dsh-model-switch 0.4.38 → 0.4.39

package/lib/index.js

@@ -1,5 +1,5 @@
 import { o as normalizeProviderGroups } from "./session-route-D1zoZgf3.js";
-import { i as autoReviewStatus } from "./auto-review-CvmQaRVf.js";
+import { h as resolveToolSource, i as autoReviewStatus, m as DEFAULT_READ_ONLY_TOOLS } from "./auto-review-C61WZIYI.js";
 import { ModelSwitchAdapterRegistry } from "./adapter-registry.js";
 import { createRequire } from "node:module";
 import z from "@deepseek-ai/schemastery";
@@ -28,6 +28,8 @@ const Config = z.object({
 	imageModel: z.string().volatile(),
 	autoReviewProvider: z.string().volatile(),
 	autoReviewModel: z.string().volatile(),
+	autoReviewSkipReadOnly: z.boolean().default(false).volatile(),
+	autoReviewAllowlist: z.array(z.string()).default([...DEFAULT_READ_ONLY_TOOLS]).volatile(),
 	compactProvider: z.string().volatile(),
 	compactModel: z.string().volatile(),
 	titleProvider: z.string().volatile(),
@@ -55,6 +57,8 @@ function readConfig(config) {
 	const imageModel = config.imageModel.get();
 	const autoReviewProvider = config.autoReviewProvider.get();
 	const autoReviewModel = config.autoReviewModel.get();
+	const autoReviewSkipReadOnly = config.autoReviewSkipReadOnly.get();
+	const autoReviewAllowlist = config.autoReviewAllowlist.get();
 	const compactProvider = config.compactProvider.get();
 	const compactModel = config.compactModel.get();
 	const titleProvider = config.titleProvider.get();
@@ -71,6 +75,8 @@ function readConfig(config) {
 		...imageModel === void 0 ? {} : { imageModel },
 		...autoReviewProvider === void 0 || autoReviewProvider === "" ? {} : { autoReviewProvider },
 		...autoReviewModel === void 0 || autoReviewModel === "" ? {} : { autoReviewModel },
+		...autoReviewSkipReadOnly ? { autoReviewSkipReadOnly } : {},
+		...Array.isArray(autoReviewAllowlist) ? { autoReviewAllowlist: [...autoReviewAllowlist] } : {},
 		...compactProvider === void 0 || compactProvider === "" ? {} : { compactProvider },
 		...compactModel === void 0 || compactModel === "" ? {} : { compactModel },
 		...titleProvider === void 0 || titleProvider === "" ? {} : { titleProvider },
@@ -320,6 +326,52 @@ function installGenerateImageTool(ctx, runtime) {
 	});
 	return controller;
 }
+//#endregion
+//#region lib/types/tool-catalog.js
+function descriptionOf(entry) {
+	const raw = entry.description;
+	if (typeof raw !== "string") return "";
+	return (raw.split("\n", 1)[0] ?? "").trim();
+}
+/**
+* Read the Host's current tool set.
+*
+* Structural and best-effort: a deployment without the tools registry (or a
+* registry that throws while listing) yields an empty catalog instead of failing
+* the settings page.
+*
+* @param ctx - any host context on the profile.
+* @returns Every exposed tool with its resolved origin, name-sorted.
+*/
+function readToolCatalog(ctx) {
+	let tools;
+	try {
+		tools = ctx.get("tools", false);
+	} catch {
+		return [];
+	}
+	const schemas = tools?.schemas;
+	if (typeof schemas !== "function") return [];
+	let listed;
+	try {
+		listed = schemas.call(tools);
+	} catch {
+		return [];
+	}
+	if (!Array.isArray(listed)) return [];
+	const catalog = [];
+	for (const entry of listed) {
+		const name = entry.name;
+		if (typeof name !== "string" || name === "") continue;
+		catalog.push({
+			name,
+			description: descriptionOf(entry),
+			source: resolveToolSource(name)
+		});
+	}
+	catalog.sort((left, right) => left.name.localeCompare(right.name));
+	return catalog;
+}
 function statusResponse(status) {
 	return new Response(status === 415 ? "Unsupported Media Type" : status === 500 ? "Internal Server Error" : "Bad Request", { status });
 }
@@ -375,7 +427,14 @@ async function handleFetchRpc(request, handler, operator) {
 	}
 }
 /** Bounded long-poll on the existing registry; each caller owns and disposes its subscription. */
-function capabilitiesRpc(registry, snapshot, lifetime) {
+function capabilitiesRpc(registry, snapshot, lifetime, catalog = () => ({
+	tools: [],
+	recommended: [...DEFAULT_READ_ONLY_TOOLS]
+}), status = () => ({
+	held: false,
+	allowedCalls: 0,
+	skippedReadOnly: 0
+})) {
 	let revision = 0;
 	let previous;
 	const read = () => {
@@ -389,6 +448,23 @@ function capabilitiesRpc(registry, snapshot, lifetime) {
 		};
 	};
 	return async (endpoint, payload, signal) => {
+		if (endpoint === "tools") {
+			if (payload === null || typeof payload !== "object" || Array.isArray(payload) || Object.keys(payload).length !== 0) return {
+				ok: false,
+				error: {
+					details: {},
+					code: "invalid-request",
+					message: "Expected an empty payload"
+				}
+			};
+			return {
+				ok: true,
+				value: {
+					...catalog(),
+					status: status()
+				}
+			};
+		}
 		if (endpoint !== "capabilities") return {
 			ok: false,
 			error: {
@@ -444,7 +520,14 @@ function capabilitiesRpc(registry, snapshot, lifetime) {
 function installCapabilitiesRpc(ctx, registry, snapshot) {
 	ctx.inject(["connection"], (scope) => scope.effect(() => {
 		const lifetime = new AbortController();
-		const handler = capabilitiesRpc(registry, snapshot, lifetime.signal);
+		const handler = capabilitiesRpc(registry, snapshot, lifetime.signal, () => ({
+			tools: readToolCatalog(ctx),
+			recommended: [...DEFAULT_READ_ONLY_TOOLS]
+		}), () => ({
+			held: autoReviewStatus.held,
+			allowedCalls: autoReviewStatus.allowedCalls,
+			skippedReadOnly: autoReviewStatus.skippedReadOnly
+		}));
 		const dispose = scope.connection.fetch.register({
 			path: "/api/plugin-rpc/model-switch",
 			methods: ["POST"],

package/lib/types/auto-review.d.ts

@@ -59,11 +59,34 @@ export declare const inject: string[];
  * tool-call safety net allows unreviewed calls instead of failing them.
  * `allowedCalls` counts the calls the net let through in that state, so the
  * settings card can tell the human how much review was skipped.
+ * `skippedReadOnly` counts the calls the allowlist took off the reviewer, which
+ * is the number the settings card shows next to the switch.
  */
 export declare const autoReviewStatus: {
     held: boolean;
     allowedCalls: number;
+    skippedReadOnly: number;
 };
+/**
+ * What one `tools/pre-execute` call carries into the reviewer's async context.
+ *
+ * The official gate reads `permissionPresets.current(session)` at the top of its
+ * listener; this store is what lets that read answer "no review needed" for one
+ * call without touching the rest of the pipeline (see
+ * {@link defensivePermissionPresets}).
+ */
+export interface AutoCallContext {
+    readonly session: Session | undefined;
+    /** `exec.name` — the tool under review. */
+    readonly tool: string;
+}
+/** The read-only skip: which tools, and whether the switch is on. */
+export interface ReadOnlyBypass {
+    /** The call currently executing in this async context, if any. */
+    ambient(): AutoCallContext | undefined;
+    /** Whether this tool name is on the allowlist. */
+    allows(tool: string): boolean;
+}
 /** Pinned reviewer route; both identifiers are non-empty. */
 export interface AutoReviewRoute {
     readonly provider: string;
@@ -108,13 +131,14 @@ export declare function resolveSessionAutoReviewRoute(ctx: Context, session?: Se
  * Because Cordis `on(..., { prepend: true })` unshifts onto the event hook list,
  * registering this listener AFTER `official.apply(scope)` places it at index 0
  * — directly ahead of the official gate's own prepended listener — so
- * `activeSession.run(exec.agent?.session, next)` wraps the entire official
- * review execution.
+ * `activeSession.run({ session, tool }, next)` wraps the entire official review
+ * execution. The stored tool name is what lets the reviewer be skipped for an
+ * allowlisted read without the gate ever seeing a fake preset.
  *
  * @param scope - the review scope context where the gate is mounted.
- * @param activeSession - AsyncLocalStorage holding the session under review.
+ * @param activeSession - AsyncLocalStorage holding the call under review.
  */
-export declare function bindAutoReviewSessionCorrelation(scope: Context, activeSession: AsyncLocalStorage<Session | undefined>): void;
+export declare function bindAutoReviewSessionCorrelation(scope: Context, activeSession: AsyncLocalStorage<AutoCallContext | undefined>): void;
 /**
  * Whether a reviewer-path throw is a broken seam rather than a real decision.
  * @param cause - whatever the waterfall threw.
@@ -188,14 +212,23 @@ export interface ManagedPermissionPresetsFace extends PermissionPresetsFace {
  * displacing row and take it back without unmounting the gate (the gate's
  * disposal would move live `auto` sessions to `danger-full-access`).
  *
+ * `current()` also answers the read-only skip. The official gate's first line is
+ * `if (permissionPresets.current(session) !== 'auto') return next()`, so a call
+ * whose tool is allowlisted can be taken off the reviewer by answering with
+ * anything else — the gate itself then runs the normal `next()` path, leaving
+ * every later listener and guard in place. The answer is scoped to the call in
+ * flight through the async store, so outside a tool call this method reports the
+ * truth (`rememberAuto()` and the settings card read it for accounting).
+ *
  * @param resolve - resolves the host's permission-preset service per call.
  * @param log - the row logger used for the single degradation report.
  * @param chain - diagnostic dump of the resolution chain; defaults to empty.
+ * @param bypass - optional read-only skip; absent when the feature is off.
  * @returns A managed preset face.
  */
 export declare function defensivePermissionPresets(resolve: () => PermissionPresetsFace | undefined, log: {
     warn(line: string): void;
-}, chain?: () => string): ManagedPermissionPresetsFace;
+}, chain?: () => string, bypass?: ReadOnlyBypass): ManagedPermissionPresetsFace;
 /**
  * Build the scoped context the official gate runs under.
  * @param ctx - host context whose modelSwitch settings pin the reviewer route.
@@ -204,7 +237,7 @@ export declare function defensivePermissionPresets(resolve: () => PermissionPres
  * @returns A child context shadowing the llm service and the permission-preset
  * service (always: a gate that sees the raw service can fail a tool call).
  */
-export declare function reviewScope(ctx: Context, activeSession?: AsyncLocalStorage<Session | undefined>, presets?: ManagedPermissionPresetsFace): Context;
+export declare function reviewScope(ctx: Context, activeSession?: AsyncLocalStorage<AutoCallContext | undefined>, presets?: ManagedPermissionPresetsFace): Context;
 /**
  * Structural view of the official gate's plugin face.
  *

package/lib/types/capabilities-rpc.d.ts

@@ -2,11 +2,20 @@ import type { Context } from '@deepseek-ai/cordis';
 import { type ConnectionRpcHandler } from '@deepseek-ai/dsh-client-connection';
 import type { ModelSwitchAdapterRegistry } from './adapter-registry.js';
 import type { RuntimeCapabilities } from './runtime-capabilities.js';
+import { type ToolCatalogSnapshot } from './tool-catalog.js';
+/** Live reviewer counters surfaced next to the allowlist editor. */
+export interface ReviewStatus {
+    readonly held: boolean;
+    readonly allowedCalls: number;
+    readonly skippedReadOnly: number;
+}
 export declare const CAPABILITIES_RPC_METHOD = "plugin-rpc/model-switch";
 export interface CapabilitiesSnapshot {
     readonly revision: number;
     readonly capabilities: RuntimeCapabilities;
 }
 /** Bounded long-poll on the existing registry; each caller owns and disposes its subscription. */
-export declare function capabilitiesRpc(registry: ModelSwitchAdapterRegistry, snapshot: () => RuntimeCapabilities, lifetime: AbortSignal): ConnectionRpcHandler;
+export declare function capabilitiesRpc(registry: ModelSwitchAdapterRegistry, snapshot: () => RuntimeCapabilities, lifetime: AbortSignal, catalog?: () => ToolCatalogSnapshot, 
+/** Live Auto-reviewer counters (see `autoReviewStatus`), shown next to the allowlist. */
+status?: () => ReviewStatus): ConnectionRpcHandler;
 export declare function installCapabilitiesRpc(ctx: Context, registry: ModelSwitchAdapterRegistry, snapshot: () => RuntimeCapabilities): void;

package/lib/types/client/ModelSwitchSettings.d.ts

@@ -2,7 +2,7 @@ import { type ReactNode } from 'react';
 import type { ModelProviderGroup } from '@deepseek-ai/dsh-api-session-controller/types';
 import type { ConfigForm } from '@deepseek-ai/dsh-client-ui-settings/client';
 import type { InjectFace, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
-import { type CapabilityRouteView, type ModelSwitchSettingsView, type SubagentSettingsView } from '../client-contract.js';
+import { type CapabilityRouteView, type ModelSwitchSettingsView, type ReviewStatusView, type SubagentSettingsView, type ToolCatalogRow } from '../client-contract.js';
 import { type ProviderGroupConfig } from '../provider-group.js';
 import type { RuntimeCapabilities } from '../runtime-capabilities.js';
 import { type CapabilitiesSnapshot } from './search-capabilities.js';
@@ -26,6 +26,16 @@ export interface ModelSwitchSettingsFace {
      */
     saveSubagent: (ops: readonly ConfigViewOp<SubagentSettingsView>[]) => Promise<void>;
     saveCapability: (route: 'search' | 'image' | 'autoReview' | 'compaction' | 'title', ops: readonly ConfigViewOp<CapabilityRouteView>[]) => Promise<void>;
+    /** Persist the read-only skip switch and its allowlist as one atomic write. */
+    saveReviewAllowlist: (value: {
+        enabled: boolean;
+        tools: readonly string[];
+    }) => Promise<void>;
+    /** The Host's live tool catalog; absent on a Host without the `tools` RPC endpoint. */
+    scanTools?: () => Promise<{
+        rows: readonly ToolCatalogRow[];
+        status?: ReviewStatusView;
+    }>;
     /** Replace or remove (undefined) one provider's saved capability group. */
     saveProviderGroup: (provider: string, group: ProviderGroupConfig | undefined) => Promise<void>;
     loadCatalog: () => Promise<readonly ModelProviderGroup[]>;

package/lib/types/client/locales.d.ts

@@ -53,6 +53,24 @@ export declare const zh: {
     readonly groupOverridesMore: "组覆盖：{listed} 等 {count} 个组；无组时用上方默认值";
     readonly saveTimeout: "保存超时，请重试";
     readonly saveRejected: "保存被拒绝，请重试";
+    readonly reviewAllowlistGroup: "审查豁免";
+    readonly reviewAllowlist: "纯读工具免审查";
+    readonly reviewAllowlistBadge: "已开启";
+    readonly reviewAllowlistOnSummary: "名单内 {count} 条免审查";
+    readonly reviewAllowlistOffSummary: "未开启：每次调用都经审查";
+    readonly reviewAllowlistHelp: "开启后，名单内的纯读工具直接执行，不再调用审查模型；名单外的写操作、命令执行与删除仍照常审查。";
+    readonly reviewAllowlistNote: "来源按工具名解析（MCP 前缀 / 插件前缀 / 扩展后缀）；同名工具可以冒充来源，徽章只是提示，不是安全边界。";
+    readonly reviewAllowlistSearch: "搜索工具名或来源";
+    readonly reviewAllowlistScan: "扫描本机工具";
+    readonly reviewAllowlistScanning: "扫描中…";
+    readonly reviewAllowlistScanFailed: "扫描失败：Host 没有提供工具目录接口。";
+    readonly reviewAllowlistReset: "恢复默认名单";
+    readonly reviewAllowlistRemove: "移除";
+    readonly reviewAllowlistAdd: "加入";
+    readonly reviewAllowlistNone: "名单为空：没有任何工具免审查。";
+    readonly reviewAllowlistAvailable: "本机存在但未放行的工具：";
+    readonly reviewAllowlistRepo: "仓库";
+    readonly reviewAllowlistSkipped: "本 Host 进程已为纯读调用跳过 {count} 次审查。";
     readonly 'reason.central-subagent-routing': "Alpha.4 没有全局子代理启动路由接口。";
     readonly 'reason.packaged-preset-roots': "Alpha.4 不支持插件提供额外 preset root。";
     readonly 'reason.tool-owner-suppression': "Alpha.4 没有工具所有者或来源抑制接口。";

package/lib/types/client/picker/PlanReviewCard.d.ts

@@ -1,5 +1,6 @@
 import type { PendingQuestion } from '@deepseek-ai/dsh-client-ui-user-questions/client';
 import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
+import { type CancelTurn } from '../../picker/discuss-plan.ts';
 import { type GoalRemote } from '../../picker/plan-goal.ts';
 import type { PlanPreviewBinding } from './plan-preview.ts';
 import { type PickerDirectoryFace } from './PickerDirectory.ts';
@@ -26,6 +27,13 @@ export interface PlanReviewFace extends PickerDirectoryFace {
     planPreview: PlanPreviewBinding;
     /** Live catalog-group-id → card-key map from ProviderDirectory. */
     catalogRoutes?: () => Readonly<Record<string, string>>;
+    /**
+     * Session-scoped turn cancellation (the official Stop path).
+     *
+     * Absent on a Host that exposes no conversation service; the discuss action
+     * then falls back to withdrawing the pending question.
+     */
+    cancelTurn?: CancelTurn;
 }
 export type PlanReviewCardProps = PropsRuntime<'conversation.composer'> & PropsLocale<'composer-picker'> & InjectFace<PlanReviewFace> & {
     matched: PendingQuestion;

package/lib/types/client-contract.d.ts

@@ -12,6 +12,10 @@ export interface ModelSwitchSettingsView {
     imageModel?: string;
     autoReviewProvider?: string;
     autoReviewModel?: string;
+    /** Opt-in read-only skip for the Auto reviewer; absent/false keeps every call reviewed. */
+    autoReviewSkipReadOnly?: boolean;
+    /** Exact tool names, or trailing-`*` patterns, that skip the reviewer when enabled. */
+    autoReviewAllowlist?: readonly string[];
     compactProvider?: string;
     compactModel?: string;
     titleProvider?: string;
@@ -50,6 +54,23 @@ export declare const AUTO_REVIEW_SETTINGS_FIELDS: Readonly<{
     readonly provider: "autoReviewProvider";
     readonly model: "autoReviewModel";
 }>;
+/** Auto-reviewer read-only skip: the switch and its allowlist are edited as one unit. */
+export declare const AUTO_REVIEW_ALLOWLIST_FIELDS: Readonly<{
+    readonly enabled: "autoReviewSkipReadOnly";
+    readonly tools: "autoReviewAllowlist";
+}>;
+/** One allowlist editor snapshot (switch + entries). */
+export interface AutoReviewAllowlistView {
+    enabled: boolean;
+    tools: readonly string[];
+}
+/**
+ * Derive the allowlist editor's value.
+ *
+ * An absent list means "never configured" and shows the shipped defaults; an
+ * explicitly emptied list stays empty, so clearing it is not undone by a reload.
+ */
+export declare function deriveAutoReviewAllowlist(settings: ModelSwitchSettingsView): AutoReviewAllowlistView;
 /** Compaction summarization route for `/compact` and automatic compaction; both unset means the official default (the conversation target). */
 export declare const COMPACTION_SETTINGS_FIELDS: Readonly<{
     readonly provider: "compactProvider";
@@ -68,3 +89,36 @@ export declare function deriveCompactionSettings(settings: ModelSwitchSettingsVi
 export declare function deriveTitleSettings(settings: ModelSwitchSettingsView): CapabilityRouteView;
 /** Whether both fields of a model route form a complete pair; an incomplete pair stays off. */
 export declare function routePairConfigured(route: CapabilityRouteView | undefined): boolean;
+/** Live reviewer counters shown beside the allowlist editor. */
+export interface ReviewStatusView {
+    readonly held: boolean;
+    readonly allowedCalls: number;
+    readonly skippedReadOnly: number;
+}
+/**
+ * Decode the reviewer counters from a `tools` RPC payload.
+ * @param value - the RPC result value.
+ * @returns The counters, or undefined when the Host does not report them.
+ */
+export declare function decodeReviewStatus(value: unknown): ReviewStatusView | undefined;
+/** One tool row in the allowlist editor, as the Host reports it. */
+export interface ToolCatalogRow {
+    readonly name: string;
+    readonly description: string;
+    /** Human source label, e.g. `MCP · wincu`. */
+    readonly sourceLabel: string;
+    /** Repository of the providing package, when known. */
+    readonly repo?: string;
+    /** Whether the shipped defaults already allow it. */
+    readonly recommended: boolean;
+}
+/**
+ * Decode the `tools` RPC payload.
+ *
+ * Malformed entries are skipped rather than failing the page: the catalog is a
+ * convenience view over the Host's tools, and a partial list is still useful.
+ *
+ * @param value - the RPC result value.
+ * @returns The rows, or undefined when the payload is not a catalog at all.
+ */
+export declare function decodeToolCatalog(value: unknown): readonly ToolCatalogRow[] | undefined;

package/lib/types/host-settings.d.ts

@@ -16,6 +16,19 @@ export interface ModelSwitchSettings {
     autoReviewProvider?: string;
     /** Reviewer model for the Auto preset; set together with `autoReviewProvider`. */
     autoReviewModel?: string;
+    /**
+     * Opt-in: pure-read tools from {@link autoReviewAllowlist} run without the Auto
+     * reviewer. Absent/false keeps every call reviewed (the shipped default).
+     */
+    autoReviewSkipReadOnly?: boolean;
+    /**
+     * Tool names that skip the reviewer when {@link autoReviewSkipReadOnly} is on.
+     *
+     * Exact names, plus a trailing `*` pattern for tools whose name carries a
+     * renameable owner (the QQ bot extension suffixes its tools with the bot's
+     * name). A bare `*` is rejected by the settings editor and never matches.
+     */
+    autoReviewAllowlist?: readonly string[];
     /** Summarization provider for `/compact` and automatic compaction; both fields unset = official default (the conversation target). */
     compactProvider?: string;
     /** Summarization model for `/compact` and automatic compaction; set together with `compactProvider`. */
@@ -39,6 +52,10 @@ export interface Config {
     imageModel: Volatile<string | undefined>;
     autoReviewProvider: Volatile<string | undefined>;
     autoReviewModel: Volatile<string | undefined>;
+    /** Opt-in: skip the Auto reviewer for allowlisted pure-read tools (default off). */
+    autoReviewSkipReadOnly: Volatile<boolean>;
+    /** Tool names (exact, or a trailing `*` pattern) that skip the Auto reviewer. */
+    autoReviewAllowlist: Volatile<readonly string[]>;
     compactProvider: Volatile<string | undefined>;
     compactModel: Volatile<string | undefined>;
     titleProvider: Volatile<string | undefined>;

package/lib/types/picker/discuss-plan.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Withdraw a pending plan review so the human can speak instead.
+ *
+ * The card used to only dismiss the pending question. Inside plan mode that
+ * dismissal makes the tool call return `ASK_CANCELLED`, the model answers, and
+ * the turn ends as **completed** — and the transcript folds every completed
+ * turn's work details at the configured timing (`collapseTiming: 'completion'`
+ * by default). The human then has to re-expand the steps they were reading.
+ *
+ * Interrupting the turn instead ends it as **aborted**, which the transcript's
+ * own always-open rule keeps permanently expanded:
+ *
+ * ```js
+ * const reason = turnLocation?.end?.data.reason.kind
+ * const alwaysOpen = presentation?.turnClosed === false
+ *   || presentation?.hasInterleavedInput === true
+ *   || reason === 'aborted' || reason === 'interrupted' || reason === 'error'
+ * ```
+ *
+ * It also returns the composer, because the pending question settles either way.
+ * The official Stop button takes the same route (`conversation.cancel()`), so
+ * this is a shipped seam rather than a special case.
+ *
+ * @module dsh-model-switch/picker/discuss-plan
+ */
+/** How the review was withdrawn. */
+export type DiscussOutcome = 'interrupted' | 'dismissed';
+/** Session-scoped turn cancellation, when the Host exposes one. */
+export type CancelTurn = (sessionId: string) => Promise<void>;
+/**
+ * Withdraw the review by interrupting the turn, falling back to dismissal.
+ *
+ * Order matters: cancellation is what keeps the work details expanded, so it is
+ * tried first and only genuinely unavailable/refused cancellation falls through
+ * to the released withdrawal (which still gives the human the composer back, just
+ * without the expansion guarantee).
+ *
+ * @param cancelTurn - the session cancel seam; absent on a Host without one.
+ * @param sessionId - the session whose turn is being withdrawn.
+ * @param dismiss - the released `PendingQuestion` withdrawal.
+ * @returns Which route withdrew the review.
+ */
+export declare function discussPlan(cancelTurn: CancelTurn | undefined, sessionId: string, dismiss: () => Promise<void>): Promise<DiscussOutcome>;

package/lib/types/tool-allowlist.d.ts

@@ -0,0 +1,113 @@
+/**
+ * The pure-read tool allowlist for the Auto reviewer.
+ *
+ * DSH's official Auto gate reviews **every** tool call with the model unless the
+ * session is off the `auto` preset, so a `read` or `grep` costs a reviewer round
+ * trip. This module owns the data behind skipping that review: which tool names
+ * are safe to run unreviewed, how a name maps back to the plugin/MCP that
+ * provides it, and the pattern syntax that keeps a re-named MCP/extension tool
+ * covered without editing the list.
+ *
+ * Everything here is pure: no `ctx`, no filesystem, no settings. The caller
+ * decides when the list applies (see `./auto-review.ts`), which keeps the rules
+ * testable without a Host.
+ *
+ * @module dsh-model-switch/tool-allowlist
+ */
+/**
+ * Where one tool comes from.
+ *
+ * - `core`: a released `@deepseek-ai/dsh-*` package (ships with the Host).
+ * - `plugin`: a profile plugin that registers model tools.
+ * - `mcp`: a tool bridged from an MCP server (`mcp__<server>__<tool>`).
+ * - `extension`: a `<tool>__<name>` tool contributed through an extension
+ *   directory — the suffix is the *owner's* name (a QQ bot persona), not a
+ *   fixed string, which is why the defaults use a pattern.
+ * - `unknown`: not in this module's calibrated catalog.
+ */
+export type ToolSourceKind = 'core' | 'plugin' | 'mcp' | 'extension' | 'unknown';
+/** One resolved tool origin, ready to render next to a tool name. */
+export interface ToolSource {
+    readonly kind: ToolSourceKind;
+    /** Short human label, e.g. `插件 · dsh-ops` or `MCP · wincu`. */
+    readonly label: string;
+    /** Repository for the providing package, when known. */
+    readonly repo?: string;
+    /** Package / server / owner name, when known. */
+    readonly owner?: string;
+}
+/** One catalogued origin: the single source of truth for labels and repos. */
+export interface SourceCatalogEntry {
+    readonly id: string;
+    readonly kind: Exclude<ToolSourceKind, 'unknown'>;
+    readonly label: string;
+    readonly repo: string;
+}
+/**
+ * Every origin this allowlist ships defaults for.
+ *
+ * The release notes render this same table, so a new default entry cannot be
+ * added without naming the package and its repository.
+ */
+export declare const SOURCE_CATALOG: readonly SourceCatalogEntry[];
+/** Catalog lookup by id. */
+export declare const SOURCE_BY_ID: ReadonlyMap<string, SourceCatalogEntry>;
+/**
+ * Default allowlist: every pure-read tool this deployment exposes, calibrated on
+ * a live desktop profile (105 tools) at dsh 0.2.1-rc.2.
+ *
+ * Grouped by origin so a reader can trace each entry through {@link SOURCE_CATALOG}.
+ * Entries ending in `*` are patterns: the QQ bot extension suffixes its tools with
+ * the bot's own name, so `sessions_list__*` keeps working when the persona is
+ * renamed.
+ */
+export declare const DEFAULT_READ_ONLY_TOOLS: readonly string[];
+/** Why one allowlist entry was refused. */
+export type AllowEntryProblem = 'empty' | 'bare-wildcard' | 'leading-wildcard';
+/**
+ * Validate one allowlist entry.
+ *
+ * `*` is a suffix wildcard: the entry must keep at least one literal leading
+ * character, so a stray `*` can never turn the list into "allow everything".
+ *
+ * @param entry - the raw entry as typed in settings.
+ * @returns `ok`, or the specific problem.
+ */
+export declare function validateAllowEntry(entry: string): 'ok' | AllowEntryProblem;
+/**
+ * Whether a tool name matches one allowlist entry.
+ *
+ * Exact names match exactly; an entry may end in `*`, which matches any
+ * remaining characters (including none). Invalid entries never match.
+ *
+ * @param name - the tool name from `exec.name`.
+ * @param entry - one allowlist entry.
+ * @returns true when the call may skip review.
+ */
+export declare function matchesAllowPattern(name: string, entry: string): boolean;
+/**
+ * Whether a tool name is covered by an allowlist.
+ * @param name - the tool name under review.
+ * @param allowlist - configured entries, patterns included.
+ * @returns true when at least one entry matches.
+ */
+export declare function isAllowedByList(name: string, allowlist: readonly string[]): boolean;
+/**
+ * Resolve the origin of one tool name for display.
+ *
+ * Resolution order: MCP bridge → `<tool>__<owner>` extension → plugin prefix →
+ * plugin table → core catalog → unknown. Only the first two are structural; the
+ * rest are calibrated names, so an unlisted tool is reported as unknown rather
+ * than guessed into a package.
+ *
+ * @param name - the tool name.
+ * @returns The origin, with its repository when known.
+ */
+export declare function resolveToolSource(name: string): ToolSource;
+/**
+ * The `<tool>__<owner>` base names this deployment's extension directory ships.
+ *
+ * Used by the settings editor to explain what a pattern covers; it is not a
+ * security boundary — the allowlist itself is.
+ */
+export declare const EXTENSION_TOOL_BASES: readonly string[];

package/lib/types/tool-catalog.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The Host's live tool catalog, annotated with where each tool comes from.
+ *
+ * The settings editor needs to show what actually exists on this machine — not
+ * just the shipped defaults — so a human can tick a tool the defaults miss (a new
+ * MCP server, a renamed bot extension) without editing YAML. The only public
+ * source for that list is `ctx.tools.schemas()`, which is the same model-facing
+ * set the reviewer sees.
+ *
+ * @module dsh-model-switch/tool-catalog
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { type ToolSource } from './tool-allowlist.js';
+/** One tool the running Host currently exposes. */
+export interface ToolCatalogEntry {
+    readonly name: string;
+    /** First line of the tool description, for the settings list. */
+    readonly description: string;
+    readonly source: ToolSource;
+}
+/** The wire shape of the `tools` RPC endpoint. */
+export interface ToolCatalogSnapshot {
+    readonly tools: readonly ToolCatalogEntry[];
+    /** Names that matched the shipped defaults, for the "已放行" mark. */
+    readonly recommended: readonly string[];
+}
+/**
+ * Read the Host's current tool set.
+ *
+ * Structural and best-effort: a deployment without the tools registry (or a
+ * registry that throws while listing) yields an empty catalog instead of failing
+ * the settings page.
+ *
+ * @param ctx - any host context on the profile.
+ * @returns Every exposed tool with its resolved origin, name-sorted.
+ */
+export declare function readToolCatalog(ctx: Context): ToolCatalogEntry[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model-switch",
-  "version": "0.4.38",
+  "version": "0.4.39",
   "description": "Explicit model routing plus composer/Plan picker for DeepSeek Harness",
   "repository": {
     "type": "git",