任务跑完了，却没有回报给 hub
+
+真机上一次派单：设备做了 30 步、37 次工具调用、写了 2808 字的完整答案，**一次都没调用 `foreman_report`**。
+hub 因此一直停在 `running`，面板上那张工单永远不结束，人也收不到结果。
+
+两个原因，都修了：
+
+1. **任务文本里没有说要回报。** 设备收到的只有标题、请求原文和附件说明，模型自然当成普通任务，
+   做完就结束。现在每张派单的末尾都有一段说明：`foreman_report` 是这个任务到达人的唯一途径，
+   答在对话里不算完成。
+2. **只靠模型自觉不可靠。** 加了一层兜底：一轮结束而还没有回报时，插件自动补一条 `ready`，
+   摘要取会话里最后一段模型输出。工具被正确调用过就不会重复补。
+
+兜底是真的兜底——任何一轮正常结束都会触发它，所以即使模型完全无视那段说明，任务也不会挂死。
+
+### 加固
+
+- 会话事件监听注册失败时（宿主不提供 `ctx.effect`），仍然会挂上回报工具：
+  没有回报通道比“看不见轮次结束”严重得多。
+
 ## 0.2.0 — 2026-11-07
 
 ### 新增：配置页，设备绑定不用再碰命令行

package/lib/client.js

@@ -58,6 +58,7 @@ window.__ModuleLoader__.load({
 				roots: valueOf(source["roots"], []),
 				heartbeatMs: valueOf(source["heartbeatMs"], 15e3),
 				reconnectMs: valueOf(source["reconnectMs"], 1e3),
+				jobPreset: valueOf(source["jobPreset"], "workspace-write"),
 				ssh: {
 					...SSH_DEFAULTS,
 					...unwrapSsh(source["ssh"])

package/lib/index.d.ts

@@ -53,6 +53,14 @@ interface NodeConfig {
   reconnectMs: number;
   /** How to reach a hub that is not directly reachable. */
   ssh: SshConfig;
+  /**
+   * The permission preset a job runs under.
+   *
+   * Defaults to `workspace-write`, which is bounded to the declared directory but asks before leaving it. A device has
+   * nobody sitting in front of it, so a question that stops the job is worse than it looks: the work simply hangs.
+   * Configure a preset that keeps the boundary and never asks — that is the operator's call, on their own machine.
+   */
+  jobPreset: string;
 }
 /** The SSH defaults, spread over whatever the host hands in, so a partial block is still complete. */
 declare const SSH_DEFAULTS: SshConfig;
@@ -340,11 +348,19 @@ interface EnsureInput {
  */
 declare class JobSessions {
   private readonly ctx;
+  private readonly preset;
   /** Jobs by assignment id, so `running()` reports what this device actually holds rather than what it was told. */
   private readonly jobs;
   /** Assignments whose Session already carries the report tool, so a redelivered assign registers it only once. */
   private readonly reported;
-  constructor(ctx: Context);
+  /** Assignments that have actually reported; a turn ending without one is closed out by `watchTurnEnd`. */
+  private readonly reports;
+  /**
+   * @param preset the permission preset a job runs under. The device operator chooses it in their own configuration:
+   *   a machine with nobody in front of it cannot answer an approval prompt, so the useful choice is usually a preset
+   *   that keeps the workspace boundary and never asks.
+   */
+  constructor(ctx: Context, preset?: string);
   /**
    * Resolve or create the `job-<assignmentId>` Session in the given directory, attach its `foreman_report` tool, and
    * register it so a heartbeat counts it.
@@ -372,6 +388,17 @@ declare class JobSessions {
   forget(assignmentId: string): void;
   /** Attach the `foreman_report` tool to a job Session, disposed with it. */
   reportTools(agent: Agent, assignmentId: string, onReport: (assignmentId: string, report: DeviceReport) => void): void;
+  /**
+   * Report for a job that ended without calling the tool.
+   *
+   * Telling the model to report is not a guarantee: on a real deployment a device did the work, wrote a complete
+   * answer, and never called `foreman_report`, so the hub waited at `running` forever. The tool alone leaves that
+   * failure open, so a turn that ends with no report is closed out here — `ready`, with the last thing the model said
+   * as the summary. A person still gets the result; the ledger still learns the job ended.
+   */
+  private watchTurnEnd;
+  /** The last text the assistant said in a Session, read from its stored history. */
+  private lastText;
 }
 /** Version reported in the hello, so the hub can tell which device build is talking. */
 declare const VERSION = "0.2.0";

package/lib/index.js

@@ -244,6 +244,7 @@ function configured(config) {
 		roots: valueOf(source["roots"], []),
 		heartbeatMs: valueOf(source["heartbeatMs"], 15e3),
 		reconnectMs: valueOf(source["reconnectMs"], 1e3),
+		jobPreset: valueOf(source["jobPreset"], "workspace-write"),
 		ssh: {
 			...SSH_DEFAULTS,
 			...unwrapSsh(source["ssh"])
@@ -858,7 +859,14 @@ function _usingCtx() {
 	};
 }
 // src/session.ts
-/** The permission preset a job runs under: bounded to the directory the device declared. */
+/**
+* The permission preset a job runs under when the device's configuration names none.
+*
+* Bounded to the directory the device declared. A job on a machine with nobody in front of it cannot answer an
+* approval prompt, so the useful alternative is not a wider sandbox but a quiet one: a preset that keeps this
+* boundary and never asks. That is the device operator's decision, taken in their own configuration, because it is
+* their machine and their risk.
+*/
 const JOB_PRESET = "workspace-write";
 /** The Session a job runs in, named the way a hub names its own worker: `job-<assignmentId>`. */
 const jobSessionId = (assignmentId) => `job-${assignmentId}`;
@@ -873,12 +881,21 @@ const requestMessage = (requestId) => MessageId(`dsh-foreman-node:${requestId}`)
 */
 var JobSessions = class {
 	ctx;
+	preset;
 	/** Jobs by assignment id, so `running()` reports what this device actually holds rather than what it was told. */
 	jobs = /* @__PURE__ */ new Map();
 	/** Assignments whose Session already carries the report tool, so a redelivered assign registers it only once. */
 	reported = /* @__PURE__ */ new Set();
-	constructor(ctx) {
+	/** Assignments that have actually reported; a turn ending without one is closed out by `watchTurnEnd`. */
+	reports = /* @__PURE__ */ new Set();
+	/**
+	* @param preset the permission preset a job runs under. The device operator chooses it in their own configuration:
+	*   a machine with nobody in front of it cannot answer an approval prompt, so the useful choice is usually a preset
+	*   that keeps the workspace boundary and never asks.
+	*/
+	constructor(ctx, preset = JOB_PRESET) {
 		this.ctx = ctx;
+		this.preset = preset;
 	}
 	/**
 	* Resolve or create the `job-<assignmentId>` Session in the given directory, attach its `foreman_report` tool, and
@@ -904,7 +921,7 @@ var JobSessions = class {
 		}
 		if ("error" in result) throw result.error;
 		await workspace.attachSession(id);
-		this.ctx.permissionPresets.set(result.agent.session, JOB_PRESET);
+		this.ctx.permissionPresets.set(result.agent.session, this.preset);
 		await this.ctx.sessionController.rename({
 			sessionId: id,
 			title: input.title
@@ -982,7 +999,12 @@ var JobSessions = class {
 	/** Attach the `foreman_report` tool to a job Session, disposed with it. */
 	reportTools(agent, assignmentId, onReport) {
 		const registrar = agent.ctx.tools;
-		const tool = foremanReportTool({ report: onReport }, assignmentId);
+		const reported = this.reports;
+		const report = (id, deviceReport) => {
+			reported.add(id);
+			onReport(id, deviceReport);
+		};
+		const tool = foremanReportTool({ report }, assignmentId);
 		registrar.register({
 			name: tool.name,
 			description: tool.description,
@@ -999,6 +1021,62 @@ var JobSessions = class {
 			},
 			execute: (args, execution) => tool.execute(args, execution)
 		});
+		this.watchTurnEnd(agent, assignmentId, report);
+	}
+	/**
+	* Report for a job that ended without calling the tool.
+	*
+	* Telling the model to report is not a guarantee: on a real deployment a device did the work, wrote a complete
+	* answer, and never called `foreman_report`, so the hub waited at `running` forever. The tool alone leaves that
+	* failure open, so a turn that ends with no report is closed out here — `ready`, with the last thing the model said
+	* as the summary. A person still gets the result; the ledger still learns the job ended.
+	*/
+	watchTurnEnd(agent, assignmentId, report) {
+		if (typeof agent.ctx.effect !== "function") return;
+		agent.ctx.effect(() => {
+			agent.ctx.on("session/event", (session, event) => {
+				if (session.id !== agent.session.id || event.type !== "turn/end") return;
+				if (this.reports.has(assignmentId)) return;
+				this.lastText(agent).then((text) => {
+					if (this.reports.has(assignmentId)) return;
+					report(assignmentId, {
+						state: "ready",
+						summary: text === "" ? "the job finished without a report" : text.slice(0, 600)
+					});
+				}, () => {
+					if (this.reports.has(assignmentId)) return;
+					report(assignmentId, {
+						state: "ready",
+						summary: "the job finished without a report"
+					});
+				});
+			});
+			return () => {};
+		});
+	}
+	/** The last text the assistant said in a Session, read from its stored history. */
+	async lastText(agent) {
+		try {
+			var _usingCtx3 = _usingCtx();
+			await this.ctx.sessionPersistence.flush();
+			const handle = _usingCtx3.a(await this.ctx.sessionPersistence.open(agent.id, "read"));
+			let found = "";
+			for (let offset = 0;;) {
+				const { events } = await handle.read(offset, 512);
+				if (events.length === 0) break;
+				for (const event of events) {
+					if (event.type !== "assistant/message") continue;
+					const text = (event.data?.message?.content ?? []).filter((part) => part?.type === "text").map((part) => part.text ?? "").join(" ").trim();
+					if (text !== "") found = text;
+				}
+				offset += events.length;
+			}
+			return found;
+		} catch (_) {
+			_usingCtx3.e = _;
+		} finally {
+			await _usingCtx3.d();
+		}
 	}
 };
 // src/index.ts
@@ -1037,7 +1115,8 @@ const Typed = s.object({
 		keyPath: "",
 		remotePort: 8790,
 		localPort: 8790
-	}).description("How to reach the hub when it is not directly reachable: a tunnel this device opens and keeps open.")
+	}).description("How to reach the hub when it is not directly reachable: a tunnel this device opens and keeps open."),
+	jobPreset: s.string().default("workspace-write").volatile().description("The permission preset a job runs under. Use one that keeps the workspace boundary and never asks, because nobody is at this machine to answer.")
 });
 /**
 * What this configuration still needs before the device can dial its hub, or undefined when it is complete.
@@ -1098,7 +1177,7 @@ async function apply(ctx, raw) {
 		ctx.logger.info("%s", missing);
 		return;
 	}
-	const jobs = new JobSessions(ctx);
+	const jobs = new JobSessions(ctx, config.jobPreset);
 	const client = new NodeClient({
 		url: hubUrlOf(config),
 		deviceId: config.deviceId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-foreman-node",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Device side of dsh-foreman: connects out to a foreman hub, takes a job into a local DSH session, reports back. No ledger, no policy, no database.",
   "type": "module",
   "main": "lib/index.js",

package/src/client/index.tsx

@@ -1,211 +1,211 @@
-/**
- * The device's configuration page, mounted in the DSH Plugin Manager.
- *
- * It does two things the page alone cannot: it lists the keys this machine has (through the device's own route, because
- * a browser cannot read `~/.ssh`) and it tests one authentication (also through the device, because a browser cannot
- * start ssh). Everything it *writes* goes through DSH's own configuration form, so the saved values land in the
- * profile's patch exactly as if they had been typed there by hand.
- */
-import { useEffect, useState } from 'react'
-import type { Context } from '@deepseek-ai/cordis'
-import type {} from '@deepseek-ai/dsh-client-locale/client'
-import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
-import type { ConfigPageForm, PluginConfigViewProps } from '@deepseek-ai/dsh-client-ui-plugin-manager/client'
-import { configured, type NodeConfig } from '../config.ts'
-import type { SshKey } from '../keys.ts'
-import type { TestResult } from '../routes.ts'
-import { addressPreview, DEFAULT_SSH, editsOf, emptyFields, keyLabel, testMessage } from './page-state.ts'
-import { en, zh } from './locales.ts'
-
-/** The prefix the device's own routes answer under. */
-const API = '/foreman-node/api'
-
-/** A key list answer, as `GET /foreman-node/api/keys` sends it. */
-interface KeysAnswer { keys: SshKey[]; directory: string }
-
-/** Fetches a key list or runs one test; both need the marker header the device's same-origin check looks for. */
-async function ask<T>(path: string, init?: RequestInit): Promise<T> {
-  const response = await fetch(new URL(`${API}/${path}`, window.location.href), {
-    ...init, headers: { 'x-orchestrator-request': '1', ...(init?.body === undefined ? {} : { 'content-type': 'application/json' }), ...init?.headers } })
-  if (!response.ok) throw new Error(`the device answered ${response.status}`)
-  return await response.json() as T
-}
-
-export const inject = ['locale', 'slots']
-export const name = 'dsh-foreman-node'
-
-/** The locale namespace this page registers its dictionaries under. */
-const NS = 'dshNode'
-
-/**
- * The page itself. `t` comes from the host's locale service, like every other plugin's page.
- *
- * `initialKeys` and `keysFailed` exist so a test can render a page without a network or a web server. Production never
- * passes them, so the page fetches as it otherwise would — they change nothing about how it behaves.
- */
-function DevicePage({ form, t, initialKeys, keysFailed: prefailed }: {
-  t: (key: keyof typeof zh) => string
-  form: ConfigPageForm | undefined
-  initialKeys?: readonly SshKey[]
-  keysFailed?: boolean
-}) {
-  // The draft starts from the saved value when there is one, so the first render already shows the configuration
-  // rather than a loading line that only an effect would replace.
-  // The host hands over the section's raw value; every field is volatile, so it is unwrapped once here.
-  const saved = form?.state.value === undefined ? undefined : configured(form.state.value as Partial<NodeConfig>)
-  const editable = form?.state.status === 'ready' && form.state.writable
-  // The draft starts from the saved value when there is one, so the first render already shows the configuration
-  // rather than a loading line that only an effect would replace.
-  const [draft, setDraft] = useState<NodeConfig | undefined>(() =>
-    saved === undefined ? undefined : { ...saved, token: '', ssh: { ...DEFAULT_SSH, ...saved.ssh } })
-  // The stored token never reaches the page (it is a secret), so the box starts empty and is only written when
-  // someone types one. `keepsToken` is what tells the page it does not have to ask.
-  // A stored token cannot be detected: it is stripped before it reaches the page, so `saved.token` is always
-  // undefined. What can be known is that the section already exists, which is what the hint is based on.
-  const keepsToken = saved !== undefined
-  const [keys, setKeys] = useState<SshKey[] | undefined>(initialKeys === undefined ? undefined : [...initialKeys])
-  const [keysFailed, setKeysFailed] = useState(prefailed === true)
-  const [tested, setTested] = useState<TestResult>()
-  const [testing, setTesting] = useState(false)
-  const [notice, setNotice] = useState<string>()
-
-  // The form's value is the saved truth; the draft is what a person is editing on top of it, so it is only adopted
-  // when nothing has been typed yet — a form that reloads must not overwrite a half-finished edit.
-  useEffect(() => { if (saved !== undefined) setDraft(current => current ?? { ...saved, ssh: { ...DEFAULT_SSH, ...saved.ssh } }) }, [saved])
-  useEffect(() => {
-    if (initialKeys !== undefined || prefailed === true) return
-    ask<KeysAnswer>('keys').then(answer => setKeys(answer.keys), () => setKeysFailed(true))
-  }, [initialKeys, prefailed])
-
-  const patch = (change: Partial<NodeConfig>) => setDraft(current => current === undefined ? current : { ...current, ...change })
-  const patchSsh = (change: Partial<NodeConfig['ssh']>) =>
-    setDraft(current => current === undefined ? current : { ...current, ssh: { ...current.ssh, ...change } })
-
-  const test = async () => {
-    if (draft === undefined) return
-    setTesting(true); setTested(undefined)
-    try {
-      setTested(await ask<TestResult>('test', { method: 'POST', body: JSON.stringify({ host: draft.ssh.host.trim(),
-        port: draft.ssh.port, user: draft.ssh.user.trim(), keyPath: draft.ssh.keyPath.trim() }) }))
-    } catch (error) { setTested({ ok: false, output: String(error) }) } finally { setTesting(false) }
-  }
-
-  const save = async () => {
-    if (draft === undefined || form === undefined) return
-    setNotice(undefined)
-    try {
-      const ok = await form.mutate(editsOf(draft), form.state.revision)
-      setNotice(ok ? t('saved') : t('saveFailed'))
-    } catch { setNotice(t('saveFailed')) }
-  }
-
-  if (draft === undefined) return <div data-foreman-node-page="loading">{t('loading')}</div>
-  const address = addressPreview(draft)
-  const missing = emptyFields(draft, keepsToken)
-  return <div data-foreman-node-page="ready">
-    <h2>{t('title')}</h2>
-    <p className="dt-hint">{t('intro')}</p>
-
-    <section data-section="keys">
-      <h3>{t('keysSection')}</h3>
-      <p className="dt-hint">{t('keysHint')}</p>
-      {keysFailed
-        ? <p data-keys="unavailable">{t('keysUnavailable')}</p>
-        : keys === undefined ? <p>{t('loading')}</p>
-          : keys.length === 0 ? <p data-keys="empty">{t('keysEmpty')}</p>
-            : <select aria-label={t('keysSection')} data-node-key value={draft.ssh.keyPath}
-                onChange={event => patchSsh({ keyPath: event.target.value })}>
-                <option value="">—</option>
-                {keys.map(key => <option key={key.path} value={key.path}>{keyLabel(key)}</option>)}
-              </select>}
-      <label>{t('keyPath')}
-        <input data-node-key-path value={draft.ssh.keyPath} disabled={!editable}
-          onChange={event => patchSsh({ keyPath: event.target.value })} />
-      </label>
-    </section>
-
-    <section data-section="ssh">
-      <h3>{t('sshSection')}</h3>
-      <label><input type="checkbox" data-node-ssh-enabled checked={draft.ssh.enabled} disabled={!editable}
-        onChange={event => patchSsh({ enabled: event.target.checked })} />{t('sshEnabled')}</label>
-      <p className="dt-hint">{t('sshEnabledHint')}</p>
-      {draft.ssh.enabled && <>
-        <label>{t('host')}<input data-node-host value={draft.ssh.host} disabled={!editable}
-          onChange={event => patchSsh({ host: event.target.value })} /></label>
-        <label>{t('port')}<input type="number" data-node-port value={draft.ssh.port} disabled={!editable}
-          onChange={event => patchSsh({ port: Number(event.target.value) || DEFAULT_SSH.port })} /></label>
-        <label>{t('user')}<input data-node-user value={draft.ssh.user} disabled={!editable}
-          onChange={event => patchSsh({ user: event.target.value })} /></label>
-        <label>{t('remotePort')}<input type="number" data-node-remote-port value={draft.ssh.remotePort} disabled={!editable}
-          onChange={event => patchSsh({ remotePort: Number(event.target.value) || DEFAULT_SSH.remotePort })} /></label>
-        <label>{t('localPort')}<input type="number" data-node-local-port value={draft.ssh.localPort} disabled={!editable}
-          onChange={event => patchSsh({ localPort: Number(event.target.value) || DEFAULT_SSH.localPort })} /></label>
-        <button type="button" data-node-test data-testing={testing ? 'true' : undefined}
-          disabled={!draft.ssh.host.trim() || !draft.ssh.user.trim() || !draft.ssh.keyPath.trim()}
-          onClick={() => { void test() }}>{testing ? t('testing') : t('test')}</button>
-        {tested !== undefined && <p data-test-result={testMessage(tested)}>
-          {tested.ok ? t('testOk')
-            : testMessage(tested) === 'passphrase' ? t('testPassphrase')
-              : testMessage(tested) === 'unresolved' ? t('testUnresolved')
-                : testMessage(tested) === 'timeout' ? t('testTimeout')
-                  : `${t('testRefused')} ${tested.output}`}
-        </p>}
-      </>}
-    </section>
-
-    <section data-section="hub">
-      <h3>{t('hubSection')}</h3>
-      <label>{t('address')}
-        <input data-node-url value={address.address} readOnly={address.derived} disabled={!editable || address.derived}
-          onChange={event => patch({ url: event.target.value })} />
-      </label>
-      {address.derived && <p className="dt-hint">{t('addressDerived')}</p>}
-      <label>{t('deviceId')}<input data-node-device value={draft.deviceId} disabled={!editable}
-        onChange={event => patch({ deviceId: event.target.value })} /></label>
-      <label>{t('token')}<input type="password" data-node-token value={draft.token} disabled={!editable}
-        autoComplete="new-password" placeholder={keepsToken ? t('tokenStored') : ''}
-        onChange={event => patch({ token: event.target.value })} /></label>
-      <p className="dt-hint">{keepsToken ? t('tokenKeep') : t('tokenHint')}</p>
-    </section>
-
-    <section data-section="roots">
-      <h3>{t('rootsSection')}</h3>
-      <p className="dt-hint">{t('rootsHint')}</p>
-      {draft.roots.map((root, index) => <div key={index} data-root={index}>
-        <label>{t('project')}<input value={root.project} disabled={!editable}
-          onChange={event => patch({ roots: draft.roots.map((item, at) => at === index ? { ...item, project: event.target.value } : item) })} /></label>
-        <label>{t('path')}<input value={root.path} disabled={!editable}
-          onChange={event => patch({ roots: draft.roots.map((item, at) => at === index ? { ...item, path: event.target.value } : item) })} /></label>
-      </div>)}
-      <button type="button" disabled={!editable}
-        onClick={() => patch({ roots: [...draft.roots, { project: '', path: '' }] })}>{t('addRoot')}</button>
-    </section>
-
-    {missing.length > 0 && <p data-missing="true">{t('missing')}{missing.join(', ')}</p>}
-    {editable
-      ? <button type="button" data-node-save onClick={() => { void save() }}>{t('save')}</button>
-      : <p data-read-only="true">{t('readOnly')}</p>}
-    {notice !== undefined && <p data-notice>{notice}</p>}
-  </div>
-}
-
-/** The page as the Plugin Manager mounts it: locale and form come from the host. */
-interface PageProps extends PluginConfigViewProps {
-  t: (key: keyof typeof zh) => string
-}
-
-function Mounted({ t, view, form = undefined }: PageProps) {
-  // A summary row gets nothing: the full page belongs to the page view, and DSH's own config form shows the summary.
-  return view === 'summary' ? null : <DevicePage t={t} form={form} />
-}
-
-/** Registers the page for the `dsh-foreman-node` row. */
-export function apply(ctx: Context): void {
-  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-foreman-node: dictionaries')
-  const t = ctx.locale.bind(NS) as unknown as (key: keyof typeof zh) => string
-  ctx.slots.inject('plugins.row.config', () => ctx.slots.register({
-    name: 'plugins.row.config', key: 'dsh-foreman-node#dsh-foreman-node', locale: NS },
-  (props: PluginConfigViewProps) => <Mounted {...props} t={(props as { t?: typeof t }).t ?? t} />))
-}
-
-export { DevicePage }
+/**
+ * The device's configuration page, mounted in the DSH Plugin Manager.
+ *
+ * It does two things the page alone cannot: it lists the keys this machine has (through the device's own route, because
+ * a browser cannot read `~/.ssh`) and it tests one authentication (also through the device, because a browser cannot
+ * start ssh). Everything it *writes* goes through DSH's own configuration form, so the saved values land in the
+ * profile's patch exactly as if they had been typed there by hand.
+ */
+import { useEffect, useState } from 'react'
+import type { Context } from '@deepseek-ai/cordis'
+import type {} from '@deepseek-ai/dsh-client-locale/client'
+import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
+import type { ConfigPageForm, PluginConfigViewProps } from '@deepseek-ai/dsh-client-ui-plugin-manager/client'
+import { configured, type NodeConfig } from '../config.ts'
+import type { SshKey } from '../keys.ts'
+import type { TestResult } from '../routes.ts'
+import { addressPreview, DEFAULT_SSH, editsOf, emptyFields, keyLabel, testMessage } from './page-state.ts'
+import { en, zh } from './locales.ts'
+
+/** The prefix the device's own routes answer under. */
+const API = '/foreman-node/api'
+
+/** A key list answer, as `GET /foreman-node/api/keys` sends it. */
+interface KeysAnswer { keys: SshKey[]; directory: string }
+
+/** Fetches a key list or runs one test; both need the marker header the device's same-origin check looks for. */
+async function ask<T>(path: string, init?: RequestInit): Promise<T> {
+  const response = await fetch(new URL(`${API}/${path}`, window.location.href), {
+    ...init, headers: { 'x-orchestrator-request': '1', ...(init?.body === undefined ? {} : { 'content-type': 'application/json' }), ...init?.headers } })
+  if (!response.ok) throw new Error(`the device answered ${response.status}`)
+  return await response.json() as T
+}
+
+export const inject = ['locale', 'slots']
+export const name = 'dsh-foreman-node'
+
+/** The locale namespace this page registers its dictionaries under. */
+const NS = 'dshNode'
+
+/**
+ * The page itself. `t` comes from the host's locale service, like every other plugin's page.
+ *
+ * `initialKeys` and `keysFailed` exist so a test can render a page without a network or a web server. Production never
+ * passes them, so the page fetches as it otherwise would — they change nothing about how it behaves.
+ */
+function DevicePage({ form, t, initialKeys, keysFailed: prefailed }: {
+  t: (key: keyof typeof zh) => string
+  form: ConfigPageForm | undefined
+  initialKeys?: readonly SshKey[]
+  keysFailed?: boolean
+}) {
+  // The draft starts from the saved value when there is one, so the first render already shows the configuration
+  // rather than a loading line that only an effect would replace.
+  // The host hands over the section's raw value; every field is volatile, so it is unwrapped once here.
+  const saved = form?.state.value === undefined ? undefined : configured(form.state.value as Partial<NodeConfig>)
+  const editable = form?.state.status === 'ready' && form.state.writable
+  // The draft starts from the saved value when there is one, so the first render already shows the configuration
+  // rather than a loading line that only an effect would replace.
+  const [draft, setDraft] = useState<NodeConfig | undefined>(() =>
+    saved === undefined ? undefined : { ...saved, token: '', ssh: { ...DEFAULT_SSH, ...saved.ssh } })
+  // The stored token never reaches the page (it is a secret), so the box starts empty and is only written when
+  // someone types one. `keepsToken` is what tells the page it does not have to ask.
+  // A stored token cannot be detected: it is stripped before it reaches the page, so `saved.token` is always
+  // undefined. What can be known is that the section already exists, which is what the hint is based on.
+  const keepsToken = saved !== undefined
+  const [keys, setKeys] = useState<SshKey[] | undefined>(initialKeys === undefined ? undefined : [...initialKeys])
+  const [keysFailed, setKeysFailed] = useState(prefailed === true)
+  const [tested, setTested] = useState<TestResult>()
+  const [testing, setTesting] = useState(false)
+  const [notice, setNotice] = useState<string>()
+
+  // The form's value is the saved truth; the draft is what a person is editing on top of it, so it is only adopted
+  // when nothing has been typed yet — a form that reloads must not overwrite a half-finished edit.
+  useEffect(() => { if (saved !== undefined) setDraft(current => current ?? { ...saved, ssh: { ...DEFAULT_SSH, ...saved.ssh } }) }, [saved])
+  useEffect(() => {
+    if (initialKeys !== undefined || prefailed === true) return
+    ask<KeysAnswer>('keys').then(answer => setKeys(answer.keys), () => setKeysFailed(true))
+  }, [initialKeys, prefailed])
+
+  const patch = (change: Partial<NodeConfig>) => setDraft(current => current === undefined ? current : { ...current, ...change })
+  const patchSsh = (change: Partial<NodeConfig['ssh']>) =>
+    setDraft(current => current === undefined ? current : { ...current, ssh: { ...current.ssh, ...change } })
+
+  const test = async () => {
+    if (draft === undefined) return
+    setTesting(true); setTested(undefined)
+    try {
+      setTested(await ask<TestResult>('test', { method: 'POST', body: JSON.stringify({ host: draft.ssh.host.trim(),
+        port: draft.ssh.port, user: draft.ssh.user.trim(), keyPath: draft.ssh.keyPath.trim() }) }))
+    } catch (error) { setTested({ ok: false, output: String(error) }) } finally { setTesting(false) }
+  }
+
+  const save = async () => {
+    if (draft === undefined || form === undefined) return
+    setNotice(undefined)
+    try {
+      const ok = await form.mutate(editsOf(draft), form.state.revision)
+      setNotice(ok ? t('saved') : t('saveFailed'))
+    } catch { setNotice(t('saveFailed')) }
+  }
+
+  if (draft === undefined) return <div data-foreman-node-page="loading">{t('loading')}</div>
+  const address = addressPreview(draft)
+  const missing = emptyFields(draft, keepsToken)
+  return <div data-foreman-node-page="ready">
+    <h2>{t('title')}</h2>
+    <p className="dt-hint">{t('intro')}</p>
+
+    <section data-section="keys">
+      <h3>{t('keysSection')}</h3>
+      <p className="dt-hint">{t('keysHint')}</p>
+      {keysFailed
+        ? <p data-keys="unavailable">{t('keysUnavailable')}</p>
+        : keys === undefined ? <p>{t('loading')}</p>
+          : keys.length === 0 ? <p data-keys="empty">{t('keysEmpty')}</p>
+            : <select aria-label={t('keysSection')} data-node-key value={draft.ssh.keyPath}
+                onChange={event => patchSsh({ keyPath: event.target.value })}>
+                <option value="">—</option>
+                {keys.map(key => <option key={key.path} value={key.path}>{keyLabel(key)}</option>)}
+              </select>}
+      <label>{t('keyPath')}
+        <input data-node-key-path value={draft.ssh.keyPath} disabled={!editable}
+          onChange={event => patchSsh({ keyPath: event.target.value })} />
+      </label>
+    </section>
+
+    <section data-section="ssh">
+      <h3>{t('sshSection')}</h3>
+      <label><input type="checkbox" data-node-ssh-enabled checked={draft.ssh.enabled} disabled={!editable}
+        onChange={event => patchSsh({ enabled: event.target.checked })} />{t('sshEnabled')}</label>
+      <p className="dt-hint">{t('sshEnabledHint')}</p>
+      {draft.ssh.enabled && <>
+        <label>{t('host')}<input data-node-host value={draft.ssh.host} disabled={!editable}
+          onChange={event => patchSsh({ host: event.target.value })} /></label>
+        <label>{t('port')}<input type="number" data-node-port value={draft.ssh.port} disabled={!editable}
+          onChange={event => patchSsh({ port: Number(event.target.value) || DEFAULT_SSH.port })} /></label>
+        <label>{t('user')}<input data-node-user value={draft.ssh.user} disabled={!editable}
+          onChange={event => patchSsh({ user: event.target.value })} /></label>
+        <label>{t('remotePort')}<input type="number" data-node-remote-port value={draft.ssh.remotePort} disabled={!editable}
+          onChange={event => patchSsh({ remotePort: Number(event.target.value) || DEFAULT_SSH.remotePort })} /></label>
+        <label>{t('localPort')}<input type="number" data-node-local-port value={draft.ssh.localPort} disabled={!editable}
+          onChange={event => patchSsh({ localPort: Number(event.target.value) || DEFAULT_SSH.localPort })} /></label>
+        <button type="button" data-node-test data-testing={testing ? 'true' : undefined}
+          disabled={!draft.ssh.host.trim() || !draft.ssh.user.trim() || !draft.ssh.keyPath.trim()}
+          onClick={() => { void test() }}>{testing ? t('testing') : t('test')}</button>
+        {tested !== undefined && <p data-test-result={testMessage(tested)}>
+          {tested.ok ? t('testOk')
+            : testMessage(tested) === 'passphrase' ? t('testPassphrase')
+              : testMessage(tested) === 'unresolved' ? t('testUnresolved')
+                : testMessage(tested) === 'timeout' ? t('testTimeout')
+                  : `${t('testRefused')} ${tested.output}`}
+        </p>}
+      </>}
+    </section>
+
+    <section data-section="hub">
+      <h3>{t('hubSection')}</h3>
+      <label>{t('address')}
+        <input data-node-url value={address.address} readOnly={address.derived} disabled={!editable || address.derived}
+          onChange={event => patch({ url: event.target.value })} />
+      </label>
+      {address.derived && <p className="dt-hint">{t('addressDerived')}</p>}
+      <label>{t('deviceId')}<input data-node-device value={draft.deviceId} disabled={!editable}
+        onChange={event => patch({ deviceId: event.target.value })} /></label>
+      <label>{t('token')}<input type="password" data-node-token value={draft.token} disabled={!editable}
+        autoComplete="new-password" placeholder={keepsToken ? t('tokenStored') : ''}
+        onChange={event => patch({ token: event.target.value })} /></label>
+      <p className="dt-hint">{keepsToken ? t('tokenKeep') : t('tokenHint')}</p>
+    </section>
+
+    <section data-section="roots">
+      <h3>{t('rootsSection')}</h3>
+      <p className="dt-hint">{t('rootsHint')}</p>
+      {draft.roots.map((root, index) => <div key={index} data-root={index}>
+        <label>{t('project')}<input value={root.project} disabled={!editable}
+          onChange={event => patch({ roots: draft.roots.map((item, at) => at === index ? { ...item, project: event.target.value } : item) })} /></label>
+        <label>{t('path')}<input value={root.path} disabled={!editable}
+          onChange={event => patch({ roots: draft.roots.map((item, at) => at === index ? { ...item, path: event.target.value } : item) })} /></label>
+      </div>)}
+      <button type="button" disabled={!editable}
+        onClick={() => patch({ roots: [...draft.roots, { project: '', path: '' }] })}>{t('addRoot')}</button>
+    </section>
+
+    {missing.length > 0 && <p data-missing="true">{t('missing')}{missing.join(', ')}</p>}
+    {editable
+      ? <button type="button" data-node-save onClick={() => { void save() }}>{t('save')}</button>
+      : <p data-read-only="true">{t('readOnly')}</p>}
+    {notice !== undefined && <p data-notice>{notice}</p>}
+  </div>
+}
+
+/** The page as the Plugin Manager mounts it: locale and form come from the host. */
+interface PageProps extends PluginConfigViewProps {
+  t: (key: keyof typeof zh) => string
+}
+
+function Mounted({ t, view, form = undefined }: PageProps) {
+  // A summary row gets nothing: the full page belongs to the page view, and DSH's own config form shows the summary.
+  return view === 'summary' ? null : <DevicePage t={t} form={form} />
+}
+
+/** Registers the page for the `dsh-foreman-node` row. */
+export function apply(ctx: Context): void {
+  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-foreman-node: dictionaries')
+  const t = ctx.locale.bind(NS) as unknown as (key: keyof typeof zh) => string
+  ctx.slots.inject('plugins.row.config', () => ctx.slots.register({
+    name: 'plugins.row.config', key: 'dsh-foreman-node#dsh-foreman-node', locale: NS },
+  (props: PluginConfigViewProps) => <Mounted {...props} t={(props as { t?: typeof t }).t ?? t} />))
+}
+
+export { DevicePage }

package/src/config.ts

@@ -49,6 +49,14 @@ export interface NodeConfig {
   reconnectMs: number
   /** How to reach a hub that is not directly reachable. */
   ssh: SshConfig
+  /**
+   * The permission preset a job runs under.
+   *
+   * Defaults to `workspace-write`, which is bounded to the declared directory but asks before leaving it. A device has
+   * nobody sitting in front of it, so a question that stops the job is worse than it looks: the work simply hangs.
+   * Configure a preset that keeps the boundary and never asks — that is the operator's call, on their own machine.
+   */
+  jobPreset: string
 }
 
 /** The SSH defaults, spread over whatever the host hands in, so a partial block is still complete. */
@@ -95,6 +103,7 @@ export function configured(config: object | undefined): NodeConfig {
   return { url: valueOf(source['url'] as string, ''), deviceId: valueOf(source['deviceId'] as string, ''),
     token: valueOf(source['token'] as string, ''), roots: valueOf(source['roots'] as NodeRoot[], []),
     heartbeatMs: valueOf(source['heartbeatMs'] as number, 15_000), reconnectMs: valueOf(source['reconnectMs'] as number, 1_000),
+    jobPreset: valueOf(source['jobPreset'] as string, 'workspace-write'),
     // `ssh` holds volatile fields too, so each one is unwrapped like the top level.
     ssh: { ...SSH_DEFAULTS, ...unwrapSsh(source['ssh']) } }
 }

package/src/index.ts

@@ -59,6 +59,8 @@ const ConfigSchema = s.object({
     localPort: s.natural().min(1).max(65535).default(8790).volatile().description('The local port the tunnel listens on; the device dials this.'),
   }).default({ enabled: false, host: '', port: 22, user: '', keyPath: '', remotePort: 8790, localPort: 8790 })
     .description('How to reach the hub when it is not directly reachable: a tunnel this device opens and keeps open.'),
+  jobPreset: s.string().default('workspace-write').volatile()
+    .description('The permission preset a job runs under. Use one that keeps the workspace boundary and never asks, because nobody is at this machine to answer.'),
 })
 /**
  * Why every field is volatile.
@@ -154,7 +156,7 @@ export async function apply(ctx: Context, raw: ConfigInput): Promise<void> {
     ctx.logger.info('%s', missing)
     return
   }
-  const jobs = new JobSessions(ctx)
+  const jobs = new JobSessions(ctx, config.jobPreset)
   const client = new NodeClient({
     url: hubUrlOf(config),
     deviceId: config.deviceId,

package/src/session.ts

@@ -25,7 +25,14 @@ declare module '@deepseek-ai/dsh-llm' {
   }
 }
 
-/** The permission preset a job runs under: bounded to the directory the device declared. */
+/**
+ * The permission preset a job runs under when the device's configuration names none.
+ *
+ * Bounded to the directory the device declared. A job on a machine with nobody in front of it cannot answer an
+ * approval prompt, so the useful alternative is not a wider sandbox but a quiet one: a preset that keeps this
+ * boundary and never asks. That is the device operator's decision, taken in their own configuration, because it is
+ * their machine and their risk.
+ */
 export const JOB_PRESET = 'workspace-write'
 
 /** The Session a job runs in, named the way a hub names its own worker: `job-<assignmentId>`. */
@@ -60,8 +67,15 @@ export class JobSessions {
   private readonly jobs = new Map<string, string>()
   /** Assignments whose Session already carries the report tool, so a redelivered assign registers it only once. */
   private readonly reported = new Set<string>()
+  /** Assignments that have actually reported; a turn ending without one is closed out by `watchTurnEnd`. */
+  private readonly reports = new Set<string>()
 
-  constructor(private readonly ctx: Context) {}
+  /**
+   * @param preset the permission preset a job runs under. The device operator chooses it in their own configuration:
+   *   a machine with nobody in front of it cannot answer an approval prompt, so the useful choice is usually a preset
+   *   that keeps the workspace boundary and never asks.
+   */
+  constructor(private readonly ctx: Context, private readonly preset: string = JOB_PRESET) {}
 
   /**
    * Resolve or create the `job-<assignmentId>` Session in the given directory, attach its `foreman_report` tool, and
@@ -85,7 +99,7 @@ export class JobSessions {
     if ('error' in result) throw result.error
     await workspace.attachSession(id as SessionId)
     // The one place the device's policy differs from the hub's: bounded, because no person is here to approve more.
-    this.ctx.permissionPresets.set(result.agent.session, JOB_PRESET)
+    this.ctx.permissionPresets.set(result.agent.session, this.preset)
     await this.ctx.sessionController.rename({ sessionId: id as SessionId, title: input.title })
     if (onReport !== undefined && !this.reported.has(input.assignmentId)) {
       this.reported.add(input.assignmentId)
@@ -147,10 +161,64 @@ export class JobSessions {
   /** Attach the `foreman_report` tool to a job Session, disposed with it. */
   reportTools(agent: Agent, assignmentId: string, onReport: (assignmentId: string, report: DeviceReport) => void): void {
     const registrar = agent.ctx.tools
-    const tool = foremanReportTool({ report: onReport }, assignmentId)
+    // Wrap the reporter so this Session's own turn ending can tell whether a report ever went out.
+    const reported = this.reports
+    const report = (id: string, deviceReport: DeviceReport): void => { reported.add(id); onReport(id, deviceReport) }
+    const tool = foremanReportTool({ report }, assignmentId)
     registrar.register({ name: tool.name, description: tool.description, parameters: tool.parameters,
       output: { schema: { type: 'object', additionalProperties: true },
         render: (_args: unknown, value: unknown) => [{ type: 'text' as const, text: JSON.stringify(value) }] },
       execute: (args: unknown, execution: { signal: AbortSignal }) => tool.execute(args as Record<string, unknown>, execution) })
+    this.watchTurnEnd(agent, assignmentId, report)
+  }
+
+  /**
+   * Report for a job that ended without calling the tool.
+   *
+   * Telling the model to report is not a guarantee: on a real deployment a device did the work, wrote a complete
+   * answer, and never called `foreman_report`, so the hub waited at `running` forever. The tool alone leaves that
+   * failure open, so a turn that ends with no report is closed out here — `ready`, with the last thing the model said
+   * as the summary. A person still gets the result; the ledger still learns the job ended.
+   */
+  private watchTurnEnd(agent: Agent, assignmentId: string, report: (id: string, r: DeviceReport) => void): void {
+    // The watcher is a safety net, not part of the tool: a host that cannot register it must still get the tool,
+    // because a job with no reporting channel at all is worse than one whose turn end is not observed.
+    if (typeof agent.ctx.effect !== 'function') return
+    agent.ctx.effect(() => {
+      const dispose = agent.ctx.on('session/event', (session, event) => {
+        if (session.id !== agent.session.id || event.type !== 'turn/end') return
+        if (this.reports.has(assignmentId)) return
+        // Reading the history is best effort: an unreadable history still closes the job out, because leaving the
+        // hub at `running` forever is the worse failure.
+        void this.lastText(agent).then(text => {
+          if (this.reports.has(assignmentId)) return
+          report(assignmentId, { state: 'ready', summary: text === '' ? 'the job finished without a report' : text.slice(0, 600) })
+        }, () => {
+          if (this.reports.has(assignmentId)) return
+          report(assignmentId, { state: 'ready', summary: 'the job finished without a report' })
+        })
+      })
+      return () => { void dispose }
+    })
+  }
+
+  /** The last text the assistant said in a Session, read from its stored history. */
+  private async lastText(agent: Agent): Promise<string> {
+    await this.ctx.sessionPersistence.flush()
+    await using handle = await this.ctx.sessionPersistence.open(agent.id, 'read')
+    let found = ''
+    for (let offset = 0; ;) {
+      const { events } = await handle.read(offset, 512)
+      if (events.length === 0) break
+      for (const event of events) {
+        if (event.type !== 'assistant/message') continue
+        const parts = (event.data as unknown as { message?: { content?: readonly { type?: string; text?: string }[] } })
+          ?.message?.content ?? []
+        const text = parts.filter(part => part?.type === 'text').map(part => part.text ?? '').join(' ').trim()
+        if (text !== '') found = text
+      }
+      offset += events.length
+    }
+    return found
   }
 }