dsh-model-switch 0.4.38 → 0.4.40

package/CHANGELOG.md

@@ -1,3 +1,39 @@
+## v0.4.40
+
+按你的点名，默认豁免名单从 47 条扩到 **58 条**：新增 11 个工具，全部在「设置 → 模型切换 → 审查豁免」里可查、可删、可恢复默认。
+
+- **纯读 / 无副作用（6 个）**：`load_workspace_dependencies`（只返回打包依赖路径与版本）、`wait_agent`（只等待队友变化）、`ask_user_question`（把问题抛给人，决策权本来就在人手里）、`present`（只登记交付物卡片，不复制内容）、`sidebar_open`（只在侧栏打开文件/文件夹/URL）、`exit_plan_mode`（计划门由人审批，第二个审查者多余）。
+- **只派发、副作用仍留在审查内（3 个）**：`send_message`（给队友投递消息，目标会话的预设是它被创建时定好的）、`team_task_create`（只写共享任务板）、`terminal_open`（只起 shell，后续 `terminal_send` 仍在审查）。
+- **自治项（2 个，按你的明确决定放出）**：`create_goal`（创建持久目标，让本会话跨轮继续）、`schedule_create`（排一条未来投递的提示）。它们触发的新回合仍跑同一个 auto 预设，所以每轮里的工具调用照样逐次审查；风险是无人值守的 token 消耗，已在名单注释里标明。
+- **明确排除：`subagent` / `subagent_fork` / `spawn_teammate` 永不进默认名单。** `dsh-subagent` 生成子会话时会读 `permissionPresets.current(parent.session)`，只有 `auto` / `danger-full-access` 会被继承；而本插件在"名单命中的调用正在飞"时把 `current()` 答成 `'custom'`——放行这三个会让子会话拿不到 auto 预设，等于造出**无审查的子 agent**。`tests/tool-allowlist.spec.ts` 新增 `DELEGATION_SPAWNS` 专项守卫，防止以后被顺手加进去。
+- **守卫调整**：`MUTATING` 里移除 `send_message`、`team_task_create`（现按"派发类"放行），补入 `subagent`、`subagent_fork`。
+- **注意**：默认名单只是"出厂值"。已经保存过名单的部署（含桌面）升级后不会自动多出这 11 条——需要点一次「恢复默认名单」，或手动加入。
+- 测试：59 个测试文件 / **541** 测试（新增 delegation 守卫与"用户放行清单"两例）。
+
+## v0.4.39
+
+「自动审查」下，**纯读工具不再调用审查模型**：`read` / `grep` / `glob` 这类只读调用直接执行，写操作、命令执行与删除仍然逐次审查。功能默认**关闭**，在「设置 → 模型切换 → 审查豁免」一键开启。
+
+- **机制：让官方 gate 自己走 `next()`，不截断流水线。** 官方 `@deepseek-ai/dsh-experimental-auto-review` 的 `tools/pre-execute` 监听器首行是 `if (permissionPresets.current(session) !== 'auto') return next()`——它对本插件挂载的 `permissionPresets` 影子提问。`defensivePermissionPresets().current()` 现在只在「当前有工具调用在飞 ∧ 该调用名命中名单 ∧ 真实预设就是 auto」时回答 `'custom'`，gate 因此自己跳过审查并调用 `next()`：其它 listener、`ctx.tools.guard` 与沙箱策略全部照常执行。只在飞行的异步上下文内生效（`AsyncLocalStorage`），工具调用之外的 `current()`（teardown 记账、设置卡片）仍报告真实值。读设置失败、名单为空、工具名为空一律 fail closed（照常审查）。
+- **默认名单（47 条）按本机实测校准，覆盖本机 105 个工具中的全部纯读项**，每条都能回溯到来源与仓库：
+
+  | 来源 | 仓库 | 默认放行 |
+  | --- | --- | --- |
+  | DSH 核心 | https://github.com/deepseek-ai/deepseek-harness | 25 条（`read` `grep` `glob` `read_image` `skill` `web_search` `web_search_pro` `web_fetch` `job_list` `job_output` `terminal_list` `terminal_read` `list_agents` `team_task_list` `team_task_get` `get_goal` `schedule_list` `list_mcp_resources` `list_mcp_resource_templates` `read_mcp_resource` `session_search` `session_event_search` `session_event_read` `session_event_trace` `session_trace`） |
+  | dsh-ops | https://github.com/T-Auto/dsh-ops | 2 条（`ops_read_files` `ops_discover_tools`） |
+  | dsh-browser-cdp | https://github.com/drscrewdriver/dsh-browser-cdp | 5 条（`bcdp_status` `bcdp_help` `bcdp_doctor` `bcdp_snapshot` `browser_window_status`） |
+  | dsh-auto-memory | https://github.com/AskTheWay/dsh-auto-memory | 2 条（`memory_list` `memory_read`） |
+  | MCP `wincu`（dsh-computer-use-win） | https://github.com/Yu-tao-Li/dsh-computer-use-win | 11 条（`accessibility_tree` `element_info` `find` `health` `list_windows` `ocr` `screenshot` `snapshot` `tools` `wait` `wait_for`） |
+  | QQ 机器人扩展（框架 @zaofan/dsh-qqbot） | https://github.com/zaofan-make/dsh-qqbot | 2 条模式（`sessions_list__*` `bing_search__*`） |
+
+  插件本身不注册纯读工具（`generate_image` 有副作用），因此不贡献默认条目。
+- **通配符后缀**：QQ 机器人扩展的工具名是 `<工具>__<机器人名>`，机器人名可自由修改，所以默认用 `sessions_list__*` / `bing_search__*` 而不是写死 `__YiXuan`；换 bot 名无需改配置。裸 `*` 与 `*开头` 的条目在校验层直接拒绝，防止把名单配成"全部放行"。
+- **设置界面可编辑并声明来源**：新增「审查豁免」卡片——开关即时保存（开关与名单作为一次原子写入，永不出现"开着但名单是旧的"）；每一行显示工具名 + 来源徽章 + 仓库链接；可按工具名/来源搜索；「恢复默认名单」；「扫描本机工具」调用新增的 `tools` RPC（`ctx.tools.schemas()` 公开接口）列出本机存在但未放行的工具，一键加入；扫描后还会显示本 Host 进程的实时计数「已为纯读调用跳过 N 次审查」，用来确认豁免真的生效。
+- **测试**：新增 `tests/tool-allowlist.spec.ts`（16 例：默认名单规模与禁项、通配符匹配与裸 `*` 拒绝、来源解析六类分支、仓库表完备、RPC 负载与计数解码）与 `tests/auto-review.spec.ts` 的 5 例豁免语义（在飞/非在飞、非 auto 预设、计数、拒绝）。`pnpm run check` 全绿（59 个测试文件 / **539** 测试 + pack 闸门）。
+- **lab 实测（`DSH_HOME=~/.dsh-lab`，3082，0.2.1-rc.2 官方 Host）**：手动选「自动审查」预设 + 开关开启后，一轮里 `read`×2 + `glob`×1 让计数变成 3（确实跳过了审查）；同一会话再 `write` 一次，计数仍是 3（写操作没有被豁免，仍走审查并被放行）；把开关关掉后再跑 `glob`+`read`，计数保持 3（审查恢复）。
+- **本地留档**：`review/allowlist-excluded.md` 列出了本机 105 个工具中未放行的 58 个及其来源与原因，`.gitignore` 已忽略 `review/`，不推送、不进包。
+- **「去聊天里说」改为中断回合，不再收起工作步骤**（`src/picker/discuss-plan.ts`、`src/client/picker/PlanReviewCard.tsx`、`src/client/picker/install.tsx`）。之前该按钮只做 `PendingQuestion.dismiss()`：计划工具返回 `ASK_CANCELLED`，模型再回一句，回合以 **completed** 结束，于是按官方「工作步骤收起时机=回答结束后」把步骤折叠——想边看计划边讨论就得手动再展开。官方 transcript 的折叠判断是 `alwaysOpen = … || reason === 'aborted' || reason === 'interrupted' || reason === 'error'`（asar `ui-chat` 的 `ChatGroupSeat`），所以改成走官方「停止」同款路径 `conversation.cancel()`（会话作用域公开方法），回合以 **aborted** 结束：输入框照样立刻回来、工作步骤保持展开、并显示「已停止」标记；取消接口不可用或被拒时自动回落到原来的 dismiss，不会让按钮失效。新增 `tests/picker/plan-discuss.spec.ts` 5 例覆盖中断 / 回落 / 无会话 id / 取消失败。lab 实测：计划卡上点「去聊天里说」后，会话日志的回合结束原因是 `aborted`（不再是 `completed`），输入框立即回来、会话显示「已停止」，工作步骤保持展开。
+
 ## v0.4.38
 
 计划卡的「设置为目标并执行」现在会**真的顶掉**旧目标：宿主把 `GoalError` 经 RPC 网关中转成 `gateway/internal`，而插件只认 `GOAL_ALREADY_EXISTS`，于是 get→clear→create 的替换分支一直是死代码，点一次报一次「设置目标失败」。
@@ -7,6 +43,7 @@
 - **Fix 2: transport failures no longer escape.** `create` / `get` / `clear` 全部经 `guarded()`：被 reject 的调用转成 `{ code: 'GOAL_TRANSPORT', message }` 的拒绝信封，不再冒泡成未处理异常（否则卡片丢掉错误态、计划停在待审却没有解释）。
 - **Fix 3: readable messages.** `normalizeHostMessage()` 剥掉 `gateway/xxx:` 前缀，`failure()` 丢弃传输层码，卡片不会再出现双重前缀；失败信息在源头就干净，卡片无需改动。
 - **Tests.** `tests/picker/plan-goal.spec.ts` 新增 6 例：网关形状的 paused / blocked 替换、非冲突网关拒绝不清目标、create / get / clear 三处 reject。`pnpm run check` 全绿（56 测试文件 / **510** 测试 + pack 闸门）。
+- **Lab verification（0.2.1-rc.2，`DSH_HOME=~/.dsh-lab`，端口 3082，`mimo-v2.6-flash`）——端到端跑通了修复后的路径。** 在装了 0.4.38 的 lab Host 里用真实计划卡走完两轮：第一轮会话无目标，点「设置为目标并执行」→ `21:35:05 goal/change create goal-720a677c active`，计划执行完后自动 `complete`；随后用 `create_goal` 造了一个**未完成**的旧目标（`21:36:04 create goal-95e79b84 active`），再提交第二个计划、点同一个按钮 → 会话日志记录 **`21:39:54 goal/change clear`** 紧跟 **`21:39:54 goal/change create goal-358a71b2 active`**，卡片没有任何报错。也就是说 get→clear→create 的替换分支在真实 Host 上确实跑起来了。说明：本次没有做 0.4.37 的 A/B 对照（修复前该分支不可达，用户桌面上报出的 `gateway/internal: … already exists with phase "paused"` 就是它失败的现场）；另外 lab 宿主本身有两处损坏，先修好才跑通：`session-query-sqlite@0.2.1-alpha.2` 与运行时 0.2.1-rc.2 不兼容导致 `sessionController` 不可用（升级 `dsh-experimental-session-search` 到 rc.2 解决），以及工作区注册表为空导致无法新建会话。
 
 ## v0.4.37
 

package/lib/{auto-review-CvmQaRVf.js → auto-review-BDx3LjVL.js}

@@ -3,6 +3,337 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+/** Catalog lookup by id. */
+const SOURCE_BY_ID = new Map([
+	{
+		id: "core",
+		kind: "core",
+		label: "DSH 核心",
+		repo: "https://github.com/deepseek-ai/deepseek-harness"
+	},
+	{
+		id: "dsh-ops",
+		kind: "plugin",
+		label: "插件 · dsh-ops",
+		repo: "https://github.com/T-Auto/dsh-ops"
+	},
+	{
+		id: "dsh-browser-cdp",
+		kind: "plugin",
+		label: "插件 · dsh-browser-cdp",
+		repo: "https://github.com/drscrewdriver/dsh-browser-cdp"
+	},
+	{
+		id: "dsh-auto-memory",
+		kind: "plugin",
+		label: "插件 · dsh-auto-memory",
+		repo: "https://github.com/AskTheWay/dsh-auto-memory"
+	},
+	{
+		id: "dsh-model-switch",
+		kind: "plugin",
+		label: "插件 · dsh-model-switch",
+		repo: "https://github.com/vandoor7-droid/dsh-model-switch"
+	},
+	{
+		id: "mcp:wincu",
+		kind: "mcp",
+		label: "MCP · wincu（dsh-computer-use-win）",
+		repo: "https://github.com/Yu-tao-Li/dsh-computer-use-win"
+	},
+	{
+		id: "qqbot-extension",
+		kind: "extension",
+		label: "QQ 机器人扩展（框架 @zaofan/dsh-qqbot）",
+		repo: "https://github.com/zaofan-make/dsh-qqbot"
+	}
+].map((entry) => [entry.id, entry]));
+/**
+* Tool names the released Host owns, calibrated against dsh 0.2.1-rc.2.
+*
+* A name outside the catalog would otherwise be reported as core, which is the
+* one guess a reader could act on wrongly; it resolves to `unknown` instead.
+*/
+const CORE_TOOLS = /* @__PURE__ */ new Set([
+	"ask_user_question",
+	"create_goal",
+	"create_skill",
+	"create_worktree",
+	"edit",
+	"exit_plan_mode",
+	"get_goal",
+	"glob",
+	"grep",
+	"interrupt_agent",
+	"job_kill",
+	"job_list",
+	"job_output",
+	"list_agents",
+	"list_mcp_resource_templates",
+	"list_mcp_resources",
+	"load_workspace_dependencies",
+	"present",
+	"pwsh",
+	"ralph",
+	"read",
+	"read_image",
+	"read_mcp_resource",
+	"schedule_create",
+	"schedule_delete",
+	"schedule_list",
+	"schedule_update",
+	"send_message",
+	"session_event_read",
+	"session_event_search",
+	"session_event_trace",
+	"session_search",
+	"session_trace",
+	"sidebar_open",
+	"skill",
+	"spawn_teammate",
+	"subagent",
+	"subagent_fork",
+	"team_task_create",
+	"team_task_get",
+	"team_task_list",
+	"team_task_update",
+	"terminal_close",
+	"terminal_list",
+	"terminal_open",
+	"terminal_read",
+	"terminal_send",
+	"terminal_signal",
+	"todo_write",
+	"update_goal",
+	"wait_agent",
+	"web_fetch",
+	"web_search",
+	"web_search_pro",
+	"workflow",
+	"working_directory",
+	"write"
+]);
+/** MCP server name → catalog id, for the servers this allowlist knows. */
+const MCP_SERVERS = /* @__PURE__ */ new Map([["wincu", "mcp:wincu"]]);
+/** Plugin identity by tool-name prefix (checked before the core catalog). */
+const PLUGIN_PREFIXES = [
+	["bcdp_", "dsh-browser-cdp"],
+	["browser_window_", "dsh-browser-cdp"],
+	["ops_", "dsh-ops"],
+	["memory_", "dsh-auto-memory"]
+];
+/** Single plugin tools that carry no prefix. */
+const PLUGIN_TOOLS = /* @__PURE__ */ new Map([["generate_image", "dsh-model-switch"]]);
+/** `<base>__<owner>` — the extension-tool naming the QQ bot framework uses. */
+const EXTENSION_TOOL = /^([A-Za-z0-9_-]+)__(.+)$/;
+/**
+* Default allowlist: every pure-read tool this deployment exposes plus the
+* no-side-effect and autonomy entries the user explicitly released, calibrated
+* on a live desktop profile (105 tools) at dsh 0.2.1-rc.2.
