dsh-isolation-gate 0.3.2 → 1.0.0

package/lib/client.js

@@ -1086,7 +1086,80 @@ window.__ModuleLoader__.load({
     }
 
     /** 有状态的一层：只负责取数与动作，渲染全交给 GateView。 */
-    // ==================== 页 2：策略档 ====================
+    // ==================== 页 2：隔离强度 ====================
+    //
+    // 2026-10-22 户主原话「策略档名字太抽象，不知道干嘛的」⇒ 改叫「隔离强度」，
+    // 三档一律用白话名（宽松 / 严格 / 全封）+ 一句"这档会发生什么"。
+    const PROFILE_PLAIN = {
+      normal: { cn: '宽松', line: '只拦你点名的目录（黑名单）；没点名的都能读能写。日常用这档。' },
+      strict: { cn: '严格', line: '反过来：只放你点名的目录（白名单），别处一律拒。' },
+      sealed: { cn: '全封', line: '任何目录都不许碰，连没登记的工具调用也拒。最保险，也最干不了活。' },
+    }
+
+    function profilePlain(name) {
+      return PROFILE_PLAIN[name] || { cn: name, line: '自定义档' }
+    }
+
+    /**
+     * 组类型的人话解释。这是整个插件最容易看错的一处语义：
+     *   严格组 = 白名单：清单里的放行，**清单外的全拒**
+     *   宽松组 = 黑名单：清单里的受限，**清单外的照常**
+     * 2026-10-23 户主实测踩坑（把 E 盘加进严格组当"只禁 E"，结果全盘封死）⇒ 必须显眼。
+     */
+    const PROFILE_MODE = {
+      allowlist: {
+        tag: '白名单模式',
+        name: '严格组',
+        rule: '只放清单里的；没列进组的，一律拒',
+        color: C.warn,
+        bg: 'rgba(251,191,36,0.14)',
+      },
+      blocklist: {
+        tag: '黑名单模式',
+        name: '宽松组',
+        rule: '只限清单里的；没列进组的，照常放行',
+        color: C.ok,
+        bg: 'rgba(74,222,128,0.14)',
+      },
+      sealed: {
+        tag: '全封模式',
+        name: '全封',
+        rule: '什么都不放行',
+        color: C.bad,
+        bg: 'rgba(248,113,113,0.14)',
+      },
+    }
+
+    function profileMode(mode) {
+      return (
+        PROFILE_MODE[mode] || { tag: '自定义模式', name: mode || '自定义', rule: '', color: C.dim, bg: 'transparent' }
+      )
+    }
+
+    /** 一条醒目的「这个组是白名单还是黑名单」横幅。 */
+    function ModeStrip(props) {
+      const info = profileMode(props.mode)
+      return h(
+        'div',
+        {
+          'data-gate-mode': props.mode,
+          style: {
+            display: 'flex',
+            alignItems: 'center',
+            gap: '6px',
+            flexWrap: 'wrap',
+            marginTop: '6px',
+            padding: '5px 9px',
+            borderRadius: '8px',
+            border: `1px solid ${info.color}55`,
+            background: info.bg,
+          },
+        },
+        h('span', { style: { fontSize: '11px', fontWeight: 700, color: info.color } }, info.tag),
+        h('span', { style: { fontSize: '11px', color: C.text } }, info.rule),
+      )
+    }
+
     function ProfilesPage() {
       const [data, setData] = useState(null)
       const [error, setError] = useState(null)
@@ -1120,8 +1193,8 @@ window.__ModuleLoader__.load({
         h(
           'div',
           { style: { display: 'flex', alignItems: 'baseline', gap: '10px', flexWrap: 'wrap' } },
-          h('div', { style: { fontSize: '20px', fontWeight: 750 } }, '门禁 · 策略档'),
-          h('div', { style: { fontSize: '12px', color: C.dim } }, '会话挂哪一档 · 目录 .dsh-gate.json · 只读'),
+          h('div', { style: { fontSize: '20px', fontWeight: 750 } }, '门禁 · 隔离强度'),
+          h('div', { style: { fontSize: '12px', color: C.dim } }, '一句话：这档决定 dsh 默认能碰什么、碰多狠'),
           h('span', { style: { flex: '1 1 auto' } }),
           h(Button, { label: busy ? '刷新中…' : '刷新', onClick: load, disabled: busy }),
         ),
@@ -1130,43 +1203,410 @@ window.__ModuleLoader__.load({
         profiles.length
           ? h(
               'div',
-              { style: { display: 'grid', gap: '10px', marginTop: '14px', gridTemplateColumns: 'repeat(auto-fill, minmax(280px, 1fr))' } },
-              profiles.map((profile) =>
-                h(
+              { style: { display: 'grid', gap: '10px', marginTop: '14px', gridTemplateColumns: 'repeat(auto-fill, minmax(300px, 1fr))' } },
+              profiles.map((profile) => {
+                const plain = profilePlain(profile.name)
+                return h(
                   'div',
-                  { key: profile.name, style: { border: `1px solid ${C.border2}`, borderRadius: '12px', padding: '12px 14px', background: C.card } },
+                  {
+                    key: profile.name,
+                    'data-gate-profile': profile.name,
+                    style: {
+                      border: `1px solid ${profile.isDefault ? C.accent : C.border2}`,
+                      borderRadius: '12px',
+                      padding: '12px 14px',
+                      background: C.card,
+                    },
+                  },
                   h(
                     'div',
-                    { style: { display: 'flex', alignItems: 'baseline', gap: '8px' } },
-                    h('div', { style: { fontSize: '15px', fontWeight: 700 } }, profile.name),
+                    { style: { display: 'flex', alignItems: 'baseline', gap: '8px', flexWrap: 'wrap' } },
+                    h('div', { style: { fontSize: '16px', fontWeight: 700 } }, plain.cn),
+                    h('span', { style: { fontSize: '11px', color: C.dim } }, profile.name),
                     profile.isDefault
-                      ? h('span', { style: { fontSize: '11px', color: C.ok, border: `1px solid ${C.ok}`, borderRadius: '999px', padding: '0 6px' } }, '默认')
+                      ? h('span', { style: { fontSize: '11px', color: C.ok, border: `1px solid ${C.ok}`, borderRadius: '999px', padding: '0 6px' } }, '当前默认')
                       : null,
-                    h('span', { style: { flex: '1 1 auto' } }),
-                    h('span', { style: { fontSize: '11px', color: C.dim } }, profile.mode),
                   ),
-                  h(Line, null, `联网：${profile.network === 'deny' ? '禁' : '允许'} · 未知工具：${profile.unknownTool === 'deny' ? '拒' : '放行'}`),
+                  h('div', { style: { fontSize: '13px', lineHeight: '20px', marginTop: '6px' } }, plain.line),
+                  h(
+                    Line,
+                    null,
+                    `没登记的目录：${profile.mode === 'allowlist' || profile.mode === 'sealed' ? '拒' : '放行'} · ` +
+                      `联网：${profile.network === 'deny' ? '禁' : '允许'} · ` +
+                      `没登记的工具：${profile.unknownTool === 'deny' ? '拒' : '放行'}`,
+                  ),
                   profile.allow.length
                     ? profile.allow.map((entry) =>
                         h('div', { key: entry.path, style: { fontSize: '12px', color: C.dim, marginTop: '4px', wordBreak: 'break-all' } }, `${entry.level} · ${entry.path}`),
                       )
-                    : h('div', { style: { fontSize: '12px', color: C.warn, marginTop: '4px' } }, 'allow 为空 ⇒ 有路径的工具调用一律拒'),
-                ),
-              ),
+                    : h('div', { style: { fontSize: '12px', color: C.dim, marginTop: '4px' } }, profile.mode === 'blocklist' ? '不点名 ⇒ 不拦' : '没点名的路径 ⇒ 全拒'),
+                )
+              }),
             )
           : null,
-        h(SectionTitle, { title: '目录绑定', hint: '在目录里放 .dsh-gate.json，只影响这棵子树；只能加严，不能解锁别处' }),
+        h(SectionTitle, { title: '按目录加严', hint: '某个目录里放 .dsh-gate.json，只影响这棵子树；只能更严，不能解锁别处' }),
         dirBindings.length
           ? dirBindings.map((item) =>
               h(
                 'div',
                 { key: item.dir, style: { border: `1px solid ${C.border2}`, borderRadius: '10px', padding: '8px 10px', marginTop: '6px', background: C.card } },
-                h('div', { style: { fontSize: '13px' } }, item.profile || '(未指定档)'),
+                h('div', { style: { fontSize: '13px' } }, `${profilePlain(item.profile).cn}${item.profile ? `（${item.profile}）` : ''}`),
                 h('div', { style: { fontSize: '11px', color: C.dim, wordBreak: 'break-all' } }, item.dir),
               ),
             )
-          : h(Line, null, '未发现任何 .dsh-gate.json（在目标目录建一个即生效）'),
+          : h(Line, null, '还没有任何 .dsh-gate.json（在目标目录建一个即生效）'),
         h(Line, null, '示例：{"profile":"strict","allow":[{"path":"D:\\\\某项目","level":"read"}]}'),
+        h(Line, null, '注意：强度档管的是 dsh 自己的工具调用；别的程序、已在跑的进程、绕过工具直接读写，都不在这个范围内。'),
+      )
+    }
+
+    // ==================== 页 2b：隔离强度 · 模板编辑器 ====================
+    const ALL_LEVELS = [
+      ['deny', '禁'],
+      ['read', '只读'],
+      ['full', '可读写删'],
+    ]
+    const EDIT_LEVELS = {
+      blocklist: ALL_LEVELS,
+      allowlist: ALL_LEVELS,
+      sealed: ALL_LEVELS,
+    }
+
+    class Boundary extends React.Component {
+      constructor(props) {
+        super(props)
+        this.state = { err: null }
+      }
+      static getDerivedStateFromError(err) {
+        return { err }
+      }
+      componentDidCatch(err) {
+        console.error('[门禁] 渲染出错：', err)
+      }
+      render() {
+        if (this.state.err) {
+          return h(
+            'div',
+            { style: { padding: '16px', borderRadius: '10px', border: `1px solid ${C.bad}`, color: C.bad, fontSize: '13px', lineHeight: 1.6 } },
+            `这一块渲染出错：${this.state.err.message}`,
+          )
+        }
+        return this.props.children
+      }
+    }
+
+    function ProfilesEditor() {
+      const [data, setData] = useState(null)
+      const [error, setError] = useState(null)
+      const [notice, setNotice] = useState(null)
+      const [busy, setBusy] = useState(false)
+      const [draft, setDraft] = useState(null)
+      const [pathInput, setPathInput] = useState('')
+
+      const load = useCallback(async () => {
+        setBusy(true)
+        setError(null)
+        try {
+          setData(await call(`${BASE}/profiles`))
+        } catch (err) {
+          setError(err.message)
+        } finally {
+          setBusy(false)
+        }
+      }, [])
+
+      useEffect(() => {
+        load()
+      }, [load])
+
+      const profiles = ((data && data.profiles) || []).filter((row) => !row.builtin)
+
+      const startFrom = (mode) => {
+        setDraft({
+          name: mode === 'allowlist' ? '严格组' : '宽松组',
+          label: '',
+          mode,
+          allow: [],
+        })
+        setPathInput('')
+        setNotice(null)
+      }
+
+      const editExisting = (row) => {
+        setDraft({
+          name: row.name,
+          label: row.label === row.name ? '' : row.label,
+          mode: row.mode,
+          allow: (row.allow || []).map((e) => ({ path: e.path, level: e.level })),
+        })
+        setPathInput('')
+        setNotice(null)
+      }
+
+      const addEntry = () => {
+        const value = pathInput.trim()
+        if (!value) return
+        const list = Array.isArray(draft.allow) ? draft.allow : []
+        const fallback = draft.mode === 'blocklist' ? 'deny' : 'read'
+        setDraft({ ...draft, allow: [...list, { path: value, level: fallback }] })
+        setPathInput('')
+      }
+
+      const pickFolder = async () => {
+        setBusy(true)
+        setError(null)
+        try {
+          const result = await post(`${BASE}/pick`, {})
+          const picked = result && (result.path || result.dir || result.selected)
+          if (picked) setPathInput(String(picked))
+        } catch (err) {
+          setError(err.message)
+        } finally {
+          setBusy(false)
+        }
+      }
+
+      const save = async () => {
+        setBusy(true)
+        setError(null)
+        setNotice(null)
+        try {
+          await post(`${BASE}/profile/save`, {
+            name: draft.name,
+            label: draft.label,
+            mode: draft.mode,
+            allow: Array.isArray(draft.allow) ? draft.allow : [],
+          })
+          setDraft(null)
+          await load()
+          setNotice('已保存')
+        } catch (err) {
+          setError(err.message)
+        } finally {
+          setBusy(false)
+        }
+      }
+
+      const removeProfile = async (name) => {
+        setBusy(true)
+        setError(null)
+        setNotice(null)
+        try {
+          await post(`${BASE}/profile/delete`, { name })
+          await load()
+          setNotice(`已删除「${name}」`)
+        } catch (err) {
+          setError(err.message)
+        } finally {
+          setBusy(false)
+        }
+      }
+
+      const makeDefault = async (row) => {
+        setBusy(true)
+        setError(null)
+        setNotice(null)
+        try {
+          await post(`${BASE}/profile/save`, {
+            name: row.name,
+            label: row.label === row.name ? '' : row.label,
+            mode: row.mode,
+            allow: row.allow,
+            asDefault: true,
+          })
+          await load()
+          setNotice(`「${row.label || row.name}」已设为全局默认`)
+        } catch (err) {
+          setError(err.message)
+        } finally {
+          setBusy(false)
+        }
+      }
+
+      const inputStyle = {
+        fontSize: '13px',
+        padding: '5px 9px',
+        borderRadius: '8px',
+        border: `1px solid ${C.border}`,
+        background: 'transparent',
+        color: C.text,
+      }
+      const levelOptions = draft && draft.mode === 'allowlist'
+        ? EDIT_LEVELS.allowlist
+        : EDIT_LEVELS.blocklist
+
+      return h(
+        'div',
+        { style: { padding: '18px 22px 32px', height: '100%', overflow: 'auto', boxSizing: 'border-box', background: C.card2, color: C.text } },
+        h(
+          'div',
+          { style: { display: 'flex', alignItems: 'baseline', gap: '10px', flexWrap: 'wrap' } },
+          h('div', { style: { fontSize: '20px', fontWeight: 750 } }, '门禁 · 特别门禁'),
+          h('div', { style: { fontSize: '12px', color: C.dim } }, '这里编"某个会话专用"的规则；没给会话挂，就等于没有特别门禁'),
+          h('span', { style: { flex: '1 1 auto' } }),
+          h(Button, { label: busy ? '刷新中…' : '刷新', onClick: load, disabled: busy }),
+        ),
+        error ? h('div', { style: { color: C.bad, fontSize: '12px', marginTop: '10px' } }, `✗ ${error}`) : null,
+        notice ? h('div', { style: { color: C.ok, fontSize: '12px', marginTop: '10px' } }, `✓ ${notice}`) : null,
+
+        h(SectionTitle, { title: '新建特别组', hint: '先选严格还是宽松，再往里加目录' }),
+        h(
+          'div',
+          { style: { display: 'flex', gap: '8px', flexWrap: 'wrap' } },
+          h(Button, { label: '＋ 严格组（只放我选的，其余一律拒）', primary: true, onClick: () => startFrom('allowlist') }),
+          h(Button, { label: '＋ 宽松组（只禁我选的，其余照常）', onClick: () => startFrom('blocklist') }),
+        ),
+
+        draft
+          ? h(
+              'div',
+              { 'data-gate-editor': '1', style: { marginTop: '12px', border: `1px solid ${C.accent}`, borderRadius: '12px', padding: '14px', background: C.card } },
+              h(
+                'div',
+                { style: { display: 'flex', gap: '8px', alignItems: 'center', flexWrap: 'wrap' } },
+                h('span', { style: { fontSize: '13px', fontWeight: 700 } }, `编辑模板「${draft.name}」`),
+                h('span', { style: { flex: '1 1 auto' } }),
+                h(Button, { label: busy ? '保存中…' : '保存', primary: true, onClick: save, disabled: busy }),
+                h(Button, { label: '取消', onClick: () => setDraft(null), disabled: busy }),
+              ),
+              h(
+                'div',
+                { style: { display: 'flex', gap: '8px', marginTop: '10px', flexWrap: 'wrap', alignItems: 'center' } },
+                h('span', { style: { fontSize: '12px', color: C.dim } }, '模板名'),
+                h('input', { value: draft.name, onChange: (e) => setDraft({ ...draft, name: e.target.value }), style: { ...inputStyle, minWidth: '200px' } }),
+                h('span', { style: { fontSize: '12px', color: C.dim } }, '显示名'),
+                h('input', { value: draft.label, placeholder: '可空', onChange: (e) => setDraft({ ...draft, label: e.target.value }), style: { ...inputStyle, minWidth: '150px' } }),
+              ),
+              h(ModeStrip, { mode: draft.mode }),
+              h(
+                Line,
+                { style: { marginTop: '6px' } },
+                draft.mode === 'allowlist'
+                  ? '清单里的条目：只读 = 只能读、可读写删 = 放行、禁 = 连这条也拒。**清单外的路径一律拒。**'
+                  : '清单里的条目：禁 = 完全不许碰、只读 = 只能读、可读写删 = 放行。**清单外的路径照常。**',
+              ),
+              h(
+                'div',
+                { style: { display: 'flex', gap: '8px', marginTop: '8px', flexWrap: 'wrap', alignItems: 'center' } },
+                h(Button, {
+                  label:
+                    draft.mode === 'allowlist'
+                      ? '改成宽松组（只禁我选的，其余照常）'
+                      : '改成严格组（只放我选的，其余一律拒）',
+                  disabled: busy,
+                  onClick: () =>
+                    setDraft({ ...draft, mode: draft.mode === 'allowlist' ? 'blocklist' : 'allowlist' }),
+                }),
+                h('span', { style: { fontSize: '11px', color: C.dim } }, '切类型不动清单，只换「清单外怎么算」'),
+              ),
+              h(
+                'div',
+                { style: { display: 'flex', gap: '8px', marginTop: '12px', flexWrap: 'wrap', alignItems: 'center' } },
+                h('input', {
+                  value: pathInput,
+                  placeholder: 'D:\\某个目录',
+                  onChange: (e) => setPathInput(e.target.value),
+                  onKeyDown: (e) => {
+                    if (e.key === 'Enter') addEntry()
+                  },
+                  style: { ...inputStyle, minWidth: '320px' },
+                }),
+                h(Button, { label: '选择文件夹…', onClick: pickFolder, disabled: busy }),
+                h(Button, { label: '加进清单', onClick: addEntry, disabled: !pathInput.trim() }),
+              ),
+              (Array.isArray(draft.allow) ? draft.allow : []).length === 0
+                ? h(Line, { style: { marginTop: '10px' } }, draft.mode === 'blocklist' ? '清单为空 ⇒ 这档什么也不拦' : '清单为空 ⇒ 这档什么都拒（等同全封）')
+                : h(
+                    'div',
+                    { style: { display: 'grid', gap: '6px', marginTop: '10px' } },
+                    (Array.isArray(draft.allow) ? draft.allow : []).map((entry, index) =>
+                      h(
+                        'div',
+                        { key: `${entry.path}-${index}`, style: { display: 'flex', gap: '8px', alignItems: 'center', padding: '6px 9px', borderRadius: '9px', border: `1px solid ${C.border}`, background: C.card2 } },
+                        h('span', { style: { fontSize: '12px', wordBreak: 'break-all', flex: '1 1 auto' } }, entry.path),
+                        h(
+                          'div',
+                          { style: { display: 'flex', gap: '4px' } },
+                          levelOptions.map(([level, label]) =>
+                            h(Button, {
+                              key: level,
+                              label,
+                              primary: entry.level === level,
+                              disabled: busy,
+                              onClick: () =>
+                                setDraft({
+                                  ...draft,
+                                  allow: draft.allow.map((row, i) => (i === index ? { ...row, level } : row)),
+                                }),
+                            }),
+                          ),
+                        ),
+                        h(Button, {
+                          label: '删',
+                          disabled: busy,
+                          onClick: () => setDraft({ ...draft, allow: draft.allow.filter((_, i) => i !== index) }),
+                        }),
+                      ),
+                    ),
+                  ),
+            )
+          : null,
+
+        h(SectionTitle, { title: '现有模板', hint: '内置三档不可删；自定义的可随时改' }),
+        !data && !error ? h(Line, null, '读取中…') : null,
+        h(
+          'div',
+          { style: { display: 'grid', gap: '10px', gridTemplateColumns: 'repeat(auto-fill, minmax(300px, 1fr))' } },
+          profiles.map((row) =>
+            h(
+              'div',
+              { key: row.name, 'data-gate-profile': row.name, style: { border: `1px solid ${row.isDefault ? C.accent : C.border2}`, borderRadius: '12px', padding: '12px 14px', background: C.card } },
+              h(
+                'div',
+                { style: { display: 'flex', alignItems: 'baseline', gap: '8px', flexWrap: 'wrap' } },
+                h('div', { style: { fontSize: '16px', fontWeight: 700 } }, row.label || row.name),
+                h('span', { style: { fontSize: '11px', color: C.dim } }, row.name),
+                row.builtin
+                  ? h('span', { style: { fontSize: '11px', color: C.dim, border: `1px solid ${C.border}`, borderRadius: '999px', padding: '0 6px' } }, '内置')
+                  : null,
+              ),
+              h(ModeStrip, { mode: row.mode }),
+              (() => {
+                const overrides = (data && data.sessionOverrides) || {}
+                const users = Object.keys(overrides).filter((sid) => overrides[sid] === row.name)
+                return h(
+                  Line,
+                  { style: { marginTop: '4px' } },
+                  users.length === 0
+                    ? `成员 ${row.allow.length} 个 · 还没有会话挂它`
+                    : `成员 ${row.allow.length} 个 · 挂在 ${users.length} 个会话：${users
+                        .map((sid) => String(sid).slice(0, 8))
+                        .join('、')}`,
+                )
+              })(),
+              row.allow.length
+                ? h(
+                    'div',
+                    { style: { marginTop: '6px', display: 'grid', gap: '3px' } },
+                    row.allow.map((entry) =>
+                      h(
+                        'div',
+                        { key: entry.path, style: { fontSize: '12px', color: C.dim, wordBreak: 'break-all' } },
+                        `${entry.level === 'deny' ? '禁' : entry.level === 'read' ? '只读' : '可读写删'} · ${entry.path}`,
+                      ),
+                    ),
+                  )
+                : h(Line, { style: { marginTop: '6px' } }, '清单为空'),
+              h(
+                'div',
+                { style: { display: 'flex', gap: '8px', marginTop: '10px' } },
+                h(Button, { label: '编辑', onClick: () => editExisting(row), disabled: busy }),
+                row.builtin ? null : h(Button, { label: '删除', onClick: () => removeProfile(row.name), disabled: busy }),
+              ),
+            ),
+          ),
+        ),
+        h(Line, { style: { marginTop: '16px' } }, '模板只管 dsh 自己的工具调用；别的程序、已在跑的进程、绕过工具直接读写，都不在范围内。'),
       )
     }
 
@@ -1261,27 +1701,79 @@ window.__ModuleLoader__.load({
 
 
     // ==================== 外壳：单页 + 标签（照「技能」面板的样子） ====================
+    //
+    // 2026-10-22 修「点了不切换」：标签用**原生 button**（不再包一层 Button），
+    // 并把当前页记在**模块级变量**里 —— 万一宿主重建了组件实例，回来还是刚才那页。
+    const SHELL_TABS = [
+      ['list', '全局门禁', '所有会话都要守：哪些目录能被 dsh 碰，各给什么级别'],
+      ['profiles', '特别门禁', '给某个会话单独加一套规则（黑名单 / 白名单 / 全封）'],
+      ['audit', '审计与诊断', '谁动过什么 + 一键清理'],
+    ]
+    let lastTab = 'list'
+
+    function TabBar(props) {
+      return h(
+        'div',
+        { role: 'tablist', style: { display: 'flex', gap: '6px', flexWrap: 'wrap' } },
+        SHELL_TABS.map(([id, label, hint]) =>
+          h(
+            'button',
+            {
+              key: id,
+              type: 'button',
+              role: 'tab',
+              'data-gate-tab': id,
+              'aria-selected': props.value === id ? 'true' : 'false',
+              title: hint,
+              onClick: () => props.onPick(id),
+              style: {
+                cursor: 'pointer',
+                fontSize: '13px',
+                fontWeight: props.value === id ? 600 : 500,
+                padding: '6px 14px',
+                borderRadius: '8px',
+                border: props.value === id ? `1px solid ${C.accent}` : `1px solid ${C.border}`,
+                background: props.value === id ? C.card : 'transparent',
+                color: props.value === id ? C.accent : C.dim,
+                boxShadow: props.value === id ? `inset 0 -2px 0 0 ${C.accent}` : 'none',
+              },
+            },
+            label,
+          ),
+        ),
+      )
+    }
+
     function GateShell() {
-      const [tab, setTab] = useState('list')
-      const tabs = [
-        ['list', '对象与分组'],
-        ['profiles', '策略档'],
-        ['audit', '审计与诊断'],
-      ]
+      const [tab, setTabState] = useState(lastTab)
+      const setTab = useCallback((id) => {
+        lastTab = id
+        setTabState(id)
+      }, [])
+      const current = SHELL_TABS.find((row) => row[0] === tab) || SHELL_TABS[0]
       return h(
         'div',
         { style: { height: '100%', display: 'flex', flexDirection: 'column', background: C.card2, color: C.text } },
         h(
           'div',
-          { style: { padding: '12px 22px 10px', borderBottom: `1px solid ${C.border2}`, display: 'flex', gap: '6px', flexWrap: 'wrap' } },
-          tabs.map(([id, label]) =>
-            h(Button, { key: id, label, primary: tab === id, onClick: () => setTab(id) }),
-          ),
+          {
+            style: {
+              padding: '12px 22px 10px',
+              borderBottom: `1px solid ${C.border2}`,
+              display: 'flex',
+              alignItems: 'center',
+              gap: '10px',
+              flexWrap: 'wrap',
+            },
+          },
+          h(TabBar, { value: tab, onPick: setTab }),
+          h('span', { style: { flex: '1 1 auto' } }),
+          h('span', { 'data-gate-tab-current': tab, style: { fontSize: '11px', color: C.dim } }, current[2]),
         ),
         h(
           'div',
-          { style: { flex: '1 1 auto', minHeight: 0 } },
-          tab === 'profiles' ? h(ProfilesPage) : tab === 'audit' ? h(AuditPage) : h(GatePage),
+          { style: { flex: '1 1 auto', minHeight: 0, overflow: 'hidden' } },
+          tab === 'profiles' ? h(Boundary, null, h(ProfilesEditor)) : tab === 'audit' ? h(AuditPage) : h(GatePage),
         ),
       )
     }
@@ -1493,6 +1985,226 @@ window.__ModuleLoader__.load({
       })
     }
 
+    const SESSION_SLOT = 'conversation.session.header.utilities'
+    const SESSION_BUTTON_ID = 'isolation-gate:session'
+
+    /** 组类型 → 中文（会话头部那一小块只留最短的说法，但必须带上"清单外怎么算"）。 */
+    function sessionModeText(profile) {
+      if (!profile) return ''
+      if (profile.mode === 'allowlist') return '严格组 · 没点名的全拒'
+      if (profile.mode === 'sealed') return '全封 · 什么都不放'
+      return '宽松组 · 没点名的照常'
+    }
+
+    /**
+     * 会话头部小按钮（垃圾桶旁边）：给**当前会话**挂一个特别组。
+     *
+     * 槽位契约（`conversation.session.header.utilities`，list，session 作用域）会给组件
+     * 标准会话 props，其中就有 `sessionId` —— 所以这里不需要再问「是哪个会话」。
+     *
+     * 单选：一个会话最多挂一个组；「不额外限制」= 清掉绑定，只走全局名单。
+     * 数据源与「特别门禁」页完全同一份（`GET /profiles?sessionId=` / `POST /session-profile`），
+     * 不在这里留副本 —— 免得头部显示的和工具侧读到的不是一回事。
+     */
+    function SessionGateButton(props) {
+      const sessionId = props && props.sessionId ? String(props.sessionId) : ''
+      const [open, setOpen] = useState(false)
+      const [model, setModel] = useState(null)
+      const [busy, setBusy] = useState(false)
+      const [error, setError] = useState('')
+
+      const load = useCallback(() => {
+        if (sessionId === '') return
+        call(`${BASE}/profiles?sessionId=${encodeURIComponent(sessionId)}`)
+          .then((next) => {
+            setModel(next)
+            setError('')
+          })
+          .catch((err) => setError(err.message))
+      }, [sessionId])
+
+      useEffect(() => {
+        load()
+      }, [load])
+
+      const pick = (name) => {
+        setBusy(true)
+        post(`${BASE}/session-profile`, { sessionId, profile: name })
+          .then(() => {
+            setBusy(false)
+            setOpen(false)
+            load()
+          })
+          .catch((err) => {
+            setBusy(false)
+            setError(err.message)
+          })
+      }
+
+      const profiles = model && Array.isArray(model.profiles) ? model.profiles : []
+      const groups = profiles.filter((item) => item.builtin !== true)
+      const current = model && typeof model.currentSessionProfile === 'string' ? model.currentSessionProfile : ''
+      const currentItem = profiles.filter((item) => item.name === current)[0] || null
+      const currentLabel = current === '' ? '' : (currentItem && currentItem.label) || current
+
+      const trigger = h(
+        'button',
+        {
+          type: 'button',
+          'data-gate-session-button': SESSION_BUTTON_ID,
+          title:
+            current === ''
+              ? '本会话没挂特别组，只走全局名单 —— 点这里挂一个'
+              : `本会话挂的特别组：${currentLabel}（点这里换一个）`,
+          onClick: () => setOpen((value) => !value),
+          style: {
+            cursor: 'pointer',
+            display: 'inline-flex',
+            alignItems: 'center',
+            gap: '5px',
+            fontSize: '12px',
+            lineHeight: '22px',
+            padding: '0 8px',
+            borderRadius: '8px',
+            border: `1px solid ${current === '' ? C.border : C.accent}`,
+            background: current === '' ? 'transparent' : 'rgba(77,107,254,0.16)',
+            color: current === '' ? C.dim : C.text,
+            maxWidth: '180px',
+          },
+        },
+        h(GateIcon, { size: 13 }),
+        h(
+          'span',
+          { style: { overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' } },
+          current === '' ? '门禁' : currentLabel,
+        ),
+      )
+
+      if (!open) return h('span', { style: { display: 'inline-flex' } }, trigger)
+
+      const row = (key, label, hint, active) =>
+        h(
+          'button',
+          {
+            key,
+            type: 'button',
+            disabled: busy,
+            'data-gate-session-pick': key === '' ? '(none)' : key,
+            onClick: () => pick(key),
+            style: {
+              cursor: busy ? 'default' : 'pointer',
+              display: 'block',
+              width: '100%',
+              textAlign: 'left',
+              padding: '6px 8px',
+              borderRadius: '8px',
+              border: 'none',
+              background: active ? 'rgba(77,107,254,0.22)' : 'transparent',
+              color: C.text,
+              opacity: busy ? 0.6 : 1,
+            },
+          },
+          h(
+            'div',
+            { style: { display: 'flex', alignItems: 'center', gap: '6px', fontSize: '12px' } },
+            h('span', { style: { color: active ? C.accent : C.idle } }, active ? '●' : '○'),
+            h('span', { style: { flex: 1, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' } }, label),
+          ),
+          hint
+            ? h('div', { style: { fontSize: '11px', color: C.dim, marginLeft: '16px' } }, hint)
+            : null,
+        )
+
+      const body = h(
+        'div',
+        null,
+        h(
+          'div',
+          {
+            style: {
+              fontSize: '11px',
+              fontWeight: 600,
+              letterSpacing: '0.04em',
+              color: C.dim,
+              padding: '4px 8px 6px',
+            },
+          },
+          '本会话的门禁',
+        ),
+        row('', '不额外限制（只走全局名单）', current === '' ? '当前' : '', current === ''),
+        groups.length === 0
+          ? h(
+              'div',
+              { style: { padding: '8px 9px 6px', lineHeight: '17px' } },
+              h('div', { style: { fontSize: '12px', color: C.text, marginBottom: '3px' } }, '还没有特别组'),
+              h(
+                'div',
+                { style: { fontSize: '11px', color: C.dim } },
+                '左边「门禁 → 特别门禁」里点「＋ 严格组 / ＋ 宽松组」建一个，再回来挂。',
+              ),
+            )
+          : groups.map((item) =>
+              row(
+                item.name,
+                item.label,
+                `${sessionModeText(item)} · ${Array.isArray(item.allow) ? item.allow.length : 0} 条${
+                  current === item.name ? ' · 当前' : ''
+                }`,
+                current === item.name,
+              ),
+            ),
+        error
+          ? h('div', { style: { fontSize: '11px', color: C.bad, padding: '6px 8px', wordBreak: 'break-all' } }, error)
+          : null,
+        h(
+          'div',
+          {
+            style: {
+              marginTop: '6px',
+              paddingTop: '6px',
+              borderTop: `1px solid ${C.border}`,
+              fontSize: '11px',
+              color: C.dim,
+              padding: '6px 8px 2px',
+              lineHeight: '16px',
+            },
+          },
+          '组只会更严，不会放宽全局名单。',
+        ),
+      )
+
+      return h(
+        'span',
+        { style: { position: 'relative', display: 'inline-flex' } },
+        trigger,
+        h('div', {
+          key: 'backdrop',
+          onClick: () => setOpen(false),
+          style: { position: 'fixed', inset: 0, zIndex: 50 },
+        }),
+        h(
+          'div',
+          {
+            key: 'popover',
+            style: {
+              position: 'absolute',
+              right: 0,
+              top: 'calc(100% + 6px)',
+              width: '252px',
+              zIndex: 51,
+              padding: '6px',
+              borderRadius: '10px',
+              border: `1px solid ${C.border2}`,
+              /* 抬升面用 bg-layer-1。bg-overlay 是「浮层遮罩色」，铺在深色底上会发脏灰 */
+              background: 'var(--dsw-alias-bg-layer-1, #1e2026)',
+              boxShadow: '0 18px 44px rgba(0,0,0,0.55), inset 0 1px 0 rgba(255,255,255,0.04)',
+            },
+          },
+          h(Boundary, null, body),
+        ),
+      )
+    }
+
     function apply(ctx) {
       try {
         const disposeRow = ctx.slots.inject('sidebar.panellist', () =>
@@ -1504,12 +2216,16 @@ window.__ModuleLoader__.load({
         const disposePage = ctx.slots.inject('main', () =>
           ctx.slots.register({ name: 'main', key: PANEL_ID }, GateShell),
         )
+        const disposeSession = ctx.slots.inject(SESSION_SLOT, () =>
+          ctx.slots.register({ name: SESSION_SLOT, id: SESSION_BUTTON_ID, order: 1 }, SessionGateButton),
+        )
         ctx.effect(() => () => {
+          disposeSession()
           disposePage()
           disposeRow()
         })
         console.log(
-          `[dsh-isolation-gate] client: 「门禁」行 + 整页已挂到 slots（order ${PANEL_ORDER}，紧贴「技能」5 下方）`,
+          `[dsh-isolation-gate] client: 「门禁」行 + 整页 + 会话头部小按钮已挂到 slots（order ${PANEL_ORDER}，紧贴「技能」5 下方）`,
         )
       } catch (error) {
         console.error('[dsh-isolation-gate] client: 槽位注册失败', error)
@@ -1519,7 +2235,29 @@ window.__ModuleLoader__.load({
     return {
       apply,
       inject: ['slots'],
-      __selftest: { GateShell, GateView, ProfilesPage, AuditPage, GateIcon, Segmented, ObjectRow, GroupCard, PANEL_ID, PANEL_ORDER },
+      __selftest: {
+        GateShell,
+        GateView,
+        TabBar,
+        SHELL_TABS,
+        PROFILE_PLAIN,
+        ProfilesPage,
+        ProfilesEditor,
+        AuditPage,
+        GateIcon,
+        Segmented,
+        ObjectRow,
+        GroupCard,
+        PANEL_ID,
+        PANEL_ORDER,
+        SessionGateButton,
+        sessionModeText,
+        profileMode,
+        ModeStrip,
+        PROFILE_MODE,
+        SESSION_BUTTON_ID,
+        SESSION_SLOT,
+      },
     }
   },
 })