dsh-ntr 0.1.5 → 0.2.0

package/README.en.md

@@ -26,6 +26,8 @@ This plugin is a DSH **bundle**: `package.json`'s `dsh.bundle.patch` declares th
 
 Open the **Plugins** page in DSH's sidebar, click **Add plugin**, enter `dsh-ntr`, and click install. Refresh the page and it's ready to use.
 
+> DSH keeps a 24-hour safety window on the npm channel: a version published within it won't be picked as the latest, so entering plain `dsh-ntr` may install the previous release. To get the new version right away, include the explicit version in the box, e.g. `dsh-ntr@0.1.5`; otherwise wait out the window and install or upgrade as usual.
+
 ### Option 2: from the npm registry
 
 ```bash
@@ -111,7 +113,7 @@ DSH's own `/model`, `/permission`, `/export`, etc. are **not** intercepted by th
 
 ### Approvals and the agent's own permission modes
 
-When the agent wants to touch something sensitive, it asks you. The approval card shows up right in the chat composer; you click Allow or Deny, and it obeys.
+When the agent wants to touch something sensitive, it asks you. The ask appears in the conversation on a card just above the composer (the plugin's own card); the options are exactly the agent's, and what you click is what it receives. The Settings page's "Pending Permission Requests" card is the cross-session mirror — answer there when the conversation isn't open.
 
 Every agent asks differently: some offer a set of options, some only allow/deny, some attach the exact command they are about to run. The plugin presents these as-is, and never pre-decides for you.
 
@@ -240,7 +242,7 @@ Mount it in your profile's `cordis.patch.yml`. When `cwd` / `allowedCwdRoots` ar
         allowedCwdRoots: [~/.dsh/dsh-ntr/workspaces]
 ```
 
-Optional agent fields: `npmPackage` (auto `npm install -g` when not found on PATH), `exposedModels` (which variants the NTR seat menu lists), `idleTimeoutMs` (idle-release window for chat processes; `0` = never release, default 30 minutes), `mcpServers` (extra MCP servers handed to the agent). Plugin-level there are also `transcriptMaxEntries` (per-conversation event buffer cap, default 600) and `probeModelsOnBoot` (kept for compatibility; boot-time per-agent probing no longer happens — see the comment on `bootstrapCatalogs`). Reliability timeouts and retries (`startupTimeoutMs`, `cancelFallbackMs`, `staleCancelRetryDelayMs`, `staleCancelMaxRetries`, `permissionTimeoutMs`, `permissionFallbackTimeoutMs`) are covered by [AGENTS.md](./AGENTS.md) constraints 12 and 13; anything editable in the Settings page should be edited there.
+Optional agent fields: `npmPackage` (auto `npm install -g` when not found on PATH), `exposedModels` (which variants the NTR seat menu lists), `idleTimeoutMs` (idle-release window for chat processes; `0` = never release, default 30 minutes), `mcpServers` (extra MCP servers handed to the agent). Plugin-level there are also `transcriptMaxEntries` (per-conversation event buffer cap, default 600) and `probeModelsOnBoot` (kept for compatibility; boot-time per-agent probing no longer happens — see the comment on `bootstrapCatalogs`). Reliability timeouts and retries (`startupTimeoutMs`, `cancelFallbackMs`, `staleCancelRetryDelayMs`, `staleCancelMaxRetries`, `permissionTimeoutMs`, `permissionTimeoutMode`) are covered by [AGENTS.md](./AGENTS.md) constraints 12 and 13; anything editable in the Settings page should be edited there.
 
 `mcpServers` uses the plugin's OWN shape (every entry carries a `name` and a `transport`), not the ACP wire shape — the wire's stdio entry has no `type`, and an entry written in the wire shape is silently dropped by the agent:
 

package/README.md

@@ -26,6 +26,8 @@
 
 打开 DSH 侧边栏的**插件**页，点**添加插件**，输入 `dsh-ntr`，点安装。装完刷新页面即可使用。
 
+> DSH 的 npm 渠道有 24 小时防范期：刚发布的版本 24 小时内不算「最新版」，只输 `dsh-ntr` 装到的可能还是旧版。想马上用新版，把版本号一起写上，例如 `dsh-ntr@0.1.5`；不急的话，等防范期过去再照常安装或升级。
+
 ### 方式二：从 npm registry 安装
 
 ```bash
@@ -111,7 +113,7 @@ DSH 自己的 `/model`、`/permission`、`/export` 等在这一模式下**不会
 
 ### 审批与 agent 自己的权限模式
 
-agent 要动敏感的东西时会问你。审批卡直接出现在聊天输入框里，你点允许或拒绝，它照着做。
+agent 要动敏感的东西时会问你。询问卡出现在对话里、聊天输入框上方（插件自己的卡片），选项就是 agent 给的那些，你点哪个它照着做；设置页的「待处理权限请求」是跨会话镜像，对话没打开时在那里回答。
 
 每个 agent 问法不一样：有的给一组选项，有的只给允许/拒绝，有的会附上它要执行的具体命令。插件把这些原样呈现给你，不预先替你决定。
 
@@ -240,7 +242,7 @@ agent 要动敏感的东西时会问你。审批卡直接出现在聊天输入
         allowedCwdRoots: [~/.dsh/dsh-ntr/workspaces]
 ```
 
-可选的 agent 字段：`npmPackage`（PATH 里找不到时自动 `npm install -g`）、`exposedModels`（NTR 座位菜单列哪些变体）、`idleTimeoutMs`（聊天进程的空闲释放窗口，`0` = 永不释放，默认 30 分钟）、`mcpServers`（额外交给 agent 连接的 MCP 服务器）。插件级还有 `transcriptMaxEntries`（会话事件缓冲上限，默认 600）与 `probeModelsOnBoot`（保留字段，启动时已不再为每个 agent 探测，见 `bootstrapCatalogs` 的注释）。可靠性超时与重试的默认值（`startupTimeoutMs`、`cancelFallbackMs`、`staleCancelRetryDelayMs`、`staleCancelMaxRetries`、`permissionTimeoutMs` 与 `permissionFallbackTimeoutMs`）见 [AGENTS.md](./AGENTS.md) 约束 12 与 13；设置页能改的都在设置页改。
+可选的 agent 字段：`npmPackage`（PATH 里找不到时自动 `npm install -g`）、`exposedModels`（NTR 座位菜单列哪些变体）、`idleTimeoutMs`（聊天进程的空闲释放窗口，`0` = 永不释放，默认 30 分钟）、`mcpServers`（额外交给 agent 连接的 MCP 服务器）。插件级还有 `transcriptMaxEntries`（会话事件缓冲上限，默认 600）与 `probeModelsOnBoot`（保留字段，启动时已不再为每个 agent 探测，见 `bootstrapCatalogs` 的注释）。可靠性超时与重试的默认值（`startupTimeoutMs`、`cancelFallbackMs`、`staleCancelRetryDelayMs`、`staleCancelMaxRetries`、`permissionTimeoutMs` 与 `permissionTimeoutMode`）见 [AGENTS.md](./AGENTS.md) 约束 12 与 13；设置页能改的都在设置页改。
 
 `mcpServers` 是**插件自己的形状**（每条必带 `name` 与 `transport`），不是 ACP 线格式——线格式里 stdio 那条不带 `type`，照线格式手写会被 agent 静默丢弃：
 

package/cordis.patch.yml

@@ -29,34 +29,62 @@
         #                                after `saveAgent`.
         # Reliability tuning (defaults shown):
         # startupTimeoutMs: 60000    # budget for initialize / session/new / session/load
-        # permissionTimeoutMs: 0     # auto-cancel a pending approval after N ms. 0 waits
-        #                                for the human on the DESIGNED ledger path; on a
-        #                                DEGRADED native route the turn still ends, after
-        #                                `permissionFallbackTimeoutMs` (default 300000) —
-        #                                see `LedgerFallbackReason`.
-        # nativeApprovalTimeoutMs: 300000
-        #                              How long the native approval route (the composer
-        #                              takeover) may stay unanswered before the ask is
-        #                              WITHDRAWN and re-asked on the settings ledger. 0 waits
-        #                              for the host forever. Default matches
-        #                              `permissionFallbackTimeoutMs`: one window for "this
-        #                              route is not working", not two. Raise it if a
-        #                              deployment's users routinely deliberate for minutes
-        #                              before answering (withdrawing only relocates the
-        #                              question to Settings — it never answers for them).
-        # permissionFallbackTimeoutMs: 300000
-        #                              Deadline for a DEGRADED ask (`unavailable`, or
-        #                              `native-timeout` after the withdrawal above): past it
-        #                              the ask is answered `cancelled` instead of hanging the
-        #                              turn. 0 disables even this. `permissionTimeoutMs > 0`
-        #                              governs every path alike and overrides both.
-        #                              `nativeApprovalTimeoutMs` and
-        #                              `permissionFallbackTimeoutMs` are ALSO editable at
-        #                              runtime (NTR 设置 → 审批时限). The card's value is
-        #                              persisted in the plugin's own state file and OUTRANKS
-        #                              this file; the card shows what this file asked for and
-        #                              offers a reset back to it. Only `permissionTimeoutMs`
-        #                              stays config-file-only, as the override of both.
+        # permissionTimeoutMs: 300000
+        #                              How long a permission ask may sit unanswered
+        #                              before the deadline fires. ONE window for every
+        #                              ask, wherever it is answered — the conversation
+        #                              card above the composer (`PermissionDock`) or
+        #                              the Settings page's cross-session mirror
+        #                              ("待处理权限请求"): one question, one answer.
+        #                              0 = 不等待: the ask is settled the moment it
+        #                              arrives, nobody is asked (no conversation card,
+        #                              no pending entry on the Settings page). That
+        #                              rung belongs to the `auto` mode ONLY — it
+        #                              ANSWERS the ask, so the agent continues. Under
+        #                              `abort` the same zero would refuse every ask on
+        #                              arrival (the agent stops at every gate), so
+        #                              `abort` starts at the shortest real wait. "Never
+        #                              expires" is NOT this key's business — that is
+        #                              `wait` mode below.
+        #                              When the deadline fires, the ask is settled IN
+        #                              PLACE: the card goes away and `permission/expired`
+        #                              records the outcome in the conversation. What
+        #                              happens is `permissionTimeoutMode`'s business.
+        #                              LEGACY: `nativeApprovalTimeoutMs` and
+        #                              `permissionFallbackTimeoutMs` are still accepted
+        #                              and folded into this key (this key wins when it
+        #                              is present), so an older config keeps meaning
+        #                              what it meant. A LEGACY 0 meant "never
+        #                              expires", so it migrates to `wait` mode with
+        #                              the default window — never to 不等待, which
+        #                              would silently turn "wait forever" into
+        #                              "answer at once".
+        # permissionTimeoutMode: wait
+        #                              What an EXPIRED deadline does — three values, no
+        #                              more:
+        #                                wait   never expire; the ask stays pending,
+        #                                       visibly, until a human answers it or the
+        #                                       session is cancelled. DEFAULT: a
+        #                                       permission ask is a question FOR A HUMAN,
+        #                                       so the safe default is to keep waiting
+        #                                       rather than to refuse (or worse, approve)
+        #                                       on their behalf.
+        #                                abort  refuse the ask (`cancelled`); the agent
+        #                                       continues with that answer.
+        #                                auto   answer it with the option the AGENT's own
+        #                                       kinds imply (allow_always → allow_once →
+        #                                       reject_once → reject_always → the first
+        #                                       option) and let the agent CONTINUE.
+        #                                       Unattended operation: this may approve
+        #                                       something nobody looked at, which is why
+        #                                       it is opt-in and why the outcome is
+        #                                       announced. Same rule as OmniTerm dev's
+        #                                       `pick_auto_option`.
+        #                              The window and the mode are BOTH editable at
+        #                              runtime (NTR 设置 → 审批时限). The card's values
+        #                              are persisted in the plugin's own state file and
+        #                              OUTRANK this file; the card shows what this file
+        #                              asked for and offers a reset back to it.
         # cancelFallbackMs: 15000    # force-finalize a turn the agent ignores after session/cancel (0 = off)
         # staleCancelRetryDelayMs: 600  # resend a prompt answered cancelled with no cancel requested (0 = at once)
         # staleCancelMaxRetries: 2      # cap on those resends before the cancelled stop is reported as-is