dsh-model-switch 0.4.41 → 0.4.42

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## v0.4.42
+
+与第三方自动模式插件 `@log.li/dsh-automode` 的插件层适配：**不改用户配置、不新增依赖、不安装任何东西**——本插件在自己的 loader 行里，把「自动审查路由」与「纯读名单」注入到 `@log.li/dsh-automode` 行的**内存配置**，让它的 `auto-mode` 档位沿用我们的路由与豁免。
+
+- **新行 `model-switch-automode-compat`**（`dsh-model-switch/automode-compat`）：`inject = ['loader','modelSwitch']`，在 `loader/patch-context` 里于该行挂载前改写 `entry.options.config`；行不存在时整行空转。可在插件管理器里单独停用，不影响审查闸门。
+- **路由**：仅当 automode 的 `classifier.provider` / `classifier.model` **都为空**时填入我们的 `autoReviewProvider/Model`；任一字段已有值即视为用户意图，绝不覆盖（状态里标 `user-set`）；我们将自己上次写入的值记为可重写，设置变更时能跟随更新。
+- **纯读豁免**：把我们的名单（默认 58 条）并入它的 `readOnlyTools`，并在「纯读工具免审查」开关关闭时**不注入**。它用精确匹配，所以 `sessions_list__*` 这类通配条目会跳过并在卡片上计数（默认名单里是 1 条）。注入后的工具仍会先过它自己的 deny 正则——不会削弱它的硬底线。
+- **不落盘**：只改运行时 `entry.options`，从不调用 `Entry.update()`；启动前后 profile 的 `cordis.patch.yml` 不变，重启自动重放。
+- **可见性**：「审查豁免」卡片新增一行 `Auto mode 已接入：审查路由 <provider>/<model>，直通 +N 个纯读工具（M 条通配未同步）`，未安装时不显示；`tools` RPC 的 `status.automode` 提供同数字段。
+- **rc.3 lab 实测**（3083 / `~/.dsh-lab3`，automode `0.17.0` + 本插件 0.4.42）：automode 的 `boot` 审计行出现；在 `auto-mode` 会话的工具调用里，它的闸门实际读到 `preset="auto-mode"`、`classifier={"provider":"apigoto","model":"mimo-v2.6-flash",…}`、`readOnlyTools=58`、`preExecuteGate=true`（即注入生效）；启动前后 profile `cordis.patch.yml` 的 sha256 一致（未落盘）；卡片显示「Auto mode 已接入：审查路由 apigoto/mimo-v2.6-flash，直通 +53 个纯读工具（2 条通配未同步）」。注：automode 的逐调用审计行本次未出现，是因为它对未升级的 workspace-write 调用按设计静默放行，与兼容性无关。
+- **边界**：它的分类器只有一个静态路由，逐步 provider 分组无法映射过去（取顶层自动审查路由）；它的 `readOnlyTools` 精确匹配，通配条目转不过去；这些都在文案与文档里写明。
+
 ## v0.4.41
 
 DSH `0.2.1-rc.3`（2026-10-23 发布，当前在 `next` 通道）兼容性更新：**插件本体零改动**，本轮做的是实证与声明；旧线（`0.1.7-alpha.2` … `0.2.1-rc.2`）的声明与依赖下界原样保留。

package/README.md

@@ -193,6 +193,8 @@ Verified releases: `0.1.7-alpha.2`, `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.2`. Th
 
 The verified releases in `package.json#dsh.compatibility.dshReleases` are evidence, not an allowlist. Review public API changes and test new Host releases before adding a verification claim.
 
+**Third-party auto modes.** When [`@log.li/dsh-automode`](https://github.com/log-li/dsh-automode) is installed, the `model-switch-automode-compat` row injects this plugin's Auto-review route and pure-read list into that row's **in-memory** config — no profile write, nothing to configure by hand. Its `auto-mode` preset then reviews with your configured route and passes your allowlisted tools, while the `auto` preset keeps using this plugin's own gate. Explicit `classifier.provider/model` values in that row always win, pattern-shaped allowlist entries cannot transfer (its check is exact-match), and its hard-deny bands still run first.
+
 ## Development
 
 Requires Node 22.19+ and pnpm.

package/README.zh.md

@@ -191,6 +191,8 @@ DSH Host peer 和开发依赖接受 `>=0.1.7-alpha.2`，包括 rc.1 和后续版
 
 `package.json#dsh.compatibility.dshReleases` 中的已验证版本是证据，不是允许列表。新增验证声明前要审查公开 API 变化并测试新 Host 版本。
 
+**第三方自动模式。** 安装 [`@log.li/dsh-automode`](https://github.com/log-li/dsh-automode) 后，`model-switch-automode-compat` 行会把本插件的自动审查路由与纯读名单注入到该行的**内存配置**里——不写 profile、不需要手工配置。它的 `auto-mode` 档位会用你配置的路由审查、并按你的名单直通纯读工具；`auto` 档位仍然走本插件自己的闸门。该行里显式写过的 `classifier.provider/model` 永远优先，带通配的名单条目无法转过去（它是精确匹配），它的硬 deny 正则也照旧先跑。
+
 ## 开发
 
 需要 Node 22.19+ 和 pnpm。

package/cordis.patch.yml

@@ -73,3 +73,10 @@
     # The official naming provider under the configurable naming route.
     - id: model-switch-session-title
       name: 'dsh-model-switch/session-title'
+
+    # Inject this plugin's Auto-review route and pure-read list into the
+    # third-party @log.li/dsh-automode row's in-memory config (no profile write,
+    # no-op when that plugin is not installed). Kept as its own row so it can be
+    # disabled without touching the reviewer gate.
+    - id: model-switch-automode-compat
+      name: 'dsh-model-switch/automode-compat'

package/lib/{auto-review-BDx3LjVL.js → auto-review-QDEFUjT2.js}

@@ -1,339 +1,9 @@
 import { i as sessionProviderOf, r as resolveCapabilityRoute } from "./session-route-D1zoZgf3.js";
+import { n as isAllowedByList } from "./tool-allowlist-DlzB5GlQ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-/** Catalog lookup by id. */
-const SOURCE_BY_ID = new Map([
-	{
-		id: "core",
-		kind: "core",
-		label: "DSH 核心",
-		repo: "https://github.com/deepseek-ai/deepseek-harness"
-	},
-	{
-		id: "dsh-ops",
-		kind: "plugin",
-		label: "插件 · dsh-ops",
-		repo: "https://github.com/T-Auto/dsh-ops"
-	},
-	{
-		id: "dsh-browser-cdp",
-		kind: "plugin",
-		label: "插件 · dsh-browser-cdp",
-		repo: "https://github.com/drscrewdriver/dsh-browser-cdp"
-	},
-	{
-		id: "dsh-auto-memory",
-		kind: "plugin",
-		label: "插件 · dsh-auto-memory",
-		repo: "https://github.com/AskTheWay/dsh-auto-memory"
-	},
-	{
-		id: "dsh-model-switch",
-		kind: "plugin",
-		label: "插件 · dsh-model-switch",
-		repo: "https://github.com/vandoor7-droid/dsh-model-switch"
-	},
-	{
-		id: "mcp:wincu",
-		kind: "mcp",
-		label: "MCP · wincu（dsh-computer-use-win）",
-		repo: "https://github.com/Yu-tao-Li/dsh-computer-use-win"
-	},
-	{
-		id: "qqbot-extension",
-		kind: "extension",
-		label: "QQ 机器人扩展（框架 @zaofan/dsh-qqbot）",
-		repo: "https://github.com/zaofan-make/dsh-qqbot"
-	}
-].map((entry) => [entry.id, entry]));
-/**
-* Tool names the released Host owns, calibrated against dsh 0.2.1-rc.2.
-*
-* A name outside the catalog would otherwise be reported as core, which is the
-* one guess a reader could act on wrongly; it resolves to `unknown` instead.
-*/
-const CORE_TOOLS = /* @__PURE__ */ new Set([
-	"ask_user_question",
-	"create_goal",
-	"create_skill",
-	"create_worktree",
-	"edit",
-	"exit_plan_mode",
-	"get_goal",
-	"glob",
-	"grep",
-	"interrupt_agent",
-	"job_kill",
-	"job_list",
-	"job_output",
-	"list_agents",
-	"list_mcp_resource_templates",
-	"list_mcp_resources",
-	"load_workspace_dependencies",
-	"present",
-	"pwsh",
-	"ralph",
-	"read",
-	"read_image",
-	"read_mcp_resource",
-	"schedule_create",
-	"schedule_delete",
-	"schedule_list",
-	"schedule_update",
-	"send_message",
-	"session_event_read",
-	"session_event_search",
-	"session_event_trace",
-	"session_search",
-	"session_trace",
-	"sidebar_open",
-	"skill",
-	"spawn_teammate",
-	"subagent",
-	"subagent_fork",
-	"team_task_create",
-	"team_task_get",
-	"team_task_list",
-	"team_task_update",
-	"terminal_close",
-	"terminal_list",
-	"terminal_open",
-	"terminal_read",
-	"terminal_send",
-	"terminal_signal",
-	"todo_write",
-	"update_goal",
-	"wait_agent",
-	"web_fetch",
-	"web_search",
-	"web_search_pro",
-	"workflow",
-	"working_directory",
-	"write"
-]);
-/** MCP server name → catalog id, for the servers this allowlist knows. */
-const MCP_SERVERS = /* @__PURE__ */ new Map([["wincu", "mcp:wincu"]]);
-/** Plugin identity by tool-name prefix (checked before the core catalog). */
-const PLUGIN_PREFIXES = [
-	["bcdp_", "dsh-browser-cdp"],
-	["browser_window_", "dsh-browser-cdp"],
-	["ops_", "dsh-ops"],
-	["memory_", "dsh-auto-memory"]
-];
-/** Single plugin tools that carry no prefix. */
-const PLUGIN_TOOLS = /* @__PURE__ */ new Map([["generate_image", "dsh-model-switch"]]);
-/** `<base>__<owner>` — the extension-tool naming the QQ bot framework uses. */
-const EXTENSION_TOOL = /^([A-Za-z0-9_-]+)__(.+)$/;
-/**
-* Default allowlist: every pure-read tool this deployment exposes plus the
-* no-side-effect and autonomy entries the user explicitly released, calibrated
-* on a live desktop profile (105 tools) at dsh 0.2.1-rc.2.
-*
-* Grouped by origin so a reader can trace each entry through {@link SOURCE_CATALOG}.
-* Entries ending in `*` are patterns: the QQ bot extension suffixes its tools with
-* the bot's own name, so `sessions_list__*` keeps working when the persona is
-* renamed.
-*
-* Everything here follows one rule: releasing it must not let a side effect escape
-* the reviewer. Calls that merely dispatch, ask, present, wait or navigate qualify
-* because the work they trigger still runs under the same auto preset. Delegation
-* tools (`subagent`, `subagent_fork`, `spawn_teammate`) deliberately stay out: a
-* child session seeds its preset from `permissionPresets.current(parent.session)`,
-* and this bypass answers `'custom'` for an allowlisted call in flight — releasing
-* them would hand the child no `auto` preset at all, i.e. no review.
-*/
-const DEFAULT_READ_ONLY_TOOLS = [
-	"read",
-	"grep",
-	"glob",
-	"read_image",
-	"skill",
-	"web_search",
-	"web_search_pro",
-	"web_fetch",
-	"load_workspace_dependencies",
-	"ask_user_question",
-	"present",
-	"sidebar_open",
-	"exit_plan_mode",
-	"job_list",
-	"job_output",
-	"terminal_list",
-	"terminal_read",
-	"list_agents",
-	"team_task_list",
-	"team_task_get",
-	"get_goal",
-	"schedule_list",
-	"wait_agent",
-	"send_message",
-	"team_task_create",
-	"list_mcp_resources",
-	"list_mcp_resource_templates",
-	"read_mcp_resource",
-	"session_search",
-	"session_event_search",
-	"session_event_read",
-	"session_event_trace",
-	"session_trace",
-	"create_goal",
-	"schedule_create",
-	"terminal_open",
-	"ops_read_files",
-	"ops_discover_tools",
-	"bcdp_status",
-	"bcdp_help",
-	"bcdp_doctor",
-	"bcdp_snapshot",
-	"browser_window_status",
-	"memory_list",
-	"memory_read",
-	"mcp__wincu__windows_computer_use_accessibility_tree",
-	"mcp__wincu__windows_computer_use_element_info",
-	"mcp__wincu__windows_computer_use_find",
-	"mcp__wincu__windows_computer_use_health",
-	"mcp__wincu__windows_computer_use_list_windows",
-	"mcp__wincu__windows_computer_use_ocr",
-	"mcp__wincu__windows_computer_use_screenshot",
-	"mcp__wincu__windows_computer_use_snapshot",
-	"mcp__wincu__windows_computer_use_tools",
-	"mcp__wincu__windows_computer_use_wait",
-	"mcp__wincu__windows_computer_use_wait_for",
-	"sessions_list__*",
-	"bing_search__*"
-];
-/**
-* Validate one allowlist entry.
-*
-* `*` is a suffix wildcard: the entry must keep at least one literal leading
-* character, so a stray `*` can never turn the list into "allow everything".
-*
-* @param entry - the raw entry as typed in settings.
-* @returns `ok`, or the specific problem.
-*/
-function validateAllowEntry(entry) {
-	const trimmed = entry.trim();
-	if (trimmed === "") return "empty";
-	if (/^\*+$/.test(trimmed)) return "bare-wildcard";
-	if (trimmed.startsWith("*")) return "leading-wildcard";
-	return "ok";
-}
-/**
-* Whether a tool name matches one allowlist entry.
-*
-* Exact names match exactly; an entry may end in `*`, which matches any
-* remaining characters (including none). Invalid entries never match.
-*
-* @param name - the tool name from `exec.name`.
-* @param entry - one allowlist entry.
-* @returns true when the call may skip review.
-*/
-function matchesAllowPattern(name, entry) {
-	if (name === "" || validateAllowEntry(entry) !== "ok") return false;
-	const trimmed = entry.trim();
-	const star = trimmed.indexOf("*");
-	if (star === -1) return name === trimmed;
-	const prefix = trimmed.slice(0, star);
-	const suffix = trimmed.slice(star + 1);
-	if (!name.startsWith(prefix) || !name.endsWith(suffix)) return false;
-	return name.length >= prefix.length + suffix.length;
-}
-/**
-* Whether a tool name is covered by an allowlist.
-* @param name - the tool name under review.
-* @param allowlist - configured entries, patterns included.
-* @returns true when at least one entry matches.
-*/
-function isAllowedByList(name, allowlist) {
-	return allowlist.some((entry) => matchesAllowPattern(name, entry));
-}
-/**
-* Resolve the origin of one tool name for display.
-*
-* Resolution order: MCP bridge → `<tool>__<owner>` extension → plugin prefix →
-* plugin table → core catalog → unknown. Only the first two are structural; the
-* rest are calibrated names, so an unlisted tool is reported as unknown rather
-* than guessed into a package.
-*
-* @param name - the tool name.
-* @returns The origin, with its repository when known.
-*/
-function resolveToolSource(name) {
-	const trimmed = name.trim().replace(/\*+$/, "");
-	const mcp = /^mcp__([A-Za-z0-9_-]+)__/.exec(trimmed);
-	if (mcp !== null) {
-		const server = mcp[1];
-		const entry = SOURCE_BY_ID.get(MCP_SERVERS.get(server) ?? "");
-		if (entry !== void 0) return {
-			kind: "mcp",
-			label: entry.label,
-			repo: entry.repo,
-			owner: server
-		};
-		return {
-			kind: "mcp",
-			label: `MCP · ${server}`,
-			owner: server
-		};
-	}
-	const extension = EXTENSION_TOOL.exec(trimmed);
-	if (extension !== null && !trimmed.startsWith("mcp__")) {
-		const entry = SOURCE_BY_ID.get("qqbot-extension");
-		const base = extension[1];
-		const owner = extension[2];
-		return {
-			kind: "extension",
-			label: `扩展 · ${base}__${owner}`,
-			...entry === void 0 ? {} : { repo: entry.repo },
-			owner
-		};
-	}
-	if (trimmed.endsWith("__")) {
-		const entry = SOURCE_BY_ID.get("qqbot-extension");
-		return {
-			kind: "extension",
-			label: `扩展 · ${trimmed.slice(0, -2)}__*`,
-			...entry === void 0 ? {} : { repo: entry.repo },
-			owner: "*"
-		};
-	}
-	for (const [prefix, id] of PLUGIN_PREFIXES) {
-		if (!trimmed.startsWith(prefix)) continue;
-		const entry = SOURCE_BY_ID.get(id);
-		if (entry !== void 0) return {
-			kind: "plugin",
-			label: entry.label,
-			repo: entry.repo,
-			owner: id
-		};
-	}
-	const plugin = PLUGIN_TOOLS.get(trimmed);
-	if (plugin !== void 0) {
-		const entry = SOURCE_BY_ID.get(plugin);
-		if (entry !== void 0) return {
-			kind: "plugin",
-			label: entry.label,
-			repo: entry.repo,
-			owner: plugin
-		};
-	}
-	if (CORE_TOOLS.has(trimmed)) {
-		const entry = SOURCE_BY_ID.get("core");
-		return {
-			kind: "core",
-			label: entry?.label ?? "DSH 核心",
-			...entry === void 0 ? {} : { repo: entry.repo },
-			owner: "core"
-		};
-	}
-	return {
-		kind: "unknown",
-		label: "未知来源"
-	};
-}
-//#endregion
 //#region lib/types/auto-sessions-state.js
 /**
 * Durable snapshot of the sessions that were on the Auto preset when this row
@@ -1394,4 +1064,4 @@ async function apply(ctx) {
 	}, "model-switch: release the Auto registration before anything else");
 }
 //#endregion
-export { bindAutoReviewSessionCorrelation as a, installToolCallSafetyNet as c, resolveSessionAutoReviewRoute as d, reviewLlm as f, resolveToolSource as h, autoReviewStatus as i, isReviewerInfrastructureFailure as l, DEFAULT_READ_ONLY_TOOLS as m, autoReviewGate as n, defensivePermissionPresets as o, reviewScope as p, autoReviewRouteOf as r, inject as s, apply as t, name as u };
+export { bindAutoReviewSessionCorrelation as a, installToolCallSafetyNet as c, resolveSessionAutoReviewRoute as d, reviewLlm as f, autoReviewStatus as i, isReviewerInfrastructureFailure as l, autoReviewGate as n, defensivePermissionPresets as o, reviewScope as p, autoReviewRouteOf as r, inject as s, apply as t, name as u };

