dsh-ntr 0.1.5 → 0.2.0

package/lib/impl.js

@@ -95,6 +95,38 @@ export function validateTagHalo(value) {
  * longer would be a mis-typed number rather than a deliberate window.
  */
 export const APPROVAL_DEADLINE_MAX_MS = 86_400_000;
+/**
+ * The shortest REAL wait: the first rung of the card's ladder (30 seconds).
+ *
+ * The floor for a mode that must not wait zero — see
+ * {@link normalizeApprovalWindow}.
+ */
+export const APPROVAL_DEADLINE_MIN_WAIT_MS = 30_000;
+/**
+ * Make a window legal for the mode it runs under.
+ *
+ * `0` means 不等待 — the ask is settled the moment it arrives instead of
+ * waiting. That is the **auto** mode's business: `auto` answers with the
+ * option the agent's own kinds imply, so the agent CONTINUES, and an
+ * unattended deployment gets a sane default instead of a hang.
+ *
+ * Under `abort` the same zero would refuse every ask the instant it arrived:
+ * the agent stops at every gate it meets, which is not a timeout, it is a
+ * brick wall. So `abort` never offers 不等待, and a window of `0` reaching it
+ * (a config file, a state file written by an older build, a mode switch that
+ * left the window behind) normalizes to the shortest real wait.
+ *
+ * `wait` ignores the window entirely — it never expires.
+ */
+export function normalizeApprovalWindow(mode, ms) {
+    return mode === 'abort' && ms === 0 ? APPROVAL_DEADLINE_MIN_WAIT_MS : ms;
+}
+/**
+ * The order `auto` mode picks an option in, by the kind the agent declared:
+ * the broadest grant first, then the narrow one, then the refusals, then
+ * whatever the agent offered instead. See {@link pickAutoOption}.
+ */
+export const AUTO_OPTION_KIND_PRIORITY = ['allow_always', 'allow_once', 'reject_once', 'reject_always'];
 /**
  * Validate ONE approval deadline, shared by every layer that accepts one.
  *
@@ -113,22 +145,55 @@ export function validateApprovalDeadlineMs(raw, label, code, hint) {
 }
 /**
  * Validate a settings-page deadline write. Omitted keys are simply absent from
- * the result — the manager merges, so a card that only touched one slider must
- * not reset the other. `reset` is not a deadline and is dropped here.
+ * the result — the manager merges, so a card that only moved the mode must not
+ * reset the number. `reset` is not a deadline and is dropped here.
  */
 export function validateApprovalDeadlines(value) {
     if (value === null || typeof value !== 'object')
         throw new AcpError('bad_payload', 'acp: approval deadlines must be an object');
-    const { nativeApprovalTimeoutMs, permissionFallbackTimeoutMs } = value;
+    const { permissionTimeoutMs } = value;
     const out = {};
-    if (nativeApprovalTimeoutMs !== undefined) {
-        out.nativeApprovalTimeoutMs = validateApprovalDeadlineMs(nativeApprovalTimeoutMs, 'nativeApprovalTimeoutMs', 'bad_payload', '(0 = wait for the host approval chain forever)');
-    }
-    if (permissionFallbackTimeoutMs !== undefined) {
-        out.permissionFallbackTimeoutMs = validateApprovalDeadlineMs(permissionFallbackTimeoutMs, 'permissionFallbackTimeoutMs', 'bad_payload', '(0 = never answer a degraded ask on the human\'s behalf)');
+    if (permissionTimeoutMs !== undefined) {
+        out.permissionTimeoutMs = validateApprovalDeadlineMs(permissionTimeoutMs, 'permissionTimeoutMs', 'bad_payload', '(0 = 不等待，仅自动推进档可用)');
     }
     return out;
 }
+/**
+ * Validate the mode a write asks for. Three values, and the list is the whole
+ * vocabulary: an unanswered ask is either answered for you, kept waiting, or
+ * refused. Anything else is a typo, not a new mode.
+ */
+export function validatePermissionTimeoutMode(raw, code) {
+    if (raw !== 'abort' && raw !== 'auto' && raw !== 'wait') {
+        throw new AcpError(code, 'acp: permissionTimeoutMode must be one of "abort", "auto", "wait"');
+    }
+    return raw;
+}
+/**
+ * The option an expired deadline answers with in `auto` mode.
