dsh-model-switch 0.4.40 → 0.4.42

package/lib/automode-compat.js

@@ -0,0 +1,266 @@
+import { t as DEFAULT_READ_ONLY_TOOLS } from "./tool-allowlist-DlzB5GlQ.js";
+//#region lib/types/automode-compat.js
+/** Cordis plugin identity; matches the `cordis.patch.yml` insert row id. */
+const name = "model-switch-automode-compat";
+/** The loader is the only seam this row needs besides this plugin's settings. */
+const inject = ["loader", "modelSwitch"];
+/** Third-party package this row adapts (strict package identity, never a prefix). */
+const AUTOMODE_PACKAGE = "@log.li/dsh-automode";
+/** Live adapter state, surfaced next to the allowlist editor. */
+const automodeCompatStatus = {
+	/** A `@log.li/dsh-automode` row exists in this Host. */
+	installed: false,
+	/** `provider/model` this adapter wrote, when it wrote one. */
+	route: void 0,
+	/** Why the route was skipped, when it was. */
+	routeSkipped: void 0,
+	/** Tools merged into the row's `readOnlyTools`. */
+	added: [],
+	/** Pattern-shaped entries that cannot transfer. */
+	skipped: [],
+	/** How many rows were rewritten (remounts included). */
+	applied: 0
+};
+/** Plain-object guard: arrays and `null` are not config objects. */
+function asRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+/** Trimmed string or empty, so whitespace-only config reads as "unset". */
+function text(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+/**
+* Whether one loader entry is the third-party auto-mode row.
+* @param entry - anything the loader hands over (an entry, or an event payload).
+* @returns true only for the exact package name.
+*/
+function isAutomodeEntry(entry) {
+	const row = entry?.options;
+	return typeof row?.name === "string" && row.name === "@log.li/dsh-automode";
+}
+/**
+* Decide the config one automode row should run with.
+*
+* Pure and side-effect free so the policy is unit-testable.
+*
+* @param config - the row's current config (any JSON-ish value).
+* @param route - this plugin's Auto-review route; empty strings mean "unset".
+* @param allowlist - tool names to merge into `readOnlyTools`; pass an empty
+*   list while the skip switch is off.
+* @param adoptedRoute - a `provider/model` this adapter wrote on an earlier
+*   pass; seeing it again means the row is still ours to rewrite.
+* @returns the config to install, whether it changed, and what was applied.
+*/
+function planAutomodeCompat(config, route, allowlist, adoptedRoute) {
+	const base = asRecord(config);
+	if (base === void 0) return {
+		config: {},
+		changed: false,
+		applied: {
+			added: [],
+			skipped: []
+		}
+	};
+	const next = { ...base };
+	let changed = false;
+	const provider = text(route.provider);
+	const model = text(route.model);
+	const classifier = asRecord(base.classifier) ?? {};
+	const declaredProvider = text(classifier.provider);
+	const declaredModel = text(classifier.model);
+	const declaredRoute = declaredProvider !== "" && declaredModel !== "" ? `${declaredProvider}/${declaredModel}` : void 0;
+	const ours = declaredRoute !== void 0 && adoptedRoute !== void 0 && declaredRoute === adoptedRoute;
+	let routeApplied;
+	let routeSkipped;
+	if (!ours && (declaredProvider !== "" || declaredModel !== "")) routeSkipped = "user-set";
+	else if (provider === "" || model === "") routeSkipped = "no-route";
+	else {
+		next.classifier = {
+			...classifier,
+			provider,
+			model
+		};
+		routeApplied = `${provider}/${model}`;
+		changed = true;
+	}
+	const existing = Array.isArray(base.readOnlyTools) ? base.readOnlyTools.filter((item) => typeof item === "string") : [];
+	const added = [];
+	const skipped = [];
+	for (const candidate of allowlist) {
+		const tool = text(candidate);
+		if (tool === "") continue;
+		if (tool.includes("*")) {
+			if (!skipped.includes(tool)) skipped.push(tool);
+			continue;
+		}
+		if (!existing.includes(tool) && !added.includes(tool)) added.push(tool);
+	}
+	if (added.length > 0) {
+		next.readOnlyTools = [...existing, ...added];
+		changed = true;
+	}
+	return {
+		config: next,
+		changed,
+		applied: {
+			route: routeApplied,
+			routeSkipped,
+			added,
+			skipped
+		}
+	};
+}
+/** The Auto-review route this plugin is configured to use. */
+function routeOf(settings) {
+	return {
+		provider: text(settings.autoReviewProvider),
+		model: text(settings.autoReviewModel)
+	};
+}
+/** Tools to merge into the third-party row, honouring the skip switch. */
+function allowlistOf(settings) {
+	if (settings.autoReviewSkipReadOnly !== true) return [];
+	const saved = settings.autoReviewAllowlist;
+	return saved !== void 0 && saved.length > 0 ? saved : DEFAULT_READ_ONLY_TOOLS;
+}
+/** Record one applied plan on the shared status object. */
+function reflect(plan) {
+	automodeCompatStatus.installed = true;
+	if (plan.applied.route !== void 0) {
+		automodeCompatStatus.route = plan.applied.route;
+		automodeCompatStatus.routeSkipped = void 0;
+	} else if (automodeCompatStatus.route === void 0) automodeCompatStatus.routeSkipped = plan.applied.routeSkipped;
+	for (const tool of plan.applied.added) if (!automodeCompatStatus.added.includes(tool)) automodeCompatStatus.added.push(tool);
+	for (const tool of plan.applied.skipped) if (!automodeCompatStatus.skipped.includes(tool)) automodeCompatStatus.skipped.push(tool);
+}
+/** Read one entry's live config object, if it has one. */
+function configOf(entry) {
+	return entry.options.config;
+}
+/** Assign the adapted config back onto the entry's live options. */
+function writeConfig(entry, config) {
+	entry.options.config = config;
+}
+/**
+* Adapt one row in memory, containing every failure.
+*
+* @param entry - the loader entry to adapt.
+* @param settings - current plugin settings, read per application.
+* @param log - row logger for the one-line report.
+* @param adoptedRoute - the route this adapter already wrote, when it wrote one.
+* @returns the plan that was applied, or undefined when nothing ran.
+*/
+function adaptEntry(entry, settings, log, adoptedRoute) {
+	try {
+		const current = settings();
+		const plan = planAutomodeCompat(configOf(entry), routeOf(current), allowlistOf(current), adoptedRoute);
+		automodeCompatStatus.installed = true;
+		if (!plan.changed) {
+			reflect(plan);
+			return plan;
+		}
+		writeConfig(entry, plan.config);
+		automodeCompatStatus.applied += 1;
+		reflect(plan);
+		return plan;
+	} catch (error) {
+		log.warn(`model-switch: could not adapt the dsh-automode row (${String(error)}); its own route and read-only list stay as configured`);
+		return;
+	}
+}
+/** One-line human summary of a plan, for the startup log. */
+function describeAutomodePlan(plan) {
+	const parts = [];
+	parts.push(plan.applied.route === void 0 ? `route ${plan.applied.routeSkipped ?? "unset"}` : `route ${plan.applied.route}`);
+	parts.push(`+${plan.applied.added.length} read-only tools`);
+	if (plan.applied.skipped.length > 0) parts.push(`${plan.applied.skipped.length} pattern entries skipped`);
+	return parts.join(", ");
+}
+/** Last adaptation summary, reused when a settings change replays the adapter. */
+let lastSummary = "";
+/**
+* Snapshot for the RPC/UI layer.
+* @returns the view, or undefined when this Host has no automode row.
+*/
+function automodeCompatView() {
+	if (!automodeCompatStatus.installed) return void 0;
+	return {
+		installed: true,
+		route: automodeCompatStatus.route,
+		routeSkipped: automodeCompatStatus.routeSkipped,
+		added: automodeCompatStatus.added.length,
+		skipped: automodeCompatStatus.skipped.length
+	};
+}
+/**
+* Install the adapter: adapt live rows now, and every row the loader mounts later.
+*
+* The loader applies the profile patch layer and mounts the entry's plugin right
+* after the `loader/patch-context` waterfall returns, so rewriting the entry's
+* `options.config` from that waterfall is what makes the adapted values the ones
+* the plugin activates with. No profile write happens here.
+*
+* @param ctx - this row's context.
+* @param loader - the loader service, when the Host provides it.
+* @param settings - reads the current plugin settings.
+* @returns a disposer that detaches the listeners, plus a replay for live rows.
+*/
+function installAutomodeCompat(ctx, loader, settings) {
+	const log = ctx.logger;
+	/** Entry → last plan applied, so remounts only log when the outcome changes. */
+	const applied = /* @__PURE__ */ new Map();
+	/** Entry → the route this adapter wrote, so a replay may rewrite its own value. */
+	const adopted = /* @__PURE__ */ new Map();
+	const applying = (entry) => {
+		const plan = adaptEntry(entry, settings, log, adopted.get(entry));
+		if (plan === void 0) return;
+		if (plan.applied.route !== void 0) adopted.set(entry, plan.applied.route);
+		else if (plan.applied.routeSkipped === "user-set") adopted.delete(entry);
+		const summary = describeAutomodePlan(plan);
+		lastSummary = summary;
+		if (!plan.changed) return;
+		if (applied.get(entry) === summary) return;
+		applied.set(entry, summary);
+		log.info(`model-switch: adapted dsh-automode (${summary})`);
+	};
+	if (loader !== void 0 && typeof loader.entries === "function") {
+		for (const entry of loader.entries()) if (isAutomodeEntry(entry)) applying(entry);
+	}
+	const dispose = ctx.on("loader/patch-context", function(first, second) {
+		const nextFn = typeof first === "function" ? first : second;
+		const candidate = typeof first === "function" ? this : first;
+		if (isAutomodeEntry(candidate)) applying(candidate);
+		return nextFn === void 0 ? void 0 : nextFn();
+	});
+	/** Re-adapt every live row (settings changed under us). */
+	const replay = () => {
+		let any = false;
+		for (const entry of loader?.entries?.() ?? []) {
+			if (!isAutomodeEntry(entry)) continue;
+			any = true;
+			applying(entry);
+		}
+		return any;
+	};
+	return {
+		dispose,
+		replay
+	};
+}
+/**
+* Row entry point: adapt the third-party row on activation and on remount.
+* @param ctx - this row's context.
+*/
+function apply(ctx) {
+	const loader = ctx.get("loader", false);
+	const settings = () => ctx.modelSwitch.currentSettings();
+	const adapter = installAutomodeCompat(ctx, loader, settings);
+	ctx.effect(function* () {
+		yield adapter.dispose;
+		yield ctx.on("model-switch/settings-update", () => {
+			if (adapter.replay()) ctx.logger.info(`model-switch: re-applied the dsh-automode adaptation after a settings change (${lastSummary})`);
+		});
+	}, "model-switch: keep the dsh-automode adapter aligned with the settings");
+}
+//#endregion
+export { AUTOMODE_PACKAGE, apply, automodeCompatStatus, automodeCompatView, describeAutomodePlan, inject, installAutomodeCompat, isAutomodeEntry, name, planAutomodeCompat };

package/lib/client.js

@@ -444,10 +444,22 @@ window.__ModuleLoader__.load({
 			if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return void 0;
 			const status = raw;
 			const count = (input) => typeof input === "number" && Number.isFinite(input) && input >= 0 ? input : 0;
+			const route = (input) => typeof input === "string" && input.trim() !== "" ? input.trim() : void 0;
+			const automode = status.automode !== null && typeof status.automode === "object" && !Array.isArray(status.automode) ? (() => {
+				const row = status.automode;
+				if (row.installed !== true) return void 0;
+				return {
+					route: route(row.route),
+					routeSkipped: route(row.routeSkipped),
+					added: count(row.added),
+					skipped: count(row.skipped)
+				};
+			})() : void 0;
 			return {
 				held: status.held === true,
 				allowedCalls: count(status.allowedCalls),
-				skippedReadOnly: count(status.skippedReadOnly)
+				skippedReadOnly: count(status.skippedReadOnly),
+				automode
 			};
 		}
 		/**
@@ -2603,6 +2615,10 @@ window.__ModuleLoader__.load({
 									className: ModelSwitchSettings_module_css_default.hint,
 									children: props.t("reviewAllowlistSkipped").replace("{count}", String(reviewStatus.skippedReadOnly))
 								}),
+								reviewStatus?.automode === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									className: ModelSwitchSettings_module_css_default.hint,
+									children: props.t("reviewAutomodeLinked").replace("{route}", reviewStatus.automode.route ?? (reviewStatus.automode.routeSkipped === "user-set" ? props.t("reviewAutomodeRouteOwn") : props.t("reviewAutomodeRouteUnset"))).replace("{added}", String(reviewStatus.automode.added)).replace("{skipped}", String(reviewStatus.automode.skipped))
+								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
 									className: ModelSwitchSettings_module_css_default.allowList,
 									children: allowlistIncluded.map((row) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
@@ -3049,6 +3065,9 @@ window.__ModuleLoader__.load({
 			reviewAllowlistAvailable: "本机存在但未放行的工具：",
 			reviewAllowlistRepo: "仓库",
 			reviewAllowlistSkipped: "本 Host 进程已为纯读调用跳过 {count} 次审查。",
+			reviewAutomodeLinked: "Auto mode 已接入：审查路由 {route}，直通 +{added} 个纯读工具（{skipped} 条通配未同步）。",
+			reviewAutomodeRouteOwn: "沿用其自身配置",
+			reviewAutomodeRouteUnset: "未配置（沿用会话模型）",
 			"reason.central-subagent-routing": "Alpha.4 没有全局子代理启动路由接口。",
 			"reason.packaged-preset-roots": "Alpha.4 不支持插件提供额外 preset root。",
 			"reason.tool-owner-suppression": "Alpha.4 没有工具所有者或来源抑制接口。",
@@ -3129,6 +3148,9 @@ window.__ModuleLoader__.load({
 			reviewAllowlistAvailable: "Present on this machine but not allowed:",
 			reviewAllowlistRepo: "repo",
 			reviewAllowlistSkipped: "This Host process has skipped the reviewer {count} times.",
+			reviewAutomodeLinked: "Auto mode linked: reviewer route {route}, passes +{added} read-only tools ({skipped} pattern entries not synced).",
+			reviewAutomodeRouteOwn: "its own settings",
+			reviewAutomodeRouteUnset: "unset (follows the session model)",
 			"reason.central-subagent-routing": "Alpha.4 exposes no global Subagent start-routing seam.",
 			"reason.packaged-preset-roots": "Alpha.4 exposes no plugin-owned preset root.",
 			"reason.tool-owner-suppression": "Alpha.4 exposes no tool owner or provenance suppression seam.",

package/lib/index.js

@@ -1,6 +1,8 @@
 import { o as normalizeProviderGroups } from "./session-route-D1zoZgf3.js";
-import { h as resolveToolSource, i as autoReviewStatus, m as DEFAULT_READ_ONLY_TOOLS } from "./auto-review-BDx3LjVL.js";
+import { r as resolveToolSource, t as DEFAULT_READ_ONLY_TOOLS } from "./tool-allowlist-DlzB5GlQ.js";
+import { i as autoReviewStatus } from "./auto-review-QDEFUjT2.js";
 import { ModelSwitchAdapterRegistry } from "./adapter-registry.js";
+import { automodeCompatView } from "./automode-compat.js";
 import { createRequire } from "node:module";
 import z from "@deepseek-ai/schemastery";
 import { Service } from "@deepseek-ai/cordis";
@@ -526,7 +528,8 @@ function installCapabilitiesRpc(ctx, registry, snapshot) {
 		}), () => ({
 			held: autoReviewStatus.held,
 			allowedCalls: autoReviewStatus.allowedCalls,
-			skippedReadOnly: autoReviewStatus.skippedReadOnly
+			skippedReadOnly: autoReviewStatus.skippedReadOnly,
+			automode: automodeCompatView()
 		}));
 		const dispose = scope.connection.fetch.register({
 			path: "/api/plugin-rpc/model-switch",

package/lib/tool-allowlist-DlzB5GlQ.js

@@ -0,0 +1,332 @@
+/** Catalog lookup by id. */
+const SOURCE_BY_ID = new Map([
+	{
+		id: "core",
+		kind: "core",
+		label: "DSH 核心",
+		repo: "https://github.com/deepseek-ai/deepseek-harness"
+	},
+	{
+		id: "dsh-ops",
+		kind: "plugin",
+		label: "插件 · dsh-ops",
+		repo: "https://github.com/T-Auto/dsh-ops"
+	},
+	{
+		id: "dsh-browser-cdp",
+		kind: "plugin",
+		label: "插件 · dsh-browser-cdp",
+		repo: "https://github.com/drscrewdriver/dsh-browser-cdp"
+	},
+	{
+		id: "dsh-auto-memory",
+		kind: "plugin",
+		label: "插件 · dsh-auto-memory",
+		repo: "https://github.com/AskTheWay/dsh-auto-memory"
+	},
+	{
+		id: "dsh-model-switch",
+		kind: "plugin",
+		label: "插件 · dsh-model-switch",
+		repo: "https://github.com/vandoor7-droid/dsh-model-switch"
+	},
+	{
+		id: "mcp:wincu",
+		kind: "mcp",
+		label: "MCP · wincu（dsh-computer-use-win）",
+		repo: "https://github.com/Yu-tao-Li/dsh-computer-use-win"
+	},
+	{
+		id: "qqbot-extension",
+		kind: "extension",
+		label: "QQ 机器人扩展（框架 @zaofan/dsh-qqbot）",
+		repo: "https://github.com/zaofan-make/dsh-qqbot"
+	}
+].map((entry) => [entry.id, entry]));
+/**
+* Tool names the released Host owns, calibrated against dsh 0.2.1-rc.2.
+*
+* A name outside the catalog would otherwise be reported as core, which is the
+* one guess a reader could act on wrongly; it resolves to `unknown` instead.
+*/
+const CORE_TOOLS = /* @__PURE__ */ new Set([
+	"ask_user_question",
+	"create_goal",
+	"create_skill",
+	"create_worktree",
+	"edit",
+	"exit_plan_mode",
+	"get_goal",
+	"glob",
+	"grep",
+	"interrupt_agent",
+	"job_kill",
+	"job_list",
+	"job_output",
+	"list_agents",
+	"list_mcp_resource_templates",
+	"list_mcp_resources",
+	"load_workspace_dependencies",
+	"present",
+	"pwsh",
+	"ralph",
+	"read",
+	"read_image",
+	"read_mcp_resource",
+	"schedule_create",
+	"schedule_delete",
+	"schedule_list",
+	"schedule_update",
+	"send_message",
+	"session_event_read",
+	"session_event_search",
+	"session_event_trace",
+	"session_search",
+	"session_trace",
+	"sidebar_open",
+	"skill",
+	"spawn_teammate",
+	"subagent",
+	"subagent_fork",
+	"team_task_create",
+	"team_task_get",
+	"team_task_list",
+	"team_task_update",
+	"terminal_close",
+	"terminal_list",
+	"terminal_open",
+	"terminal_read",
+	"terminal_send",
+	"terminal_signal",
+	"todo_write",
+	"update_goal",
+	"wait_agent",
+	"web_fetch",
+	"web_search",
+	"web_search_pro",
+	"workflow",
+	"working_directory",
+	"write"
+]);
+/** MCP server name → catalog id, for the servers this allowlist knows. */
+const MCP_SERVERS = /* @__PURE__ */ new Map([["wincu", "mcp:wincu"]]);
+/** Plugin identity by tool-name prefix (checked before the core catalog). */
+const PLUGIN_PREFIXES = [
+	["bcdp_", "dsh-browser-cdp"],
+	["browser_window_", "dsh-browser-cdp"],
+	["ops_", "dsh-ops"],
+	["memory_", "dsh-auto-memory"]
+];
+/** Single plugin tools that carry no prefix. */
+const PLUGIN_TOOLS = /* @__PURE__ */ new Map([["generate_image", "dsh-model-switch"]]);
+/** `<base>__<owner>` — the extension-tool naming the QQ bot framework uses. */
+const EXTENSION_TOOL = /^([A-Za-z0-9_-]+)__(.+)$/;
+/**
+* Default allowlist: every pure-read tool this deployment exposes plus the
+* no-side-effect and autonomy entries the user explicitly released, calibrated
+* on a live desktop profile (105 tools) at dsh 0.2.1-rc.2.
+*
+* Grouped by origin so a reader can trace each entry through {@link SOURCE_CATALOG}.
+* Entries ending in `*` are patterns: the QQ bot extension suffixes its tools with
+* the bot's own name, so `sessions_list__*` keeps working when the persona is
+* renamed.
+*
+* Everything here follows one rule: releasing it must not let a side effect escape
+* the reviewer. Calls that merely dispatch, ask, present, wait or navigate qualify
+* because the work they trigger still runs under the same auto preset. Delegation
+* tools (`subagent`, `subagent_fork`, `spawn_teammate`) deliberately stay out: a
+* child session seeds its preset from `permissionPresets.current(parent.session)`,
+* and this bypass answers `'custom'` for an allowlisted call in flight — releasing
+* them would hand the child no `auto` preset at all, i.e. no review.
+*/
+const DEFAULT_READ_ONLY_TOOLS = [
+	"read",
+	"grep",
+	"glob",
+	"read_image",
+	"skill",
+	"web_search",
+	"web_search_pro",
+	"web_fetch",
+	"load_workspace_dependencies",
+	"ask_user_question",
+	"present",
+	"sidebar_open",
+	"exit_plan_mode",
+	"job_list",
+	"job_output",
+	"terminal_list",
+	"terminal_read",
+	"list_agents",
+	"team_task_list",
+	"team_task_get",
+	"get_goal",
+	"schedule_list",
+	"wait_agent",
+	"send_message",
+	"team_task_create",
+	"list_mcp_resources",
+	"list_mcp_resource_templates",
+	"read_mcp_resource",
+	"session_search",
+	"session_event_search",
+	"session_event_read",
+	"session_event_trace",
+	"session_trace",
+	"create_goal",
+	"schedule_create",
+	"terminal_open",
+	"ops_read_files",
+	"ops_discover_tools",
+	"bcdp_status",
+	"bcdp_help",
+	"bcdp_doctor",
+	"bcdp_snapshot",
+	"browser_window_status",
+	"memory_list",
+	"memory_read",
+	"mcp__wincu__windows_computer_use_accessibility_tree",
+	"mcp__wincu__windows_computer_use_element_info",
+	"mcp__wincu__windows_computer_use_find",
+	"mcp__wincu__windows_computer_use_health",
+	"mcp__wincu__windows_computer_use_list_windows",
+	"mcp__wincu__windows_computer_use_ocr",
+	"mcp__wincu__windows_computer_use_screenshot",
+	"mcp__wincu__windows_computer_use_snapshot",
+	"mcp__wincu__windows_computer_use_tools",
+	"mcp__wincu__windows_computer_use_wait",
+	"mcp__wincu__windows_computer_use_wait_for",
+	"sessions_list__*",
+	"bing_search__*"
+];
+/**
+* Validate one allowlist entry.
+*
+* `*` is a suffix wildcard: the entry must keep at least one literal leading
+* character, so a stray `*` can never turn the list into "allow everything".
+*
+* @param entry - the raw entry as typed in settings.
+* @returns `ok`, or the specific problem.
+*/
+function validateAllowEntry(entry) {
+	const trimmed = entry.trim();
+	if (trimmed === "") return "empty";
+	if (/^\*+$/.test(trimmed)) return "bare-wildcard";
+	if (trimmed.startsWith("*")) return "leading-wildcard";
+	return "ok";
+}
+/**
+* Whether a tool name matches one allowlist entry.
+*
+* Exact names match exactly; an entry may end in `*`, which matches any
+* remaining characters (including none). Invalid entries never match.
+*
+* @param name - the tool name from `exec.name`.
+* @param entry - one allowlist entry.
+* @returns true when the call may skip review.
+*/
+function matchesAllowPattern(name, entry) {
+	if (name === "" || validateAllowEntry(entry) !== "ok") return false;
+	const trimmed = entry.trim();
+	const star = trimmed.indexOf("*");
+	if (star === -1) return name === trimmed;
+	const prefix = trimmed.slice(0, star);
+	const suffix = trimmed.slice(star + 1);
+	if (!name.startsWith(prefix) || !name.endsWith(suffix)) return false;
+	return name.length >= prefix.length + suffix.length;
+}
+/**
+* Whether a tool name is covered by an allowlist.
+* @param name - the tool name under review.
+* @param allowlist - configured entries, patterns included.
+* @returns true when at least one entry matches.
+*/
+function isAllowedByList(name, allowlist) {
+	return allowlist.some((entry) => matchesAllowPattern(name, entry));
+}
+/**
+* Resolve the origin of one tool name for display.
+*
+* Resolution order: MCP bridge → `<tool>__<owner>` extension → plugin prefix →
+* plugin table → core catalog → unknown. Only the first two are structural; the
+* rest are calibrated names, so an unlisted tool is reported as unknown rather
+* than guessed into a package.
+*
+* @param name - the tool name.
+* @returns The origin, with its repository when known.
+*/
+function resolveToolSource(name) {
+	const trimmed = name.trim().replace(/\*+$/, "");
+	const mcp = /^mcp__([A-Za-z0-9_-]+)__/.exec(trimmed);
+	if (mcp !== null) {
+		const server = mcp[1];
+		const entry = SOURCE_BY_ID.get(MCP_SERVERS.get(server) ?? "");
+		if (entry !== void 0) return {
+			kind: "mcp",
+			label: entry.label,
+			repo: entry.repo,
+			owner: server
+		};
+		return {
+			kind: "mcp",
+			label: `MCP · ${server}`,
+			owner: server
+		};
+	}
+	const extension = EXTENSION_TOOL.exec(trimmed);
+	if (extension !== null && !trimmed.startsWith("mcp__")) {
+		const entry = SOURCE_BY_ID.get("qqbot-extension");
+		const base = extension[1];
+		const owner = extension[2];
+		return {
+			kind: "extension",
+			label: `扩展 · ${base}__${owner}`,
+			...entry === void 0 ? {} : { repo: entry.repo },
+			owner
+		};
+	}
+	if (trimmed.endsWith("__")) {
+		const entry = SOURCE_BY_ID.get("qqbot-extension");
+		return {
+			kind: "extension",
+			label: `扩展 · ${trimmed.slice(0, -2)}__*`,
+			...entry === void 0 ? {} : { repo: entry.repo },
+			owner: "*"
+		};
+	}
+	for (const [prefix, id] of PLUGIN_PREFIXES) {
+		if (!trimmed.startsWith(prefix)) continue;
+		const entry = SOURCE_BY_ID.get(id);
+		if (entry !== void 0) return {
+			kind: "plugin",
+			label: entry.label,
+			repo: entry.repo,
+			owner: id
+		};
+	}
+	const plugin = PLUGIN_TOOLS.get(trimmed);
+	if (plugin !== void 0) {
+		const entry = SOURCE_BY_ID.get(plugin);
+		if (entry !== void 0) return {
+			kind: "plugin",
+			label: entry.label,
+			repo: entry.repo,
+			owner: plugin
+		};
+	}
+	if (CORE_TOOLS.has(trimmed)) {
+		const entry = SOURCE_BY_ID.get("core");
+		return {
+			kind: "core",
+			label: entry?.label ?? "DSH 核心",
+			...entry === void 0 ? {} : { repo: entry.repo },
+			owner: "core"
+		};
+	}
+	return {
+		kind: "unknown",
+		label: "未知来源"
+	};
+}
+//#endregion
+export { isAllowedByList as n, resolveToolSource as r, DEFAULT_READ_ONLY_TOOLS as t };