dsh-foreman-node 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+## 0.2.2 — 2026-11-08
+
+### 新增：任务运行的权限预设可以配置了
+
+以前设备上的 job 会话固定用 `workspace-write`。它把改动限制在声明的工作区里，但**越界时会弹审批**——
+而那台机器前面没有人，弹审批等于让任务卡住。
+
+现在可以在设备配置里指定 `jobPreset`：
+
+```yaml
+jobPreset: workspace-write-never-ask
+```
+
+推荐做法：在 DSH 里加一个 `workspace-write + never` 的预设，把它填在这里。**边界照旧限制在工作区内**，
+只是不再停下来问人。
+
+不填仍是 `workspace-write`（保持原有行为）。这个选择属于那台机器的操作者，因为风险落在他们的机器上。
+
 ## 0.2.1 — 2026-11-08
 
 ### 修复：任务跑完了，却没有回报给 hub

package/lib/client.js

@@ -58,6 +58,7 @@ window.__ModuleLoader__.load({
 				roots: valueOf(source["roots"], []),
 				heartbeatMs: valueOf(source["heartbeatMs"], 15e3),
 				reconnectMs: valueOf(source["reconnectMs"], 1e3),
+				jobPreset: valueOf(source["jobPreset"], "workspace-write"),
 				ssh: {
 					...SSH_DEFAULTS,
 					...unwrapSsh(source["ssh"])

package/lib/index.d.ts

@@ -53,6 +53,14 @@ interface NodeConfig {
   reconnectMs: number;
   /** How to reach a hub that is not directly reachable. */
   ssh: SshConfig;
+  /**
+   * The permission preset a job runs under.
+   *
+   * Defaults to `workspace-write`, which is bounded to the declared directory but asks before leaving it. A device has
+   * nobody sitting in front of it, so a question that stops the job is worse than it looks: the work simply hangs.
+   * Configure a preset that keeps the boundary and never asks — that is the operator's call, on their own machine.
+   */
+  jobPreset: string;
 }
 /** The SSH defaults, spread over whatever the host hands in, so a partial block is still complete. */
 declare const SSH_DEFAULTS: SshConfig;
@@ -340,13 +348,19 @@ interface EnsureInput {
  */
 declare class JobSessions {
   private readonly ctx;
+  private readonly preset;
   /** Jobs by assignment id, so `running()` reports what this device actually holds rather than what it was told. */
   private readonly jobs;
   /** Assignments whose Session already carries the report tool, so a redelivered assign registers it only once. */
   private readonly reported;
   /** Assignments that have actually reported; a turn ending without one is closed out by `watchTurnEnd`. */
   private readonly reports;
-  constructor(ctx: Context);
+  /**
+   * @param preset the permission preset a job runs under. The device operator chooses it in their own configuration:
+   *   a machine with nobody in front of it cannot answer an approval prompt, so the useful choice is usually a preset
+   *   that keeps the workspace boundary and never asks.
+   */
+  constructor(ctx: Context, preset?: string);
   /**
    * Resolve or create the `job-<assignmentId>` Session in the given directory, attach its `foreman_report` tool, and
    * register it so a heartbeat counts it.

package/lib/index.js

@@ -244,6 +244,7 @@ function configured(config) {
 		roots: valueOf(source["roots"], []),
 		heartbeatMs: valueOf(source["heartbeatMs"], 15e3),
 		reconnectMs: valueOf(source["reconnectMs"], 1e3),
+		jobPreset: valueOf(source["jobPreset"], "workspace-write"),
 		ssh: {
 			...SSH_DEFAULTS,
 			...unwrapSsh(source["ssh"])
@@ -858,7 +859,14 @@ function _usingCtx() {
 	};
 }
 // src/session.ts
-/** The permission preset a job runs under: bounded to the directory the device declared. */
+/**
+* The permission preset a job runs under when the device's configuration names none.
+*
+* Bounded to the directory the device declared. A job on a machine with nobody in front of it cannot answer an
+* approval prompt, so the useful alternative is not a wider sandbox but a quiet one: a preset that keeps this
+* boundary and never asks. That is the device operator's decision, taken in their own configuration, because it is
+* their machine and their risk.
+*/
 const JOB_PRESET = "workspace-write";
 /** The Session a job runs in, named the way a hub names its own worker: `job-<assignmentId>`. */
 const jobSessionId = (assignmentId) => `job-${assignmentId}`;
@@ -873,14 +881,21 @@ const requestMessage = (requestId) => MessageId(`dsh-foreman-node:${requestId}`)
 */
 var JobSessions = class {
 	ctx;
+	preset;
 	/** Jobs by assignment id, so `running()` reports what this device actually holds rather than what it was told. */
 	jobs = /* @__PURE__ */ new Map();
 	/** Assignments whose Session already carries the report tool, so a redelivered assign registers it only once. */
 	reported = /* @__PURE__ */ new Set();
 	/** Assignments that have actually reported; a turn ending without one is closed out by `watchTurnEnd`. */
 	reports = /* @__PURE__ */ new Set();
-	constructor(ctx) {
+	/**
+	* @param preset the permission preset a job runs under. The device operator chooses it in their own configuration:
+	*   a machine with nobody in front of it cannot answer an approval prompt, so the useful choice is usually a preset
+	*   that keeps the workspace boundary and never asks.
+	*/
+	constructor(ctx, preset = JOB_PRESET) {
 		this.ctx = ctx;
+		this.preset = preset;
 	}
 	/**
 	* Resolve or create the `job-<assignmentId>` Session in the given directory, attach its `foreman_report` tool, and
@@ -906,7 +921,7 @@ var JobSessions = class {
 		}
 		if ("error" in result) throw result.error;
 		await workspace.attachSession(id);
-		this.ctx.permissionPresets.set(result.agent.session, JOB_PRESET);
+		this.ctx.permissionPresets.set(result.agent.session, this.preset);
 		await this.ctx.sessionController.rename({
 			sessionId: id,
 			title: input.title
@@ -1100,7 +1115,8 @@ const Typed = s.object({
 		keyPath: "",
 		remotePort: 8790,
 		localPort: 8790
-	}).description("How to reach the hub when it is not directly reachable: a tunnel this device opens and keeps open.")
+	}).description("How to reach the hub when it is not directly reachable: a tunnel this device opens and keeps open."),
+	jobPreset: s.string().default("workspace-write").volatile().description("The permission preset a job runs under. Use one that keeps the workspace boundary and never asks, because nobody is at this machine to answer.")
 });
 /**
 * What this configuration still needs before the device can dial its hub, or undefined when it is complete.
@@ -1161,7 +1177,7 @@ async function apply(ctx, raw) {
 		ctx.logger.info("%s", missing);
 		return;
 	}
-	const jobs = new JobSessions(ctx);
+	const jobs = new JobSessions(ctx, config.jobPreset);
 	const client = new NodeClient({
 		url: hubUrlOf(config),
 		deviceId: config.deviceId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-foreman-node",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Device side of dsh-foreman: connects out to a foreman hub, takes a job into a local DSH session, reports back. No ledger, no policy, no database.",
   "type": "module",
   "main": "lib/index.js",

package/src/client/index.tsx

@@ -1,211 +1,211 @@
-/**
- * The device's configuration page, mounted in the DSH Plugin Manager.
- *
- * It does two things the page alone cannot: it lists the keys this machine has (through the device's own route, because
- * a browser cannot read `~/.ssh`) and it tests one authentication (also through the device, because a browser cannot
- * start ssh). Everything it *writes* goes through DSH's own configuration form, so the saved values land in the
- * profile's patch exactly as if they had been typed there by hand.
- */
-import { useEffect, useState } from 'react'
-import type { Context } from '@deepseek-ai/cordis'
-import type {} from '@deepseek-ai/dsh-client-locale/client'
-import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
-import type { ConfigPageForm, PluginConfigViewProps } from '@deepseek-ai/dsh-client-ui-plugin-manager/client'
-import { configured, type NodeConfig } from '../config.ts'
-import type { SshKey } from '../keys.ts'
-import type { TestResult } from '../routes.ts'
-import { addressPreview, DEFAULT_SSH, editsOf, emptyFields, keyLabel, testMessage } from './page-state.ts'
-import { en, zh } from './locales.ts'
-
-/** The prefix the device's own routes answer under. */
-const API = '/foreman-node/api'
-
-/** A key list answer, as `GET /foreman-node/api/keys` sends it. */
-interface KeysAnswer { keys: SshKey[]; directory: string }
-
-/** Fetches a key list or runs one test; both need the marker header the device's same-origin check looks for. */
-async function ask<T>(path: string, init?: RequestInit): Promise<T> {
-  const response = await fetch(new URL(`${API}/${path}`, window.location.href), {
-    ...init, headers: { 'x-orchestrator-request': '1', ...(init?.body === undefined ? {} : { 'content-type': 'application/json' }), ...init?.headers } })
-  if (!response.ok) throw new Error(`the device answered ${response.status}`)
-  return await response.json() as T
-}
-
-export const inject = ['locale', 'slots']
-export const name = 'dsh-foreman-node'
-
-/** The locale namespace this page registers its dictionaries under. */
-const NS = 'dshNode'
-
-/**
- * The page itself. `t` comes from the host's locale service, like every other plugin's page.
- *
- * `initialKeys` and `keysFailed` exist so a test can render a page without a network or a web server. Production never
- * passes them, so the page fetches as it otherwise would — they change nothing about how it behaves.
- */
-function DevicePage({ form, t, initialKeys, keysFailed: prefailed }: {
-  t: (key: keyof typeof zh) => string
-  form: ConfigPageForm | undefined
-  initialKeys?: readonly SshKey[]
-  keysFailed?: boolean
-}) {
-  // The draft starts from the saved value when there is one, so the first render already shows the configuration
-  // rather than a loading line that only an effect would replace.
-  // The host hands over the section's raw value; every field is volatile, so it is unwrapped once here.
-  const saved = form?.state.value === undefined ? undefined : configured(form.state.value as Partial<NodeConfig>)
-  const editable = form?.state.status === 'ready' && form.state.writable
-  // The draft starts from the saved value when there is one, so the first render already shows the configuration
-  // rather than a loading line that only an effect would replace.
-  const [draft, setDraft] = useState<NodeConfig | undefined>(() =>
-    saved === undefined ? undefined : { ...saved, token: '', ssh: { ...DEFAULT_SSH, ...saved.ssh } })
-  // The stored token never reaches the page (it is a secret), so the box starts empty and is only written when
-  // someone types one. `keepsToken` is what tells the page it does not have to ask.
-  // A stored token cannot be detected: it is stripped before it reaches the page, so `saved.token` is always
-  // undefined. What can be known is that the section already exists, which is what the hint is based on.
-  const keepsToken = saved !== undefined
-  const [keys, setKeys] = useState<SshKey[] | undefined>(initialKeys === undefined ? undefined : [...initialKeys])
-  const [keysFailed, setKeysFailed] = useState(prefailed === true)
-  const [tested, setTested] = useState<TestResult>()
-  const [testing, setTesting] = useState(false)
-  const [notice, setNotice] = useState<string>()
-
-  // The form's value is the saved truth; the draft is what a person is editing on top of it, so it is only adopted
-  // when nothing has been typed yet — a form that reloads must not overwrite a half-finished edit.
-  useEffect(() => { if (saved !== undefined) setDraft(current => current ?? { ...saved, ssh: { ...DEFAULT_SSH, ...saved.ssh } }) }, [saved])
-  useEffect(() => {
-    if (initialKeys !== undefined || prefailed === true) return
-    ask<KeysAnswer>('keys').then(answer => setKeys(answer.keys), () => setKeysFailed(true))
-  }, [initialKeys, prefailed])
-
-  const patch = (change: Partial<NodeConfig>) => setDraft(current => current === undefined ? current : { ...current, ...change })
-  const patchSsh = (change: Partial<NodeConfig['ssh']>) =>
-    setDraft(current => current === undefined ? current : { ...current, ssh: { ...current.ssh, ...change } })
-
-  const test = async () => {
-    if (draft === undefined) return
-    setTesting(true); setTested(undefined)
-    try {
-      setTested(await ask<TestResult>('test', { method: 'POST', body: JSON.stringify({ host: draft.ssh.host.trim(),
-        port: draft.ssh.port, user: draft.ssh.user.trim(), keyPath: draft.ssh.keyPath.trim() }) }))
-    } catch (error) { setTested({ ok: false, output: String(error) }) } finally { setTesting(false) }
-  }
-
-  const save = async () => {
-    if (draft === undefined || form === undefined) return
-    setNotice(undefined)
-    try {
-      const ok = await form.mutate(editsOf(draft), form.state.revision)
-      setNotice(ok ? t('saved') : t('saveFailed'))
-    } catch { setNotice(t('saveFailed')) }
-  }
-
-  if (draft === undefined) return <div data-foreman-node-page="loading">{t('loading')}</div>
-  const address = addressPreview(draft)
-  const missing = emptyFields(draft, keepsToken)
-  return <div data-foreman-node-page="ready">
-    <h2>{t('title')}</h2>
-    <p className="dt-hint">{t('intro')}</p>
-
-    <section data-section="keys">
-      <h3>{t('keysSection')}</h3>
-      <p className="dt-hint">{t('keysHint')}</p>
-      {keysFailed
-        ? <p data-keys="unavailable">{t('keysUnavailable')}</p>
-        : keys === undefined ? <p>{t('loading')}</p>
-          : keys.length === 0 ? <p data-keys="empty">{t('keysEmpty')}</p>
-            : <select aria-label={t('keysSection')} data-node-key value={draft.ssh.keyPath}
-                onChange={event => patchSsh({ keyPath: event.target.value })}>
-                <option value="">—</option>
-                {keys.map(key => <option key={key.path} value={key.path}>{keyLabel(key)}</option>)}
-              </select>}
-      <label>{t('keyPath')}
-        <input data-node-key-path value={draft.ssh.keyPath} disabled={!editable}
-          onChange={event => patchSsh({ keyPath: event.target.value })} />
-      </label>
-    </section>
-
-    <section data-section="ssh">
-      <h3>{t('sshSection')}</h3>
-      <label><input type="checkbox" data-node-ssh-enabled checked={draft.ssh.enabled} disabled={!editable}
-        onChange={event => patchSsh({ enabled: event.target.checked })} />{t('sshEnabled')}</label>
-      <p className="dt-hint">{t('sshEnabledHint')}</p>
-      {draft.ssh.enabled && <>
-        <label>{t('host')}<input data-node-host value={draft.ssh.host} disabled={!editable}
-          onChange={event => patchSsh({ host: event.target.value })} /></label>
-        <label>{t('port')}<input type="number" data-node-port value={draft.ssh.port} disabled={!editable}
-          onChange={event => patchSsh({ port: Number(event.target.value) || DEFAULT_SSH.port })} /></label>
-        <label>{t('user')}<input data-node-user value={draft.ssh.user} disabled={!editable}
-          onChange={event => patchSsh({ user: event.target.value })} /></label>
-        <label>{t('remotePort')}<input type="number" data-node-remote-port value={draft.ssh.remotePort} disabled={!editable}
-          onChange={event => patchSsh({ remotePort: Number(event.target.value) || DEFAULT_SSH.remotePort })} /></label>
-        <label>{t('localPort')}<input type="number" data-node-local-port value={draft.ssh.localPort} disabled={!editable}
-          onChange={event => patchSsh({ localPort: Number(event.target.value) || DEFAULT_SSH.localPort })} /></label>
-        <button type="button" data-node-test data-testing={testing ? 'true' : undefined}
-          disabled={!draft.ssh.host.trim() || !draft.ssh.user.trim() || !draft.ssh.keyPath.trim()}
-          onClick={() => { void test() }}>{testing ? t('testing') : t('test')}</button>
-        {tested !== undefined && <p data-test-result={testMessage(tested)}>
-          {tested.ok ? t('testOk')
-            : testMessage(tested) === 'passphrase' ? t('testPassphrase')
-              : testMessage(tested) === 'unresolved' ? t('testUnresolved')
-                : testMessage(tested) === 'timeout' ? t('testTimeout')
-                  : `${t('testRefused')} ${tested.output}`}
-        </p>}
-      </>}
-    </section>
-
-    <section data-section="hub">
-      <h3>{t('hubSection')}</h3>
-      <label>{t('address')}
-        <input data-node-url value={address.address} readOnly={address.derived} disabled={!editable || address.derived}
-          onChange={event => patch({ url: event.target.value })} />
-      </label>
-      {address.derived && <p className="dt-hint">{t('addressDerived')}</p>}
-      <label>{t('deviceId')}<input data-node-device value={draft.deviceId} disabled={!editable}
-        onChange={event => patch({ deviceId: event.target.value })} /></label>
-      <label>{t('token')}<input type="password" data-node-token value={draft.token} disabled={!editable}
-        autoComplete="new-password" placeholder={keepsToken ? t('tokenStored') : ''}
-        onChange={event => patch({ token: event.target.value })} /></label>
-      <p className="dt-hint">{keepsToken ? t('tokenKeep') : t('tokenHint')}</p>
-    </section>
-
-    <section data-section="roots">
-      <h3>{t('rootsSection')}</h3>
-      <p className="dt-hint">{t('rootsHint')}</p>
-      {draft.roots.map((root, index) => <div key={index} data-root={index}>
-        <label>{t('project')}<input value={root.project} disabled={!editable}
-          onChange={event => patch({ roots: draft.roots.map((item, at) => at === index ? { ...item, project: event.target.value } : item) })} /></label>
-        <label>{t('path')}<input value={root.path} disabled={!editable}
-          onChange={event => patch({ roots: draft.roots.map((item, at) => at === index ? { ...item, path: event.target.value } : item) })} /></label>
-      </div>)}
-      <button type="button" disabled={!editable}
-        onClick={() => patch({ roots: [...draft.roots, { project: '', path: '' }] })}>{t('addRoot')}</button>
-    </section>
-
-    {missing.length > 0 && <p data-missing="true">{t('missing')}{missing.join(', ')}</p>}
-    {editable
-      ? <button type="button" data-node-save onClick={() => { void save() }}>{t('save')}</button>
-      : <p data-read-only="true">{t('readOnly')}</p>}
-    {notice !== undefined && <p data-notice>{notice}</p>}
-  </div>
-}
-
-/** The page as the Plugin Manager mounts it: locale and form come from the host. */
-interface PageProps extends PluginConfigViewProps {
-  t: (key: keyof typeof zh) => string
-}
-
-function Mounted({ t, view, form = undefined }: PageProps) {
-  // A summary row gets nothing: the full page belongs to the page view, and DSH's own config form shows the summary.
-  return view === 'summary' ? null : <DevicePage t={t} form={form} />
-}
-
-/** Registers the page for the `dsh-foreman-node` row. */
-export function apply(ctx: Context): void {
-  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-foreman-node: dictionaries')
-  const t = ctx.locale.bind(NS) as unknown as (key: keyof typeof zh) => string
-  ctx.slots.inject('plugins.row.config', () => ctx.slots.register({
-    name: 'plugins.row.config', key: 'dsh-foreman-node#dsh-foreman-node', locale: NS },
-  (props: PluginConfigViewProps) => <Mounted {...props} t={(props as { t?: typeof t }).t ?? t} />))
-}
-
-export { DevicePage }
+/**
+ * The device's configuration page, mounted in the DSH Plugin Manager.
+ *
+ * It does two things the page alone cannot: it lists the keys this machine has (through the device's own route, because
+ * a browser cannot read `~/.ssh`) and it tests one authentication (also through the device, because a browser cannot
+ * start ssh). Everything it *writes* goes through DSH's own configuration form, so the saved values land in the
+ * profile's patch exactly as if they had been typed there by hand.
+ */
+import { useEffect, useState } from 'react'
+import type { Context } from '@deepseek-ai/cordis'
+import type {} from '@deepseek-ai/dsh-client-locale/client'
+import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
+import type { ConfigPageForm, PluginConfigViewProps } from '@deepseek-ai/dsh-client-ui-plugin-manager/client'
+import { configured, type NodeConfig } from '../config.ts'
+import type { SshKey } from '../keys.ts'
+import type { TestResult } from '../routes.ts'
+import { addressPreview, DEFAULT_SSH, editsOf, emptyFields, keyLabel, testMessage } from './page-state.ts'
+import { en, zh } from './locales.ts'
+
+/** The prefix the device's own routes answer under. */
+const API = '/foreman-node/api'
+
+/** A key list answer, as `GET /foreman-node/api/keys` sends it. */
+interface KeysAnswer { keys: SshKey[]; directory: string }
+
+/** Fetches a key list or runs one test; both need the marker header the device's same-origin check looks for. */
+async function ask<T>(path: string, init?: RequestInit): Promise<T> {
+  const response = await fetch(new URL(`${API}/${path}`, window.location.href), {
+    ...init, headers: { 'x-orchestrator-request': '1', ...(init?.body === undefined ? {} : { 'content-type': 'application/json' }), ...init?.headers } })
+  if (!response.ok) throw new Error(`the device answered ${response.status}`)
+  return await response.json() as T
+}
+
+export const inject = ['locale', 'slots']
+export const name = 'dsh-foreman-node'
+
+/** The locale namespace this page registers its dictionaries under. */
+const NS = 'dshNode'
+
+/**
+ * The page itself. `t` comes from the host's locale service, like every other plugin's page.
+ *
+ * `initialKeys` and `keysFailed` exist so a test can render a page without a network or a web server. Production never
+ * passes them, so the page fetches as it otherwise would — they change nothing about how it behaves.
+ */
+function DevicePage({ form, t, initialKeys, keysFailed: prefailed }: {
+  t: (key: keyof typeof zh) => string
+  form: ConfigPageForm | undefined
+  initialKeys?: readonly SshKey[]
+  keysFailed?: boolean
+}) {
+  // The draft starts from the saved value when there is one, so the first render already shows the configuration
+  // rather than a loading line that only an effect would replace.
+  // The host hands over the section's raw value; every field is volatile, so it is unwrapped once here.
+  const saved = form?.state.value === undefined ? undefined : configured(form.state.value as Partial<NodeConfig>)
+  const editable = form?.state.status === 'ready' && form.state.writable
+  // The draft starts from the saved value when there is one, so the first render already shows the configuration
+  // rather than a loading line that only an effect would replace.
+  const [draft, setDraft] = useState<NodeConfig | undefined>(() =>
+    saved === undefined ? undefined : { ...saved, token: '', ssh: { ...DEFAULT_SSH, ...saved.ssh } })
+  // The stored token never reaches the page (it is a secret), so the box starts empty and is only written when
+  // someone types one. `keepsToken` is what tells the page it does not have to ask.
+  // A stored token cannot be detected: it is stripped before it reaches the page, so `saved.token` is always
+  // undefined. What can be known is that the section already exists, which is what the hint is based on.
+  const keepsToken = saved !== undefined
+  const [keys, setKeys] = useState<SshKey[] | undefined>(initialKeys === undefined ? undefined : [...initialKeys])
+  const [keysFailed, setKeysFailed] = useState(prefailed === true)
+  const [tested, setTested] = useState<TestResult>()
+  const [testing, setTesting] = useState(false)
+  const [notice, setNotice] = useState<string>()
+
+  // The form's value is the saved truth; the draft is what a person is editing on top of it, so it is only adopted
+  // when nothing has been typed yet — a form that reloads must not overwrite a half-finished edit.
+  useEffect(() => { if (saved !== undefined) setDraft(current => current ?? { ...saved, ssh: { ...DEFAULT_SSH, ...saved.ssh } }) }, [saved])
+  useEffect(() => {
+    if (initialKeys !== undefined || prefailed === true) return
+    ask<KeysAnswer>('keys').then(answer => setKeys(answer.keys), () => setKeysFailed(true))
+  }, [initialKeys, prefailed])
+
+  const patch = (change: Partial<NodeConfig>) => setDraft(current => current === undefined ? current : { ...current, ...change })
+  const patchSsh = (change: Partial<NodeConfig['ssh']>) =>
+    setDraft(current => current === undefined ? current : { ...current, ssh: { ...current.ssh, ...change } })
+
+  const test = async () => {
+    if (draft === undefined) return
+    setTesting(true); setTested(undefined)
+    try {
+      setTested(await ask<TestResult>('test', { method: 'POST', body: JSON.stringify({ host: draft.ssh.host.trim(),
+        port: draft.ssh.port, user: draft.ssh.user.trim(), keyPath: draft.ssh.keyPath.trim() }) }))
+    } catch (error) { setTested({ ok: false, output: String(error) }) } finally { setTesting(false) }
+  }
+
+  const save = async () => {
+    if (draft === undefined || form === undefined) return
+    setNotice(undefined)
+    try {
+      const ok = await form.mutate(editsOf(draft), form.state.revision)
+      setNotice(ok ? t('saved') : t('saveFailed'))
+    } catch { setNotice(t('saveFailed')) }
+  }
+
+  if (draft === undefined) return <div data-foreman-node-page="loading">{t('loading')}</div>
+  const address = addressPreview(draft)
+  const missing = emptyFields(draft, keepsToken)
+  return <div data-foreman-node-page="ready">
+    <h2>{t('title')}</h2>
+    <p className="dt-hint">{t('intro')}</p>
+
+    <section data-section="keys">
+      <h3>{t('keysSection')}</h3>
+      <p className="dt-hint">{t('keysHint')}</p>
+      {keysFailed
+        ? <p data-keys="unavailable">{t('keysUnavailable')}</p>
+        : keys === undefined ? <p>{t('loading')}</p>
+          : keys.length === 0 ? <p data-keys="empty">{t('keysEmpty')}</p>
+            : <select aria-label={t('keysSection')} data-node-key value={draft.ssh.keyPath}
+                onChange={event => patchSsh({ keyPath: event.target.value })}>
+                <option value="">—</option>
+                {keys.map(key => <option key={key.path} value={key.path}>{keyLabel(key)}</option>)}
+              </select>}
+      <label>{t('keyPath')}
+        <input data-node-key-path value={draft.ssh.keyPath} disabled={!editable}
+          onChange={event => patchSsh({ keyPath: event.target.value })} />
+      </label>
+    </section>
+
+    <section data-section="ssh">
+      <h3>{t('sshSection')}</h3>
+      <label><input type="checkbox" data-node-ssh-enabled checked={draft.ssh.enabled} disabled={!editable}
+        onChange={event => patchSsh({ enabled: event.target.checked })} />{t('sshEnabled')}</label>
+      <p className="dt-hint">{t('sshEnabledHint')}</p>
+      {draft.ssh.enabled && <>
+        <label>{t('host')}<input data-node-host value={draft.ssh.host} disabled={!editable}
+          onChange={event => patchSsh({ host: event.target.value })} /></label>
+        <label>{t('port')}<input type="number" data-node-port value={draft.ssh.port} disabled={!editable}
+          onChange={event => patchSsh({ port: Number(event.target.value) || DEFAULT_SSH.port })} /></label>
+        <label>{t('user')}<input data-node-user value={draft.ssh.user} disabled={!editable}
+          onChange={event => patchSsh({ user: event.target.value })} /></label>
+        <label>{t('remotePort')}<input type="number" data-node-remote-port value={draft.ssh.remotePort} disabled={!editable}
+          onChange={event => patchSsh({ remotePort: Number(event.target.value) || DEFAULT_SSH.remotePort })} /></label>
+        <label>{t('localPort')}<input type="number" data-node-local-port value={draft.ssh.localPort} disabled={!editable}
+          onChange={event => patchSsh({ localPort: Number(event.target.value) || DEFAULT_SSH.localPort })} /></label>
+        <button type="button" data-node-test data-testing={testing ? 'true' : undefined}
+          disabled={!draft.ssh.host.trim() || !draft.ssh.user.trim() || !draft.ssh.keyPath.trim()}
+          onClick={() => { void test() }}>{testing ? t('testing') : t('test')}</button>
+        {tested !== undefined && <p data-test-result={testMessage(tested)}>
+          {tested.ok ? t('testOk')
+            : testMessage(tested) === 'passphrase' ? t('testPassphrase')
+              : testMessage(tested) === 'unresolved' ? t('testUnresolved')
+                : testMessage(tested) === 'timeout' ? t('testTimeout')
+                  : `${t('testRefused')} ${tested.output}`}
+        </p>}
+      </>}
+    </section>
+
+    <section data-section="hub">
+      <h3>{t('hubSection')}</h3>
+      <label>{t('address')}
+        <input data-node-url value={address.address} readOnly={address.derived} disabled={!editable || address.derived}
+          onChange={event => patch({ url: event.target.value })} />
+      </label>
+      {address.derived && <p className="dt-hint">{t('addressDerived')}</p>}
+      <label>{t('deviceId')}<input data-node-device value={draft.deviceId} disabled={!editable}
+        onChange={event => patch({ deviceId: event.target.value })} /></label>
+      <label>{t('token')}<input type="password" data-node-token value={draft.token} disabled={!editable}
+        autoComplete="new-password" placeholder={keepsToken ? t('tokenStored') : ''}
+        onChange={event => patch({ token: event.target.value })} /></label>
+      <p className="dt-hint">{keepsToken ? t('tokenKeep') : t('tokenHint')}</p>
+    </section>
+
+    <section data-section="roots">
+      <h3>{t('rootsSection')}</h3>
+      <p className="dt-hint">{t('rootsHint')}</p>
+      {draft.roots.map((root, index) => <div key={index} data-root={index}>
+        <label>{t('project')}<input value={root.project} disabled={!editable}
+          onChange={event => patch({ roots: draft.roots.map((item, at) => at === index ? { ...item, project: event.target.value } : item) })} /></label>
+        <label>{t('path')}<input value={root.path} disabled={!editable}
+          onChange={event => patch({ roots: draft.roots.map((item, at) => at === index ? { ...item, path: event.target.value } : item) })} /></label>
+      </div>)}
+      <button type="button" disabled={!editable}
+        onClick={() => patch({ roots: [...draft.roots, { project: '', path: '' }] })}>{t('addRoot')}</button>
+    </section>
+
+    {missing.length > 0 && <p data-missing="true">{t('missing')}{missing.join(', ')}</p>}
+    {editable
+      ? <button type="button" data-node-save onClick={() => { void save() }}>{t('save')}</button>
+      : <p data-read-only="true">{t('readOnly')}</p>}
+    {notice !== undefined && <p data-notice>{notice}</p>}
+  </div>
+}
+
+/** The page as the Plugin Manager mounts it: locale and form come from the host. */
+interface PageProps extends PluginConfigViewProps {
+  t: (key: keyof typeof zh) => string
+}
+
+function Mounted({ t, view, form = undefined }: PageProps) {
+  // A summary row gets nothing: the full page belongs to the page view, and DSH's own config form shows the summary.
+  return view === 'summary' ? null : <DevicePage t={t} form={form} />
+}
+
+/** Registers the page for the `dsh-foreman-node` row. */
+export function apply(ctx: Context): void {
+  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-foreman-node: dictionaries')
+  const t = ctx.locale.bind(NS) as unknown as (key: keyof typeof zh) => string
+  ctx.slots.inject('plugins.row.config', () => ctx.slots.register({
+    name: 'plugins.row.config', key: 'dsh-foreman-node#dsh-foreman-node', locale: NS },
+  (props: PluginConfigViewProps) => <Mounted {...props} t={(props as { t?: typeof t }).t ?? t} />))
+}
+
+export { DevicePage }

package/src/config.ts

@@ -49,6 +49,14 @@ export interface NodeConfig {
   reconnectMs: number
   /** How to reach a hub that is not directly reachable. */
   ssh: SshConfig
+  /**
+   * The permission preset a job runs under.
+   *
+   * Defaults to `workspace-write`, which is bounded to the declared directory but asks before leaving it. A device has
+   * nobody sitting in front of it, so a question that stops the job is worse than it looks: the work simply hangs.
+   * Configure a preset that keeps the boundary and never asks — that is the operator's call, on their own machine.
+   */
+  jobPreset: string
 }
 
 /** The SSH defaults, spread over whatever the host hands in, so a partial block is still complete. */
@@ -95,6 +103,7 @@ export function configured(config: object | undefined): NodeConfig {
   return { url: valueOf(source['url'] as string, ''), deviceId: valueOf(source['deviceId'] as string, ''),
     token: valueOf(source['token'] as string, ''), roots: valueOf(source['roots'] as NodeRoot[], []),
     heartbeatMs: valueOf(source['heartbeatMs'] as number, 15_000), reconnectMs: valueOf(source['reconnectMs'] as number, 1_000),
+    jobPreset: valueOf(source['jobPreset'] as string, 'workspace-write'),
     // `ssh` holds volatile fields too, so each one is unwrapped like the top level.
     ssh: { ...SSH_DEFAULTS, ...unwrapSsh(source['ssh']) } }
 }

package/src/index.ts

@@ -59,6 +59,8 @@ const ConfigSchema = s.object({
     localPort: s.natural().min(1).max(65535).default(8790).volatile().description('The local port the tunnel listens on; the device dials this.'),
   }).default({ enabled: false, host: '', port: 22, user: '', keyPath: '', remotePort: 8790, localPort: 8790 })
     .description('How to reach the hub when it is not directly reachable: a tunnel this device opens and keeps open.'),
+  jobPreset: s.string().default('workspace-write').volatile()
+    .description('The permission preset a job runs under. Use one that keeps the workspace boundary and never asks, because nobody is at this machine to answer.'),
 })
 /**
  * Why every field is volatile.
@@ -154,7 +156,7 @@ export async function apply(ctx: Context, raw: ConfigInput): Promise<void> {
     ctx.logger.info('%s', missing)
     return
   }
-  const jobs = new JobSessions(ctx)
+  const jobs = new JobSessions(ctx, config.jobPreset)
   const client = new NodeClient({
     url: hubUrlOf(config),
     deviceId: config.deviceId,

package/src/session.ts

@@ -25,7 +25,14 @@ declare module '@deepseek-ai/dsh-llm' {
   }
 }
 
-/** The permission preset a job runs under: bounded to the directory the device declared. */
+/**
+ * The permission preset a job runs under when the device's configuration names none.
+ *
+ * Bounded to the directory the device declared. A job on a machine with nobody in front of it cannot answer an
+ * approval prompt, so the useful alternative is not a wider sandbox but a quiet one: a preset that keeps this
+ * boundary and never asks. That is the device operator's decision, taken in their own configuration, because it is
+ * their machine and their risk.
+ */
 export const JOB_PRESET = 'workspace-write'
 
 /** The Session a job runs in, named the way a hub names its own worker: `job-<assignmentId>`. */
@@ -63,7 +70,12 @@ export class JobSessions {
   /** Assignments that have actually reported; a turn ending without one is closed out by `watchTurnEnd`. */
   private readonly reports = new Set<string>()
 
-  constructor(private readonly ctx: Context) {}
+  /**
+   * @param preset the permission preset a job runs under. The device operator chooses it in their own configuration:
+   *   a machine with nobody in front of it cannot answer an approval prompt, so the useful choice is usually a preset
+   *   that keeps the workspace boundary and never asks.
+   */
+  constructor(private readonly ctx: Context, private readonly preset: string = JOB_PRESET) {}
 
   /**
    * Resolve or create the `job-<assignmentId>` Session in the given directory, attach its `foreman_report` tool, and
@@ -87,7 +99,7 @@ export class JobSessions {
     if ('error' in result) throw result.error
     await workspace.attachSession(id as SessionId)
     // The one place the device's policy differs from the hub's: bounded, because no person is here to approve more.
-    this.ctx.permissionPresets.set(result.agent.session, JOB_PRESET)
+    this.ctx.permissionPresets.set(result.agent.session, this.preset)
     await this.ctx.sessionController.rename({ sessionId: id as SessionId, title: input.title })
     if (onReport !== undefined && !this.reported.has(input.assignmentId)) {
       this.reported.add(input.assignmentId)