+ *
+ * The pick is by the option's KIND, because that is what the agent declared
+ * about the choice it is offering: `allow_always` first (one grant covers the
+ * rest of the run), then `allow_once` (the smaller grant), then the reject
+ * kinds (refuse but let the agent continue), and finally the first option
+ * whatever it is — an agent may offer only a custom kind, and refusing to
+ * answer at all would hang the turn.
+ *
+ * `undefined` means NO option could be read (no options, or none with a usable
+ * id). The caller then degrades to `abort`: guessing an option is worse than
+ * refusing, and hanging is worse than either. OmniTerm dev picks the same way
+ * (`pick_auto_option`, `src/acp/permission.rs`).
+ */
+export function pickAutoOption(options) {
+    const usable = (option) => option.optionId === '' ? undefined : option;
+    for (const kind of AUTO_OPTION_KIND_PRIORITY) {
+        const hit = options.find(option => option.kind === kind);
+        const picked = hit === undefined ? undefined : usable(hit);
+        if (picked !== undefined)
+            return picked;
+    }
+    return options.length === 0 ? undefined : usable(options[0]);
+}
 /**
  * Bound on the number of MCP servers one agent may declare. An MCP server is
  * a process (stdio) or a remote endpoint the agent connects to at session
@@ -418,17 +483,25 @@ export function validateConfig(raw) {
     if (typeof startupTimeoutMs !== 'number' || !Number.isFinite(startupTimeoutMs) || startupTimeoutMs < 1_000 || startupTimeoutMs > 600_000) {
         throw new AcpError('bad_config', 'acp: startupTimeoutMs must be a number in [1000, 600000]');
     }
-    const permissionTimeoutMs = value.permissionTimeoutMs ?? 0;
-    if (typeof permissionTimeoutMs !== 'number' || !Number.isInteger(permissionTimeoutMs) || permissionTimeoutMs < 0 || permissionTimeoutMs > APPROVAL_DEADLINE_MAX_MS) {
-        throw new AcpError('bad_config', `acp: permissionTimeoutMs must be an integer in [0, ${String(APPROVAL_DEADLINE_MAX_MS)}] (0 = wait forever)`);
-    }
-    // Both degraded-route deadlines share the `permissionTimeoutMs` range: `0` is
-    // the meaningful value (never withdraw / never auto-cancel), and anything up
-    // to a day is a legitimate "ask again later" window. Same validator as the
-    // settings-page write, so a baseline the panel can display is a baseline the
-    // panel can also produce.
-    const nativeApprovalTimeoutMs = validateApprovalDeadlineMs(value.nativeApprovalTimeoutMs ?? 300_000, 'nativeApprovalTimeoutMs', 'bad_config', '(0 = wait for the host approval chain forever)');
-    const permissionFallbackTimeoutMs = validateApprovalDeadlineMs(value.permissionFallbackTimeoutMs ?? 300_000, 'permissionFallbackTimeoutMs', 'bad_config', '(0 = never answer a degraded ask on the human\'s behalf)');
+    // ONE wait window for both routes. The two legacy keys are folded in when
+    // the new one is absent, so an existing `cordis.patch.yml` keeps meaning what
+    // it meant instead of silently falling back to the default.
+    const legacyWindow = value.nativeApprovalTimeoutMs ?? value.permissionFallbackTimeoutMs;
+    // A legacy window of 0 meant "this window never fires". The only way to say
+    // that now is the `wait` MODE (0 is 不等待 today), so a legacy zero carries
+    // over as the mode — otherwise an unattended deployment would silently turn
+    // "wait forever" into "answer immediately".
+    const legacyNever = legacyWindow === 0;
+    const permissionTimeoutMs = validateApprovalDeadlineMs(legacyNever ? 300_000 : (value.permissionTimeoutMs ?? legacyWindow ?? 300_000), 'permissionTimeoutMs', 'bad_config', '(0 = 不等待，仅自动推进档可用)');
+    // What an expired deadline DOES. Same validator as the settings-page write,
+    // so a mode the panel can offer is a mode the next boot accepts.
+    const permissionTimeoutMode = legacyNever
+        ? 'wait'
+        : validatePermissionTimeoutMode(value.permissionTimeoutMode ?? 'wait', 'bad_config');
+    // 不等待 belongs to `auto` (it answers, so the agent continues). Under
+    // `abort` a zero window would refuse every ask on arrival — the agent stops
+    // at every gate — so it becomes the shortest real wait.
+    const effectivePermissionTimeoutMs = normalizeApprovalWindow(permissionTimeoutMode, permissionTimeoutMs);
     const cancelFallbackMs = value.cancelFallbackMs ?? 15_000;
     if (typeof cancelFallbackMs !== 'number' || !Number.isInteger(cancelFallbackMs) || cancelFallbackMs < 0 || cancelFallbackMs > 600_000) {
         throw new AcpError('bad_config', 'acp: cancelFallbackMs must be an integer in [0, 600000] (0 = disable the fallback)');
@@ -446,9 +519,8 @@ export function validateConfig(raw) {
         transcriptMaxEntries: max,
         probeModelsOnBoot,
         startupTimeoutMs,
-        permissionTimeoutMs,
-        nativeApprovalTimeoutMs,
-        permissionFallbackTimeoutMs,
+        permissionTimeoutMs: effectivePermissionTimeoutMs,
+        permissionTimeoutMode,
         cancelFallbackMs,
         staleCancelRetryDelayMs,
         staleCancelMaxRetries,
@@ -1441,13 +1513,35 @@ export class PermissionLedger {
             views.push({
                 requestId: entry.requestId,
                 sessionId: entry.sessionId,
-                toolCall: entry.view.toolCall,
-                options: entry.view.options,
+                ...entry.view,
             });
         }
         return views;
     }
 }
+/**
+ * The `permission/request` frame for one ask.
+ *
+ * ONE builder for both the live broadcast and the reconnect replay, so the two
+ * can never drift: a client that reconnects must receive exactly the frame the
+ * live one carried (its conversation card filters on `dshSessionId` and shows
+ * `toolName` / `deadlineAt`, so a replay missing them would silently drop the
+ * ask).
+ */
+export function permissionRequestFrame(view) {
+    return {
+        type: 'permission/request',
+        requestId: view.requestId,
+        sessionId: view.sessionId,
+        ...(view.dshSessionId === undefined ? {} : { dshSessionId: view.dshSessionId }),
+        toolCall: view.toolCall,
+        toolName: view.toolName,
+        ...(view.reason === undefined ? {} : { reason: view.reason }),
+        options: view.options,
+        timeoutMode: view.timeoutMode,
+        ...(view.deadlineAt === undefined ? {} : { deadlineAt: view.deadlineAt }),
+    };
+}
 /**
  * Frames that re-establish a freshly connected client's view of the pending
  * permission asks: every outstanding ask re-sent as its original
@@ -1455,10 +1549,10 @@ export class PermissionLedger {
  *
  * Why a replay at all: a `permission/request` is broadcast ONCE, when the ask is
  * created. A client that connects later — page reload, second tab, stream
- * outage — never receives it, and for a ledger ask (the `/acp` RPC path, or a
- * native route that degraded) that card is the ONLY answer entry, so the ask is
- * invisible to exactly the client that needs it. OmniTerm closes the same hole
- * with `PermissionManager::pending_events()` + a `PermissionsSynced` marker on
+ * outage — never receives it, and that card (conversation or settings ledger)
+ * is the ONLY answer entry for the ask, so the ask is invisible to exactly the
+ * client that needs it. OmniTerm closes the same hole with
+ * `PermissionManager::pending_events()` + a `PermissionsSynced` marker on
  * every WS connect.
  *
  * Why the terminator is mandatory: the replay is a snapshot, so an ask resolved
@@ -1467,13 +1561,7 @@ export class PermissionLedger {
  * `respond` would answer `unknown_request`.
  */
 export function permissionReplayFrames(pending) {
-    const requests = pending.map(p => ({
-        type: 'permission/request',
-        requestId: p.requestId,
-        sessionId: p.sessionId,
-        toolCall: p.toolCall,
-        options: p.options,
-    }));
+    const requests = pending.map(permissionRequestFrame);
     return [...requests, { type: 'permission/synced', requestIds: pending.map(p => p.requestId) }];
 }
 function ok(value) {
@@ -1507,12 +1595,7 @@ export async function dispatchRpc(manager, endpoint, payload) {
     try {
         switch (endpoint) {
             case 'agents/list':
-                // `approvalRouted` is a capability report, not a command: the browser
-                // uses it to decide whether the settings panel still owns approvals.
-                return ok({
-                    agents: manager.agentViews(),
-                    approvalRouted: manager.approvalRouting?.() ?? false,
-                });
+                return ok({ agents: manager.agentViews() });
             case 'agents/detect':
                 return ok({ agents: await (manager.detectAgents?.() ?? Promise.resolve([])) });
             case 'agent/save': {
@@ -1683,10 +1766,10 @@ export async function dispatchRpc(manager, endpoint, payload) {
                 // renders nothing rather than a number it cannot trust.
                 return ok({ deadlines: manager.approvalDeadlines?.() });
             case 'ui/approval-deadlines-set': {
-                const patch = validateApprovalDeadlines({
-                    nativeApprovalTimeoutMs: body.nativeApprovalTimeoutMs,
-                    permissionFallbackTimeoutMs: body.permissionFallbackTimeoutMs,
-                });
+                const patch = {
+                    ...validateApprovalDeadlines({ permissionTimeoutMs: body.permissionTimeoutMs }),
+                    ...(body.mode === undefined ? {} : { mode: validatePermissionTimeoutMode(body.mode, 'bad_payload') }),
+                };
                 await manager.setApprovalDeadlines?.(patch, body.reset === true);
                 return ok({ deadlines: manager.approvalDeadlines?.() });
             }

package/lib/index.js

@@ -7,10 +7,10 @@
 import { ACP_PRESET_ID, AcpLlmAdapter, BridgeManager } from "./bridge.js";
 import { EventHub, dispatchRpc, permissionReplayFrames, sessionAgentPreset, sessionAgentPresetFromLog, validateConfig } from "./impl.js";
 export const name = 'dsh-ntr';
-// `approval` / `agents` are deliberately NOT listed here: they are optional
-// collaborators probed structurally below. A hard dependency would make the
-// whole plugin fail to load on a deployment without them (see the LLM service
-// probe, which follows the same shape).
+// Deliberately minimal: every other host service is probed structurally
+// (`ctx.get` + a late `ctx.inject`) so a deployment without one still loads
+// this plugin. ACP permission asks are answered through this plugin's own
+// ledger, so the host approval service is not a collaborator at all.
 export const inject = ['webServer', 'connection'];
 /** How many stored events the cold-read folds before giving up on scanning. */
 const COLD_READ_MAX_EVENTS = 4096;
@@ -24,8 +24,7 @@ export function apply(ctx, config) {
     const manager = new BridgeManager(resolved.agents, hub, resolved.transcriptMaxEntries ?? 600, undefined, undefined, resolved.probeModelsOnBoot ?? true, {
         startupTimeoutMs: resolved.startupTimeoutMs,
         permissionTimeoutMs: resolved.permissionTimeoutMs,
-        nativeApprovalTimeoutMs: resolved.nativeApprovalTimeoutMs,
-        permissionFallbackTimeoutMs: resolved.permissionFallbackTimeoutMs,
+        permissionTimeoutMode: resolved.permissionTimeoutMode,
         cancelFallbackMs: resolved.cancelFallbackMs,
         staleCancelRetryDelayMs: resolved.staleCancelRetryDelayMs,
         staleCancelMaxRetries: resolved.staleCancelMaxRetries,
@@ -39,12 +38,20 @@ export function apply(ctx, config) {
     // returns to). Only the keys the file actually names are declared.
     const rawConfig = (config ?? {});
     const configuredDeadlines = {};
-    for (const key of ['nativeApprovalTimeoutMs', 'permissionFallbackTimeoutMs']) {
-        const value = rawConfig[key];
-        if (typeof value === 'number' && Number.isFinite(value))
-            configuredDeadlines[key] = value;
+    // The window the file actually named — the new key, or the legacy one it
+    // folded into (same order `validateConfig` resolves them in, so the card's
+    // baseline and the running value never disagree).
+    const rawWindow = rawConfig.permissionTimeoutMs
+        ?? rawConfig.nativeApprovalTimeoutMs
+        ?? rawConfig.permissionFallbackTimeoutMs;
+    if (typeof rawWindow === 'number' && Number.isFinite(rawWindow)) {
+        configuredDeadlines.permissionTimeoutMs = rawWindow;
     }
-    manager.setConfiguredApprovalDeadlines(configuredDeadlines);
+    // The mode is declared the same way: only when the file actually names it.
+    const configuredMode = rawConfig.permissionTimeoutMode === 'abort' || rawConfig.permissionTimeoutMode === 'auto' || rawConfig.permissionTimeoutMode === 'wait'
+        ? rawConfig.permissionTimeoutMode
+        : undefined;
+    manager.setConfiguredApprovalDeadlines(configuredDeadlines, configuredMode);
     // Boot hook kept only so this entry point's shape does not change:
     // `bootstrapCatalogs` is intentionally empty — boot never spawns an agent,
     // in any environment and for any `probeModelsOnBoot` value. Catalogs fill
@@ -79,37 +86,6 @@ export function apply(ctx, config) {
         // Late arrival: the registry may still be loading when this plugin applies.
         ctx.inject(['agentPresets'], () => { wirePresetRoster(); });
     }
-    /**
-     * Native approval routing: answer ACP `session/request_permission` through
-     * the host approval chain so the question takes over the chat composer
-     * (`ApprovalPanel`) instead of the settings panel.
-     *
-     * `approval.request` needs the live agent object (its session carries the
-     * audit pair, and the ask must land inside an open turn) and the chat
-     * session id our adapter already knows. Any missing piece — service absent,
-     * unknown session, a rejecting service — degrades to `'unavailable'`, which
-     * sends the ask back to the ledger/panel path rather than losing it.
-     */
-    const wireApproval = () => {
-        const approval = (typeof ctx.get === 'function' ? ctx.get('approval') : ctx.approval);
-        const agents = (typeof ctx.get === 'function' ? ctx.get('agents') : ctx.agents);
-        if (approval === undefined || agents === undefined)
-            return;
-        manager.setApprovalRequester(async ({ dshSessionId, toolName, signal }) => {
-            if (dshSessionId === undefined)
-                return 'unavailable';
-            const agent = agents.get(dshSessionId);
-            if (agent === undefined)
-                return 'unavailable';
-            try {
-                return await approval.request({ agent, toolName, ...(signal === undefined ? {} : { signal }) });
-            }
-            catch {
-                // Never propagate: a failed ask must fall back, not break the turn.
-                return 'unavailable';
-            }
-        });
-    };
     /**
      * Workspace routing: the sidebar's selected workspace IS the chat session's
      * workspace, so the agent's session and its process both run there (see
@@ -203,11 +179,10 @@ export function apply(ctx, config) {
             return undefined;
         }
     };
-    wireApproval();
     wireWorkspace();
     if (typeof ctx.inject === 'function') {
-        // Late arrival for the workspace collaborators; kept separate from the
-        // approval probe so a deployment missing one service still wires the other.
+        // Late arrival for the workspace collaborators: a deployment missing one
+        // service must not fail this plugin's activation.
         ctx.inject(['sandboxPolicy', 'sessions'], () => {
             wireWorkspace();
         });
@@ -220,13 +195,6 @@ export function apply(ctx, config) {
             wireAcpMode();
         });
     }
-    if (typeof ctx.inject === 'function') {
-        // Late arrival: both services may still be loading when this plugin
-        // applies (profile order is not ours to control).
-        ctx.inject(['approval', 'agents'], () => {
-            wireApproval();
-        });
-    }
     const registerLlm = (llmHandle) => {
         ctx.effect(() => {
             // The route exists so the host's driver can reach this adapter at all: