dsh-model-switch 0.4.39 → 0.4.40

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## v0.4.40
+
+按你的点名，默认豁免名单从 47 条扩到 **58 条**：新增 11 个工具，全部在「设置 → 模型切换 → 审查豁免」里可查、可删、可恢复默认。
+
+- **纯读 / 无副作用（6 个）**：`load_workspace_dependencies`（只返回打包依赖路径与版本）、`wait_agent`（只等待队友变化）、`ask_user_question`（把问题抛给人，决策权本来就在人手里）、`present`（只登记交付物卡片，不复制内容）、`sidebar_open`（只在侧栏打开文件/文件夹/URL）、`exit_plan_mode`（计划门由人审批，第二个审查者多余）。
+- **只派发、副作用仍留在审查内（3 个）**：`send_message`（给队友投递消息，目标会话的预设是它被创建时定好的）、`team_task_create`（只写共享任务板）、`terminal_open`（只起 shell，后续 `terminal_send` 仍在审查）。
+- **自治项（2 个，按你的明确决定放出）**：`create_goal`（创建持久目标，让本会话跨轮继续）、`schedule_create`（排一条未来投递的提示）。它们触发的新回合仍跑同一个 auto 预设，所以每轮里的工具调用照样逐次审查；风险是无人值守的 token 消耗，已在名单注释里标明。
+- **明确排除：`subagent` / `subagent_fork` / `spawn_teammate` 永不进默认名单。** `dsh-subagent` 生成子会话时会读 `permissionPresets.current(parent.session)`，只有 `auto` / `danger-full-access` 会被继承；而本插件在"名单命中的调用正在飞"时把 `current()` 答成 `'custom'`——放行这三个会让子会话拿不到 auto 预设，等于造出**无审查的子 agent**。`tests/tool-allowlist.spec.ts` 新增 `DELEGATION_SPAWNS` 专项守卫，防止以后被顺手加进去。
+- **守卫调整**：`MUTATING` 里移除 `send_message`、`team_task_create`（现按"派发类"放行），补入 `subagent`、`subagent_fork`。
+- **注意**：默认名单只是"出厂值"。已经保存过名单的部署（含桌面）升级后不会自动多出这 11 条——需要点一次「恢复默认名单」，或手动加入。
+- 测试：59 个测试文件 / **541** 测试（新增 delegation 守卫与"用户放行清单"两例）。
+
 ## v0.4.39
 
 「自动审查」下，**纯读工具不再调用审查模型**：`read` / `grep` / `glob` 这类只读调用直接执行，写操作、命令执行与删除仍然逐次审查。功能默认**关闭**，在「设置 → 模型切换 → 审查豁免」一键开启。

package/lib/{auto-review-C61WZIYI.js → auto-review-BDx3LjVL.js}

@@ -127,13 +127,22 @@ const PLUGIN_TOOLS = /* @__PURE__ */ new Map([["generate_image", "dsh-model-swit
 /** `<base>__<owner>` — the extension-tool naming the QQ bot framework uses. */
 const EXTENSION_TOOL = /^([A-Za-z0-9_-]+)__(.+)$/;
 /**
-* Default allowlist: every pure-read tool this deployment exposes, calibrated on
-* a live desktop profile (105 tools) at dsh 0.2.1-rc.2.
+* Default allowlist: every pure-read tool this deployment exposes plus the
+* no-side-effect and autonomy entries the user explicitly released, calibrated
+* on a live desktop profile (105 tools) at dsh 0.2.1-rc.2.
 *
 * Grouped by origin so a reader can trace each entry through {@link SOURCE_CATALOG}.
 * Entries ending in `*` are patterns: the QQ bot extension suffixes its tools with
 * the bot's own name, so `sessions_list__*` keeps working when the persona is
 * renamed.
+*
+* Everything here follows one rule: releasing it must not let a side effect escape
+* the reviewer. Calls that merely dispatch, ask, present, wait or navigate qualify
+* because the work they trigger still runs under the same auto preset. Delegation
+* tools (`subagent`, `subagent_fork`, `spawn_teammate`) deliberately stay out: a
+* child session seeds its preset from `permissionPresets.current(parent.session)`,
+* and this bypass answers `'custom'` for an allowlisted call in flight — releasing
+* them would hand the child no `auto` preset at all, i.e. no review.
 */
 const DEFAULT_READ_ONLY_TOOLS = [
 	"read",
@@ -144,6 +153,11 @@ const DEFAULT_READ_ONLY_TOOLS = [
 	"web_search",
 	"web_search_pro",
 	"web_fetch",
+	"load_workspace_dependencies",
+	"ask_user_question",
+	"present",
+	"sidebar_open",
+	"exit_plan_mode",
 	"job_list",
 	"job_output",
 	"terminal_list",
@@ -153,6 +167,9 @@ const DEFAULT_READ_ONLY_TOOLS = [
 	"team_task_get",
 	"get_goal",
 	"schedule_list",
+	"wait_agent",
+	"send_message",
+	"team_task_create",
 	"list_mcp_resources",
 	"list_mcp_resource_templates",
 	"read_mcp_resource",
@@ -161,6 +178,9 @@ const DEFAULT_READ_ONLY_TOOLS = [
 	"session_event_read",
 	"session_event_trace",
 	"session_trace",
+	"create_goal",
+	"schedule_create",
+	"terminal_open",
 	"ops_read_files",
 	"ops_discover_tools",
 	"bcdp_status",

package/lib/auto-review.js

@@ -1,2 +1,2 @@
-import { a as bindAutoReviewSessionCorrelation, c as installToolCallSafetyNet, d as resolveSessionAutoReviewRoute, f as reviewLlm, i as autoReviewStatus, l as isReviewerInfrastructureFailure, n as autoReviewGate, o as defensivePermissionPresets, p as reviewScope, r as autoReviewRouteOf, s as inject, t as apply, u as name } from "./auto-review-C61WZIYI.js";
+import { a as bindAutoReviewSessionCorrelation, c as installToolCallSafetyNet, d as resolveSessionAutoReviewRoute, f as reviewLlm, i as autoReviewStatus, l as isReviewerInfrastructureFailure, n as autoReviewGate, o as defensivePermissionPresets, p as reviewScope, r as autoReviewRouteOf, s as inject, t as apply, u as name } from "./auto-review-BDx3LjVL.js";
 export { apply, autoReviewGate, autoReviewRouteOf, autoReviewStatus, bindAutoReviewSessionCorrelation, defensivePermissionPresets, inject, installToolCallSafetyNet, isReviewerInfrastructureFailure, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };

package/lib/client.js

@@ -132,13 +132,22 @@ window.__ModuleLoader__.load({
 		/** `<base>__<owner>` — the extension-tool naming the QQ bot framework uses. */
 		const EXTENSION_TOOL = /^([A-Za-z0-9_-]+)__(.+)$/;
 		/**
-		* Default allowlist: every pure-read tool this deployment exposes, calibrated on
-		* a live desktop profile (105 tools) at dsh 0.2.1-rc.2.
+		* Default allowlist: every pure-read tool this deployment exposes plus the
+		* no-side-effect and autonomy entries the user explicitly released, calibrated
+		* on a live desktop profile (105 tools) at dsh 0.2.1-rc.2.
 		*
 		* Grouped by origin so a reader can trace each entry through {@link SOURCE_CATALOG}.
 		* Entries ending in `*` are patterns: the QQ bot extension suffixes its tools with
 		* the bot's own name, so `sessions_list__*` keeps working when the persona is
 		* renamed.
+		*
+		* Everything here follows one rule: releasing it must not let a side effect escape
+		* the reviewer. Calls that merely dispatch, ask, present, wait or navigate qualify
+		* because the work they trigger still runs under the same auto preset. Delegation
+		* tools (`subagent`, `subagent_fork`, `spawn_teammate`) deliberately stay out: a
+		* child session seeds its preset from `permissionPresets.current(parent.session)`,
+		* and this bypass answers `'custom'` for an allowlisted call in flight — releasing
+		* them would hand the child no `auto` preset at all, i.e. no review.
 		*/
 		const DEFAULT_READ_ONLY_TOOLS = [
 			"read",
@@ -149,6 +158,11 @@ window.__ModuleLoader__.load({
 			"web_search",
 			"web_search_pro",
 			"web_fetch",
+			"load_workspace_dependencies",
+			"ask_user_question",
+			"present",
+			"sidebar_open",
+			"exit_plan_mode",
 			"job_list",
 			"job_output",
 			"terminal_list",
@@ -158,6 +172,9 @@ window.__ModuleLoader__.load({
 			"team_task_get",
 			"get_goal",
 			"schedule_list",
+			"wait_agent",
+			"send_message",
+			"team_task_create",
 			"list_mcp_resources",
 			"list_mcp_resource_templates",
 			"read_mcp_resource",
@@ -166,6 +183,9 @@ window.__ModuleLoader__.load({
 			"session_event_read",
 			"session_event_trace",
 			"session_trace",
+			"create_goal",
+			"schedule_create",
+			"terminal_open",
 			"ops_read_files",
 			"ops_discover_tools",
 			"bcdp_status",

package/lib/index.js

@@ -1,5 +1,5 @@
 import { o as normalizeProviderGroups } from "./session-route-D1zoZgf3.js";
-import { h as resolveToolSource, i as autoReviewStatus, m as DEFAULT_READ_ONLY_TOOLS } from "./auto-review-C61WZIYI.js";
+import { h as resolveToolSource, i as autoReviewStatus, m as DEFAULT_READ_ONLY_TOOLS } from "./auto-review-BDx3LjVL.js";
 import { ModelSwitchAdapterRegistry } from "./adapter-registry.js";
 import { createRequire } from "node:module";
 import z from "@deepseek-ai/schemastery";

package/lib/types/tool-allowlist.d.ts

@@ -53,13 +53,22 @@ export declare const SOURCE_CATALOG: readonly SourceCatalogEntry[];
 /** Catalog lookup by id. */
 export declare const SOURCE_BY_ID: ReadonlyMap<string, SourceCatalogEntry>;
 /**
- * Default allowlist: every pure-read tool this deployment exposes, calibrated on
- * a live desktop profile (105 tools) at dsh 0.2.1-rc.2.
+ * Default allowlist: every pure-read tool this deployment exposes plus the
+ * no-side-effect and autonomy entries the user explicitly released, calibrated
+ * on a live desktop profile (105 tools) at dsh 0.2.1-rc.2.
  *
  * Grouped by origin so a reader can trace each entry through {@link SOURCE_CATALOG}.
  * Entries ending in `*` are patterns: the QQ bot extension suffixes its tools with
  * the bot's own name, so `sessions_list__*` keeps working when the persona is
  * renamed.
+ *
+ * Everything here follows one rule: releasing it must not let a side effect escape
+ * the reviewer. Calls that merely dispatch, ask, present, wait or navigate qualify
+ * because the work they trigger still runs under the same auto preset. Delegation
+ * tools (`subagent`, `subagent_fork`, `spawn_teammate`) deliberately stay out: a
+ * child session seeds its preset from `permissionPresets.current(parent.session)`,
+ * and this bypass answers `'custom'` for an allowlisted call in flight — releasing
+ * them would hand the child no `auto` preset at all, i.e. no review.
  */
 export declare const DEFAULT_READ_ONLY_TOOLS: readonly string[];
 /** Why one allowlist entry was refused. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model-switch",
-  "version": "0.4.39",
+  "version": "0.4.40",
   "description": "Explicit model routing plus composer/Plan picker for DeepSeek Harness",
   "repository": {
     "type": "git",