package/lib/auto-review.js

@@ -1,2 +1,2 @@
-import { a as bindAutoReviewSessionCorrelation, c as installToolCallSafetyNet, d as resolveSessionAutoReviewRoute, f as reviewLlm, i as autoReviewStatus, l as isReviewerInfrastructureFailure, n as autoReviewGate, o as defensivePermissionPresets, p as reviewScope, r as autoReviewRouteOf, s as inject, t as apply, u as name } from "./auto-review-BDx3LjVL.js";
+import { a as bindAutoReviewSessionCorrelation, c as installToolCallSafetyNet, d as resolveSessionAutoReviewRoute, f as reviewLlm, i as autoReviewStatus, l as isReviewerInfrastructureFailure, n as autoReviewGate, o as defensivePermissionPresets, p as reviewScope, r as autoReviewRouteOf, s as inject, t as apply, u as name } from "./auto-review-QDEFUjT2.js";
 export { apply, autoReviewGate, autoReviewRouteOf, autoReviewStatus, bindAutoReviewSessionCorrelation, defensivePermissionPresets, inject, installToolCallSafetyNet, isReviewerInfrastructureFailure, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };

package/lib/automode-compat.js

@@ -0,0 +1,266 @@
+import { t as DEFAULT_READ_ONLY_TOOLS } from "./tool-allowlist-DlzB5GlQ.js";
+//#region lib/types/automode-compat.js
+/** Cordis plugin identity; matches the `cordis.patch.yml` insert row id. */
+const name = "model-switch-automode-compat";
+/** The loader is the only seam this row needs besides this plugin's settings. */
+const inject = ["loader", "modelSwitch"];
+/** Third-party package this row adapts (strict package identity, never a prefix). */
+const AUTOMODE_PACKAGE = "@log.li/dsh-automode";
+/** Live adapter state, surfaced next to the allowlist editor. */
+const automodeCompatStatus = {
+	/** A `@log.li/dsh-automode` row exists in this Host. */
+	installed: false,
+	/** `provider/model` this adapter wrote, when it wrote one. */
+	route: void 0,
+	/** Why the route was skipped, when it was. */
+	routeSkipped: void 0,
+	/** Tools merged into the row's `readOnlyTools`. */
+	added: [],
+	/** Pattern-shaped entries that cannot transfer. */
+	skipped: [],
+	/** How many rows were rewritten (remounts included). */
+	applied: 0
+};
+/** Plain-object guard: arrays and `null` are not config objects. */
+function asRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+/** Trimmed string or empty, so whitespace-only config reads as "unset". */
+function text(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+/**
+* Whether one loader entry is the third-party auto-mode row.
+* @param entry - anything the loader hands over (an entry, or an event payload).
+* @returns true only for the exact package name.
+*/
+function isAutomodeEntry(entry) {
+	const row = entry?.options;
+	return typeof row?.name === "string" && row.name === "@log.li/dsh-automode";
+}
+/**
+* Decide the config one automode row should run with.
+*
+* Pure and side-effect free so the policy is unit-testable.
+*
+* @param config - the row's current config (any JSON-ish value).
+* @param route - this plugin's Auto-review route; empty strings mean "unset".
+* @param allowlist - tool names to merge into `readOnlyTools`; pass an empty
+*   list while the skip switch is off.
+* @param adoptedRoute - a `provider/model` this adapter wrote on an earlier
+*   pass; seeing it again means the row is still ours to rewrite.
+* @returns the config to install, whether it changed, and what was applied.
+*/
+function planAutomodeCompat(config, route, allowlist, adoptedRoute) {
+	const base = asRecord(config);
+	if (base === void 0) return {
+		config: {},
+		changed: false,
+		applied: {
+			added: [],
+			skipped: []
+		}
+	};
+	const next = { ...base };
+	let changed = false;
+	const provider = text(route.provider);
+	const model = text(route.model);
+	const classifier = asRecord(base.classifier) ?? {};
+	const declaredProvider = text(classifier.provider);
+	const declaredModel = text(classifier.model);
+	const declaredRoute = declaredProvider !== "" && declaredModel !== "" ? `${declaredProvider}/${declaredModel}` : void 0;
+	const ours = declaredRoute !== void 0 && adoptedRoute !== void 0 && declaredRoute === adoptedRoute;
+	let routeApplied;
+	let routeSkipped;
+	if (!ours && (declaredProvider !== "" || declaredModel !== "")) routeSkipped = "user-set";
+	else if (provider === "" || model === "") routeSkipped = "no-route";
+	else {
+		next.classifier = {
+			...classifier,
+			provider,
+			model
+		};
+		routeApplied = `${provider}/${model}`;
+		changed = true;
+	}
+	const existing = Array.isArray(base.readOnlyTools) ? base.readOnlyTools.filter((item) => typeof item === "string") : [];
+	const added = [];
+	const skipped = [];
+	for (const candidate of allowlist) {
+		const tool = text(candidate);
+		if (tool === "") continue;
+		if (tool.includes("*")) {
+			if (!skipped.includes(tool)) skipped.push(tool);
+			continue;
+		}
+		if (!existing.includes(tool) && !added.includes(tool)) added.push(tool);
+	}
+	if (added.length > 0) {
+		next.readOnlyTools = [...existing, ...added];
+		changed = true;
+	}
+	return {
+		config: next,
+		changed,
+		applied: {
+			route: routeApplied,
+			routeSkipped,
+			added,
+			skipped
+		}
+	};
+}
+/** The Auto-review route this plugin is configured to use. */
+function routeOf(settings) {
+	return {
+		provider: text(settings.autoReviewProvider),
+		model: text(settings.autoReviewModel)
+	};
+}
+/** Tools to merge into the third-party row, honouring the skip switch. */
+function allowlistOf(settings) {
+	if (settings.autoReviewSkipReadOnly !== true) return [];
+	const saved = settings.autoReviewAllowlist;
+	return saved !== void 0 && saved.length > 0 ? saved : DEFAULT_READ_ONLY_TOOLS;
+}
+/** Record one applied plan on the shared status object. */
+function reflect(plan) {
+	automodeCompatStatus.installed = true;
+	if (plan.applied.route !== void 0) {
+		automodeCompatStatus.route = plan.applied.route;
+		automodeCompatStatus.routeSkipped = void 0;
+	} else if (automodeCompatStatus.route === void 0) automodeCompatStatus.routeSkipped = plan.applied.routeSkipped;
+	for (const tool of plan.applied.added) if (!automodeCompatStatus.added.includes(tool)) automodeCompatStatus.added.push(tool);
+	for (const tool of plan.applied.skipped) if (!automodeCompatStatus.skipped.includes(tool)) automodeCompatStatus.skipped.push(tool);
+}
+/** Read one entry's live config object, if it has one. */
+function configOf(entry) {
+	return entry.options.config;
+}
+/** Assign the adapted config back onto the entry's live options. */
+function writeConfig(entry, config) {
+	entry.options.config = config;
+}
+/**
+* Adapt one row in memory, containing every failure.
+*
+* @param entry - the loader entry to adapt.
+* @param settings - current plugin settings, read per application.
+* @param log - row logger for the one-line report.
+* @param adoptedRoute - the route this adapter already wrote, when it wrote one.
+* @returns the plan that was applied, or undefined when nothing ran.
+*/
+function adaptEntry(entry, settings, log, adoptedRoute) {
+	try {
+		const current = settings();
+		const plan = planAutomodeCompat(configOf(entry), routeOf(current), allowlistOf(current), adoptedRoute);
+		automodeCompatStatus.installed = true;
+		if (!plan.changed) {
+			reflect(plan);
+			return plan;
+		}
+		writeConfig(entry, plan.config);
+		automodeCompatStatus.applied += 1;
+		reflect(plan);
+		return plan;
+	} catch (error) {
+		log.warn(`model-switch: could not adapt the dsh-automode row (${String(error)}); its own route and read-only list stay as configured`);
+		return;
+	}
+}
+/** One-line human summary of a plan, for the startup log. */
+function describeAutomodePlan(plan) {
+	const parts = [];
+	parts.push(plan.applied.route === void 0 ? `route ${plan.applied.routeSkipped ?? "unset"}` : `route ${plan.applied.route}`);
+	parts.push(`+${plan.applied.added.length} read-only tools`);
+	if (plan.applied.skipped.length > 0) parts.push(`${plan.applied.skipped.length} pattern entries skipped`);
+	return parts.join(", ");
+}
+/** Last adaptation summary, reused when a settings change replays the adapter. */
+let lastSummary = "";
+/**
+* Snapshot for the RPC/UI layer.
+* @returns the view, or undefined when this Host has no automode row.
+*/
+function automodeCompatView() {
+	if (!automodeCompatStatus.installed) return void 0;
+	return {
+		installed: true,
+		route: automodeCompatStatus.route,
+		routeSkipped: automodeCompatStatus.routeSkipped,
+		added: automodeCompatStatus.added.length,
+		skipped: automodeCompatStatus.skipped.length
+	};
+}
+/**
+* Install the adapter: adapt live rows now, and every row the loader mounts later.
+*
+* The loader applies the profile patch layer and mounts the entry's plugin right
+* after the `loader/patch-context` waterfall returns, so rewriting the entry's
+* `options.config` from that waterfall is what makes the adapted values the ones
+* the plugin activates with. No profile write happens here.
+*
+* @param ctx - this row's context.
+* @param loader - the loader service, when the Host provides it.
+* @param settings - reads the current plugin settings.
+* @returns a disposer that detaches the listeners, plus a replay for live rows.
+*/
+function installAutomodeCompat(ctx, loader, settings) {
+	const log = ctx.logger;
+	/** Entry → last plan applied, so remounts only log when the outcome changes. */
+	const applied = /* @__PURE__ */ new Map();
+	/** Entry → the route this adapter wrote, so a replay may rewrite its own value. */
+	const adopted = /* @__PURE__ */ new Map();
+	const applying = (entry) => {
+		const plan = adaptEntry(entry, settings, log, adopted.get(entry));
+		if (plan === void 0) return;
+		if (plan.applied.route !== void 0) adopted.set(entry, plan.applied.route);
+		else if (plan.applied.routeSkipped === "user-set") adopted.delete(entry);
+		const summary = describeAutomodePlan(plan);
+		lastSummary = summary;
+		if (!plan.changed) return;
+		if (applied.get(entry) === summary) return;
+		applied.set(entry, summary);
+		log.info(`model-switch: adapted dsh-automode (${summary})`);
+	};
+	if (loader !== void 0 && typeof loader.entries === "function") {
+		for (const entry of loader.entries()) if (isAutomodeEntry(entry)) applying(entry);
+	}
+	const dispose = ctx.on("loader/patch-context", function(first, second) {
+		const nextFn = typeof first === "function" ? first : second;
+		const candidate = typeof first === "function" ? this : first;
+		if (isAutomodeEntry(candidate)) applying(candidate);
+		return nextFn === void 0 ? void 0 : nextFn();
+	});
+	/** Re-adapt every live row (settings changed under us). */
+	const replay = () => {
+		let any = false;
+		for (const entry of loader?.entries?.() ?? []) {
+			if (!isAutomodeEntry(entry)) continue;
+			any = true;
+			applying(entry);
+		}
+		return any;
+	};
+	return {
+		dispose,
+		replay
+	};
+}
+/**
+* Row entry point: adapt the third-party row on activation and on remount.
+* @param ctx - this row's context.
+*/
+function apply(ctx) {
+	const loader = ctx.get("loader", false);
+	const settings = () => ctx.modelSwitch.currentSettings();
+	const adapter = installAutomodeCompat(ctx, loader, settings);
+	ctx.effect(function* () {
+		yield adapter.dispose;
+		yield ctx.on("model-switch/settings-update", () => {
+			if (adapter.replay()) ctx.logger.info(`model-switch: re-applied the dsh-automode adaptation after a settings change (${lastSummary})`);
+		});
+	}, "model-switch: keep the dsh-automode adapter aligned with the settings");
+}
+//#endregion
+export { AUTOMODE_PACKAGE, apply, automodeCompatStatus, automodeCompatView, describeAutomodePlan, inject, installAutomodeCompat, isAutomodeEntry, name, planAutomodeCompat };