+*
+* Grouped by origin so a reader can trace each entry through {@link SOURCE_CATALOG}.
+* Entries ending in `*` are patterns: the QQ bot extension suffixes its tools with
+* the bot's own name, so `sessions_list__*` keeps working when the persona is
+* renamed.
+*
+* Everything here follows one rule: releasing it must not let a side effect escape
+* the reviewer. Calls that merely dispatch, ask, present, wait or navigate qualify
+* because the work they trigger still runs under the same auto preset. Delegation
+* tools (`subagent`, `subagent_fork`, `spawn_teammate`) deliberately stay out: a
+* child session seeds its preset from `permissionPresets.current(parent.session)`,
+* and this bypass answers `'custom'` for an allowlisted call in flight — releasing
+* them would hand the child no `auto` preset at all, i.e. no review.
+*/
+const DEFAULT_READ_ONLY_TOOLS = [
+	"read",
+	"grep",
+	"glob",
+	"read_image",
+	"skill",
+	"web_search",
+	"web_search_pro",
+	"web_fetch",
+	"load_workspace_dependencies",
+	"ask_user_question",
+	"present",
+	"sidebar_open",
+	"exit_plan_mode",
+	"job_list",
+	"job_output",
+	"terminal_list",
+	"terminal_read",
+	"list_agents",
+	"team_task_list",
+	"team_task_get",
+	"get_goal",
+	"schedule_list",
+	"wait_agent",
+	"send_message",
+	"team_task_create",
+	"list_mcp_resources",
+	"list_mcp_resource_templates",
+	"read_mcp_resource",
+	"session_search",
+	"session_event_search",
+	"session_event_read",
+	"session_event_trace",
+	"session_trace",
+	"create_goal",
+	"schedule_create",
+	"terminal_open",
+	"ops_read_files",
+	"ops_discover_tools",
+	"bcdp_status",
+	"bcdp_help",
+	"bcdp_doctor",
+	"bcdp_snapshot",
+	"browser_window_status",
+	"memory_list",
+	"memory_read",
+	"mcp__wincu__windows_computer_use_accessibility_tree",
+	"mcp__wincu__windows_computer_use_element_info",
+	"mcp__wincu__windows_computer_use_find",
+	"mcp__wincu__windows_computer_use_health",
+	"mcp__wincu__windows_computer_use_list_windows",
+	"mcp__wincu__windows_computer_use_ocr",
+	"mcp__wincu__windows_computer_use_screenshot",
+	"mcp__wincu__windows_computer_use_snapshot",
+	"mcp__wincu__windows_computer_use_tools",
+	"mcp__wincu__windows_computer_use_wait",
+	"mcp__wincu__windows_computer_use_wait_for",
+	"sessions_list__*",
+	"bing_search__*"
+];
+/**
+* Validate one allowlist entry.
+*
+* `*` is a suffix wildcard: the entry must keep at least one literal leading
+* character, so a stray `*` can never turn the list into "allow everything".
+*
+* @param entry - the raw entry as typed in settings.
+* @returns `ok`, or the specific problem.
+*/
+function validateAllowEntry(entry) {
+	const trimmed = entry.trim();
+	if (trimmed === "") return "empty";
+	if (/^\*+$/.test(trimmed)) return "bare-wildcard";
+	if (trimmed.startsWith("*")) return "leading-wildcard";
+	return "ok";
+}
+/**
+* Whether a tool name matches one allowlist entry.
+*
+* Exact names match exactly; an entry may end in `*`, which matches any
+* remaining characters (including none). Invalid entries never match.
+*
+* @param name - the tool name from `exec.name`.
+* @param entry - one allowlist entry.
+* @returns true when the call may skip review.
+*/
+function matchesAllowPattern(name, entry) {
+	if (name === "" || validateAllowEntry(entry) !== "ok") return false;
+	const trimmed = entry.trim();
+	const star = trimmed.indexOf("*");
+	if (star === -1) return name === trimmed;
+	const prefix = trimmed.slice(0, star);
+	const suffix = trimmed.slice(star + 1);
+	if (!name.startsWith(prefix) || !name.endsWith(suffix)) return false;
+	return name.length >= prefix.length + suffix.length;
+}
+/**
+* Whether a tool name is covered by an allowlist.
+* @param name - the tool name under review.
+* @param allowlist - configured entries, patterns included.
+* @returns true when at least one entry matches.
+*/
+function isAllowedByList(name, allowlist) {
+	return allowlist.some((entry) => matchesAllowPattern(name, entry));
+}
+/**
+* Resolve the origin of one tool name for display.
+*
+* Resolution order: MCP bridge → `<tool>__<owner>` extension → plugin prefix →
+* plugin table → core catalog → unknown. Only the first two are structural; the
+* rest are calibrated names, so an unlisted tool is reported as unknown rather
+* than guessed into a package.
+*
+* @param name - the tool name.
+* @returns The origin, with its repository when known.
+*/
+function resolveToolSource(name) {
+	const trimmed = name.trim().replace(/\*+$/, "");
+	const mcp = /^mcp__([A-Za-z0-9_-]+)__/.exec(trimmed);
+	if (mcp !== null) {
+		const server = mcp[1];
+		const entry = SOURCE_BY_ID.get(MCP_SERVERS.get(server) ?? "");
+		if (entry !== void 0) return {
+			kind: "mcp",
+			label: entry.label,
+			repo: entry.repo,
+			owner: server
+		};
+		return {
+			kind: "mcp",
+			label: `MCP · ${server}`,
+			owner: server
+		};
+	}
+	const extension = EXTENSION_TOOL.exec(trimmed);
+	if (extension !== null && !trimmed.startsWith("mcp__")) {
+		const entry = SOURCE_BY_ID.get("qqbot-extension");
+		const base = extension[1];
+		const owner = extension[2];
+		return {
+			kind: "extension",
+			label: `扩展 · ${base}__${owner}`,
+			...entry === void 0 ? {} : { repo: entry.repo },
+			owner
+		};
+	}
+	if (trimmed.endsWith("__")) {
+		const entry = SOURCE_BY_ID.get("qqbot-extension");
+		return {
+			kind: "extension",
+			label: `扩展 · ${trimmed.slice(0, -2)}__*`,
+			...entry === void 0 ? {} : { repo: entry.repo },
+			owner: "*"
+		};
+	}
+	for (const [prefix, id] of PLUGIN_PREFIXES) {
+		if (!trimmed.startsWith(prefix)) continue;
+		const entry = SOURCE_BY_ID.get(id);
+		if (entry !== void 0) return {
+			kind: "plugin",
+			label: entry.label,
+			repo: entry.repo,
+			owner: id
+		};
+	}
+	const plugin = PLUGIN_TOOLS.get(trimmed);
+	if (plugin !== void 0) {
+		const entry = SOURCE_BY_ID.get(plugin);
+		if (entry !== void 0) return {
+			kind: "plugin",
+			label: entry.label,
+			repo: entry.repo,
+			owner: plugin
+		};
+	}
+	if (CORE_TOOLS.has(trimmed)) {
+		const entry = SOURCE_BY_ID.get("core");
+		return {
+			kind: "core",
+			label: entry?.label ?? "DSH 核心",
+			...entry === void 0 ? {} : { repo: entry.repo },
+			owner: "core"
+		};
+	}
+	return {
+		kind: "unknown",
+		label: "未知来源"
+	};
+}
+//#endregion
 //#region lib/types/auto-sessions-state.js
 /**
 * Durable snapshot of the sessions that were on the Auto preset when this row
@@ -352,10 +683,13 @@ const AUTO_PRESET = "auto";
 * tool-call safety net allows unreviewed calls instead of failing them.
 * `allowedCalls` counts the calls the net let through in that state, so the
 * settings card can tell the human how much review was skipped.
+* `skippedReadOnly` counts the calls the allowlist took off the reviewer, which
+* is the number the settings card shows next to the switch.
 */
 const autoReviewStatus = {
 	held: false,
-	allowedCalls: 0
+	allowedCalls: 0,
+	skippedReadOnly: 0
 };
 /**
 * Resolve the pinned reviewer route from live settings.
@@ -419,15 +753,19 @@ function resolveSessionAutoReviewRoute(ctx, session) {
 * Because Cordis `on(..., { prepend: true })` unshifts onto the event hook list,
 * registering this listener AFTER `official.apply(scope)` places it at index 0
 * — directly ahead of the official gate's own prepended listener — so
-* `activeSession.run(exec.agent?.session, next)` wraps the entire official
-* review execution.
+* `activeSession.run({ session, tool }, next)` wraps the entire official review
+* execution. The stored tool name is what lets the reviewer be skipped for an
+* allowlisted read without the gate ever seeing a fake preset.
 *
 * @param scope - the review scope context where the gate is mounted.
-* @param activeSession - AsyncLocalStorage holding the session under review.
+* @param activeSession - AsyncLocalStorage holding the call under review.
 */
 function bindAutoReviewSessionCorrelation(scope, activeSession) {
 	scope.effect(function* () {
-		yield scope.on("tools/pre-execute", (exec, next) => activeSession.run(exec.agent?.session, next), { prepend: true });
+		yield scope.on("tools/pre-execute", (exec, next) => activeSession.run({
+			session: exec.agent?.session,
+			tool: exec.name
+		}, next), { prepend: true });
 	}, "model-switch: auto-review session correlation");
 }
 /**
@@ -546,12 +884,21 @@ function fiberChainOf(ctx) {
 * displacing row and take it back without unmounting the gate (the gate's
 * disposal would move live `auto` sessions to `danger-full-access`).
 *
+* `current()` also answers the read-only skip. The official gate's first line is
+* `if (permissionPresets.current(session) !== 'auto') return next()`, so a call
+* whose tool is allowlisted can be taken off the reviewer by answering with
+* anything else — the gate itself then runs the normal `next()` path, leaving
+* every later listener and guard in place. The answer is scoped to the call in
+* flight through the async store, so outside a tool call this method reports the
+* truth (`rememberAuto()` and the settings card read it for accounting).
+*
 * @param resolve - resolves the host's permission-preset service per call.
 * @param log - the row logger used for the single degradation report.
 * @param chain - diagnostic dump of the resolution chain; defaults to empty.
+* @param bypass - optional read-only skip; absent when the feature is off.
 * @returns A managed preset face.
 */
-function defensivePermissionPresets(resolve, log, chain = () => "") {
+function defensivePermissionPresets(resolve, log, chain = () => "", bypass) {
 	let reported = false;
 	let admit;
 	let release;
@@ -567,12 +914,18 @@ function defensivePermissionPresets(resolve, log, chain = () => "") {
 	};
 	return {
 		current(session) {
+			let preset;
 			try {
-				return requireService().current(session);
+				preset = requireService().current(session);
 			} catch (error) {
 				degrade("current()", error);
 				return CUSTOM_PRESET;
 			}
+			if (preset !== AUTO_PRESET || bypass === void 0) return preset;
+			const ambient = bypass.ambient();
+			if (ambient === void 0 || !bypass.allows(ambient.tool)) return preset;
+			autoReviewStatus.skippedReadOnly += 1;
+			return CUSTOM_PRESET;
 		},
 		set(session, preset) {
 			try {
@@ -622,7 +975,7 @@ function defensivePermissionPresets(resolve, log, chain = () => "") {
 */
 function reviewScope(ctx, activeSession = new AsyncLocalStorage(), presets = defensivePermissionPresets(() => permissionPresetsOf(ctx), ctx.logger, () => fiberChainOf(ctx))) {
 	return ctx.extend({
-		llm: reviewLlm(ctx.llm, () => resolveSessionAutoReviewRoute(ctx, activeSession.getStore())),
+		llm: reviewLlm(ctx.llm, () => resolveSessionAutoReviewRoute(ctx, activeSession.getStore()?.session)),
 		permissionPresets: presets
 	});
 }
@@ -709,8 +1062,30 @@ async function apply(ctx) {
 		ctx.logger.error(cause);
 		return;
 	}
-	const presets = defensivePermissionPresets(() => permissionPresetsOf(ctx), ctx.logger, () => fiberChainOf(ctx));
 	const activeSession = new AsyncLocalStorage();
+	/**
+	* The read-only skip, read live so a settings change applies to the next call.
+	*
+	* Fails closed: an unreadable setting, a disabled switch, or an empty list all
+	* mean "review it". The allowlist is the user's explicit opt-in, so a broken
+	* read must never widen what runs unreviewed.
+	*/
+	const skipReadOnly = (tool) => {
+		let settings;
+		try {
+			settings = ctx.modelSwitch.currentSettings();
+		} catch {
+			return false;
+		}
+		if (settings?.autoReviewSkipReadOnly !== true) return false;
+		const list = settings.autoReviewAllowlist;
+		if (!Array.isArray(list) || list.length === 0) return false;
+		return isAllowedByList(tool, list);
+	};
+	const presets = defensivePermissionPresets(() => permissionPresetsOf(ctx), ctx.logger, () => fiberChainOf(ctx), {
+		ambient: () => activeSession.getStore(),
+		allows: skipReadOnly
+	});
 	const scope = reviewScope(ctx, activeSession, presets);
 	installToolCallSafetyNet(ctx, {
 		fiberChain: () => fiberChainOf(ctx),
@@ -1019,4 +1394,4 @@ async function apply(ctx) {
 	}, "model-switch: release the Auto registration before anything else");
 }
 //#endregion
-export { bindAutoReviewSessionCorrelation as a, installToolCallSafetyNet as c, resolveSessionAutoReviewRoute as d, reviewLlm as f, autoReviewStatus as i, isReviewerInfrastructureFailure as l, autoReviewGate as n, defensivePermissionPresets as o, reviewScope as p, autoReviewRouteOf as r, inject as s, apply as t, name as u };
+export { bindAutoReviewSessionCorrelation as a, installToolCallSafetyNet as c, resolveSessionAutoReviewRoute as d, reviewLlm as f, resolveToolSource as h, autoReviewStatus as i, isReviewerInfrastructureFailure as l, DEFAULT_READ_ONLY_TOOLS as m, autoReviewGate as n, defensivePermissionPresets as o, reviewScope as p, autoReviewRouteOf as r, inject as s, apply as t, name as u };

package/lib/auto-review.js

@@ -1,2 +1,2 @@
-import { a as bindAutoReviewSessionCorrelation, c as installToolCallSafetyNet, d as resolveSessionAutoReviewRoute, f as reviewLlm, i as autoReviewStatus, l as isReviewerInfrastructureFailure, n as autoReviewGate, o as defensivePermissionPresets, p as reviewScope, r as autoReviewRouteOf, s as inject, t as apply, u as name } from "./auto-review-CvmQaRVf.js";
+import { a as bindAutoReviewSessionCorrelation, c as installToolCallSafetyNet, d as resolveSessionAutoReviewRoute, f as reviewLlm, i as autoReviewStatus, l as isReviewerInfrastructureFailure, n as autoReviewGate, o as defensivePermissionPresets, p as reviewScope, r as autoReviewRouteOf, s as inject, t as apply, u as name } from "./auto-review-BDx3LjVL.js";
 export { apply, autoReviewGate, autoReviewRouteOf, autoReviewStatus, bindAutoReviewSessionCorrelation, defensivePermissionPresets, inject, installToolCallSafetyNet, isReviewerInfrastructureFailure, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };