dsh-model-switch 0.4.40 → 0.4.42

package/CHANGELOG.md

@@ -1,3 +1,25 @@
+## v0.4.42
+
+与第三方自动模式插件 `@log.li/dsh-automode` 的插件层适配：**不改用户配置、不新增依赖、不安装任何东西**——本插件在自己的 loader 行里，把「自动审查路由」与「纯读名单」注入到 `@log.li/dsh-automode` 行的**内存配置**，让它的 `auto-mode` 档位沿用我们的路由与豁免。
+
+- **新行 `model-switch-automode-compat`**（`dsh-model-switch/automode-compat`）：`inject = ['loader','modelSwitch']`，在 `loader/patch-context` 里于该行挂载前改写 `entry.options.config`；行不存在时整行空转。可在插件管理器里单独停用，不影响审查闸门。
+- **路由**：仅当 automode 的 `classifier.provider` / `classifier.model` **都为空**时填入我们的 `autoReviewProvider/Model`；任一字段已有值即视为用户意图，绝不覆盖（状态里标 `user-set`）；我们将自己上次写入的值记为可重写，设置变更时能跟随更新。
+- **纯读豁免**：把我们的名单（默认 58 条）并入它的 `readOnlyTools`，并在「纯读工具免审查」开关关闭时**不注入**。它用精确匹配，所以 `sessions_list__*` 这类通配条目会跳过并在卡片上计数（默认名单里是 1 条）。注入后的工具仍会先过它自己的 deny 正则——不会削弱它的硬底线。
+- **不落盘**：只改运行时 `entry.options`，从不调用 `Entry.update()`；启动前后 profile 的 `cordis.patch.yml` 不变，重启自动重放。
+- **可见性**：「审查豁免」卡片新增一行 `Auto mode 已接入：审查路由 <provider>/<model>，直通 +N 个纯读工具（M 条通配未同步）`，未安装时不显示；`tools` RPC 的 `status.automode` 提供同数字段。
+- **rc.3 lab 实测**（3083 / `~/.dsh-lab3`，automode `0.17.0` + 本插件 0.4.42）：automode 的 `boot` 审计行出现；在 `auto-mode` 会话的工具调用里，它的闸门实际读到 `preset="auto-mode"`、`classifier={"provider":"apigoto","model":"mimo-v2.6-flash",…}`、`readOnlyTools=58`、`preExecuteGate=true`（即注入生效）；启动前后 profile `cordis.patch.yml` 的 sha256 一致（未落盘）；卡片显示「Auto mode 已接入：审查路由 apigoto/mimo-v2.6-flash，直通 +53 个纯读工具（2 条通配未同步）」。注：automode 的逐调用审计行本次未出现，是因为它对未升级的 workspace-write 调用按设计静默放行，与兼容性无关。
+- **边界**：它的分类器只有一个静态路由，逐步 provider 分组无法映射过去（取顶层自动审查路由）；它的 `readOnlyTools` 精确匹配，通配条目转不过去；这些都在文案与文档里写明。
+
+## v0.4.41
+
+DSH `0.2.1-rc.3`（2026-10-23 发布，当前在 `next` 通道）兼容性更新：**插件本体零改动**，本轮做的是实证与声明；旧线（`0.1.7-alpha.2` … `0.2.1-rc.2`）的声明与依赖下界原样保留。
+
+- **rc.3 是纯客户端加法**（compare `dsh-v0.2.1-rc.2...dsh-v0.2.1-rc.3`，300 个文件）：`ui-conversation` 只新增 `conversation.session.header.views.actions` 槽位与 header 的 `entryPins`/`entryActions`/`setPinned`（`conversation.composer` 链与 `ComposerChainProps` 一字未改）；输入侧新增 `whenDraftExists`，`clearPreviousDraft` 语义保持兼容（本插件从不调用 `requestDraftInitialization`）；`ui-user-questions`、`ui-primitives` 只加不改；`experimental-auto-review`、`dsh-tools`、`dsh-session`、`dsh-subagent` 与 `api/*` 源码未变（只有版本号）。
+- **rc.3 lab 实测**（独立 home `~/.dsh-lab3`、端口 3083、`@deepseek-ai/dsh@0.2.1-rc.3`）：挂载无 `best-effort on unverified runtime` 告警；「审查豁免」卡片正常，「恢复默认名单」得到 **58 条**；自动审查预设下 `read`+`glob`+`read` 让跳过计数到 **3**，随后 `write` 让计数保持 **3**（写操作仍走审查）；计划卡「去聊天里说」使回合以 **`aborted`** 结束、输入框回来、显示「已停止」；草稿跨会话切换保留（rc.3 的修复点）。
+- **rc.2 回归**（3082，同一份 0.4.41 产物）：挂载正常、卡片正常、`glob`+`read` 跳过计数 **2**，与 0.4.40 行为一致。
+- **声明**：`package.json#dsh.compatibility.dshReleases` 增加 `0.2.1-rc.3`；`README.md`、`README.zh.md` 与 `docs/dsh-compat-watch.md` 同步（含「rc.3 走 `next` 通道」与本次「用户显式要求、先于 `latest` 触发」的例外记录）。
+- **测试**：`tests/compatibility.spec.ts` 新增两例——真实 `package.json` 必须同时保留旧线与 rc.3 的声明；rc.3 分类为 verified（不产生告警），未知版本仍 fail-open。
+
 ## v0.4.40
 
