dsh-isolation-gate 0.4.0 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 1.1.0 — 2026-10-24
+
+- 加固：`gate_request` 只接受已在名单里的对象；面板「批准」会复核对象仍在受管名单（防止批准出名单外的孤儿对象）。
+**模型可以直接管门禁了。** 以前改门禁只能人工点面板或 shell 出去跑 `gate.mjs`；这一版把同一套能力注册成 7 个模型工具，像任务板那样「说需求 → 模型自己调」。
+
+- **新增 7 个工具**：`gate_status`（全量状态）、`gate_check`（干跑判定）、`gate_add`（加对象，固定「禁」）、`gate_set_level`（改级别）、`gate_request`（申请放宽）、`gate_requests`（看待批）、`gate_log`（读审计）。
+- **权限边界（刻意的不对称）**：查 / 新增 / 收紧随时可做；**放宽（→只读 / 可读写删）模型自己批不了** —— 没户主授权窗口时只生成一条待批申请。
+- **待批队列**：新文件 `<状态目录>\requests.json`（v1），含 `requests[]` 与 `aiGrantUntil`；同目标同级别去重，最多 50 条。**不动已冻结的 state v3**。
+- **新增 4 条路由**：`GET /requests`、`POST /requests-approve`、`POST /requests-reject`、`POST /grant`（户主在面板/本机窗口批准，模型工具里没有"批准"这个动作）。
+- **零新依赖**：工具定义直接按宿主 `ToolDefinition` 形状注册，**没有引入 `@deepseek-ai/dsh-tools` peer**，躲开兼容性闸门。
+- 测试：6 个套件全绿（路由数 16 → 20）。
+
+## 1.0.0 — 2026-10-23
+
+**1.0 = 功能与格式冻结，不是「完美版」。** 承诺范围见 README 的「1.0 的稳定性承诺」：状态文件 v3、CLI 子命令与退出码、HTTP 路径、四条判定语义 —— 只增不破。
+
+这一版**没有功能变更、没有格式变更**，只做发版前的对齐：
+
+- **文档纠错**：状态文件章节标到 v3（原文写 v2，实际 `STATE_VERSION = 3`）。
+- **测试数字纠错**：改为实跑结果 **6 个套件 · 396 条断言**（原文「4 个套件 · 325 断言」是旧数；英文 README 的 309 同样过期）。
+- **定位改写**：从「别人做规则、我们做管理面」改为「别人按工具/参数立规则，我们按目录立对象」—— 前者已被同类追上，后者才是实际差异。
+- **SECURITY.md**：支持范围改 `1.x`；新增「已知边界」五条（同权限域可自改、档位模式无 realpath、黑名单只判抽到的目标、审计可改、管不到 DSH 之外）。
+- **新增**：README（中/英）各加一节「1.0 的稳定性承诺」。
+
 ## 0.4.0 — 2026-10-23
 
 - **改（重要）**：组类型（严格 / 宽松）以前只在按钮上写一句小字，实际是**两套相反语义** —— 严格组是白名单（没列进组的全拒），宽松组是黑名单（没列进组的照常）。实测踩坑：把目录加进严格组当「只禁这个」，结果全盘封死。现在模板卡片和编辑区都挂一条醒目的**模式横幅**（白名单模式 / 黑名单模式 + 「没列进组的怎么算」），编辑区还给一键「换成宽松组 / 严格组」（不动清单，只换清单外怎么算）。

package/README.en.md

@@ -91,22 +91,24 @@ dsh plugin --profile desktop add dsh-isolation-gate
 
 ---
 
-## State file (v2)
+## State file (v3)
 
 ```jsonc
 {
-  "version": 2,
+  "version": 3,
   "defaultLevel": "deny",
   "groups": { "harness isolation": { "note": "", "updatedAt": "…" } },
   "objects": {
     "Zcode": { "level": "deny", "note": "", "group": "harness isolation", "updatedAt": "…" },
     "E:\\data\\shared\\project": { "level": "read", "note": "", "group": "", "updatedAt": "…" }
-  }
+  },
+  "profiles": { "strict-delivery": { "mode": "allowlist", "allow": [{ "path": "E:\\data\\shared", "level": "read" }], "network": "deny", "unknownTool": "deny" } },
+  "sessionOverrides": { "<sessionId>": "strict-delivery" }
 }
 ```
 
-- **v1 is still readable**: legacy `harnesses: { key: { level } }` is migrated on read, **levels are preserved**;
-  the next write persists v2.
+- **Legacy formats stay readable**: v1 `harnesses: { key: { level } }` and v2 `objects` are normalised to v3 on read
+  (**levels are preserved**; `profiles` / `sessionOverrides` default to empty); the next write persists v3.
 - Missing file = **deny everything**; corrupt JSON = **deny everything and never overwrite it**.
 - No BOM; writes go through temp-file + rename (atomic).
 - `state.harnesses` remains a read-only in-memory alias; it is no longer written to disk.
@@ -185,6 +187,19 @@ External `Origin` → 403; wrong method → 405; bad JSON / invalid level → 40
 
 ---
 
+## The 1.0 stability promise
+
+From 1.0 onward, the surfaces below **only grow, never break**. A breaking change would ship as 2.0 with a migration note.
+
+| Surface | Promise |
+|---|---|
+| **State file** | On-disk format `v3`; v1 / v2 are read-compatible and upgraded on write, levels preserved. New fields are appended only; existing field meanings do not change. |
+| **CLI** | `bin/gate.mjs` subcommands and exit codes (`0` allowed / `3` denied / `2` usage or environment error) are frozen; new flags are additive. |
+| **HTTP** | Existing `/__dsh-isolation-gate/*` paths and methods are frozen; new routes are additive. |
+| **Decision semantics** | The three levels (deny / read / full), longest-prefix matching, default deny and fail-closed are frozen — changing them would be a different product. |
+
+**Not promised**: panel visuals and copy, and audit-log fields, may evolve; bug fixes are not breaking changes.
+
 ## Known boundaries (read this)
 
 1. **Raw filesystem access and separate processes are not blocked.** Any program or script that bypasses DSH tool calls can read/write the disk directly.
@@ -198,7 +213,7 @@ External `Origin` → 403; wrong method → 405; bad JSON / invalid level → 40
 ## Tests
 
 ```bash
-node test/run-all.mjs     # 4 suites · 309 assertions · fully offline
+node test/run-all.mjs     # 6 suites · 396 assertions · fully offline
 node --check lib/*.js
 ```
 

package/README.md

@@ -28,8 +28,10 @@ dsh plugin --profile desktop add dsh-isolation-gate
 
 它不是又一个 allow/deny 规则引擎，也不是沙箱本身。
 
-- **别人做的是「怎么让 agent 多访问几个目录」**（multi-root / allowlist / write-protect）或「怎么用规则拦住工具」（permission-rules / safety-net）；
-- **我们做的是「这台机器上哪些目录属于禁区、现在给什么级别、谁改的、agent 自己怎么查」**。
+- **别人按「工具 / 命令 / 参数」立规则**（`dsh-permission-rules`、`dsh-permissions` 这类：allow / deny / ask + glob / 正则）；
+- **我们按「目录」立对象**：这台机器上哪些目录属于禁区、现在给什么级别、谁改的、agent 自己怎么查。
+
+规则引擎回答的是「**这次调用准不准**」，门禁回答的是「**这个目录开不开**」。两者可以叠着用，不冲突。
 
 所以它的核心是**管理面**：
 
@@ -105,23 +107,23 @@ dsh plugin --profile desktop add dsh-isolation-gate
 
 ---
 
-## 状态文件（v2）
+## 状态文件（v3）
 
 ```jsonc
 {
-  "version": 2,
+  "version": 3,
   "defaultLevel": "deny",
-  "groups": {
-    "harness 隔离": { "note": "", "updatedAt": "…" }
-  },
+  "groups": { "harness 隔离": { "note": "", "updatedAt": "…" } },
   "objects": {
     "Zcode": { "level": "deny", "note": "", "group": "harness 隔离", "updatedAt": "…" },
     "E:\\资料\\合作档案\\某项目": { "level": "read", "note": "", "group": "", "updatedAt": "…" }
-  }
+  },
+  "profiles": { "严格交付": { "mode": "allowlist", "allow": [{ "path": "E:\\资料\\库", "level": "read" }], "network": "deny", "unknownTool": "deny" } },
+  "sessionOverrides": { "<sessionId>": "严格交付" }
 }
 ```
 
-- **v1 仍可读**：旧的 `harnesses: { key: { level } }` 读入时自动迁移成 `objects`，**级别不丢**；下一次写盘才落成 v2。
+- **旧格式仍可读**：v1 的 `harnesses: { key: { level } }` 与 v2 的 `objects` 读入时自动收敛成 v3（**级别不丢**，`profiles` / `sessionOverrides` 缺省为空）；下一次写盘才落成 v3。
 - 文件缺失 = **全禁**；坏 JSON = **全禁且不覆盖原文件**。
 - 无 BOM；写盘走临时文件 + rename（原子替换）。
 - `state.harnesses` 在内存里保留为只读别名，磁盘上不再写它。
@@ -202,6 +204,19 @@ node bin/gate.mjs log    --limit 20
 
 ---
 
+## 1.0 的稳定性承诺
+
+从 1.0 起，下面这些**只增不破**；要破坏会走 2.0 并附迁移说明：
+
+| 面 | 承诺 |
+|---|---|
+| **状态文件** | 磁盘格式 `v3`；v1 / v2 一律**读时兼容、写时升级**，级别不丢。新增字段只追加，不改已有字段含义。 |
+| **CLI** | `bin/gate.mjs` 的子命令与退出码（`0` 放行 / `3` 拒绝 / `2` 用错或环境错误）不改；新参数只增加。 |
+| **HTTP** | `/__dsh-isolation-gate/*` 现有路径与方法不改；新路由只增加。 |
+| **判定语义** | 三级（deny / read / full）、最长前缀命中、默认禁、fail-closed —— 这四项冻结；改它们等于换产品。 |
+
+**不承诺**：面板的视觉与文案、审计日志的字段可以随版本演进；修 bug 不算破坏性变更。
+
 ## 已知边界（必须明说）
 
 1. **raw fs 与独立进程拦不住。** 任何程序、脚本、别的 agent 不经过 DSH 工具调用就直接读写磁盘，本插件看不到。
@@ -217,16 +232,18 @@ node bin/gate.mjs log    --limit 20
 ## 自测
 
 ```bash
-node test/run-all.mjs     # 4 个套件 · 325 断言 · 全离线（不需要 GUI/dsh）
+node test/run-all.mjs     # 6 个套件 · 396 断言 · 全离线（不需要 GUI/dsh）
 node --check lib/*.js
 ```
 
 | 套件 | 覆盖 |
 |---|---|
-| `run-data-layer.mjs` | 状态 v1→v2 迁移 / 无 BOM / 坏 JSON 不覆盖 / 路径键 / 名单备份 / 分组 / 孤儿清理 |
-| `run-guard.mjs` | 三级×四操作矩阵 / 最长前缀 / 同前缀不误伤 / fail-closed / 真实 I/O 闭环 |
-| `run-routes.mjs` | 11 条路由 / 组级切 / 工具门挂载与干跑 / 选择器缺省 / 级别落盘 / 403/405/400 |
-| `run-client.mjs` | 两座位注册 / 摘要条 / 分组卡片 / 分段控件 / `⋯` 菜单 / 空态 / 交互接线 |
+| `run-data-layer.mjs`（85） | 状态 v1/v2→v3 迁移 / 无 BOM / 坏 JSON 不覆盖 / 路径键 / 名单备份 / 分组 / 孤儿清理 |
+| `run-guard.mjs`（74） | 三级×四操作矩阵 / 最长前缀 / 同前缀不误伤 / fail-closed / 真实 I/O 闭环 |
+| `run-profiles.mjs`（45） | 隔离强度三档 / 白名单与黑名单语义 / 会话绑定只能加严 / 联网软禁 |
+| `run-profiles-runtime.mjs`（11） | 档位文件读取 / 目录绑定 / 坏配置 fail-closed |
+| `run-routes.mjs`（84） | 11 条路由 / 组级切 / 工具门挂载与干跑 / 选择器缺省 / 级别落盘 / 403/405/400 |
+| `run-client.mjs`（97） | 两座位注册 / 摘要条 / 分组卡片 / 分段控件 / `⋯` 菜单 / 空态 / 交互接线 |
 
 ---
 
@@ -249,6 +266,7 @@ MIT · 见 [LICENSE](./LICENSE)。
 
 - [x] 截图四张：总览 / 组卡 / 审计与诊断 / 特别组草稿（见 [docs/screenshots](./docs/screenshots)）
 - [ ] 30 秒演示 GIF（欢迎贡献：录你自己机器上的演示；我们不录，整屏会带出无关窗口）
+- [ ] **认知帷幕**：受管路径的读取不直接回原文，只回字段摘要或打码内容（群友提的方向；比目录权限更接近「少看一点」）
 - [ ] `gate export --csv`：把审计日志导出成表格
 - [ ] 临时授权：给某对象一个到期时间，到点自动回到 `deny`
 - [ ] 状态文件并发锁（多窗口同时改不互相覆盖）

package/lib/client.js

@@ -546,6 +546,121 @@ window.__ModuleLoader__.load({
      * 纯视图：`props.model` 为 null 时是首次加载态。
      * 自测直接调它，不需要 React 运行时。
      */
+    /**
+     * 待批申请 + 「授权 AI 放宽」。
+     * 模型（gate_* 工具）只能收紧；要放宽就得在这里点一下 —— 这是唯一的人批入口。
+     */
+    function GateRequestsCard(props) {
+      const [data, setData] = useState(null)
+      const [error, setError] = useState(null)
+      const [busy, setBusy] = useState(false)
+
+      const load = useCallback(async () => {
+        try {
+          setData(await call(`${BASE}/requests`))
+          setError(null)
+        } catch (e) {
+          setError((e && e.message) || String(e))
+        }
+      }, [])
+
+      useEffect(() => {
+        load()
+      }, [load, props.refreshKey])
+
+      const act = async (fn) => {
+        setBusy(true)
+        setError(null)
+        try {
+          await fn()
+          await load()
+          if (props.onChanged) props.onChanged()
+        } catch (e) {
+          setError((e && e.message) || String(e))
+        } finally {
+          setBusy(false)
+        }
+      }
+
+      const pending = (data && data.requests) || []
+      const grantActive = !!(data && data.grantActive)
+      const grantUntil = data && data.aiGrantUntil
+      const levelText = (lv) => ({ deny: '禁', read: '只读', full: '可读写删' }[lv] || lv)
+
+      if (pending.length === 0 && !grantActive) return null
+
+      return h(
+        'div',
+        {
+          style: {
+            marginTop: '12px',
+            border: `1px solid ${pending.length ? C.warn : C.border}`,
+            background: pending.length ? 'rgba(251,191,36,0.06)' : C.card,
+            borderRadius: '10px',
+            padding: '10px 12px',
+          },
+        },
+        h(
+          'div',
+          { style: { display: 'flex', alignItems: 'center', gap: '8px', flexWrap: 'wrap' } },
+          h(
+            'div',
+            { style: { fontSize: '13px', fontWeight: 700, color: pending.length ? C.warn : C.text } },
+            pending.length ? `待批申请 · ${pending.length} 条（模型想把权限放宽）` : 'AI 放宽授权进行中',
+          ),
+          h('span', { style: { flex: '1 1 auto' } }),
+          h(Button, {
+            label: grantActive
+              ? `撤销授权（至 ${new Date(grantUntil).toLocaleTimeString()}）`
+              : '授权 AI 放宽 30 分钟',
+            disabled: busy,
+            onClick: () => act(() => post(`${BASE}/grant`, { minutes: grantActive ? 0 : 30 })),
+          }),
+        ),
+        error
+          ? h('div', { style: { color: C.bad, fontSize: '12px', marginTop: '6px' } }, `✗ ${error}`)
+          : null,
+        pending.map((item) =>
+          h(
+            'div',
+            {
+              key: item.id,
+              style: {
+                display: 'flex',
+                alignItems: 'center',
+                gap: '8px',
+                flexWrap: 'wrap',
+                marginTop: '8px',
+                paddingTop: '8px',
+                borderTop: `1px solid ${C.border}`,
+              },
+            },
+            h(
+              'div',
+              { style: { fontSize: '12px', color: C.text } },
+              `${item.target}：${item.fromLevel ? levelText(item.fromLevel) : '未入名单'} → ${levelText(item.level)}`,
+            ),
+            h(
+              'div',
+              { style: { fontSize: '11px', color: C.dim, flex: '1 1 220px' } },
+              item.reason || '（没写理由）',
+            ),
+            h(Button, {
+              label: '批准',
+              primary: true,
+              disabled: busy,
+              onClick: () => act(() => post(`${BASE}/requests-approve`, { id: item.id })),
+            }),
+            h(Button, {
+              label: '驳回',
+              disabled: busy,
+              onClick: () => act(() => post(`${BASE}/requests-reject`, { id: item.id })),
+            }),
+          ),
+        ),
+      )
+    }
+
     function GateView(props) {
       const model = props.model
       const levels = (model && model.levels) || []
@@ -635,6 +750,9 @@ window.__ModuleLoader__.load({
           h(Button, { label: props.busy ? '刷新中…' : '刷新', onClick: props.onRefresh, disabled: props.busy }),
         ),
 
+        // —— 待批申请 / AI 放宽授权（模型工具的配套人批入口） ——
+        h(GateRequestsCard, { refreshKey: props.busy ? 1 : 0, onChanged: props.onRefresh }),
+
         // —— 摘要条 ——
         h(
           'div',

package/lib/gate-tools.js

@@ -0,0 +1,331 @@
+/**
+ * 模型可直接调用的门禁工具（2026-10-24 新增）。
+ *
+ * 为什么要有：户主平时不点面板，只说需求。以前模型只能 shell 出去跑
+ * `node bin/gate.mjs ...`，多一层猜；这里把同一套能力注册成工具，
+ * 模型像调 `task_board_*` 一样直接调。
+ *
+ * 权限边界（户主拍板「只能收紧是对的，但用户授权后可以全做」）：
+ *   · 查：随时；
+ *   · 新增对象：只能按默认 `deny` 加；
+ *   · 收紧（改到更严的级别）：随时；
+ *   · 放宽：只有户主在面板点了「授权 AI 放宽 N 分钟」的窗口期内才直接生效，
+ *     否则写一条待批申请，等户主批准。模型自己不能批。
+ */
+import { checkTool } from './service.js';
+import { readAudit } from './audit.js';
+import {
+  LEVELS,
+  LEVEL_LABEL,
+  readState,
+  writeState,
+  withLevel,
+  withGroup,
+  findEntryKey,
+  levelOf,
+  groupsOf,
+} from './store.js';
+import {
+  addRequest,
+  grantActive,
+  listRequests,
+  pendingCount,
+  readRequests,
+  requestsPathFor,
+} from './requests.js';
+import { normalizePathKey } from './roster.js';
+
+const OP_LEVEL = { traverse: 0, read: 1, write: 2, delete: 3 };
+const OPS = ['traverse', 'read', 'write', 'delete'];
+
+function text(schema) {
+  return { type: 'string', description: schema };
+}
+
+/** 目标解析：名字（D 盘一级目录）或绝对路径。 */
+function resolveTarget(args) {
+  if (typeof args.path === 'string' && args.path.trim()) {
+    return { target: normalizePathKey(args.path.trim()), kind: 'path' };
+  }
+  if (typeof args.name === 'string' && args.name.trim()) {
+    return { target: args.name.trim(), kind: 'name' };
+  }
+  throw new Error('必须给 name（D 盘一级目录名）或 path（绝对路径）之一');
+}
+
+function rank(level) {
+  const i = LEVELS.indexOf(level);
+  return i < 0 ? 0 : i;
+}
+
+function label(level) {
+  return LEVEL_LABEL[level] ?? level;
+}
+
+function targetExists(state, key) {
+  return findEntryKey(state, key) !== null;
+}
+
+function jsonResult(value) {
+  return {
+    schema: { type: 'object' },
+    render: (_args, v) => [{ type: 'text', text: JSON.stringify(v, null, 2) }],
+  };
+}
+
+/** 工具返回值必须是 lossless JSON：undefined / NaN / BigInt 会被宿主直接拒收。 */
+function plain(value) {
+  return value === undefined ? null : JSON.parse(JSON.stringify(value));
+}
+
+export function registerGateTools(ctx, cfg) {
+  const requestsPath = requestsPathFor(cfg.statePath);
+  const register = (definition) => {
+    const run = definition.execute;
+    const safe = { ...definition, execute: async (args, exec) => plain(await run(args, exec)) };
+    return ctx.effect(() => ctx.tools.register(safe), `dsh-isolation-gate: ${definition.name}`);
+  };
+
+  // ── 1. 看全量状态 ────────────────────────────────────────────────
+  register({
+    name: 'gate_status',
+    description:
+      '查看门禁全量状态：默认级别、所有受管对象及其级别/分组、分组列表、待批申请数、AI 放宽授权是否有效。任何"门禁里现在是什么情况"的问题先调它。',
+    parameters: { type: 'object', properties: {}, additionalProperties: false },
+    output: jsonResult(),
+    execute: async () => {
+      const state = readState(cfg.statePath).state;
+      const requests = listRequests(requestsPath);
+      const objects = Object.entries(state.objects ?? {}).map(([key, entry]) => ({
+        target: key,
+        level: entry.level,
+        levelLabel: label(entry.level),
+        group: entry.group || '',
+        note: entry.note || '',
+      }));
+      return {
+        defaultLevel: state.defaultLevel,
+        defaultLevelLabel: label(state.defaultLevel),
+        objects,
+        groups: groupsOf(state),
+        profiles: Object.keys(state.profiles ?? {}),
+        pendingRequests: requests.requests.length,
+        aiGrantUntil: requests.aiGrantUntil,
+        aiGrantActive: requests.grantActive,
+        auditPath: cfg.auditPath,
+      };
+    },
+  });
+
+  // ── 2. 干跑一次判定 ─────────────────────────────────────────────
+  register({
+    name: 'gate_check',
+    description:
+      '干跑判定：给一个路径（或目录名）和一个操作，返回门禁会不会放行、命中哪个对象、理由是什么。不读文件内容、不执行任何东西。动手前先问"这个能不能读/写"时用它。',
+    parameters: {
+      type: 'object',
+      properties: {
+        name: text('D 盘一级目录名，如 Zcode'),
+        path: text('绝对路径，如 D:\\Zcode\\a.txt'),
+        op: { type: 'string', enum: OPS, description: '操作：traverse / read / write / delete' },
+      },
+      required: ['op'],
+      additionalProperties: false,
+    },
+    output: jsonResult(),
+    execute: async (args) => {
+      const { target, kind } = resolveTarget(args);
+      const op = String(args.op);
+      if (!OPS.includes(op)) throw new Error(`未知操作 ${op}`);
+      const decision = checkTool(cfg, kind === 'path' ? { path: target, op } : { name: target, op });
+      return {
+        target,
+        kind,
+        op,
+        allowed: decision.ok ? decision.allowed === true : false,
+        reason: decision.reason,
+        matched: decision.matchedKey ?? null,
+        level: decision.level ?? null,
+        inRoster: decision.inRoster ?? null,
+        error: decision.ok ? null : decision.reason,
+      };
+    },
+  });
+
+  // ── 3. 新增对象（只能默认禁）─────────────────────────────────────
+  register({
+    name: 'gate_add',
+    description:
+      '把目录（或绝对路径）加入受管名单，级别固定为「禁」。加进来只是"开始管它"，不会放行任何东西；要只读/可写必须另外申请并由户主批准。',
+    parameters: {
+      type: 'object',
+      properties: {
+        name: text('D 盘一级目录名'),
+        path: text('绝对路径'),
+        group: text('可选：放进哪个组'),
+        note: text('可选：备注'),
+      },
+      additionalProperties: false,
+    },
+    output: jsonResult(),
+    execute: async (args) => {
+      const { target, kind } = resolveTarget(args);
+      const state = readState(cfg.statePath).state;
+      if (targetExists(state, target)) {
+        const current = levelOf(state, target);
+        return { ok: true, target, kind, level: current, changed: false, message: `已在名单里，当前「${label(current)}」` };
+      }
+      let next = withLevel(state, target, 'deny', { by: 'agent' });
+      if (args.group) next = withGroup(next, target, String(args.group), { by: 'agent' });
+      writeState(cfg.statePath, next);
+      return { ok: true, target, kind, level: 'deny', changed: true, message: '已加入名单，级别「禁」' };
+    },
+  });
+
+  // ── 4. 改级别（默认只允许收紧）──────────────────────────────────
+  register({
+    name: 'gate_set_level',
+    description:
+      '改一个受管对象的级别。收紧（往「禁」方向）随时可以；放宽（往「只读 / 可读写删」方向）只有在户主点了「授权 AI 放宽」的窗口期内才直接生效，否则会写一条待批申请并在返回里说明。',
+    parameters: {
+      type: 'object',
+      properties: {
+        name: text('D 盘一级目录名'),
+        path: text('绝对路径'),
+        level: { type: 'string', enum: LEVELS, description: 'deny / read / full' },
+        reason: text('可选：为什么要改，写进审计与待批申请'),
+      },
+      required: ['level'],
+      additionalProperties: false,
+    },
+    output: jsonResult(),
+    execute: async (args) => {
+      const { target, kind } = resolveTarget(args);
+      const want = String(args.level);
+      if (!LEVELS.includes(want)) throw new Error(`未知级别 ${want}`);
+      const state = readState(cfg.statePath).state;
+      if (!targetExists(state, target)) {
+        throw new Error(`「${target}」不在名单里；先用 gate_add 加进来（只会是「禁」）`);
+      }
+      const current = levelOf(state, target);
+      if (current === want) {
+        return { ok: true, changed: false, target, level: current, message: '已经是这个级别' };
+      }
+      const tightening = rank(want) < rank(current);
+      const requests = readRequests(requestsPath);
+      const mayWiden = grantActive(requests);
+      if (!tightening && !mayWiden) {
+        const request = addRequest(requestsPath, {
+          target,
+          targetKind: kind,
+          level: want,
+          fromLevel: current,
+          reason: args.reason ?? '',
+          requestedBy: 'agent',
+        });
+        return {
+          ok: false,
+          changed: false,
+          needsApproval: true,
+          requestId: request.id,
+          target,
+          from: current,
+          to: want,
+          message: `放宽需要户主批准：已在「门禁」面板生成待批申请 ${request.id}。户主点批准后即可生效；不要重复申请。`,
+        };
+      }
+      const next = withLevel(state, target, want, { by: 'agent' });
+      writeState(cfg.statePath, next);
+      return {
+        ok: true,
+        changed: true,
+        target,
+        from: current,
+        to: want,
+        viaGrant: !tightening && mayWiden,
+        message: tightening ? `已收紧到「${label(want)}」` : `已在授权窗口内放宽到「${label(want)}」`,
+      };
+    },
+  });
+
+  // ── 5. 申请放宽 ─────────────────────────────────────────────────
+  register({
+    name: 'gate_request',
+    description:
+      '为某个受管对象申请一个更宽的级别（只读 / 可读写删），写进待批列表等户主在面板批准。理由写清楚：为什么要、大概多久。',
+    parameters: {
+      type: 'object',
+      properties: {
+        name: text('D 盘一级目录名'),
+        path: text('绝对路径'),
+        level: { type: 'string', enum: LEVELS },
+        reason: text('为什么要放宽（户主看这条决定批不批）'),
+      },
+      required: ['level', 'reason'],
+      additionalProperties: false,
+    },
+    output: jsonResult(),
+    execute: async (args) => {
+      const { target, kind } = resolveTarget(args);
+      const want = String(args.level);
+      if (!LEVELS.includes(want)) throw new Error(`未知级别 ${want}`);
+      const state = readState(cfg.statePath).state;
+      const current = targetExists(state, target) ? levelOf(state, target) : null;
+      if (current === null) {
+        return {
+          ok: false,
+          error: `「${target}」还不在名单里。先用 gate_add 把它纳入受管（固定为「禁」），再申请放宽。`,
+          target,
+          kind,
+          hint: 'gate_add',
+        };
+      }
+      if (current === want) return { ok: true, created: false, message: '已经是这个级别，无需申请' };
+      const request = addRequest(requestsPath, {
+        target,
+        targetKind: kind,
+        level: want,
+        fromLevel: current,
+        reason: String(args.reason),
+        requestedBy: 'agent',
+      });
+      return {
+        ok: true,
+        created: true,
+        requestId: request.id,
+        target,
+        from: current,
+        to: want,
+        pending: pendingCount(requestsPath),
+        message: `已提交待批申请 ${request.id}；户主批准前保持现状。`,
+      };
+    },
+  });
+
+  // ── 6. 看待批 ──────────────────────────────────────────────────
+  register({
+    name: 'gate_requests',
+    description: '列出门禁的待批申请（模型用来看自己提的申请有没有被批准）。',
+    parameters: { type: 'object', properties: {}, additionalProperties: false },
+    output: jsonResult(),
+    execute: async () => listRequests(requestsPath),
+  });
+
+  // ── 7. 看审计 ──────────────────────────────────────────────────
+  register({
+    name: 'gate_log',
+    description: '读门禁最近的决定记录（时间 / 对象 / 级别 / 操作 / 是否放行 / 理由），不读文件内容。',
+    parameters: {
+      type: 'object',
+      properties: { limit: { type: 'integer', description: '条数，默认 20，最多 200' } },
+      additionalProperties: false,
+    },
+    output: jsonResult(),
+    execute: async (args) => {
+      const limit = Math.max(1, Math.min(200, Number(args.limit) || 20));
+      return { entries: readAudit(cfg.auditPath, limit) };
+    },
+  });
+
+  return { count: 7, requestsPath };
+}

package/lib/index.js

@@ -30,6 +30,8 @@
  */
 
 import { spawn } from 'node:child_process';
+import { registerGateTools } from './gate-tools.js';
+import { clearGrant, grantActive, listRequests, markRequest, requestsPathFor, setGrant, readRequests } from './requests.js';
 import {
   assignGroup,
   createGroup,
@@ -45,6 +47,7 @@ import {
   setLevel,
 } from './service.js';
 import { clearAudit } from './audit.js';
+import { normalizePathKey } from './roster.js';
 import { collectTargets } from './toolgate.js';
 import { decideWithProfiles, knownDirBindings, loadProfileState, __clearProfileCaches } from './profiles-runtime.js';
 import {
@@ -61,7 +64,7 @@ export const name = 'dsh-isolation-gate';
 /** `tools` 是硬依赖：工具执行门没有它就不成立。 */
 export const inject = ['tools'];
 
-const VERSION = '0.3.0';
+const VERSION = '1.1.0';
 const BASE = '/__dsh-isolation-gate';
 const MAX_BODY = 256 * 1024;
 
@@ -164,6 +167,16 @@ export function apply(ctx, config) {
     console.log('[dsh-isolation-gate] 工具执行门已关闭（config.toolGate=false，仅通道层生效）');
   }
 
+  // ---- 模型可直接调用的工具（2026-10-24）--------------------------------
+  // 户主不点面板、只说需求；模型用 gate_* 工具查/收紧/申请，放宽需户主批准。
+  try {
+    const info = registerGateTools(ctx, cfg);
+    console.log(`[dsh-isolation-gate] 已注册 ${info.count} 个模型工具（gate_*）`);
+  } catch (error) {
+    // 工具注册失败不能拖垮门禁本体（拦截仍然有效）。
+    console.log(`[dsh-isolation-gate] 工具注册失败：${error?.message ?? String(error)}`);
+  }
+
   // ---- 目录选择器（可选能力：优先宿主抽象服务，Windows 上自带原生兜底）--------
   // 契约：capability() 返回 `native`（pick）或 `browse`（list/createDirectory）之一。
   const pickerCapability = (() => {
@@ -241,6 +254,10 @@ export function apply(ctx, config) {
           `POST ${BASE}/check`,
           `GET ${BASE}/log`,
           `POST ${BASE}/audit/clear`,
+          `GET ${BASE}/requests`,
+          `POST ${BASE}/requests-approve`,
+          `POST ${BASE}/requests-reject`,
+          `POST ${BASE}/grant`,
         ],
         statePath: cfg.statePath,
         rosterPath: cfg.rosterPath,
@@ -532,6 +549,63 @@ export function apply(ctx, config) {
     }
   };
 
+  // ---- 待批申请 / AI 放宽授权（2026-10-24）------------------------------
+  // 批准与授权只走本机面板（HTTP），模型工具里没有"批准"这个动作。
+  routes.push(
+    {
+      method: 'GET',
+      path: `${BASE}/requests`,
+      handler: async () => {
+        const file = requestsPathFor(cfg.statePath);
+        return { ok: true, ...listRequests(file) };
+      },
+    },
+    {
+      method: 'POST',
+      path: `${BASE}/requests-approve`,
+      handler: async (req) => {
+        const body = await readJsonBody(req);
+        const file = requestsPathFor(cfg.statePath);
+        const request = readRequests(file).requests.find((item) => item.id === body.id);
+        if (!request || request.status !== 'pending') return { ok: false, error: '没有这条待批申请' };
+        const keys = Object.keys(readState(cfg.statePath).state.objects ?? {});
+        const stillManaged = keys.some((k) => normalizePathKey(k) === normalizePathKey(request.target));
+        if (!stillManaged) {
+          return { ok: false, error: `「${request.target}」已不在受管名单里，无法批准；请让模型重新 gate_add 后再申请。` };
+        }
+        const applied = setLevel(cfg, { name: request.target, level: request.level, by: 'owner' });
+        if (!applied.ok) return { ok: false, error: applied.error || '改级别失败' };
+        markRequest(file, request.id, 'approved');
+        return { ok: true, request, level: request.level };
+      },
+    },
+    {
+      method: 'POST',
+      path: `${BASE}/requests-reject`,
+      handler: async (req) => {
+        const body = await readJsonBody(req);
+        const file = requestsPathFor(cfg.statePath);
+        const rejected = markRequest(file, String(body.id), 'rejected');
+        return rejected ? { ok: true, request: rejected } : { ok: false, error: '没有这条待批申请' };
+      },
+    },
+    {
+      method: 'POST',
+      path: `${BASE}/grant`,
+      handler: async (req) => {
+        const body = await readJsonBody(req);
+        const file = requestsPathFor(cfg.statePath);
+        const minutes = Number(body.minutes);
+        if (minutes === 0) {
+          const cleared = clearGrant(file);
+          return { ok: true, aiGrantUntil: cleared.aiGrantUntil, grantActive: false };
+        }
+        const data = setGrant(file, minutes || 30);
+        return { ok: true, aiGrantUntil: data.aiGrantUntil, grantActive: grantActive(data) };
+      },
+    },
+  );
+
   const webServer = ctx.get('webServer');
   if (webServer !== undefined) {
     register(webServer, ctx);

package/lib/requests.js

@@ -0,0 +1,131 @@
+/**
+ * 待批申请 + AI 授权窗口（与状态文件分开存，避免动 1.0 冻结的 state v3 形状）。
+ *
+ * 设计约束（2026-10-24 户主拍板）：
+ *   · AI 默认只能收紧、只能新增（默认禁）、只能查；
+ *   · 放宽（改成 read / full）走「申请 → 户主在面板点批准」；
+ *   · 户主在面板点「授权 AI 放宽 N 分钟」后，窗口期内 AI 可以直接改，不必逐条批。
+ *
+ * 落点：与状态文件同目录的 `requests.json`。
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+export const REQUESTS_VERSION = 1;
+export const DEFAULT_GRANT_MINUTES = 30;
+export const MAX_PENDING = 50;
+
+export function requestsPathFor(statePath) {
+  return join(dirname(statePath), 'requests.json');
+}
+
+function empty(now = new Date()) {
+  return {
+    version: REQUESTS_VERSION,
+    updatedAt: now.toISOString(),
+    aiGrantUntil: null,
+    requests: [],
+  };
+}
+
+function normalize(raw) {
+  if (!raw || typeof raw !== 'object') return empty();
+  const requests = Array.isArray(raw.requests) ? raw.requests : [];
+  return {
+    version: REQUESTS_VERSION,
+    updatedAt: typeof raw.updatedAt === 'string' ? raw.updatedAt : new Date().toISOString(),
+    aiGrantUntil: typeof raw.aiGrantUntil === 'string' ? raw.aiGrantUntil : null,
+    requests: requests
+      .filter((item) => item && typeof item.id === 'string' && typeof item.target === 'string')
+      .slice(0, MAX_PENDING),
+  };
+}
+
+export function readRequests(filePath) {
+  try {
+    if (!existsSync(filePath)) return empty();
+    return normalize(JSON.parse(readFileSync(filePath, 'utf8')));
+  } catch {
+    // 读坏 ⇒ 当作空；不影响门禁本体（门禁自己的 fail-closed 在状态文件那侧）。
+    return empty();
+  }
+}
+
+export function writeRequests(filePath, data, now = new Date()) {
+  const next = normalize({ ...data, updatedAt: now.toISOString() });
+  mkdirSync(dirname(filePath), { recursive: true });
+  const tmp = `${filePath}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(next, null, 2), 'utf8');
+  renameSync(tmp, filePath);
+  return next;
+}
+
+export function grantActive(data, now = new Date()) {
+  if (!data || !data.aiGrantUntil) return false;
+  const until = Date.parse(data.aiGrantUntil);
+  return Number.isFinite(until) && until > now.getTime();
+}
+
+export function setGrant(filePath, minutes = DEFAULT_GRANT_MINUTES, now = new Date()) {
+  const data = readRequests(filePath);
+  const span = Math.max(1, Math.min(240, Number(minutes) || DEFAULT_GRANT_MINUTES));
+  data.aiGrantUntil = new Date(now.getTime() + span * 60_000).toISOString();
+  return writeRequests(filePath, data, now);
+}
+
+export function clearGrant(filePath, now = new Date()) {
+  const data = readRequests(filePath);
+  data.aiGrantUntil = null;
+  return writeRequests(filePath, data, now);
+}
+
+/** 待批：同目标 + 同级别只留一条（新的覆盖旧的），避免刷屏。 */
+export function addRequest(filePath, input, now = new Date()) {
+  const data = readRequests(filePath);
+  const pending = data.requests.filter(
+    (item) => item.status === 'pending' && !(item.target === input.target && item.level === input.level),
+  );
+  const request = {
+    id: `req-${now.getTime().toString(36)}-${Math.random().toString(36).slice(2, 6)}`,
+    target: String(input.target),
+    targetKind: input.targetKind === 'path' ? 'path' : 'name',
+    level: input.level,
+    fromLevel: input.fromLevel ?? null,
+    reason: String(input.reason ?? '').slice(0, 500),
+    requestedBy: String(input.requestedBy ?? 'agent').slice(0, 80),
+    createdAt: now.toISOString(),
+    status: 'pending',
+    decidedAt: null,
+  };
+  data.requests = [request, ...pending].slice(0, MAX_PENDING);
+  writeRequests(filePath, data, now);
+  return request;
+}
+
+export function listRequests(filePath, options = {}) {
+  const data = readRequests(filePath);
+  const includeAll = options.includeAll === true;
+  return {
+    aiGrantUntil: data.aiGrantUntil,
+    grantActive: grantActive(data, options.now),
+    requests: includeAll ? data.requests : data.requests.filter((item) => item.status === 'pending'),
+  };
+}
+
+export function findRequest(filePath, id) {
+  const data = readRequests(filePath);
+  return data.requests.find((item) => item.id === id) ?? null;
+}
+
+export function markRequest(filePath, id, status, now = new Date()) {
+  const data = readRequests(filePath);
+  const index = data.requests.findIndex((item) => item.id === id);
+  if (index < 0) return null;
+  data.requests[index] = { ...data.requests[index], status, decidedAt: now.toISOString() };
+  writeRequests(filePath, data, now);
+  return data.requests[index];
+}
+
+export function pendingCount(filePath) {
+  return listRequests(filePath).requests.length;
+}

package/package.json

@@ -1,79 +1,79 @@
-{
-  "name": "dsh-isolation-gate",
-  "version": "0.4.0",
-  "description": "门禁 · 目录访问管制（隔离区授权台）：一屏管理「哪些目录受管、各自什么级别」，三级=禁/只读/可读写删；判定同时挂在受管辖通道（bin/gate.mjs）与宿主工具执行门（ctx.tools.guard）上，默认禁、名单缺失一律拒绝（fail-closed）、审计可查、agent 可自查；支持分组批量切、目录选择器与状态文件自动迁移。",
-  "keywords": [
-    "dsh",
-    "dsh-plugin",
-    "dsh-bundle",
-    "isolation-gate",
-    "permissions",
-    "isolation",
-    "authorization",
-    "sandbox",
-    "agent-safety",
-    "access-control",
-    "windows",
-    "deepseek-harness",
-    "cordis",
-    "ai-agent",
-    "security"
-  ],
-  "license": "MIT",
-  "publishConfig": {
-    "access": "public"
-  },
-  "type": "module",
-  "main": "./lib/index.js",
-  "exports": {
-    ".": {
-      "default": "./lib/index.js"
-    },
-    "./client": {
-      "default": "./lib/client.js"
-    },
-    "./package.json": "./package.json",
-    "./locale/*.json": "./locale/*.json"
-  },
-  "bin": {
-    "gate": "bin/gate.mjs"
-  },
-  "files": [
-    "lib",
-    "bin",
-    "locale",
-    "cordis.patch.yml",
-    "README.md",
-    "README.en.md",
-    "CHANGELOG.md",
-    "LICENSE",
-    "docs"
-  ],
-  "engines": {
-    "node": ">=20.11"
-  },
-  "scripts": {
-    "test": "node test/run-all.mjs",
-    "gate": "node bin/gate.mjs",
-    "release:check": "node scripts/release-sync.mjs"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "inject": [
-        "@deepseek-ai/dsh-client-runtime"
-      ],
-      "platform": "web"
-    }
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/huanlin-labs/dsh-isolation-gate.git"
-  },
-  "homepage": "https://github.com/huanlin-labs/dsh-isolation-gate#readme",
-  "bugs": {
-    "url": "https://github.com/huanlin-labs/dsh-isolation-gate/issues"
-  }
-}
+{
+  "name": "dsh-isolation-gate",
+  "version": "1.1.0",
+  "description": "门禁 · 目录访问管制（隔离区授权台）：一屏管理「哪些目录受管、各自什么级别」，三级=禁/只读/可读写删；判定同时挂在受管辖通道（bin/gate.mjs）与宿主工具执行门（ctx.tools.guard）上，默认禁、名单缺失一律拒绝（fail-closed）、审计可查、agent 可自查；支持分组批量切、目录选择器与状态文件自动迁移。",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "dsh-bundle",
+    "isolation-gate",
+    "permissions",
+    "isolation",
+    "authorization",
+    "sandbox",
+    "agent-safety",
+    "access-control",
+    "windows",
+    "deepseek-harness",
+    "cordis",
+    "ai-agent",
+    "security"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./lib/index.js",
+  "exports": {
+    ".": {
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "default": "./lib/client.js"
+    },
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
+  },
+  "bin": {
+    "gate": "bin/gate.mjs"
+  },
+  "files": [
+    "lib",
+    "bin",
+    "locale",
+    "cordis.patch.yml",
+    "README.md",
+    "README.en.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    "docs"
+  ],
+  "engines": {
+    "node": ">=20.11"
+  },
+  "scripts": {
+    "test": "node test/run-all.mjs",
+    "gate": "node bin/gate.mjs",
+    "release:check": "node scripts/release-sync.mjs"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime"
+      ],
+      "platform": "web"
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/huanlin-labs/dsh-isolation-gate.git"
+  },
+  "homepage": "https://github.com/huanlin-labs/dsh-isolation-gate#readme",
+  "bugs": {
+    "url": "https://github.com/huanlin-labs/dsh-isolation-gate/issues"
+  }
+}