dsh-lark-bot 0.17.2 → 0.18.0

package/README.md

@@ -141,14 +141,29 @@ Markdown、toast 与旧客户端降级路径同时显示中英文。agent 最终
 | `/model`、`/providers`、`/provider`、`/key` | 打开交互式管理卡片（模型直接点选/恢复默认；管理写操作走多轮向导）|
 | `/model use <provider/model>` | 热切换当前会话模型（也兼容唯一模型 ID；下一轮生效，无需重启）|
 | `/model default <id>` | 写入 dsh 默认模型 `agent-default-model`（管理员）|
-| `/model add\|remove <provider> <modelId>` | 添加 / 删除 provider 的模型（管理员）|
+| `/model add\|remove <provider> <modelId> [--input-modalities text,image]` | 添加 / 删除 provider 的模型，可声明视觉输入能力（管理员）|
 | `/provider add\|update\|remove <id>` | 管理 provider（管理员；deepseek-official 与自定义 pi-ai）|
-| `/key set\|remove\|list <引用名>` | 管理 dsh 凭据（set / remove 需管理员）|
+| `/key set <引用名>`、`/key remove\|list <引用名>` | 通过仅请求者可提交的安全表单设置 dsh 凭据；remove 需管理员 |
+| `/secret status\|set\|remove <dsh-credential\|app-secret> <引用>` | 查询状态或安全采集/删除受支持密钥（写操作需管理员；值不进入 Agent） |
+| `/language show\|set plain\|agent …\|reset …` | 管理普通文本与 Agent 回答语言策略（写操作需管理员） |
 | `/ask <问题>` | 发送问答卡，回答写入会话上下文|
 | `/invite user\|admin\|group <id>`、`/invite list`、`/invite remove user\|group <id>` | 管理访问白名单（写操作需管理员）|
 | `/help` | 查看帮助|
 
-飞书消息中的图片会下载到本地 media 目录并传给 dsh；文本类文件会读取内容并注入任务上下文。
+每轮 SDK / ACP / Web 请求都会注入结构化、无密钥的频道上下文，并注册官方 runtime Skill
+`dsh-lark-bot`。API Key、token 与 App Secret 必须经 `/key set <引用名>`、`/secret set …` 或 Agent
+工具 `lark_request_secret` 打开的密码表单提交；普通聊天、旧 `/key set <引用名> <值>` 与
+`--api-key` 不再消费值。表单只允许发起者提交，值直接写入本机受支持目标，不进入 prompt、session、
+任务账本、归档、日志、诊断包或回复。Guardian 安全模式是降级恢复面，不提供该完整配置与密钥工具。
+
+飞书消息中的图片会按文件内容识别 PNG/JPEG/WebP/GIF 并补全安全扩展名；默认 SDK 会经 dsh
+附件存储校验后发送原生 image block，而不是把路径当作图片。无法读取或模型不支持视觉时会明确
+失败，agent 被要求不得用工作区内其他图片替代。文本类文件会读取内容并注入任务上下文。
+`/model` 卡片会把 dsh 默认模型并入可切换目录（即使 provider 的显式列表尚未包含它），
+并用去除公共前缀后的短标签、每行最多两个按钮适配移动端。provider 名称、模型、输入模态和
+推理档位从 models.dev 运行时目录发现（15 分钟内存缓存）；网络失败时只使用 dsh settings 中的
+显式配置与默认选择，不回退到代码内置名单。通过命令或向导新增视觉模型时可声明 `text,image`，
+能力字段会原样写入 settings。目录地址可用 `DSH_LARK_MODEL_CATALOG_URL` 替换。
 
 **DSH session 消息级同步（`web` adapter）**：发送 `/session` 只会列出当前 canonical workspace
 的非 subagent session 元数据，不显示正文；选择后确认卡会列明标题、ID、workspace、更新时间、
@@ -229,19 +244,27 @@ guardian 仍只救援其配置的主实例。
 
 **结果文件直接回传**：SDK / ACP / Web agent 可调用 `lark_send_file`，把当前会话 workspace、实际执行 worktree、当前 scope 归档或实例日志中的文件直接上传到原飞书聊天 / 话题；普通 `/archive [note]` 会在落盘后立即发送 Markdown + JSONL，失败时保留路径并可用 `/archive send <id> [scope|chatId]` 重试或由管理员转发到指定会话。上传只接受普通文件，默认单文件不超过 20 MiB；真实路径必须位于 bridge 计算的会话目录内，runtime 自报 cwd 不能扩大边界。
 
-**逐操作审批与 scope 权限策略**：默认 SDK 与 Web 宿主在 `tools/pre-execute` 强制拦截高风险调用，并接入 dsh rc.8 官方 `approval/request` seam；ACP 走原生 `session/request_permission`。默认 `ask` 会弹出“允许执行一次 / 拒绝”卡。管理员可用 `/permission allow` 对当前隔离 scope 自动放行逐工具审批，或用 `/permission deny` 直接拒绝并向聊天给出明确反馈；`/permission ask` 恢复逐次询问。member 隔离下可从目标 `/status` 复制 scope，执行 `/permission <策略> <scope>`；只允许修改当前聊天内 scope。策略成功落盘后才确认，持久化到 profile 的 `permission-policies.json`（0600），重启不丢，且显示在 `/status`。该策略不绕过较大/高风险任务的计划门禁；legacy `headless` 不具备工具回调能力。
+**逐操作审批与 scope 权限策略**：SDK / ACP / Web runtime 在任何本地快速通道和计划门裁决前，先通过鉴权回环读取当前 immutable scope 的 `ask|allow|deny`。`deny` 对低风险与高风险工具都先行拒绝并返回 `permission-policy` 来源；`ask` 对保守只读自省静默放行、对高风险调用弹“允许执行一次 / 拒绝”卡；`allow` 自动放行逐工具审批，但仍不替代高风险任务的计划确认或 Harness 文件沙箱。管理员可用 `/permission allow|deny|ask [scope]` 修改当前聊天内 scope；策略成功落盘后才确认，持久化到 profile 的 `permission-policies.json`（0600），重启不丢并显示在 `/status`。legacy `headless` 不具备工具回调能力。
 
 **关键任务计划门禁**：SDK / ACP / Web agent 在修改文件、运行脚本等较大或高风险动作前使用
 `lark_request_plan_approval`；同一 turn 未获批准时，runtime pre-execute 策略会拒绝写入、删除、
 移动、非只读 shell 命令与 `run_code`。一次计划批准只放行随后一次高风险调用，计划外的后续调用必须
-重新确认。`date`、`pwd`、`ls`、`find`、`rg`、`git status/log/diff` 等单条
-只读检查直接放行；包含串联、重定向、命令替换或未知程序的 shell 调用仍保守地走计划门禁。
+重新确认。快速通道只保留无路径的 `date`、`id`、`pwd`、`uname`、`whoami` 与受限的
+`git status/log/diff` 等仓库内检查；`cat`、`grep`、`find`、`head`、`tail`、`rg`、`ls` 等可读取文件或枚举路径的命令不在快速通道，避免借工作区外路径读取环境或凭据。SDK `bash` 自动附带的 `description`、`workdir` 与
+`run_in_background:false` 经无副作用校验后不会改变只读判定。包含未知参数、串联、重定向、
+命令替换或未知程序的 shell 调用仍保守地走计划门禁。
 bridge 先把完整 Markdown 计划作为普通消息发出，再弹出“批准，开始执行 /
 继续规划”决策卡；卡内可填写修改意见。工具在等待期间阻塞且暂停空闲超时，批准后原任务自动继续；
 继续规划时 agent 会收到意见、修订计划并再次请求确认。门禁无固定十分钟截止，跟随所属 run 的取消
 信号；停止任务会精确取消该 session 的 pending 卡并撤回。可信部署可设置
 `DSH_LARK_PLAN_GATE=off` 关闭这层独立门禁（逐工具审批仍按原策略执行）；legacy headless adapter 不具备工具回调能力。
 
+插件可控的拒绝统一为 `[policy-denial layer=<plan-gate|permission-policy|tool-approval>]`，随后给出
+`reason` 与 `to change`；Harness 自己的 `[sandbox: ...]` 明确归类为 `file-sandbox`。高风险分类器、
+persona 中的只读说明和拒绝文本由 `src/policy/tool-policy.ts` 同一来源生成，因此策略调整不会只改
+提示词或只改执行钩子。persona 同时要求任一层拒绝后停止，不得换用等价命令、工具或路径绕行。
+计划门与逐工具审批仍保留不同语义，`/permission allow` 不扩大文件沙箱，也不替代计划确认。
+
 **任务中向你提问（问答卡）**：agent 需要你拍板、确认或补充信息时，通过 `lark_ask_user` 工具弹**问答卡**（单选 / 多选 / 自由文本）。可提交卡片，也可直接回复该卡片输入任意文字；单选/多选没有合适项时，回复文字就是补充答案。系统按被回复的 card messageId 精确匹配 pending 问题，回答后任务自动继续，等待期间运行超时看门狗暂停。（与 `/ask` 的“你主动提问”方向相反。）
 
 计划、审批与问答卡提交后会立即显示成功提示、发送一条终态确认并撤回原卡，避免按钮仍停留在聊天中造成“未生效”的误解；失效卡会返回明确错误提示，入站点击与失效原因写入结构化日志。确认或撤回失败不会影响已经提交给 agent 的决策、审批结果或答案。本地人机决策回调会以 JSON 空白流保活，避免 Node HTTP 客户端在等待 5 分钟后切断仍有效的卡片。
@@ -292,7 +315,7 @@ profile 的前台进程会拒绝并提示先停止，生命周期锁阻止并发
   （需 `--api` / `--base-url` / 至少一个 `--model`，与官方 schema 一致）或 `deepseek-official`。
 - `/key set|remove|list`：读写 `~/.dsh/.credentials.yaml`（0600）；settings 只存 `apiKeyEnv` 引用，
   字面密钥不进 settings / 聊天记录。
-- **凭据引用必须关联**：`/key set <引用名> <值>` 只写入凭据文件；provider 要生效还须在其
+- **凭据引用必须关联**：`/key set <引用名>` 通过安全表单写入凭据文件；provider 要生效还须在其
   `apiKeyEnv` 字段引用同一名字（`/provider add|update ... --api-key-env <引用名>`，或向导中填写）。
   引用名与 provider ID 相同且 provider 未设 `apiKeyEnv` 时，`/key set` 会自动补关联；
   已存在的老配置在下次运行时也会自动补齐。
@@ -301,7 +324,7 @@ profile 的前台进程会拒绝并提示先停止，生命周期锁阻止并发
   `https://www.kingapi.xyz`）会自动补全为 `/v1`。dsh runtime 启动后需几百毫秒才注册
   pi-ai 路由，桥接会重试握手直到注册完成（避免 “no adapter registered for provider”）。
 
-安全提醒：在飞书会话输入密钥会对可见成员暴露，建议私聊使用或 `--api-key-env` 引用环境变量；bot 不在任何回复中回显密钥值。
+安全提醒：不要在普通飞书消息中输入密钥；使用安全表单或 `--api-key-env` 引用环境变量。bot 不读取旧式带值命令，也不在回复中回显密钥值。
 
 ## 升级、禁用与卸载
 
@@ -401,8 +424,8 @@ dsh plugin --profile dsh-lark remove dsh-lark-bot
   自动/人工验证边界见 [`docs/DSH_RC8_AUDIT.md`](docs/DSH_RC8_AUDIT.md)。
 - **运行时**：Node.js ≥ 22.19（见 `package.json` engines）。
 - **平台**：Linux / macOS / Windows（飞书 WebSocket 出站长连接，免公网服务器 / 域名 / 内网穿透）。
-- 默认 adapter 为官方 **`@deepseek-ai/dsh-sdk-client`**（SDK JSON-RPC runtime，原生 session 续跑 +
-  token 级流式事件）；`DSH_LARK_ADAPTER=acp` 切到官方 **ACP server**（审批卡）；`headless` 保留旧版
+- 默认 adapter 为官方 **`@deepseek-ai/dsh-sdk-client`**（SDK JSON-RPC runtime，原生 session 续跑、
+  token 级流式事件与 dsh attachment store 原生图片块）；`DSH_LARK_ADAPTER=acp` 切到官方 **ACP server**（审批卡）；`headless` 保留旧版
   子进程 fallback；`DSH_LARK_ADAPTER=web` 驱动**本地 dsh web agent**（`session.prompt` +
   `/api/events.mux`，网页端成为唯一写者，从根上消除多写者会话损坏）。首次启动自动在
   `~/.dsh/profiles/dsh-lark-sdk`（或 `dsh-lark-acp`）创建 runtime profile。
@@ -458,8 +481,9 @@ SDK 模式下 dsh 原生 session 续跑，headless 模式则把历史注入下
 | `DSH_LARK_DSH_COMMAND` | `自动发现` | dsh 启动命令；通常无需设置|
 | `DSH_LARK_DSH_ARGS` | `自动发现` | dsh 启动参数，逗号分隔；通常无需设置|
 | `DSH_LARK_ADAPTER` | `sdk` | `sdk`（默认，approval answerer）/ `acp`（协议原生审批）/ `headless`（legacy）/ `web`（本地 dsh web agent，单写者）|
-| `DSH_LARK_PROVIDER` | `deepseek-official` | 模型 provider|
-| `DSH_LARK_MODEL` | `deepseek-v4-flash` | 默认模型|
+| `DSH_LARK_PROVIDER` | 未设置 | 模型 provider；可由对象形式的 dsh 默认模型提供|
+| `DSH_LARK_MODEL` | 未设置 | 默认模型；可由 dsh `agent-default-model` 提供|
+| `DSH_LARK_MODEL_CATALOG_URL` | `https://models.dev/api.json` | provider / 模型能力实时目录或兼容镜像|
 | `DSH_LARK_MAX_TOKENS` | 未设置 | SDK agent 每请求输出 token 上限|
 | `DSH_LARK_WEB_URL` | `http://127.0.0.1:3080` | `web` 适配器：本地 dsh web agent 的 base URL|
 | `DSH_LARK_SESSION_PROJECTION` | `true` | `web` 适配器：启用用户显式绑定后的历史/实时消息投影；绝不自动切换（`0` 关闭）|
@@ -495,6 +519,11 @@ SDK 模式下 dsh 原生 session 续跑，headless 模式则把历史注入下
 | `DSH_LARK_UPGRADE_NOTIFY` | `false` | `true` 时发现新版本向指定 chat 推送飞书通知（默认仅日志）|
 | `DSH_LARK_UPGRADE_NOTIFY_CHAT` | — | 接收更新通知的 chat id（配合 `DSH_LARK_UPGRADE_NOTIFY=true`）|
 
+SDK / ACP 启动会先解析完整 provider/model route：显式双字段优先；缺失时读取 dsh 对象形式
+`agent-default-model: { provider, model }`；仍无法得到完整 route 时在 bridge/doctor 入口给出本项目的
+明确配置错误，不把空 provider 传给上游 runtime。受管 service 的 install/start/restart 会把旧 env
+文件中的受管键与当前 shell 合并（当前 shell 显式值优先），避免从另一个终端重启时静默丢失已有 route。
+
 启动时会自动查找本机常见的 `@deepseek-ai/dsh` 安装位置。只有自动发现失败或需要指定特殊 profile 时，才需要设置这两个变量。
 
 ## 权限与数据
@@ -587,10 +616,18 @@ pnpm check:publish-bundle   # 校验 dist 与全部 exports/bin 入口一致（
 pnpm ci:local
 pnpm release:check   # ci:local + 上游一致性检查
 pnpm compat:probe    # 临时安装锁定版 dsh，验证 SDK/ACP 握手及 SDK 工具/续接
-pnpm dsh:upstream    # 对比 npm 上游 stable 与锁定矩阵
+pnpm upstream:report # 只读检查 dsh + dsh-TUI 的 GitHub Release/npm 双源发布
+pnpm dsh:upstream    # upstream:report 的兼容别名
 pnpm security:monitor # 假冒仓库与仿冒包监控（建议每周）
 ```
 
+仓库的 `upstream-release-watch` GitHub Actions 每天运行，也可手动触发。它以
+`scripts/upstream-release-config.mjs` 中经人工确认的 `trackFrom` 为首次基线，合并全部非 draft
+GitHub Releases 与 npm 全版本/发布时间/dist-tags；每个新“上游 + 版本”创建一个带
+`upstream-update` label 的跟踪 Issue。同一版本的 npm-only Issue 会在 GitHub Release 后续补发时
+原地补充，closed Issue 也参与隐藏标记去重。该自动化只搬运并安全截断外部发布信息，不分析兼容性、
+不修改依赖或代码，也不自动创建适配 PR。
+
 开发规范见 [`AGENTS.md`](AGENTS.md)，模块契约见 [`docs/API.md`](docs/API.md)，架构见 [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md)。
 兼容矩阵的升级政策与自动化见 [`docs/COMPATIBILITY.md`](docs/COMPATIBILITY.md)。
 

package/README_EN.md

@@ -139,14 +139,34 @@ Send a normal message to the bot in Feishu to get started. Common commands:
 | `/model`, `/providers`, `/provider`, `/key` | Open the interactive hub (tap a model or restore the default; management writes use a multi-turn wizard) |
 | `/model use <provider/model>` | Hot-switch the current session model (a unique bare model ID also works; effective next message, no restart) |
 | `/model default <id>` | Write the dsh default model `agent-default-model` (admin) |
-| `/model add\|remove <provider> <modelId>` | Add / remove a provider model (admin) |
+| `/model add\|remove <provider> <modelId> [--input-modalities text,image]` | Add / remove a provider model and declare vision input (admin) |
 | `/provider add\|update\|remove <id>` | Manage providers (admin; deepseek-official and custom pi-ai) |
-| `/key set\|remove\|list <ref>` | Manage dsh credentials (set / remove require admin) |
+| `/key set <ref>`, `/key remove\|list <ref>` | Set dsh credentials through an owner-only secure form; remove requires admin |
+| `/secret status\|set\|remove <dsh-credential\|app-secret> <ref>` | Inspect status or securely collect/remove a supported secret (admin writes) |
+| `/language show\|set plain\|agent …\|reset …` | Manage plain-message and agent-answer language policy (admin writes) |
 | `/ask <question>` | Send a Q&A card; the answer is written back to session context |
 | `/invite user\|admin\|group <id>`、`/invite list`、`/invite remove user\|group <id>` | Manage the access allowlist (mutating commands require admin) |
 | `/help` | Show help |
 
-Images in Feishu messages are downloaded to the local media directory and passed to dsh; text files are read and their content is injected into the task context.
+Every SDK, ACP, and Web turn receives structured, secret-free channel context and the official runtime
+`dsh-lark-bot` skill. API keys, tokens, and App Secrets must be entered through the owner-only password form opened
+by `/key set <ref>`, `/secret set …`, or `lark_request_secret`. Ordinary chat, legacy `/key set <ref> <value>`, and
+`--api-key` no longer consume values. The value never enters prompts, sessions, jobs, archives, logs, diagnostics,
+or replies. Guardian safe mode is a degraded recovery surface without the full configuration/secret seam.
+The form payload still traverses Feishu/Lark; platform-side auditing and retention are outside this project's control,
+so use a trusted direct chat. The bridge guarantees that the value is not an ordinary chat message and is never sent
+to the cloud LLM.
+
+Feishu images are detected by content as PNG/JPEG/WebP/GIF and receive a safe extension. The default
+SDK validates them through dsh's attachment store and sends native image blocks instead of path text.
+Unreadable or unsupported images fail explicitly, and the agent is instructed never to substitute another
+workspace image. Text files are read and injected into the task context.
+The `/model` card merges the dsh default into its switchable catalogue even when a provider's explicit
+list omits it, and uses compact distinguishing labels with at most two buttons per mobile row. Provider
+names, models, input modalities, and reasoning-effort options are discovered from the models.dev runtime
+catalogue and cached in memory for 15 minutes. If it is unavailable, only explicit dsh settings and the
+configured default are shown—there is no hardcoded fallback list. Override the feed with
+`DSH_LARK_MODEL_CATALOG_URL`; model commands and the wizard preserve `inputModalities`.
 
 **Message-level DSH session sync (`web` adapter)**: `/session` lists metadata only for non-subagent sessions
 in the current canonical workspace—never message bodies. The confirmation card freezes the title, ID,
@@ -239,7 +259,8 @@ reject `web`, because a shared Web agent broadcast stream cannot isolate session
 changes, scripts, or other substantial/high-risk actions. A runtime pre-execute policy denies writes, deletes,
 moves, non-read-only shell commands and `run_code` until a plan is approved. Each approval grants only the next
 high-risk call; later unplanned calls require approval again. Single read-only inspections such as `date`, `pwd`,
-`ls`, `find`, `rg`, and `git status/log/diff` run directly; shell chaining,
+`ls`, `find`, `rg`, and `git status/log/diff` run directly. Inert SDK `bash` metadata (`description`,
+`workdir`, and `run_in_background:false`) does not change that decision; unknown metadata, shell chaining,
 redirection, command substitution, and unknown executables remain behind the conservative plan gate. The bridge sends the complete Markdown plan as a normal
 message, then a card with **Approve and execute** / **Continue planning** plus optional feedback. The tool blocks
 and pauses the idle watchdog; approval resumes the original turn, while revision returns the feedback and requires
@@ -247,6 +268,13 @@ another plan. There is no fixed ten-minute deadline: the gate follows the owning
 stopping it cancels and recalls only that session's pending card. Trusted deployments may set
 `DSH_LARK_PLAN_GATE=off` to disable this separate gate (ordinary per-tool approval still applies). The legacy headless adapter cannot use callback tools.
 
+Plugin-controlled refusals now use `[policy-denial layer=<plan-gate|permission-policy|tool-approval>]`
+followed by `reason` and `to change`; Harness `[sandbox: ...]` errors are identified as the
+`file-sandbox` layer. The high-risk classifier, persona read-only guidance, and denial text share
+`src/policy/tool-policy.ts`, so policy changes cannot update only the prompt or only enforcement.
+The plan gate and per-tool approval retain distinct semantics: `/permission allow` neither expands
+the file sandbox nor replaces plan confirmation.
+
 **Mid-task questions (question cards)**: when the agent needs a decision, confirmation, or missing information, it sends a **question card** via the `lark_ask_user` tool (single choice / multi choice / free text). Submit the form or reply directly to that card with any text—even when none of the listed choices fits. The replied card message id selects the exact pending question, the agent resumes automatically, and the run-timeout watchdog pauses while it waits. (The opposite direction of `/ask`, where you ask the agent.)
 
 Plan, approval and question-card submissions immediately show a native toast, post a terminal confirmation and recall the original card. Stale cards return an explicit error toast, while received actions and stale reasons are written to structured logs. Confirmation/recall failures do not change the decision already delivered to the agent. Local human-decision callbacks stream insignificant JSON whitespace while waiting so Node's HTTP client cannot invalidate a live card after five minutes.
@@ -302,7 +330,7 @@ Configuration is persisted the official dsh way (the same storage protocol as th
   changes (effective on the next message). A bare pi-ai Base URL (e.g. `https://www.kingapi.xyz`)
   is completed with `/v1` automatically.
 
-Security note: typing a key in a Feishu conversation exposes it to everyone who can see that chat; prefer private chats or `--api-key-env` references to environment variables. The bot never echoes key values in any reply.
+Security note: never type a key in ordinary Feishu chat. Use the secure form or an `--api-key-env` environment reference. Legacy value-bearing commands are not consumed, and replies never echo values.
 
 ## Upgrade, Disable & Uninstall
 
@@ -394,7 +422,7 @@ See [`docs/QUICK_START.md`](docs/QUICK_START.md) for installation details, state
 - **DeepSeek Harness (`dsh`)**: verified against **dsh 0.1.0-rc.8** (last verified 2026-08-22: clean temporary install, SDK JSON-RPC / ACP initialize, tool/approval, live-session resume, and restart-collision probes), connected through the official `@deepseek-ai/dsh-sdk-client` / `@deepseek-ai/dsh-acp`; see [`docs/COMPATIBILITY.md`](docs/COMPATIBILITY.md) for exact pins and probing, [`docs/adapter-notes.md`](docs/adapter-notes.md) for adapter details, and [`docs/DSH_RC8_AUDIT.md`](docs/DSH_RC8_AUDIT.md) for rc.8 risks and verification boundaries.
 - **Runtime**: Node.js ≥ 22.19 (see `engines` in `package.json`).
 - **Platform**: Linux / macOS / Windows (Feishu outbound WebSocket long connection; no public server, domain or tunneling required).
-- The default adapter is the official **`@deepseek-ai/dsh-sdk-client`** (SDK JSON-RPC runtime with native continuation, streaming events, and the rc.8 approval answerer); `DSH_LARK_ADAPTER=acp` switches to the official **ACP server** with protocol-native approval; `headless` keeps the legacy subprocess fallback; `DSH_LARK_ADAPTER=web` drives the **local dsh web agent** (`session.prompt` + `/api/events.mux` — the web agent becomes the single writer, eliminating multi-writer session-log corruption at the root). On first start the bot creates the runtime profile at `~/.dsh/profiles/dsh-lark-sdk` (or `dsh-lark-acp`).
+- The default adapter is the official **`@deepseek-ai/dsh-sdk-client`** (SDK JSON-RPC runtime with native continuation, streaming events, dsh attachment-store image blocks, and the rc.8 approval answerer); `DSH_LARK_ADAPTER=acp` switches to the official **ACP server** with protocol-native approval; `headless` keeps the legacy subprocess fallback; `DSH_LARK_ADAPTER=web` drives the **local dsh web agent** (`session.prompt` + `/api/events.mux` — the web agent becomes the single writer, eliminating multi-writer session-log corruption at the root). On first start the bot creates the runtime profile at `~/.dsh/profiles/dsh-lark-sdk` (or `dsh-lark-acp`).
 
 ## Known limitations
 
@@ -429,8 +457,9 @@ Core environment variables:
 | `DSH_LARK_DSH_COMMAND` | auto-discovered | dsh launch command; usually not needed |
 | `DSH_LARK_DSH_ARGS` | auto-discovered | dsh launch args, comma-separated; usually not needed |
 | `DSH_LARK_ADAPTER` | `sdk` | `sdk` (default, approval answerer) / `acp` (protocol-native approval) / `headless` (legacy) / `web` (local dsh web agent, single writer) |
-| `DSH_LARK_PROVIDER` | `deepseek-official` | Model provider |
-| `DSH_LARK_MODEL` | `deepseek-v4-flash` | Default model |
+| `DSH_LARK_PROVIDER` | unset | Model provider; may come from an object-form dsh default selection |
+| `DSH_LARK_MODEL` | unset | Default model; may come from dsh `agent-default-model` |
+| `DSH_LARK_MODEL_CATALOG_URL` | `https://models.dev/api.json` | Live provider/model capability feed or compatible mirror |
 | `DSH_LARK_MAX_TOKENS` | unset | Per-request output token cap for SDK agents |
 | `DSH_LARK_WEB_URL` | `http://127.0.0.1:3080` | `web` adapter: base URL of the local dsh web agent |
 | `DSH_LARK_SESSION_PROJECTION` | `true` | `web` adapter: enable history/live message projection after explicit user binding; never auto-switches (`0` disables) |
@@ -552,10 +581,18 @@ pnpm check:publish-bundle   # verifies dist matches every export & the CLI entry
 pnpm ci:local
 pnpm release:check   # ci:local + upstream consistency check
 pnpm compat:probe    # temp-installs pinned dsh; probes SDK/ACP plus SDK tool/resume
-pnpm dsh:upstream    # compares npm upstream stable with the pinned matrix
+pnpm upstream:report # read-only dsh + dsh-TUI GitHub Release/npm source report
+pnpm dsh:upstream    # backward-compatible alias for upstream:report
 pnpm security:monitor # impostor-repo & npm copycat monitor (recommended weekly)
 ```
 
+The repository's `upstream-release-watch` GitHub Actions workflow runs daily and can also be dispatched
+manually. Its reviewed `trackFrom` baselines live in `scripts/upstream-release-config.mjs`. It merges every
+non-draft GitHub Release with npm versions, publish times, and dist-tags, then creates one `upstream-update`
+Issue per upstream/version. A later GitHub Release enriches the existing npm-only Issue, while hidden markers
+deduplicate both open and closed Issues. This automation only transports sanitized, bounded release data; it
+does not assess compatibility, modify dependencies/code, or create adaptation PRs.
+
 See [`AGENTS.md`](AGENTS.md) for the development workflow, [`docs/API.md`](docs/API.md) for module contracts, and [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for the architecture. See [`docs/COMPATIBILITY.md`](docs/COMPATIBILITY.md) for the compatibility matrix, upgrade policy and automation.
 
 Contributions are welcome via Issues and PRs; see [`AGENTS.md`](AGENTS.md) for the workflow (required reading, commit conventions, push policy) and [`docs/ECOSYSTEM.md`](docs/ECOSYSTEM.md) for ecosystem delivery standards.

package/cordis.patch.yml

@@ -44,10 +44,23 @@
         endpoint: !!js process.env.DSH_LARK_FILE_URL
         token: !!js process.env.DSH_LARK_NOTIFY_TOKEN
 
+    - id: lark-secret
+      name: 'dsh-lark-bot/secret'
+      config:
+        endpoint: !!js process.env.DSH_LARK_SECRET_URL
+        token: !!js process.env.DSH_LARK_NOTIFY_TOKEN
+
+    - id: lark-ask
+      name: 'dsh-lark-bot/ask'
+      config:
+        endpoint: !!js process.env.DSH_LARK_ASK_URL
+        token: !!js process.env.DSH_LARK_NOTIFY_TOKEN
+
     - id: lark-plan-approval
       name: 'dsh-lark-bot/plan'
       config:
         endpoint: !!js process.env.DSH_LARK_PLAN_URL
+        policyEndpoint: !!js process.env.DSH_LARK_APPROVAL_URL
         token: !!js process.env.DSH_LARK_NOTIFY_TOKEN
         mode: !!js process.env.DSH_LARK_PLAN_GATE
 

package/dist/approval.js

@@ -1,28 +1,10 @@
-// src/notify/plan-tool.ts
+// src/policy/tool-policy.ts
 var READ_ONLY_SHELL_TOOLS = /* @__PURE__ */ new Set(["bash", "shell"]);
 var READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
-  "basename",
-  "cat",
   "date",
-  "df",
-  "dirname",
-  "du",
-  "find",
-  "grep",
-  "head",
   "id",
-  "jq",
-  "ls",
-  "pgrep",
-  "ps",
   "pwd",
-  "readlink",
-  "realpath",
-  "rg",
-  "stat",
-  "tail",
   "uname",
-  "wc",
   "whoami"
 ]);
 var READ_ONLY_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
@@ -36,6 +18,17 @@ var READ_ONLY_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "status"
 ]);
 var SHELL_CONTROL_SYNTAX = /[\n\r;&|<>`]|\$\(|\$\{/u;
+function policyDenialText(denial) {
+  return `[policy-denial layer=${denial.layer}] denied by ${denial.layer}: ${denial.reason}
+to change: ${denial.toChange}`;
+}
+function toolApprovalDenial(toolName) {
+  return {
+    layer: "tool-approval",
+    reason: `the user rejected the one-shot approval for tool ${toolName}`,
+    toChange: "choose a safer alternative or ask the user before requesting approval again"
+  };
+}
 function isHighRiskTool(ctx, execution) {
   if (execution.name === "lark_request_plan_approval") return false;
   if (execution.name === "run_code") return true;
@@ -69,28 +62,17 @@ function isSimpleReadOnlyShellCommand(rawArguments) {
       (word) => word === "-u" || word === "--utc" || word === "--universal" || word.startsWith("+")
     );
   }
-  if (executable === "rg") {
-    return !words.slice(1).some(
-      (word) => word === "--pre" || word.startsWith("--pre=") || word === "--hostname-bin" || word.startsWith("--hostname-bin=")
-    );
-  }
-  if (executable === "find") {
-    return !words.slice(1).some(
-      (word) => ["-delete", "-exec", "-execdir", "-ok", "-okdir", "-fprint", "-fprint0", "-fprintf"].includes(word)
-    );
-  }
-  if (executable === "tail") {
-    return !words.slice(1).some(
-      (word) => word === "-f" || word === "-F" || word === "--follow" || word.startsWith("--follow=")
-    );
-  }
-  return true;
+  return words.length === 1;
 }
 function shellCommand(rawArguments) {
   if (typeof rawArguments === "object" && rawArguments !== null && !Array.isArray(rawArguments)) {
-    const entries = Object.entries(rawArguments);
-    if (entries.length !== 1 || entries[0]?.[0] !== "command") return void 0;
-    const command = entries[0][1];
+    const record = rawArguments;
+    const allowedKeys = /* @__PURE__ */ new Set(["command", "description", "workdir", "run_in_background"]);
+    if (Object.keys(record).some((key) => !allowedKeys.has(key))) return void 0;
+    if (record.description !== void 0 && typeof record.description !== "string") return void 0;
+    if (record.workdir !== void 0 && typeof record.workdir !== "string") return void 0;
+    if (record.run_in_background !== void 0 && record.run_in_background !== false) return void 0;
+    const command = record.command;
     return typeof command === "string" ? command : void 0;
   }
   if (typeof rawArguments !== "string") return void 0;
@@ -101,11 +83,7 @@ function shellCommand(rawArguments) {
   }
 }
 function isReadOnlyGitCommand(words) {
-  let index = 0;
-  while (words[index] === "-C") {
-    if (!words[index + 1]) return false;
-    index += 2;
-  }
+  const index = 0;
   const subcommand = words[index];
   if (subcommand === "branch") {
     const flags = words.slice(index + 1);
@@ -119,7 +97,7 @@ function isReadOnlyGitCommand(words) {
   }
   if (!subcommand || !READ_ONLY_GIT_SUBCOMMANDS.has(subcommand)) return false;
   return !words.slice(index + 1).some(
-    (word) => word === "-o" || word === "--output" || word.startsWith("--output=") || word === "--ext-diff" || word === "--textconv"
+    (word) => word === "-o" || word === "--output" || word.startsWith("--output=") || word === "--ext-diff" || word === "--textconv" || word === "--no-index" || word.startsWith("/") || word.startsWith("~") || /(^|\/)\.\.(\/|$)/u.test(word)
   );
 }
 
@@ -134,21 +112,29 @@ function apply(ctx, config = {}) {
       inFlightGrant.delete(request.agent);
       return "allowed-once";
     }
-    return requestBridgeApproval(config, request, next);
+    return (await requestBridgeApproval(config, request, next)).outcome;
   });
   approvalCtx.on("tools/pre-execute", async (execution, next) => {
-    if (!isHighRiskTool(approvalCtx, execution)) return next();
+    const highRisk = isHighRiskTool(approvalCtx, execution);
+    if (!highRisk && !approvalEndpoint(config)) return next();
     const request = {
       ...execution.agent === void 0 ? {} : { agent: execution.agent },
       toolName: execution.name,
       reason: approvalReason(execution),
-      toolInput: execution.arguments
+      toolInput: execution.arguments,
+      lowRisk: !highRisk
     };
-    const outcome = await requestBridgeApproval(config, request, async () => "unavailable");
-    if (outcome !== "allowed-once") {
+    const decision = await requestBridgeApproval(config, request, async () => "unavailable");
+    if (decision.outcome !== "allowed-once") {
       return {
         kind: "deny",
-        reason: outcome === "rejected" ? "The user rejected this one-shot tool execution. Continue with a safer alternative." : "This tool execution was not approved and remains blocked."
+        reason: policyDenialText(
+          decision.denial ?? (decision.outcome === "rejected" ? toolApprovalDenial(execution.name) : {
+            layer: "tool-approval",
+            reason: `tool ${execution.name} did not receive approval (${decision.outcome})`,
+            toChange: "retry only after approval is available, or choose a safer alternative"
+          })
+        )
       };
     }
     if (execution.agent) inFlightGrant.set(execution.agent, execution.name);
@@ -160,11 +146,13 @@ function apply(ctx, config = {}) {
   });
 }
 async function requestBridgeApproval(config, request, next) {
-  const endpoint = config.endpoint ?? process.env.DSH_LARK_APPROVAL_URL;
+  const endpoint = approvalEndpoint(config);
   const token = config.token ?? process.env.DSH_LARK_NOTIFY_TOKEN;
-  if (!endpoint || !token) return next();
+  if (!endpoint || !token) return { outcome: await next() };
   const sessionId = request.agent?.session?.id;
-  if (sessionId === void 0 || typeof request.toolName !== "string") return "unavailable";
+  if (sessionId === void 0 || typeof request.toolName !== "string") {
+    return { outcome: "unavailable" };
+  }
   try {
     const response = await fetch(endpoint, {
       method: "POST",
@@ -175,16 +163,23 @@ async function requestBridgeApproval(config, request, next) {
         toolName: request.toolName,
         ...request.callId === void 0 ? {} : { callId: String(request.callId) },
         ...typeof request.reason === "string" ? { reason: request.reason } : {},
-        ...request.toolInput === void 0 ? {} : { toolInput: request.toolInput }
+        ...request.toolInput === void 0 ? {} : { toolInput: request.toolInput },
+        ..."lowRisk" in request && request.lowRisk === true ? { lowRisk: true } : {}
       }),
       ...request.signal === void 0 ? {} : { signal: request.signal }
     });
     const body = await response.json();
-    return response.ok && body.ok === true && isOutcome(body.outcome) ? body.outcome : "unavailable";
+    return response.ok && body.ok === true && isOutcome(body.outcome) ? {
+      outcome: body.outcome,
+      ...isPolicyDenial(body.denial) ? { denial: body.denial } : {}
+    } : { outcome: "unavailable" };
   } catch {
-    return request.signal?.aborted ? "cancelled" : "unavailable";
+    return { outcome: request.signal?.aborted ? "cancelled" : "unavailable" };
   }
 }
+function approvalEndpoint(config) {
+  return config.endpoint ?? process.env.DSH_LARK_APPROVAL_URL;
+}
 function approvalReason(execution) {
   if (typeof execution.arguments === "object" && execution.arguments !== null && "description" in execution.arguments && typeof execution.arguments.description === "string") {
     return execution.arguments.description;
@@ -194,6 +189,11 @@ function approvalReason(execution) {
 function isOutcome(value) {
   return value === "allowed-once" || value === "rejected" || value === "cancelled" || value === "unavailable";
 }
+function isPolicyDenial(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const denial = value;
+  return (denial.layer === "plan-gate" || denial.layer === "permission-policy" || denial.layer === "tool-approval" || denial.layer === "file-sandbox") && typeof denial.reason === "string" && typeof denial.toChange === "string";
+}
 export {
   apply,
   inject,

package/dist/approval.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/notify/plan-tool.ts","../src/notify/approval-answerer.ts"],"sourcesContent":["import type { Context } from '@deepseek-ai/cordis';\nimport {\n  objectArgs,\n  requiredString,\n  type RawToolExecution,\n  type ToolPluginContext,\n} from './raw-tool.js';\n\nexport const name = 'lark-plan-approval';\nexport const inject = ['tools'];\n\nexport interface Config {\n  endpoint?: string;\n  token?: string;\n  mode?: 'strict' | 'off';\n}\n\nexport interface PlanPolicyExecution {\n  name: string;\n  arguments: unknown;\n  agent?: object;\n}\n\nconst READ_ONLY_SHELL_TOOLS = new Set(['bash', 'shell']);\nconst READ_ONLY_COMMANDS = new Set([\n  'basename',\n  'cat',\n  'date',\n  'df',\n  'dirname',\n  'du',\n  'find',\n  'grep',\n  'head',\n  'id',\n  'jq',\n  'ls',\n  'pgrep',\n  'ps',\n  'pwd',\n  'readlink',\n  'realpath',\n  'rg',\n  'stat',\n  'tail',\n  'uname',\n  'wc',\n  'whoami',\n]);\nconst READ_ONLY_GIT_SUBCOMMANDS = new Set([\n  'diff',\n  'ls-files',\n  'ls-tree',\n  'log',\n  'merge-base',\n  'rev-parse',\n  'show',\n  'status',\n]);\nconst SHELL_CONTROL_SYNTAX = /[\\n\\r;&|<>`]|\\$\\(|\\$\\{/u;\n\ntype PlanPolicyContext = ToolPluginContext & {\n  on(\n    event: 'agent/pre-step',\n    listener: (\n      payload: { agent: object; turn: number },\n      next: () => Promise<unknown>,\n    ) => Promise<unknown>,\n  ): unknown;\n  on(\n    event: 'tools/pre-execute',\n    listener: (\n      execution: PlanPolicyExecution,\n      next: () => Promise<unknown>,\n    ) => Promise<unknown>,\n  ): unknown;\n};\n\n/** Human plan gate for substantial or high-risk repository actions. */\nexport function apply(ctx: Context, config: Config = {}) {\n  const policyCtx = ctx as PlanPolicyContext;\n  const currentTurns = new WeakMap<object, number>();\n  const approvedCalls = new WeakMap<object, number>();\n  const gateDisabled = (config.mode ?? process.env.DSH_LARK_PLAN_GATE) === 'off';\n\n  policyCtx.on('agent/pre-step', async (payload, next) => {\n    currentTurns.set(payload.agent, payload.turn);\n    return next();\n  });\n  policyCtx.on('tools/pre-execute', async (execution, next) => {\n    if (gateDisabled) return next();\n    if (!isHighRiskTool(policyCtx, execution)) return next();\n    const agent = execution.agent;\n    const turn = agent ? currentTurns.get(agent) : undefined;\n    if (agent && turn !== undefined && approvedCalls.get(agent) === turn) {\n      approvedCalls.delete(agent);\n      return next();\n    }\n    return {\n      kind: 'deny',\n      reason:\n        'This action is blocked until the current turn calls lark_request_plan_approval and the user approves the plan.',\n    };\n  });\n\n  policyCtx.tools.register({\n    name: 'lark_request_plan_approval',\n    description:\n      'Before modifying files, running scripts, or taking another substantial/high-risk action, draft a complete plan and call this tool before execution. It sends the full plan as a normal Feishu/Lark message, then waits for Approve or Continue planning plus optional feedback. Do not execute until approved. If revision is requested, revise the plan and call this tool again.',\n    parameters: {\n      type: 'object',\n      additionalProperties: false,\n      required: ['plan'],\n      properties: {\n        plan: { type: 'string', minLength: 1, description: 'Complete readable plan in Markdown.' },\n      },\n    },\n    output: {\n      schema: {\n        type: 'object',\n        additionalProperties: false,\n        required: ['resolved'],\n        properties: {\n          resolved: { type: 'boolean' },\n          decision: { type: 'string', enum: ['approved', 'revise'] },\n          feedback: { type: 'string' },\n          error: { type: 'string' },\n        },\n      },\n      render: (_args, rawValue) => {\n        const value = rawValue as {\n          resolved: boolean;\n          decision?: string;\n          feedback?: string;\n          error?: string;\n        };\n        return [{\n          type: 'text',\n          text: value.resolved\n            ? `Plan decision: ${value.decision}${value.feedback ? `; feedback: ${value.feedback}` : ''}`\n            : `Plan approval failed: ${value.error ?? 'cancelled'}`,\n        }];\n      },\n    },\n    async execute(rawArgs, exec: RawToolExecution | undefined) {\n      const args = objectArgs(rawArgs, 'lark_request_plan_approval');\n      const plan = requiredString(args, 'plan', 'lark_request_plan_approval');\n      const endpoint = config.endpoint ?? process.env.DSH_LARK_PLAN_URL;\n      const token = config.token ?? process.env.DSH_LARK_NOTIFY_TOKEN;\n      if (!endpoint || !token) {\n        throw new Error('lark_request_plan_approval is not configured (endpoint/token missing)');\n      }\n      const sessionId = exec?.agent?.session === undefined\n        ? undefined\n        : String(exec.agent.session.id);\n      if (!sessionId) throw new Error('lark_request_plan_approval needs an active session');\n      let response: Response;\n      try {\n        response = await fetch(endpoint, {\n          method: 'POST',\n          headers: { 'content-type': 'application/json' },\n          body: JSON.stringify({ token, sessionId, plan }),\n          ...(exec?.signal === undefined ? {} : { signal: exec.signal }),\n        });\n      } catch (error) {\n        if (exec?.signal?.aborted) return { resolved: false, error: 'cancelled' };\n        throw error;\n      }\n      const body = await response.json() as {\n        ok?: boolean;\n        decision?: 'approved' | 'revise';\n        feedback?: string;\n        error?: string;\n      };\n      if (!response.ok || body.ok !== true || !body.decision) {\n        if (body.error?.toLowerCase().includes('cancel')) {\n          return { resolved: false, error: body.error };\n        }\n        throw new Error(body.error ?? `plan approval delivery failed (${response.status})`);\n      }\n      if (body.decision === 'approved' && exec?.agent) {\n        const turn = currentTurns.get(exec.agent);\n        if (turn !== undefined) approvedCalls.set(exec.agent, turn);\n      }\n      return {\n        resolved: true,\n        decision: body.decision,\n        ...(body.feedback ? { feedback: body.feedback } : {}),\n      };\n    },\n  });\n}\n\nexport function isHighRiskTool(ctx: ToolPluginContext, execution: PlanPolicyExecution): boolean {\n  if (execution.name === 'lark_request_plan_approval') return false;\n  if (execution.name === 'run_code') return true;\n  const normalized = execution.name.toLowerCase().replaceAll('-', '_');\n  if (READ_ONLY_SHELL_TOOLS.has(normalized)) {\n    return !isSimpleReadOnlyShellCommand(execution.arguments);\n  }\n  try {\n    const view = ctx.tools.get?.(execution.name, execution.agent)?.presentCall?.(\n      execution.arguments,\n    ) as { card?: string; kind?: string } | undefined;\n    if (view?.card === 'terminal' || view?.card === 'diff') return true;\n    const kind = view?.kind;\n    if (kind && ['edit', 'delete', 'move', 'execute'].includes(kind)) return true;\n  } catch {\n    // Fall through to the conservative name classifier.\n  }\n  return /(^|_)(bash|shell|exec|execute|run|write|edit|patch|delete|remove|move|rename)(_|$)/u\n    .test(normalized);\n}\n\n/**\n * Read-only shell calls bypass both the plan gate and one-shot approval.\n * Keep this deliberately narrow: one command only, no shell composition, and\n * an allowlisted executable/subcommand. Unknown syntax remains high risk.\n */\nfunction isSimpleReadOnlyShellCommand(rawArguments: unknown): boolean {\n  const command = shellCommand(rawArguments)?.trim();\n  if (!command || SHELL_CONTROL_SYNTAX.test(command)) return false;\n  const words = command.split(/\\s+/u);\n  const executablePath = words[0];\n  if (\n    !executablePath ||\n    (executablePath.includes('/') &&\n      !executablePath.startsWith('/bin/') &&\n      !executablePath.startsWith('/usr/bin/'))\n  ) return false;\n  const executable = executablePath.split('/').at(-1);\n  if (!executable) return false;\n  if (executable === 'git') return isReadOnlyGitCommand(words.slice(1));\n  if (!READ_ONLY_COMMANDS.has(executable)) return false;\n  if (executable === 'date') {\n    return words.slice(1).every((word) =>\n      word === '-u' || word === '--utc' || word === '--universal' || word.startsWith('+')\n    );\n  }\n  if (executable === 'rg') {\n    return !words.slice(1).some((word) =>\n      word === '--pre' ||\n      word.startsWith('--pre=') ||\n      word === '--hostname-bin' ||\n      word.startsWith('--hostname-bin=')\n    );\n  }\n  if (executable === 'find') {\n    return !words.slice(1).some((word) =>\n      ['-delete', '-exec', '-execdir', '-ok', '-okdir', '-fprint', '-fprint0', '-fprintf'].includes(word)\n    );\n  }\n  if (executable === 'tail') {\n    return !words.slice(1).some((word) =>\n      word === '-f' || word === '-F' || word === '--follow' || word.startsWith('--follow=')\n    );\n  }\n  return true;\n}\n\nfunction shellCommand(rawArguments: unknown): string | undefined {\n  if (typeof rawArguments === 'object' && rawArguments !== null && !Array.isArray(rawArguments)) {\n    const entries = Object.entries(rawArguments);\n    if (entries.length !== 1 || entries[0]?.[0] !== 'command') return undefined;\n    const command = entries[0][1];\n    return typeof command === 'string' ? command : undefined;\n  }\n  if (typeof rawArguments !== 'string') return undefined;\n  try {\n    return shellCommand(JSON.parse(rawArguments));\n  } catch {\n    return rawArguments;\n  }\n}\n\nfunction isReadOnlyGitCommand(words: readonly string[]): boolean {\n  let index = 0;\n  while (words[index] === '-C') {\n    if (!words[index + 1]) return false;\n    index += 2;\n  }\n  const subcommand = words[index];\n  if (subcommand === 'branch') {\n    const flags = words.slice(index + 1);\n    return flags.length === 0 || flags.every((word) =>\n      ['--show-current', '--list', '--all', '-a', '--remotes', '-r', '-v', '-vv'].includes(word)\n    );\n  }\n  if (subcommand === 'remote') {\n    const args = words.slice(index + 1);\n    return args.length === 0 ||\n      args.every((word) => word === '-v' || word === '--verbose') ||\n      args[0] === 'get-url';\n  }\n  if (!subcommand || !READ_ONLY_GIT_SUBCOMMANDS.has(subcommand)) return false;\n  return !words.slice(index + 1).some((word) =>\n    word === '-o' ||\n    word === '--output' ||\n    word.startsWith('--output=') ||\n    word === '--ext-diff' ||\n    word === '--textconv'\n  );\n}\n","import type { Context } from '@deepseek-ai/cordis';\nimport { isHighRiskTool, type PlanPolicyExecution } from './plan-tool.js';\nimport type { ToolPluginContext } from './raw-tool.js';\n\nexport const name = 'lark-approval-answerer';\nexport const inject = ['approval', 'tools'];\n\nexport interface Config {\n  endpoint?: string;\n  token?: string;\n}\n\ntype Outcome = 'allowed-once' | 'rejected' | 'cancelled' | 'unavailable';\n\ninterface RawApprovalRequest {\n  agent?: { session?: { id?: unknown } };\n  toolName?: unknown;\n  callId?: unknown;\n  reason?: unknown;\n  toolInput?: unknown;\n  signal?: AbortSignal;\n}\n\ntype ApprovalContext = Context & {\n  on(\n    event: 'approval/request',\n    listener: (request: RawApprovalRequest, next: () => Promise<Outcome>) => Promise<Outcome>,\n  ): unknown;\n  on(\n    event: 'tools/pre-execute',\n    listener: (\n      execution: PlanPolicyExecution,\n      next: () => Promise<unknown>,\n    ) => Promise<unknown>,\n  ): unknown;\n};\n\n/** Terminal rc.8 approval answerer for the nested SDK and host runtimes. */\nexport function apply(ctx: Context, config: Config = {}): void {\n  const approvalCtx = ctx as ApprovalContext & ToolPluginContext;\n  const inFlightGrant = new WeakMap<object, string>();\n\n  approvalCtx.on('approval/request', async (request, next) => {\n    if (request.agent && inFlightGrant.get(request.agent) === request.toolName) {\n      inFlightGrant.delete(request.agent);\n      return 'allowed-once';\n    }\n    return requestBridgeApproval(config, request, next);\n  });\n\n  approvalCtx.on('tools/pre-execute', async (execution, next) => {\n    if (!isHighRiskTool(approvalCtx, execution)) return next();\n    const request: RawApprovalRequest = {\n      ...(execution.agent === undefined\n        ? {}\n        : { agent: execution.agent as NonNullable<RawApprovalRequest['agent']> }),\n      toolName: execution.name,\n      reason: approvalReason(execution),\n      toolInput: execution.arguments,\n    };\n    const outcome = await requestBridgeApproval(config, request, async () => 'unavailable');\n    if (outcome !== 'allowed-once') {\n      return {\n        kind: 'deny',\n        reason: outcome === 'rejected'\n          ? 'The user rejected this one-shot tool execution. Continue with a safer alternative.'\n          : 'This tool execution was not approved and remains blocked.',\n      };\n    }\n    if (execution.agent) inFlightGrant.set(execution.agent, execution.name);\n    try {\n      return await next();\n    } finally {\n      if (execution.agent) inFlightGrant.delete(execution.agent);\n    }\n  });\n}\n\nasync function requestBridgeApproval(\n  config: Config,\n  request: RawApprovalRequest,\n  next: () => Promise<Outcome>,\n): Promise<Outcome> {\n    const endpoint = config.endpoint ?? process.env.DSH_LARK_APPROVAL_URL;\n    const token = config.token ?? process.env.DSH_LARK_NOTIFY_TOKEN;\n    if (!endpoint || !token) return next();\n    const sessionId = request.agent?.session?.id;\n    if (sessionId === undefined || typeof request.toolName !== 'string') return 'unavailable';\n    try {\n      const response = await fetch(endpoint, {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({\n          token,\n          sessionId: String(sessionId),\n          toolName: request.toolName,\n          ...(request.callId === undefined ? {} : { callId: String(request.callId) }),\n          ...(typeof request.reason === 'string' ? { reason: request.reason } : {}),\n          ...(request.toolInput === undefined ? {} : { toolInput: request.toolInput }),\n        }),\n        ...(request.signal === undefined ? {} : { signal: request.signal }),\n      });\n      const body = await response.json() as { ok?: boolean; outcome?: unknown };\n      return response.ok && body.ok === true && isOutcome(body.outcome)\n        ? body.outcome\n        : 'unavailable';\n    } catch {\n      return request.signal?.aborted ? 'cancelled' : 'unavailable';\n    }\n}\n\nfunction approvalReason(execution: PlanPolicyExecution): string {\n  if (\n    typeof execution.arguments === 'object' && execution.arguments !== null &&\n    'description' in execution.arguments &&\n    typeof (execution.arguments as { description?: unknown }).description === 'string'\n  ) {\n    return (execution.arguments as { description: string }).description;\n  }\n  return `Execute high-risk tool ${execution.name}`;\n}\n\nfunction isOutcome(value: unknown): value is Outcome {\n  return value === 'allowed-once' || value === 'rejected' ||\n    value === 'cancelled' || value === 'unavailable';\n}\n"],"mappings":";AAuBA,IAAM,wBAAwB,oBAAI,IAAI,CAAC,QAAQ,OAAO,CAAC;AACvD,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACD,IAAM,uBAAuB;AAsItB,SAAS,eAAe,KAAwB,WAAyC;AAC9F,MAAI,UAAU,SAAS,6BAA8B,QAAO;AAC5D,MAAI,UAAU,SAAS,WAAY,QAAO;AAC1C,QAAM,aAAa,UAAU,KAAK,YAAY,EAAE,WAAW,KAAK,GAAG;AACnE,MAAI,sBAAsB,IAAI,UAAU,GAAG;AACzC,WAAO,CAAC,6BAA6B,UAAU,SAAS;AAAA,EAC1D;AACA,MAAI;AACF,UAAM,OAAO,IAAI,MAAM,MAAM,UAAU,MAAM,UAAU,KAAK,GAAG;AAAA,MAC7D,UAAU;AAAA,IACZ;AACA,QAAI,MAAM,SAAS,cAAc,MAAM,SAAS,OAAQ,QAAO;AAC/D,UAAM,OAAO,MAAM;AACnB,QAAI,QAAQ,CAAC,QAAQ,UAAU,QAAQ,SAAS,EAAE,SAAS,IAAI,EAAG,QAAO;AAAA,EAC3E,QAAQ;AAAA,EAER;AACA,SAAO,sFACJ,KAAK,UAAU;AACpB;AAOA,SAAS,6BAA6B,cAAgC;AACpE,QAAM,UAAU,aAAa,YAAY,GAAG,KAAK;AACjD,MAAI,CAAC,WAAW,qBAAqB,KAAK,OAAO,EAAG,QAAO;AAC3D,QAAM,QAAQ,QAAQ,MAAM,MAAM;AAClC,QAAM,iBAAiB,MAAM,CAAC;AAC9B,MACE,CAAC,kBACA,eAAe,SAAS,GAAG,KAC1B,CAAC,eAAe,WAAW,OAAO,KAClC,CAAC,eAAe,WAAW,WAAW,EACxC,QAAO;AACT,QAAM,aAAa,eAAe,MAAM,GAAG,EAAE,GAAG,EAAE;AAClD,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI,eAAe,MAAO,QAAO,qBAAqB,MAAM,MAAM,CAAC,CAAC;AACpE,MAAI,CAAC,mBAAmB,IAAI,UAAU,EAAG,QAAO;AAChD,MAAI,eAAe,QAAQ;AACzB,WAAO,MAAM,MAAM,CAAC,EAAE;AAAA,MAAM,CAAC,SAC3B,SAAS,QAAQ,SAAS,WAAW,SAAS,iBAAiB,KAAK,WAAW,GAAG;AAAA,IACpF;AAAA,EACF;AACA,MAAI,eAAe,MAAM;AACvB,WAAO,CAAC,MAAM,MAAM,CAAC,EAAE;AAAA,MAAK,CAAC,SAC3B,SAAS,WACT,KAAK,WAAW,QAAQ,KACxB,SAAS,oBACT,KAAK,WAAW,iBAAiB;AAAA,IACnC;AAAA,EACF;AACA,MAAI,eAAe,QAAQ;AACzB,WAAO,CAAC,MAAM,MAAM,CAAC,EAAE;AAAA,MAAK,CAAC,SAC3B,CAAC,WAAW,SAAS,YAAY,OAAO,UAAU,WAAW,YAAY,UAAU,EAAE,SAAS,IAAI;AAAA,IACpG;AAAA,EACF;AACA,MAAI,eAAe,QAAQ;AACzB,WAAO,CAAC,MAAM,MAAM,CAAC,EAAE;AAAA,MAAK,CAAC,SAC3B,SAAS,QAAQ,SAAS,QAAQ,SAAS,cAAc,KAAK,WAAW,WAAW;AAAA,IACtF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,cAA2C;AAC/D,MAAI,OAAO,iBAAiB,YAAY,iBAAiB,QAAQ,CAAC,MAAM,QAAQ,YAAY,GAAG;AAC7F,UAAM,UAAU,OAAO,QAAQ,YAAY;AAC3C,QAAI,QAAQ,WAAW,KAAK,QAAQ,CAAC,IAAI,CAAC,MAAM,UAAW,QAAO;AAClE,UAAM,UAAU,QAAQ,CAAC,EAAE,CAAC;AAC5B,WAAO,OAAO,YAAY,WAAW,UAAU;AAAA,EACjD;AACA,MAAI,OAAO,iBAAiB,SAAU,QAAO;AAC7C,MAAI;AACF,WAAO,aAAa,KAAK,MAAM,YAAY,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,OAAmC;AAC/D,MAAI,QAAQ;AACZ,SAAO,MAAM,KAAK,MAAM,MAAM;AAC5B,QAAI,CAAC,MAAM,QAAQ,CAAC,EAAG,QAAO;AAC9B,aAAS;AAAA,EACX;AACA,QAAM,aAAa,MAAM,KAAK;AAC9B,MAAI,eAAe,UAAU;AAC3B,UAAM,QAAQ,MAAM,MAAM,QAAQ,CAAC;AACnC,WAAO,MAAM,WAAW,KAAK,MAAM;AAAA,MAAM,CAAC,SACxC,CAAC,kBAAkB,UAAU,SAAS,MAAM,aAAa,MAAM,MAAM,KAAK,EAAE,SAAS,IAAI;AAAA,IAC3F;AAAA,EACF;AACA,MAAI,eAAe,UAAU;AAC3B,UAAM,OAAO,MAAM,MAAM,QAAQ,CAAC;AAClC,WAAO,KAAK,WAAW,KACrB,KAAK,MAAM,CAAC,SAAS,SAAS,QAAQ,SAAS,WAAW,KAC1D,KAAK,CAAC,MAAM;AAAA,EAChB;AACA,MAAI,CAAC,cAAc,CAAC,0BAA0B,IAAI,UAAU,EAAG,QAAO;AACtE,SAAO,CAAC,MAAM,MAAM,QAAQ,CAAC,EAAE;AAAA,IAAK,CAAC,SACnC,SAAS,QACT,SAAS,cACT,KAAK,WAAW,WAAW,KAC3B,SAAS,gBACT,SAAS;AAAA,EACX;AACF;;;AC1SO,IAAM,OAAO;AACb,IAAM,SAAS,CAAC,YAAY,OAAO;AAiCnC,SAAS,MAAM,KAAc,SAAiB,CAAC,GAAS;AAC7D,QAAM,cAAc;AACpB,QAAM,gBAAgB,oBAAI,QAAwB;AAElD,cAAY,GAAG,oBAAoB,OAAO,SAAS,SAAS;AAC1D,QAAI,QAAQ,SAAS,cAAc,IAAI,QAAQ,KAAK,MAAM,QAAQ,UAAU;AAC1E,oBAAc,OAAO,QAAQ,KAAK;AAClC,aAAO;AAAA,IACT;AACA,WAAO,sBAAsB,QAAQ,SAAS,IAAI;AAAA,EACpD,CAAC;AAED,cAAY,GAAG,qBAAqB,OAAO,WAAW,SAAS;AAC7D,QAAI,CAAC,eAAe,aAAa,SAAS,EAAG,QAAO,KAAK;AACzD,UAAM,UAA8B;AAAA,MAClC,GAAI,UAAU,UAAU,SACpB,CAAC,IACD,EAAE,OAAO,UAAU,MAAkD;AAAA,MACzE,UAAU,UAAU;AAAA,MACpB,QAAQ,eAAe,SAAS;AAAA,MAChC,WAAW,UAAU;AAAA,IACvB;AACA,UAAM,UAAU,MAAM,sBAAsB,QAAQ,SAAS,YAAY,aAAa;AACtF,QAAI,YAAY,gBAAgB;AAC9B,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ,YAAY,aAChB,uFACA;AAAA,MACN;AAAA,IACF;AACA,QAAI,UAAU,MAAO,eAAc,IAAI,UAAU,OAAO,UAAU,IAAI;AACtE,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,UAAI,UAAU,MAAO,eAAc,OAAO,UAAU,KAAK;AAAA,IAC3D;AAAA,EACF,CAAC;AACH;AAEA,eAAe,sBACb,QACA,SACA,MACkB;AAChB,QAAM,WAAW,OAAO,YAAY,QAAQ,IAAI;AAChD,QAAM,QAAQ,OAAO,SAAS,QAAQ,IAAI;AAC1C,MAAI,CAAC,YAAY,CAAC,MAAO,QAAO,KAAK;AACrC,QAAM,YAAY,QAAQ,OAAO,SAAS;AAC1C,MAAI,cAAc,UAAa,OAAO,QAAQ,aAAa,SAAU,QAAO;AAC5E,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,UAAU;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB;AAAA,QACA,WAAW,OAAO,SAAS;AAAA,QAC3B,UAAU,QAAQ;AAAA,QAClB,GAAI,QAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,QAAQ,MAAM,EAAE;AAAA,QACzE,GAAI,OAAO,QAAQ,WAAW,WAAW,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,QACvE,GAAI,QAAQ,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,UAAU;AAAA,MAC5E,CAAC;AAAA,MACD,GAAI,QAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,IACnE,CAAC;AACD,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO,SAAS,MAAM,KAAK,OAAO,QAAQ,UAAU,KAAK,OAAO,IAC5D,KAAK,UACL;AAAA,EACN,QAAQ;AACN,WAAO,QAAQ,QAAQ,UAAU,cAAc;AAAA,EACjD;AACJ;AAEA,SAAS,eAAe,WAAwC;AAC9D,MACE,OAAO,UAAU,cAAc,YAAY,UAAU,cAAc,QACnE,iBAAiB,UAAU,aAC3B,OAAQ,UAAU,UAAwC,gBAAgB,UAC1E;AACA,WAAQ,UAAU,UAAsC;AAAA,EAC1D;AACA,SAAO,0BAA0B,UAAU,IAAI;AACjD;AAEA,SAAS,UAAU,OAAkC;AACnD,SAAO,UAAU,kBAAkB,UAAU,cAC3C,UAAU,eAAe,UAAU;AACvC;","names":[]}
+{"version":3,"sources":["../src/policy/tool-policy.ts","../src/notify/approval-answerer.ts"],"sourcesContent":["import type { ToolPluginContext } from '../notify/raw-tool.js';\n\nexport type PolicyLayer = 'plan-gate' | 'permission-policy' | 'tool-approval' | 'file-sandbox';\n\nexport interface PolicyDenial {\n  layer: PolicyLayer;\n  reason: string;\n  toChange: string;\n}\n\nexport interface PlanPolicyExecution {\n  name: string;\n  arguments: unknown;\n  agent?: object;\n}\n\nconst READ_ONLY_SHELL_TOOLS = new Set(['bash', 'shell']);\nconst READ_ONLY_COMMANDS = new Set([\n  'date', 'id', 'pwd', 'uname', 'whoami',\n]);\nconst READ_ONLY_GIT_SUBCOMMANDS = new Set([\n  'diff', 'ls-files', 'ls-tree', 'log', 'merge-base', 'rev-parse', 'show', 'status',\n]);\nconst SHELL_CONTROL_SYNTAX = /[\\n\\r;&|<>`]|\\$\\(|\\$\\{/u;\n\nexport function policyDenialText(denial: PolicyDenial): string {\n  return `[policy-denial layer=${denial.layer}] denied by ${denial.layer}: ${denial.reason}\\n` +\n    `to change: ${denial.toChange}`;\n}\n\nexport function planGateDenial(): PolicyDenial {\n  return {\n    layer: 'plan-gate',\n    reason: 'this substantial or high-risk action has no plan approval for the current turn',\n    toChange: 'call lark_request_plan_approval and wait for approval; /permission does not change the plan gate',\n  };\n}\n\nexport function permissionPolicyDenial(scope: string, toolName: string): PolicyDenial {\n  return {\n    layer: 'permission-policy',\n    reason: `tool ${toolName} is blocked by scope ${scope}'s deny policy`,\n    toChange: `an admin can run /permission ask ${scope} or /permission allow ${scope}`,\n  };\n}\n\nexport function toolApprovalDenial(toolName: string): PolicyDenial {\n  return {\n    layer: 'tool-approval',\n    reason: `the user rejected the one-shot approval for tool ${toolName}`,\n    toChange: 'choose a safer alternative or ask the user before requesting approval again',\n  };\n}\n\n/** Persona text generated from the same command vocabulary used for enforcement. */\nexport function renderToolPolicyPersona(): string[] {\n  return [\n    `The bridge policy treats one uncomposed shell call as read-only only when its executable is one of: ${[...READ_ONLY_COMMANDS].join(', ')}; read-only git subcommands are ${[...READ_ONLY_GIT_SUBCOMMANDS].join(', ')} plus listing branch/remote forms.`,\n    'Read-only calls must not use chaining, redirects, command substitution, background execution, escalation, or mutating flags; run qualifying inspections directly.',\n    'Before modifying files, installing packages, running scripts, pushing, deleting, or taking another substantial or high-risk action, use lark_request_plan_approval and wait for approval.',\n    'The plan-gate confirms the intended plan; /permission separately controls per-tool approval and never bypasses the plan-gate or the Harness file-sandbox.',\n    'Policy refusals use [policy-denial layer=...] with a reason and to-change instruction. Harness errors beginning [sandbox: ...] are file-sandbox refusals. Report the named layer and exact error; never invent a different restriction.',\n    'After any policy or sandbox refusal, do not try an equivalent command, tool, or path to obtain the same result. Stop, report the refusal accurately, and let the user decide whether to change the policy or approve another approach.',\n  ];\n}\n\nexport function isHighRiskTool(ctx: ToolPluginContext, execution: PlanPolicyExecution): boolean {\n  if (execution.name === 'lark_request_plan_approval') return false;\n  if (execution.name === 'run_code') return true;\n  const normalized = execution.name.toLowerCase().replaceAll('-', '_');\n  if (READ_ONLY_SHELL_TOOLS.has(normalized)) {\n    return !isSimpleReadOnlyShellCommand(execution.arguments);\n  }\n  try {\n    const view = ctx.tools.get?.(execution.name, execution.agent)?.presentCall?.(\n      execution.arguments,\n    ) as { card?: string; kind?: string } | undefined;\n    if (view?.card === 'terminal' || view?.card === 'diff') return true;\n    const kind = view?.kind;\n    if (kind && ['edit', 'delete', 'move', 'execute'].includes(kind)) return true;\n  } catch {\n    // Fall through to the conservative name classifier.\n  }\n  return /(^|_)(bash|shell|exec|execute|run|write|edit|patch|delete|remove|move|rename)(_|$)/u\n    .test(normalized);\n}\n\nfunction isSimpleReadOnlyShellCommand(rawArguments: unknown): boolean {\n  const command = shellCommand(rawArguments)?.trim();\n  if (!command || SHELL_CONTROL_SYNTAX.test(command)) return false;\n  const words = command.split(/\\s+/u);\n  const executablePath = words[0];\n  if (\n    !executablePath ||\n    (executablePath.includes('/') &&\n      !executablePath.startsWith('/bin/') &&\n      !executablePath.startsWith('/usr/bin/'))\n  ) return false;\n  const executable = executablePath.split('/').at(-1);\n  if (!executable) return false;\n  if (executable === 'git') return isReadOnlyGitCommand(words.slice(1));\n  if (!READ_ONLY_COMMANDS.has(executable)) return false;\n  if (executable === 'date') {\n    return words.slice(1).every((word) =>\n      word === '-u' || word === '--utc' || word === '--universal' || word.startsWith('+')\n    );\n  }\n  return words.length === 1;\n}\n\nfunction shellCommand(rawArguments: unknown): string | undefined {\n  if (typeof rawArguments === 'object' && rawArguments !== null && !Array.isArray(rawArguments)) {\n    const record = rawArguments as Record<string, unknown>;\n    const allowedKeys = new Set(['command', 'description', 'workdir', 'run_in_background']);\n    if (Object.keys(record).some((key) => !allowedKeys.has(key))) return undefined;\n    if (record.description !== undefined && typeof record.description !== 'string') return undefined;\n    if (record.workdir !== undefined && typeof record.workdir !== 'string') return undefined;\n    if (record.run_in_background !== undefined && record.run_in_background !== false) return undefined;\n    const command = record.command;\n    return typeof command === 'string' ? command : undefined;\n  }\n  if (typeof rawArguments !== 'string') return undefined;\n  try {\n    return shellCommand(JSON.parse(rawArguments));\n  } catch {\n    return rawArguments;\n  }\n}\n\nfunction isReadOnlyGitCommand(words: readonly string[]): boolean {\n  const index = 0;\n  const subcommand = words[index];\n  if (subcommand === 'branch') {\n    const flags = words.slice(index + 1);\n    return flags.length === 0 || flags.every((word) =>\n      ['--show-current', '--list', '--all', '-a', '--remotes', '-r', '-v', '-vv'].includes(word)\n    );\n  }\n  if (subcommand === 'remote') {\n    const args = words.slice(index + 1);\n    return args.length === 0 ||\n      args.every((word) => word === '-v' || word === '--verbose') ||\n      args[0] === 'get-url';\n  }\n  if (!subcommand || !READ_ONLY_GIT_SUBCOMMANDS.has(subcommand)) return false;\n  return !words.slice(index + 1).some((word) =>\n    word === '-o' || word === '--output' || word.startsWith('--output=') ||\n    word === '--ext-diff' || word === '--textconv' || word === '--no-index' ||\n    word.startsWith('/') || word.startsWith('~') || /(^|\\/)\\.\\.(\\/|$)/u.test(word)\n  );\n}\n","import type { Context } from '@deepseek-ai/cordis';\nimport {\n  isHighRiskTool,\n  policyDenialText,\n  toolApprovalDenial,\n  type PlanPolicyExecution,\n  type PolicyDenial,\n} from '../policy/tool-policy.js';\nimport type { ToolPluginContext } from './raw-tool.js';\n\nexport const name = 'lark-approval-answerer';\nexport const inject = ['approval', 'tools'];\n\nexport interface Config {\n  endpoint?: string;\n  token?: string;\n}\n\ntype Outcome = 'allowed-once' | 'rejected' | 'cancelled' | 'unavailable';\n\ninterface ApprovalDecision {\n  outcome: Outcome;\n  denial?: PolicyDenial;\n}\n\ninterface RawApprovalRequest {\n  agent?: { session?: { id?: unknown } };\n  toolName?: unknown;\n  callId?: unknown;\n  reason?: unknown;\n  toolInput?: unknown;\n  signal?: AbortSignal;\n  lowRisk?: boolean;\n}\n\ntype ApprovalContext = Context & {\n  on(\n    event: 'approval/request',\n    listener: (request: RawApprovalRequest, next: () => Promise<Outcome>) => Promise<Outcome>,\n  ): unknown;\n  on(\n    event: 'tools/pre-execute',\n    listener: (\n      execution: PlanPolicyExecution,\n      next: () => Promise<unknown>,\n    ) => Promise<unknown>,\n  ): unknown;\n};\n\n/** Terminal rc.8 approval answerer for the nested SDK and host runtimes. */\nexport function apply(ctx: Context, config: Config = {}): void {\n  const approvalCtx = ctx as ApprovalContext & ToolPluginContext;\n  const inFlightGrant = new WeakMap<object, string>();\n\n  approvalCtx.on('approval/request', async (request, next) => {\n    if (request.agent && inFlightGrant.get(request.agent) === request.toolName) {\n      inFlightGrant.delete(request.agent);\n      return 'allowed-once';\n    }\n    return (await requestBridgeApproval(config, request, next)).outcome;\n  });\n\n  approvalCtx.on('tools/pre-execute', async (execution, next) => {\n    const highRisk = isHighRiskTool(approvalCtx, execution);\n    if (!highRisk && !approvalEndpoint(config)) return next();\n    const request: RawApprovalRequest = {\n      ...(execution.agent === undefined\n        ? {}\n        : { agent: execution.agent as NonNullable<RawApprovalRequest['agent']> }),\n      toolName: execution.name,\n      reason: approvalReason(execution),\n      toolInput: execution.arguments,\n      lowRisk: !highRisk,\n    };\n    const decision = await requestBridgeApproval(config, request, async () => 'unavailable');\n    if (decision.outcome !== 'allowed-once') {\n      return {\n        kind: 'deny',\n        reason: policyDenialText(\n          decision.denial ?? (\n            decision.outcome === 'rejected'\n              ? toolApprovalDenial(execution.name)\n              : {\n                  layer: 'tool-approval',\n                  reason: `tool ${execution.name} did not receive approval (${decision.outcome})`,\n                  toChange: 'retry only after approval is available, or choose a safer alternative',\n                }\n          ),\n        ),\n      };\n    }\n    if (execution.agent) inFlightGrant.set(execution.agent, execution.name);\n    try {\n      return await next();\n    } finally {\n      if (execution.agent) inFlightGrant.delete(execution.agent);\n    }\n  });\n}\n\nasync function requestBridgeApproval(\n  config: Config,\n  request: RawApprovalRequest,\n  next: () => Promise<Outcome>,\n): Promise<ApprovalDecision> {\n    const endpoint = approvalEndpoint(config);\n    const token = config.token ?? process.env.DSH_LARK_NOTIFY_TOKEN;\n    if (!endpoint || !token) return { outcome: await next() };\n    const sessionId = request.agent?.session?.id;\n    if (sessionId === undefined || typeof request.toolName !== 'string') {\n      return { outcome: 'unavailable' };\n    }\n    try {\n      const response = await fetch(endpoint, {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({\n          token,\n          sessionId: String(sessionId),\n          toolName: request.toolName,\n          ...(request.callId === undefined ? {} : { callId: String(request.callId) }),\n          ...(typeof request.reason === 'string' ? { reason: request.reason } : {}),\n          ...(request.toolInput === undefined ? {} : { toolInput: request.toolInput }),\n          ...('lowRisk' in request && request.lowRisk === true ? { lowRisk: true } : {}),\n        }),\n        ...(request.signal === undefined ? {} : { signal: request.signal }),\n      });\n      const body = await response.json() as {\n        ok?: boolean;\n        outcome?: unknown;\n        denial?: unknown;\n      };\n      return response.ok && body.ok === true && isOutcome(body.outcome)\n        ? {\n            outcome: body.outcome,\n            ...(isPolicyDenial(body.denial) ? { denial: body.denial } : {}),\n          }\n        : { outcome: 'unavailable' };\n    } catch {\n      return { outcome: request.signal?.aborted ? 'cancelled' : 'unavailable' };\n    }\n}\n\nfunction approvalEndpoint(config: Config): string | undefined {\n  return config.endpoint ?? process.env.DSH_LARK_APPROVAL_URL;\n}\n\nfunction approvalReason(execution: PlanPolicyExecution): string {\n  if (\n    typeof execution.arguments === 'object' && execution.arguments !== null &&\n    'description' in execution.arguments &&\n    typeof (execution.arguments as { description?: unknown }).description === 'string'\n  ) {\n    return (execution.arguments as { description: string }).description;\n  }\n  return `Execute high-risk tool ${execution.name}`;\n}\n\nfunction isOutcome(value: unknown): value is Outcome {\n  return value === 'allowed-once' || value === 'rejected' ||\n    value === 'cancelled' || value === 'unavailable';\n}\n\nfunction isPolicyDenial(value: unknown): value is PolicyDenial {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;\n  const denial = value as Partial<PolicyDenial>;\n  return (\n    denial.layer === 'plan-gate' || denial.layer === 'permission-policy' ||\n    denial.layer === 'tool-approval' || denial.layer === 'file-sandbox'\n  ) && typeof denial.reason === 'string' && typeof denial.toChange === 'string';\n}\n"],"mappings":";AAgBA,IAAM,wBAAwB,oBAAI,IAAI,CAAC,QAAQ,OAAO,CAAC;AACvD,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAO;AAAA,EAAS;AAChC,CAAC;AACD,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAW;AAAA,EAAO;AAAA,EAAc;AAAA,EAAa;AAAA,EAAQ;AAC3E,CAAC;AACD,IAAM,uBAAuB;AAEtB,SAAS,iBAAiB,QAA8B;AAC7D,SAAO,wBAAwB,OAAO,KAAK,eAAe,OAAO,KAAK,KAAK,OAAO,MAAM;AAAA,aACxE,OAAO,QAAQ;AACjC;AAkBO,SAAS,mBAAmB,UAAgC;AACjE,SAAO;AAAA,IACL,OAAO;AAAA,IACP,QAAQ,oDAAoD,QAAQ;AAAA,IACpE,UAAU;AAAA,EACZ;AACF;AAcO,SAAS,eAAe,KAAwB,WAAyC;AAC9F,MAAI,UAAU,SAAS,6BAA8B,QAAO;AAC5D,MAAI,UAAU,SAAS,WAAY,QAAO;AAC1C,QAAM,aAAa,UAAU,KAAK,YAAY,EAAE,WAAW,KAAK,GAAG;AACnE,MAAI,sBAAsB,IAAI,UAAU,GAAG;AACzC,WAAO,CAAC,6BAA6B,UAAU,SAAS;AAAA,EAC1D;AACA,MAAI;AACF,UAAM,OAAO,IAAI,MAAM,MAAM,UAAU,MAAM,UAAU,KAAK,GAAG;AAAA,MAC7D,UAAU;AAAA,IACZ;AACA,QAAI,MAAM,SAAS,cAAc,MAAM,SAAS,OAAQ,QAAO;AAC/D,UAAM,OAAO,MAAM;AACnB,QAAI,QAAQ,CAAC,QAAQ,UAAU,QAAQ,SAAS,EAAE,SAAS,IAAI,EAAG,QAAO;AAAA,EAC3E,QAAQ;AAAA,EAER;AACA,SAAO,sFACJ,KAAK,UAAU;AACpB;AAEA,SAAS,6BAA6B,cAAgC;AACpE,QAAM,UAAU,aAAa,YAAY,GAAG,KAAK;AACjD,MAAI,CAAC,WAAW,qBAAqB,KAAK,OAAO,EAAG,QAAO;AAC3D,QAAM,QAAQ,QAAQ,MAAM,MAAM;AAClC,QAAM,iBAAiB,MAAM,CAAC;AAC9B,MACE,CAAC,kBACA,eAAe,SAAS,GAAG,KAC1B,CAAC,eAAe,WAAW,OAAO,KAClC,CAAC,eAAe,WAAW,WAAW,EACxC,QAAO;AACT,QAAM,aAAa,eAAe,MAAM,GAAG,EAAE,GAAG,EAAE;AAClD,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI,eAAe,MAAO,QAAO,qBAAqB,MAAM,MAAM,CAAC,CAAC;AACpE,MAAI,CAAC,mBAAmB,IAAI,UAAU,EAAG,QAAO;AAChD,MAAI,eAAe,QAAQ;AACzB,WAAO,MAAM,MAAM,CAAC,EAAE;AAAA,MAAM,CAAC,SAC3B,SAAS,QAAQ,SAAS,WAAW,SAAS,iBAAiB,KAAK,WAAW,GAAG;AAAA,IACpF;AAAA,EACF;AACA,SAAO,MAAM,WAAW;AAC1B;AAEA,SAAS,aAAa,cAA2C;AAC/D,MAAI,OAAO,iBAAiB,YAAY,iBAAiB,QAAQ,CAAC,MAAM,QAAQ,YAAY,GAAG;AAC7F,UAAM,SAAS;AACf,UAAM,cAAc,oBAAI,IAAI,CAAC,WAAW,eAAe,WAAW,mBAAmB,CAAC;AACtF,QAAI,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,IAAI,GAAG,CAAC,EAAG,QAAO;AACrE,QAAI,OAAO,gBAAgB,UAAa,OAAO,OAAO,gBAAgB,SAAU,QAAO;AACvF,QAAI,OAAO,YAAY,UAAa,OAAO,OAAO,YAAY,SAAU,QAAO;AAC/E,QAAI,OAAO,sBAAsB,UAAa,OAAO,sBAAsB,MAAO,QAAO;AACzF,UAAM,UAAU,OAAO;AACvB,WAAO,OAAO,YAAY,WAAW,UAAU;AAAA,EACjD;AACA,MAAI,OAAO,iBAAiB,SAAU,QAAO;AAC7C,MAAI;AACF,WAAO,aAAa,KAAK,MAAM,YAAY,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,OAAmC;AAC/D,QAAM,QAAQ;AACd,QAAM,aAAa,MAAM,KAAK;AAC9B,MAAI,eAAe,UAAU;AAC3B,UAAM,QAAQ,MAAM,MAAM,QAAQ,CAAC;AACnC,WAAO,MAAM,WAAW,KAAK,MAAM;AAAA,MAAM,CAAC,SACxC,CAAC,kBAAkB,UAAU,SAAS,MAAM,aAAa,MAAM,MAAM,KAAK,EAAE,SAAS,IAAI;AAAA,IAC3F;AAAA,EACF;AACA,MAAI,eAAe,UAAU;AAC3B,UAAM,OAAO,MAAM,MAAM,QAAQ,CAAC;AAClC,WAAO,KAAK,WAAW,KACrB,KAAK,MAAM,CAAC,SAAS,SAAS,QAAQ,SAAS,WAAW,KAC1D,KAAK,CAAC,MAAM;AAAA,EAChB;AACA,MAAI,CAAC,cAAc,CAAC,0BAA0B,IAAI,UAAU,EAAG,QAAO;AACtE,SAAO,CAAC,MAAM,MAAM,QAAQ,CAAC,EAAE;AAAA,IAAK,CAAC,SACnC,SAAS,QAAQ,SAAS,cAAc,KAAK,WAAW,WAAW,KACnE,SAAS,gBAAgB,SAAS,gBAAgB,SAAS,gBAC3D,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,KAAK,oBAAoB,KAAK,IAAI;AAAA,EAC/E;AACF;;;AC5IO,IAAM,OAAO;AACb,IAAM,SAAS,CAAC,YAAY,OAAO;AAuCnC,SAAS,MAAM,KAAc,SAAiB,CAAC,GAAS;AAC7D,QAAM,cAAc;AACpB,QAAM,gBAAgB,oBAAI,QAAwB;AAElD,cAAY,GAAG,oBAAoB,OAAO,SAAS,SAAS;AAC1D,QAAI,QAAQ,SAAS,cAAc,IAAI,QAAQ,KAAK,MAAM,QAAQ,UAAU;AAC1E,oBAAc,OAAO,QAAQ,KAAK;AAClC,aAAO;AAAA,IACT;AACA,YAAQ,MAAM,sBAAsB,QAAQ,SAAS,IAAI,GAAG;AAAA,EAC9D,CAAC;AAED,cAAY,GAAG,qBAAqB,OAAO,WAAW,SAAS;AAC7D,UAAM,WAAW,eAAe,aAAa,SAAS;AACtD,QAAI,CAAC,YAAY,CAAC,iBAAiB,MAAM,EAAG,QAAO,KAAK;AACxD,UAAM,UAA8B;AAAA,MAClC,GAAI,UAAU,UAAU,SACpB,CAAC,IACD,EAAE,OAAO,UAAU,MAAkD;AAAA,MACzE,UAAU,UAAU;AAAA,MACpB,QAAQ,eAAe,SAAS;AAAA,MAChC,WAAW,UAAU;AAAA,MACrB,SAAS,CAAC;AAAA,IACZ;AACA,UAAM,WAAW,MAAM,sBAAsB,QAAQ,SAAS,YAAY,aAAa;AACvF,QAAI,SAAS,YAAY,gBAAgB;AACvC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,SAAS,WACP,SAAS,YAAY,aACjB,mBAAmB,UAAU,IAAI,IACjC;AAAA,YACE,OAAO;AAAA,YACP,QAAQ,QAAQ,UAAU,IAAI,8BAA8B,SAAS,OAAO;AAAA,YAC5E,UAAU;AAAA,UACZ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AACA,QAAI,UAAU,MAAO,eAAc,IAAI,UAAU,OAAO,UAAU,IAAI;AACtE,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,UAAI,UAAU,MAAO,eAAc,OAAO,UAAU,KAAK;AAAA,IAC3D;AAAA,EACF,CAAC;AACH;AAEA,eAAe,sBACb,QACA,SACA,MAC2B;AACzB,QAAM,WAAW,iBAAiB,MAAM;AACxC,QAAM,QAAQ,OAAO,SAAS,QAAQ,IAAI;AAC1C,MAAI,CAAC,YAAY,CAAC,MAAO,QAAO,EAAE,SAAS,MAAM,KAAK,EAAE;AACxD,QAAM,YAAY,QAAQ,OAAO,SAAS;AAC1C,MAAI,cAAc,UAAa,OAAO,QAAQ,aAAa,UAAU;AACnE,WAAO,EAAE,SAAS,cAAc;AAAA,EAClC;AACA,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,UAAU;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB;AAAA,QACA,WAAW,OAAO,SAAS;AAAA,QAC3B,UAAU,QAAQ;AAAA,QAClB,GAAI,QAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,QAAQ,MAAM,EAAE;AAAA,QACzE,GAAI,OAAO,QAAQ,WAAW,WAAW,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,QACvE,GAAI,QAAQ,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,UAAU;AAAA,QAC1E,GAAI,aAAa,WAAW,QAAQ,YAAY,OAAO,EAAE,SAAS,KAAK,IAAI,CAAC;AAAA,MAC9E,CAAC;AAAA,MACD,GAAI,QAAQ,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,IACnE,CAAC;AACD,UAAM,OAAO,MAAM,SAAS,KAAK;AAKjC,WAAO,SAAS,MAAM,KAAK,OAAO,QAAQ,UAAU,KAAK,OAAO,IAC5D;AAAA,MACE,SAAS,KAAK;AAAA,MACd,GAAI,eAAe,KAAK,MAAM,IAAI,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,IAC/D,IACA,EAAE,SAAS,cAAc;AAAA,EAC/B,QAAQ;AACN,WAAO,EAAE,SAAS,QAAQ,QAAQ,UAAU,cAAc,cAAc;AAAA,EAC1E;AACJ;AAEA,SAAS,iBAAiB,QAAoC;AAC5D,SAAO,OAAO,YAAY,QAAQ,IAAI;AACxC;AAEA,SAAS,eAAe,WAAwC;AAC9D,MACE,OAAO,UAAU,cAAc,YAAY,UAAU,cAAc,QACnE,iBAAiB,UAAU,aAC3B,OAAQ,UAAU,UAAwC,gBAAgB,UAC1E;AACA,WAAQ,UAAU,UAAsC;AAAA,EAC1D;AACA,SAAO,0BAA0B,UAAU,IAAI;AACjD;AAEA,SAAS,UAAU,OAAkC;AACnD,SAAO,UAAU,kBAAkB,UAAU,cAC3C,UAAU,eAAe,UAAU;AACvC;AAEA,SAAS,eAAe,OAAuC;AAC7D,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,UACE,OAAO,UAAU,eAAe,OAAO,UAAU,uBACjD,OAAO,UAAU,mBAAmB,OAAO,UAAU,mBAClD,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,aAAa;AACvE;","names":[]}