 按你的点名，默认豁免名单从 47 条扩到 **58 条**：新增 11 个工具，全部在「设置 → 模型切换 → 审查豁免」里可查、可删、可恢复默认。

package/README.md

@@ -158,7 +158,7 @@ A packed tarball installs the same build without a registry:
 dsh plugin --profile web add --force ./dsh-model-switch-0.4.26.tgz
 ```
 
-Then install only the provider adapters you use. This release was checked against official DeepSeek Harness `0.1.7-rc.2` and verified on `0.2.0-rc.2` and `0.2.1-rc.2`:
+Then install only the provider adapters you use. This release was checked against official DeepSeek Harness `0.1.7-rc.2` and verified on `0.2.0-rc.2`, `0.2.1-rc.2` and `0.2.1-rc.3` (rc.3 currently ships on the `next` dist-tag):
 
 ```sh
 dsh plugin --profile web add --force \
@@ -193,6 +193,8 @@ Verified releases: `0.1.7-alpha.2`, `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.2`. Th
 
 The verified releases in `package.json#dsh.compatibility.dshReleases` are evidence, not an allowlist. Review public API changes and test new Host releases before adding a verification claim.
 
+**Third-party auto modes.** When [`@log.li/dsh-automode`](https://github.com/log-li/dsh-automode) is installed, the `model-switch-automode-compat` row injects this plugin's Auto-review route and pure-read list into that row's **in-memory** config — no profile write, nothing to configure by hand. Its `auto-mode` preset then reviews with your configured route and passes your allowlisted tools, while the `auto` preset keeps using this plugin's own gate. Explicit `classifier.provider/model` values in that row always win, pattern-shaped allowlist entries cannot transfer (its check is exact-match), and its hard-deny bands still run first.
+
 ## Development
 
 Requires Node 22.19+ and pnpm.

package/README.zh.md

@@ -156,7 +156,7 @@ dsh plugin --profile web add --force dsh-model-switch
 dsh plugin --profile web add --force ./dsh-model-switch-0.4.17.tgz
 ```
 
-然后只安装实际使用的 Provider Adapter。此版本已在官方 DeepSeek Harness `0.1.7-rc.2` 上检查，并在 `0.2.0-rc.2` 上验证：
+然后只安装实际使用的 Provider Adapter。此版本已在官方 DeepSeek Harness `0.1.7-rc.2` 上检查，并在 `0.2.0-rc.2`、`0.2.1-rc.2` 与 `0.2.1-rc.3`（rc.3 目前走 `next` 通道）上验证：
 
 ```sh
 dsh plugin --profile web add --force \
@@ -187,10 +187,12 @@ DeepSeek 薄适配器调用官方公开 `DeepSeekSearchProvider`，复用用户
 
 DSH Host peer 和开发依赖接受 `>=0.1.7-alpha.2`，包括 rc.1 和后续版本。开发锁文件解析到 rc.2。Cordis 接受 `>=4.0.4 <5.0.0`。
 
-已验证版本：`0.1.7-alpha.2`、`0.1.7-rc.1`、`0.1.7-rc.2`、`0.2.0-rc.2`、`0.2.1-rc.2`。0.2.0 的声明覆盖三处差异：Host 改名的提问撤下动词（`cancel()` → `dismiss()`）、`session.selectModel` 不 await 的部署默认值写入、以返回值报出的 `ModelDirectory.select` 拒绝；三者均已在 lab（3082/3085）与真实桌面会话中逐一验证。0.2.1 的声明覆盖两处被替换的 seam：共享命名调用改为 provider 自备提示词与解析的 `executeSessionTitleLlm`（本插件按安装行在运行时适配，并镜像官方 0.2.1 的提示词、取最低 reasoning effort 与 `currentTitle` 锚定）；Subagent 运行时以 `startActivation` 取代 `start()`/`startContinuable()`，本插件同时识别两条已发布线，并为激活入口覆写 `spec.request.agentOptions`（显式路由仍优先、非 agentOptions 能力的外部适配器不改写），路由语义与旧线一致（0.4.28，记录于 `docs/seam-gap.md`）；0.2.1 还新增了自动审查门禁对 `ctx.workingDirectory` 的读取，旧实现因在自己的 fiber 里直调 `official.apply` 而需要手工镜像门禁的 `inject`，于是每个工具调用都被拒（`cannot get property "workingDirectory" without inject`），0.4.28 改为把官方门禁以插件方式挂载、由官方 `inject` 解析依赖，本行只声明自身需要的服务。0.4.28 的真实包证据：0.2.1 上旧形态精确复现该注入错误、新形态到达 `workingDirectory.ensure` 且成功注册门禁、激活入口的路由改写与 spec 透传通过；0.2.0 上无需 `workingDirectory` 服务即可注册门禁，`start()` 路由改写与父身份保持不变。0.2.1 的 lab 证据为：npm 安装的 0.2.1 运行时 + 打包后的 0.4.26 组合 `exit 0`、命名/压缩/自动审查/子代理四行均来自本插件、Web Host 在 3082 启动并服务需要鉴权的页面；该次未经浏览器调用 3082 能力 RPC，真实桌面的 0.2.1 命名差分在应用升级后复验。0.2.1 还暴露出一处预设层面的差异（0.2.1 校验提示词变量、只有 `provider`/`model`，且把 `time-context`/`tool-schedule` 移进预设）：0.4.26 的静态预设副本因此让每一轮都报 `unknown prompt variable "{{cwd}}"`，0.4.27 删除副本改为启动期运行时桥接，并在 lab 的 0.2.1 headless 真实回合中验证通过（展开见 CHANGELOG 0.4.27）。
+已验证版本：`0.1.7-alpha.2`、`0.1.7-rc.1`、`0.1.7-rc.2`、`0.2.0-rc.2`、`0.2.1-rc.2`、`0.2.1-rc.3`。0.2.0 的声明覆盖三处差异：Host 改名的提问撤下动词（`cancel()` → `dismiss()`）、`session.selectModel` 不 await 的部署默认值写入、以返回值报出的 `ModelDirectory.select` 拒绝；三者均已在 lab（3082/3085）与真实桌面会话中逐一验证。0.2.1 的声明覆盖两处被替换的 seam：共享命名调用改为 provider 自备提示词与解析的 `executeSessionTitleLlm`（本插件按安装行在运行时适配，并镜像官方 0.2.1 的提示词、取最低 reasoning effort 与 `currentTitle` 锚定）；Subagent 运行时以 `startActivation` 取代 `start()`/`startContinuable()`，本插件同时识别两条已发布线，并为激活入口覆写 `spec.request.agentOptions`（显式路由仍优先、非 agentOptions 能力的外部适配器不改写），路由语义与旧线一致（0.4.28，记录于 `docs/seam-gap.md`）；0.2.1 还新增了自动审查门禁对 `ctx.workingDirectory` 的读取，旧实现因在自己的 fiber 里直调 `official.apply` 而需要手工镜像门禁的 `inject`，于是每个工具调用都被拒（`cannot get property "workingDirectory" without inject`），0.4.28 改为把官方门禁以插件方式挂载、由官方 `inject` 解析依赖，本行只声明自身需要的服务。0.4.28 的真实包证据：0.2.1 上旧形态精确复现该注入错误、新形态到达 `workingDirectory.ensure` 且成功注册门禁、激活入口的路由改写与 spec 透传通过；0.2.0 上无需 `workingDirectory` 服务即可注册门禁，`start()` 路由改写与父身份保持不变。0.2.1 的 lab 证据为：npm 安装的 0.2.1 运行时 + 打包后的 0.4.26 组合 `exit 0`、命名/压缩/自动审查/子代理四行均来自本插件、Web Host 在 3082 启动并服务需要鉴权的页面；该次未经浏览器调用 3082 能力 RPC，真实桌面的 0.2.1 命名差分在应用升级后复验。0.2.1 还暴露出一处预设层面的差异（0.2.1 校验提示词变量、只有 `provider`/`model`，且把 `time-context`/`tool-schedule` 移进预设）：0.4.26 的静态预设副本因此让每一轮都报 `unknown prompt variable "{{cwd}}"`，0.4.27 删除副本改为启动期运行时桥接，并在 lab 的 0.2.1 headless 真实回合中验证通过（展开见 CHANGELOG 0.4.27）。0.2.1-rc.3 是纯客户端改动：本品读到的三个包都是加法——`ui-conversation` 新增 `conversation.session.header.views.actions` 槽位与 header 的 `entryPins`/`entryActions`/`setPinned`（`conversation.composer` 链与 `ComposerChainProps` 一字未改）、`ui-primitives` 新增 `IconAppsAddOutline*` 图标、`ui-user-questions` 只有版本号；`experimental-auto-review`、`dsh-tools`、`dsh-session`、`dsh-subagent` 与 `api/*` 在 rc.3 中源码未变（后者只有版本号）。插件本体零改动，在 rc.3 lab（3083，`@deepseek-ai/dsh@0.2.1-rc.3`）复验：挂载无 unverified 告警、58 条默认名单、纯读跳过计数、写操作仍审查、计划卡「去聊天里说」回合以 `aborted` 结束、草稿跨会话保留；再用同一产物在 rc.2 lab（3082）回归通过（展开见 CHANGELOG 0.4.41）。
 
 `package.json#dsh.compatibility.dshReleases` 中的已验证版本是证据，不是允许列表。新增验证声明前要审查公开 API 变化并测试新 Host 版本。
 
+**第三方自动模式。** 安装 [`@log.li/dsh-automode`](https://github.com/log-li/dsh-automode) 后，`model-switch-automode-compat` 行会把本插件的自动审查路由与纯读名单注入到该行的**内存配置**里——不写 profile、不需要手工配置。它的 `auto-mode` 档位会用你配置的路由审查、并按你的名单直通纯读工具；`auto` 档位仍然走本插件自己的闸门。该行里显式写过的 `classifier.provider/model` 永远优先，带通配的名单条目无法转过去（它是精确匹配），它的硬 deny 正则也照旧先跑。
+
 ## 开发
 
 需要 Node 22.19+ 和 pnpm。

package/cordis.patch.yml

@@ -73,3 +73,10 @@
     # The official naming provider under the configurable naming route.
     - id: model-switch-session-title
       name: 'dsh-model-switch/session-title'
+
+    # Inject this plugin's Auto-review route and pure-read list into the
+    # third-party @log.li/dsh-automode row's in-memory config (no profile write,
+    # no-op when that plugin is not installed). Kept as its own row so it can be
+    # disabled without touching the reviewer gate.
+    - id: model-switch-automode-compat
+      name: 'dsh-model-switch/automode-compat'

package/lib/{auto-review-BDx3LjVL.js → auto-review-QDEFUjT2.js}

@@ -1,339 +1,9 @@
 import { i as sessionProviderOf, r as resolveCapabilityRoute } from "./session-route-D1zoZgf3.js";
+import { n as isAllowedByList } from "./tool-allowlist-DlzB5GlQ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-/** Catalog lookup by id. */
-const SOURCE_BY_ID = new Map([
-	{
-		id: "core",
-		kind: "core",
-		label: "DSH 核心",
-		repo: "https://github.com/deepseek-ai/deepseek-harness"
-	},
-	{
-		id: "dsh-ops",
-		kind: "plugin",
-		label: "插件 · dsh-ops",
-		repo: "https://github.com/T-Auto/dsh-ops"
-	},
-	{
-		id: "dsh-browser-cdp",
-		kind: "plugin",
-		label: "插件 · dsh-browser-cdp",
-		repo: "https://github.com/drscrewdriver/dsh-browser-cdp"
-	},
-	{
-		id: "dsh-auto-memory",
-		kind: "plugin",
-		label: "插件 · dsh-auto-memory",
-		repo: "https://github.com/AskTheWay/dsh-auto-memory"
-	},
-	{
-		id: "dsh-model-switch",
-		kind: "plugin",
-		label: "插件 · dsh-model-switch",
-		repo: "https://github.com/vandoor7-droid/dsh-model-switch"
-	},
-	{
-		id: "mcp:wincu",
-		kind: "mcp",
-		label: "MCP · wincu（dsh-computer-use-win）",
-		repo: "https://github.com/Yu-tao-Li/dsh-computer-use-win"
-	},
-	{
-		id: "qqbot-extension",
-		kind: "extension",
-		label: "QQ 机器人扩展（框架 @zaofan/dsh-qqbot）",
-		repo: "https://github.com/zaofan-make/dsh-qqbot"
-	}
-].map((entry) => [entry.id, entry]));
-/**
-* Tool names the released Host owns, calibrated against dsh 0.2.1-rc.2.
-*
-* A name outside the catalog would otherwise be reported as core, which is the
-* one guess a reader could act on wrongly; it resolves to `unknown` instead.
-*/
-const CORE_TOOLS = /* @__PURE__ */ new Set([
-	"ask_user_question",
-	"create_goal",
-	"create_skill",
-	"create_worktree",
-	"edit",
-	"exit_plan_mode",
-	"get_goal",
-	"glob",
-	"grep",
-	"interrupt_agent",
-	"job_kill",
-	"job_list",
-	"job_output",
-	"list_agents",
-	"list_mcp_resource_templates",
-	"list_mcp_resources",
-	"load_workspace_dependencies",
-	"present",
-	"pwsh",
-	"ralph",
-	"read",
-	"read_image",
-	"read_mcp_resource",
-	"schedule_create",
-	"schedule_delete",
-	"schedule_list",
-	"schedule_update",
-	"send_message",
-	"session_event_read",
-	"session_event_search",
-	"session_event_trace",
-	"session_search",
-	"session_trace",
-	"sidebar_open",
-	"skill",
-	"spawn_teammate",
-	"subagent",
-	"subagent_fork",
-	"team_task_create",
-	"team_task_get",
-	"team_task_list",
-	"team_task_update",
-	"terminal_close",
-	"terminal_list",
-	"terminal_open",
-	"terminal_read",
-	"terminal_send",
-	"terminal_signal",
-	"todo_write",
-	"update_goal",
-	"wait_agent",
-	"web_fetch",
-	"web_search",
-	"web_search_pro",
-	"workflow",
-	"working_directory",
-	"write"
-]);
-/** MCP server name → catalog id, for the servers this allowlist knows. */
-const MCP_SERVERS = /* @__PURE__ */ new Map([["wincu", "mcp:wincu"]]);
-/** Plugin identity by tool-name prefix (checked before the core catalog). */
-const PLUGIN_PREFIXES = [
-	["bcdp_", "dsh-browser-cdp"],
-	["browser_window_", "dsh-browser-cdp"],
-	["ops_", "dsh-ops"],
-	["memory_", "dsh-auto-memory"]
-];
-/** Single plugin tools that carry no prefix. */
-const PLUGIN_TOOLS = /* @__PURE__ */ new Map([["generate_image", "dsh-model-switch"]]);
-/** `<base>__<owner>` — the extension-tool naming the QQ bot framework uses. */
-const EXTENSION_TOOL = /^([A-Za-z0-9_-]+)__(.+)$/;
-/**
-* Default allowlist: every pure-read tool this deployment exposes plus the
-* no-side-effect and autonomy entries the user explicitly released, calibrated
-* on a live desktop profile (105 tools) at dsh 0.2.1-rc.2.
-*
-* Grouped by origin so a reader can trace each entry through {@link SOURCE_CATALOG}.
-* Entries ending in `*` are patterns: the QQ bot extension suffixes its tools with
-* the bot's own name, so `sessions_list__*` keeps working when the persona is
-* renamed.
-*
-* Everything here follows one rule: releasing it must not let a side effect escape
-* the reviewer. Calls that merely dispatch, ask, present, wait or navigate qualify
-* because the work they trigger still runs under the same auto preset. Delegation
-* tools (`subagent`, `subagent_fork`, `spawn_teammate`) deliberately stay out: a
-* child session seeds its preset from `permissionPresets.current(parent.session)`,
-* and this bypass answers `'custom'` for an allowlisted call in flight — releasing
-* them would hand the child no `auto` preset at all, i.e. no review.
-*/
-const DEFAULT_READ_ONLY_TOOLS = [
-	"read",
-	"grep",
-	"glob",
-	"read_image",
-	"skill",
-	"web_search",
-	"web_search_pro",
-	"web_fetch",
-	"load_workspace_dependencies",
-	"ask_user_question",
-	"present",
-	"sidebar_open",
-	"exit_plan_mode",
-	"job_list",
-	"job_output",
-	"terminal_list",
-	"terminal_read",
-	"list_agents",
-	"team_task_list",
-	"team_task_get",
-	"get_goal",
-	"schedule_list",
-	"wait_agent",
-	"send_message",
-	"team_task_create",
-	"list_mcp_resources",
-	"list_mcp_resource_templates",
-	"read_mcp_resource",
-	"session_search",
-	"session_event_search",
-	"session_event_read",
-	"session_event_trace",
-	"session_trace",
-	"create_goal",
-	"schedule_create",
-	"terminal_open",
-	"ops_read_files",
-	"ops_discover_tools",
-	"bcdp_status",
-	"bcdp_help",
-	"bcdp_doctor",
-	"bcdp_snapshot",
-	"browser_window_status",
-	"memory_list",
-	"memory_read",
-	"mcp__wincu__windows_computer_use_accessibility_tree",
-	"mcp__wincu__windows_computer_use_element_info",
-	"mcp__wincu__windows_computer_use_find",
-	"mcp__wincu__windows_computer_use_health",
-	"mcp__wincu__windows_computer_use_list_windows",
-	"mcp__wincu__windows_computer_use_ocr",
-	"mcp__wincu__windows_computer_use_screenshot",
-	"mcp__wincu__windows_computer_use_snapshot",
-	"mcp__wincu__windows_computer_use_tools",
-	"mcp__wincu__windows_computer_use_wait",
-	"mcp__wincu__windows_computer_use_wait_for",
-	"sessions_list__*",
-	"bing_search__*"
-];
-/**
-* Validate one allowlist entry.
-*
-* `*` is a suffix wildcard: the entry must keep at least one literal leading
-* character, so a stray `*` can never turn the list into "allow everything".
-*
-* @param entry - the raw entry as typed in settings.
-* @returns `ok`, or the specific problem.
-*/
-function validateAllowEntry(entry) {
-	const trimmed = entry.trim();
-	if (trimmed === "") return "empty";
-	if (/^\*+$/.test(trimmed)) return "bare-wildcard";
-	if (trimmed.startsWith("*")) return "leading-wildcard";
-	return "ok";
-}
-/**
-* Whether a tool name matches one allowlist entry.
-*
-* Exact names match exactly; an entry may end in `*`, which matches any
-* remaining characters (including none). Invalid entries never match.
-*
-* @param name - the tool name from `exec.name`.
-* @param entry - one allowlist entry.
-* @returns true when the call may skip review.
-*/
-function matchesAllowPattern(name, entry) {
-	if (name === "" || validateAllowEntry(entry) !== "ok") return false;
-	const trimmed = entry.trim();
-	const star = trimmed.indexOf("*");
-	if (star === -1) return name === trimmed;
-	const prefix = trimmed.slice(0, star);
-	const suffix = trimmed.slice(star + 1);
-	if (!name.startsWith(prefix) || !name.endsWith(suffix)) return false;
-	return name.length >= prefix.length + suffix.length;
-}
-/**
-* Whether a tool name is covered by an allowlist.
-* @param name - the tool name under review.
-* @param allowlist - configured entries, patterns included.
-* @returns true when at least one entry matches.
-*/
-function isAllowedByList(name, allowlist) {
-	return allowlist.some((entry) => matchesAllowPattern(name, entry));
-}
-/**
-* Resolve the origin of one tool name for display.
-*
-* Resolution order: MCP bridge → `<tool>__<owner>` extension → plugin prefix →
-* plugin table → core catalog → unknown. Only the first two are structural; the
-* rest are calibrated names, so an unlisted tool is reported as unknown rather
-* than guessed into a package.
-*
-* @param name - the tool name.
-* @returns The origin, with its repository when known.
-*/
-function resolveToolSource(name) {
-	const trimmed = name.trim().replace(/\*+$/, "");
-	const mcp = /^mcp__([A-Za-z0-9_-]+)__/.exec(trimmed);
-	if (mcp !== null) {
-		const server = mcp[1];
-		const entry = SOURCE_BY_ID.get(MCP_SERVERS.get(server) ?? "");
-		if (entry !== void 0) return {
-			kind: "mcp",
-			label: entry.label,
-			repo: entry.repo,
-			owner: server
-		};
-		return {
-			kind: "mcp",
-			label: `MCP · ${server}`,
-			owner: server
-		};
-	}
-	const extension = EXTENSION_TOOL.exec(trimmed);
-	if (extension !== null && !trimmed.startsWith("mcp__")) {
-		const entry = SOURCE_BY_ID.get("qqbot-extension");
-		const base = extension[1];
-		const owner = extension[2];
-		return {
-			kind: "extension",
-			label: `扩展 · ${base}__${owner}`,
-			...entry === void 0 ? {} : { repo: entry.repo },
-			owner
-		};
-	}
-	if (trimmed.endsWith("__")) {
-		const entry = SOURCE_BY_ID.get("qqbot-extension");
-		return {
-			kind: "extension",
-			label: `扩展 · ${trimmed.slice(0, -2)}__*`,
-			...entry === void 0 ? {} : { repo: entry.repo },
-			owner: "*"
-		};
-	}
-	for (const [prefix, id] of PLUGIN_PREFIXES) {
-		if (!trimmed.startsWith(prefix)) continue;
-		const entry = SOURCE_BY_ID.get(id);
-		if (entry !== void 0) return {
-			kind: "plugin",
-			label: entry.label,
-			repo: entry.repo,
-			owner: id
-		};
-	}
-	const plugin = PLUGIN_TOOLS.get(trimmed);
-	if (plugin !== void 0) {
-		const entry = SOURCE_BY_ID.get(plugin);
-		if (entry !== void 0) return {
-			kind: "plugin",
-			label: entry.label,
-			repo: entry.repo,
-			owner: plugin
-		};
-	}
-	if (CORE_TOOLS.has(trimmed)) {
-		const entry = SOURCE_BY_ID.get("core");
-		return {
-			kind: "core",
-			label: entry?.label ?? "DSH 核心",
-			...entry === void 0 ? {} : { repo: entry.repo },
-			owner: "core"
-		};
-	}
-	return {
-		kind: "unknown",
-		label: "未知来源"
-	};
-}
-//#endregion
 //#region lib/types/auto-sessions-state.js
 /**
 * Durable snapshot of the sessions that were on the Auto preset when this row
@@ -1394,4 +1064,4 @@ async function apply(ctx) {
 	}, "model-switch: release the Auto registration before anything else");
 }
 //#endregion
-export { bindAutoReviewSessionCorrelation as a, installToolCallSafetyNet as c, resolveSessionAutoReviewRoute as d, reviewLlm as f, resolveToolSource as h, autoReviewStatus as i, isReviewerInfrastructureFailure as l, DEFAULT_READ_ONLY_TOOLS as m, autoReviewGate as n, defensivePermissionPresets as o, reviewScope as p, autoReviewRouteOf as r, inject as s, apply as t, name as u };
+export { bindAutoReviewSessionCorrelation as a, installToolCallSafetyNet as c, resolveSessionAutoReviewRoute as d, reviewLlm as f, autoReviewStatus as i, isReviewerInfrastructureFailure as l, autoReviewGate as n, defensivePermissionPresets as o, reviewScope as p, autoReviewRouteOf as r, inject as s, apply as t, name as u };

package/lib/auto-review.js

@@ -1,2 +1,2 @@
-import { a as bindAutoReviewSessionCorrelation, c as installToolCallSafetyNet, d as resolveSessionAutoReviewRoute, f as reviewLlm, i as autoReviewStatus, l as isReviewerInfrastructureFailure, n as autoReviewGate, o as defensivePermissionPresets, p as reviewScope, r as autoReviewRouteOf, s as inject, t as apply, u as name } from "./auto-review-BDx3LjVL.js";
+import { a as bindAutoReviewSessionCorrelation, c as installToolCallSafetyNet, d as resolveSessionAutoReviewRoute, f as reviewLlm, i as autoReviewStatus, l as isReviewerInfrastructureFailure, n as autoReviewGate, o as defensivePermissionPresets, p as reviewScope, r as autoReviewRouteOf, s as inject, t as apply, u as name } from "./auto-review-QDEFUjT2.js";
 export { apply, autoReviewGate, autoReviewRouteOf, autoReviewStatus, bindAutoReviewSessionCorrelation, defensivePermissionPresets, inject, installToolCallSafetyNet, isReviewerInfrastructureFailure, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };