dsh-ntr 0.1.6 → 0.2.0

package/src/client/store.ts

@@ -59,11 +59,65 @@ export type Block =
   | { kind: 'event'; event: string; text: string; raw?: string; status?: string }
   | { kind: 'notice'; tone: 'info' | 'error'; text: string }
 
+/**
+ * One permission ask waiting for a human. Every field is copied VERBATIM from
+ * the host's `permission/request` frame: the host owns what the ask is called
+ * (`toolName` / `reason`), which options the agent offered (order included),
+ * and whether the ask carries a deadline. The browser does not derive a title
+ * from `toolCall` and does not second-guess the agent's option labels.
+ */
 export interface PendingPermission {
   requestId: string
+  /** ACP session id. */
   sessionId: string
-  title: string
+  /** DSH chat session id; absent for `/acp` RPC-only sessions (settings-only ask). */
+  dshSessionId?: string
+  toolName: string
+  reason?: string
   options: Array<{ optionId: string; name: string; kind: string }>
+  timeoutMode: PermissionTimeoutMode
+  /** Epoch ms; absent in `wait` mode. */
+  deadlineAt?: number
+}
+
+/** Returned by {@link deadlineRemainingLabel} once the deadline has passed. */
+export const PERMISSION_DEADLINE_EXPIRED = 'expired'
+
+/**
+ * The asks that belong to one DSH chat conversation. An ask without a
+ * `dshSessionId` belongs to no conversation (an `/acp` RPC-only session), so it
+ * is deliberately absent from every conversation's dock and stays in the
+ * settings-panel ledger.
+ */
+export function permissionsForSession(
+  permissions: readonly PendingPermission[],
+  dshSessionId: string,
+): PendingPermission[] {
+  return permissions.filter(permission => permission.dshSessionId === dshSessionId)
+}
+
+/**
+ * Compact countdown for one ask, or `undefined` when there is nothing to count
+ * down (`wait` mode, or a frame without a deadline). Pure so the formatting is
+ * testable without a clock: the dock passes `Date.now()` on its tick.
+ *
+ * Past the deadline the answer is {@link PERMISSION_DEADLINE_EXPIRED} rather
+ * than a negative number — the host has already armed the expiry, and a card
+ * counting backwards would claim a deadline that no longer exists.
+ */
+export function deadlineRemainingLabel(
+  deadlineAt: number | undefined,
+  now: number,
+  mode: PermissionTimeoutMode,
+): string | undefined {
+  if (mode === 'wait' || deadlineAt === undefined) return undefined
+  const remainingMs = deadlineAt - now
+  if (remainingMs <= 0) return PERMISSION_DEADLINE_EXPIRED
+  const seconds = Math.ceil(remainingMs / 1000)
+  if (seconds < 60) return `${String(seconds)}s`
+  const minutes = Math.floor(seconds / 60)
+  const rest = seconds % 60
+  return rest === 0 ? `${String(minutes)}m` : `${String(minutes)}m ${String(rest)}s`
 }
 
 /**
@@ -137,17 +191,6 @@ export interface UiState {
    * that never answers, …) reads as a dead button.
    */
   probeErrors: Record<string, string>
-  /**
-   * Host reports that it HAS the native approval chain (permission asks are
-   * answered in the chat composer). This is a capability report, not a
-   * per-ask promise: an individual ask still falls back to the settings-panel
-   * ledger when the service is unavailable this time, or when the session has
-   * no chat identity behind it (`AgentBridge.askNativeApproval`). The panel
-   * therefore answers ANY pending ask, whatever this flag says — see
-   * `permissionLedgerCard` in panel.tsx. False on an older host or when the
-   * approval service is missing, in which case the ledger is the only path.
-   */
-  approvalRouted: boolean
   /**
    * ACP agent sessions backing the chat session the composer control sits in.
    * Only meaningful together with {@link chatSessionsFor}: the control reads it
@@ -539,7 +582,6 @@ export class AcpStore {
     seatCatalogs: {},
     probingModels: {},
     probeErrors: {},
-    approvalRouted: false,
     chatSessions: [],
     tagHalo: { ...DEFAULT_TAG_HALO },
     approvalDeadlines: undefined,
@@ -741,8 +783,8 @@ export class AcpStore {
   /** Snapshot refresh used on panel open and after a stream outage. */
   async resync(): Promise<void> {
     try {
-      const [{ agents, approvalRouted }, { sessions }, defaultAgentInfo, detectResult, presetResult, tagHaloResult, deadlinesResult] = await Promise.all([
-        this.call<{ agents: AgentView[]; approvalRouted?: boolean }>('agents/list'),
+      const [{ agents }, { sessions }, defaultAgentInfo, detectResult, presetResult, tagHaloResult, deadlinesResult] = await Promise.all([
+        this.call<{ agents: AgentView[] }>('agents/list'),
         this.call<{ sessions: SessionView[] }>('sessions/list'),
         // The plugin's OWN default ACP agent — a plugin-private id, not a DSH
         // model route (see `defaultAgent` on the host half).
@@ -766,7 +808,6 @@ export class AcpStore {
         sessions,
         defaultAgent: defaultAgentInfo?.agentId,
         detectedAgents,
-        approvalRouted: approvalRouted === true,
         preset: presetResult?.preset ?? undefined,
         tagHalo: tagHaloResult?.halo ?? { ...DEFAULT_TAG_HALO },
         approvalDeadlines: deadlinesResult.deadlines,
@@ -1483,11 +1524,20 @@ export class AcpStore {
     }
   }
 
+  /**
+   * Answer one ask (`optionId` absent = cancel it). A failure is reported
+   * through the store's notice — the settings panel renders that — AND
+   * rethrown, so the conversation dock can pin the message next to the card
+   * that failed instead of leaving it on a settings page the user may not
+   * have open. Callers that cannot show it (the settings panel) swallow it
+   * after the notice.
+   */
   async respondPermission(requestId: string, optionId?: string): Promise<void> {
     try {
       await this.call('permission/respond', { requestId, ...(optionId === undefined ? {} : { optionId }) })
     } catch (error) {
       this.flashError(error)
+      throw error
     }
   }
 
@@ -1851,16 +1901,22 @@ export class AcpStore {
         return this.loadAgentCatalog(event.agentId)
       }
       case 'permission/request': {
-        const title = typeof (event.toolCall as { title?: unknown } | undefined)?.title === 'string'
-          ? String((event.toolCall as { title: string }).title)
-          : this.locale('工具调用', 'tool call')
+        // Verbatim copy of the host's frame. The host decides what the ask is
+        // called (`toolName` / `reason`) and which options exist; deriving a
+        // title from `toolCall` here used to make the card say something the
+        // host never said.
+        const permission: PendingPermission = {
+          requestId: event.requestId,
+          sessionId: event.sessionId,
+          ...(event.dshSessionId === undefined ? {} : { dshSessionId: event.dshSessionId }),
+          toolName: event.toolName,
+          ...(event.reason === undefined ? {} : { reason: event.reason }),
+          options: event.options,
+          timeoutMode: event.timeoutMode,
+          ...(event.deadlineAt === undefined ? {} : { deadlineAt: event.deadlineAt }),
+        }
         this.mutate({
-          permissions: [...this.state.permissions.filter(p => p.requestId !== event.requestId), {
-            requestId: event.requestId,
-            sessionId: event.sessionId,
-            title,
-            options: event.options,
-          }],
+          permissions: [...this.state.permissions.filter(p => p.requestId !== event.requestId), permission],
         })
         return Promise.resolve()
       }

package/src/impl.ts

@@ -1579,6 +1579,22 @@ export class EventHub {
 
 // ---- Permission ledger ----
 
+/** Everything a `permission/request` frame carries besides the ids the ledger owns. */
+export interface PendingPermissionFields {
+  /** DSH chat session id; absent for `/acp` RPC-only sessions. */
+  dshSessionId?: string
+  toolCall: unknown
+  /** Host-derived human name (`permissionToolName`). */
+  toolName: string
+  /** One-line detail from the agent's declared input, when it has any. */
+  reason?: string
+  options: PermissionOptionView[]
+  /** What an unanswered ask does when its deadline fires. */
+  timeoutMode: PermissionTimeoutMode
+  /** Epoch ms of the deadline; absent in `wait` mode (no deadline). */
+  deadlineAt?: number
+}
+
 export interface PendingPermission {
   requestId: string
   sessionId: string
@@ -1588,15 +1604,13 @@ export interface PendingPermission {
    * client receives (see `permissionReplayFrames`). Absent on entries created
    * without a view — those still answer, they just cannot be re-shown.
    */
-  view?: { toolCall: unknown; options: PermissionOptionView[] }
+  view?: PendingPermissionFields
 }
 
 /** One outstanding ask as a reconnecting client must be re-shown it. */
-export interface PendingPermissionView {
+export interface PendingPermissionView extends PendingPermissionFields {
   requestId: string
   sessionId: string
-  toolCall: unknown
-  options: PermissionOptionView[]
 }
 
 export class PermissionLedger {
@@ -1648,14 +1662,37 @@ export class PermissionLedger {
       views.push({
         requestId: entry.requestId,
         sessionId: entry.sessionId,
-        toolCall: entry.view.toolCall,
-        options: entry.view.options,
+        ...entry.view,
       })
     }
     return views
   }
 }
 
+/**
+ * The `permission/request` frame for one ask.
+ *
+ * ONE builder for both the live broadcast and the reconnect replay, so the two
+ * can never drift: a client that reconnects must receive exactly the frame the
+ * live one carried (its conversation card filters on `dshSessionId` and shows
+ * `toolName` / `deadlineAt`, so a replay missing them would silently drop the
+ * ask).
+ */
+export function permissionRequestFrame(view: PendingPermissionView): AcpEvent {
+  return {
+    type: 'permission/request',
+    requestId: view.requestId,
+    sessionId: view.sessionId,
+    ...(view.dshSessionId === undefined ? {} : { dshSessionId: view.dshSessionId }),
+    toolCall: view.toolCall,
+    toolName: view.toolName,
+    ...(view.reason === undefined ? {} : { reason: view.reason }),
+    options: view.options,
+    timeoutMode: view.timeoutMode,
+    ...(view.deadlineAt === undefined ? {} : { deadlineAt: view.deadlineAt }),
+  }
+}
+
 /**
  * Frames that re-establish a freshly connected client's view of the pending
  * permission asks: every outstanding ask re-sent as its original
@@ -1663,10 +1700,10 @@ export class PermissionLedger {
  *
  * Why a replay at all: a `permission/request` is broadcast ONCE, when the ask is
  * created. A client that connects later — page reload, second tab, stream
- * outage — never receives it, and for a ledger ask (the `/acp` RPC path, or a
- * native route that degraded) that card is the ONLY answer entry, so the ask is
- * invisible to exactly the client that needs it. OmniTerm closes the same hole
- * with `PermissionManager::pending_events()` + a `PermissionsSynced` marker on
+ * outage — never receives it, and that card (conversation or settings ledger)
+ * is the ONLY answer entry for the ask, so the ask is invisible to exactly the
+ * client that needs it. OmniTerm closes the same hole with
+ * `PermissionManager::pending_events()` + a `PermissionsSynced` marker on
  * every WS connect.
  *
  * Why the terminator is mandatory: the replay is a snapshot, so an ask resolved
@@ -1675,13 +1712,7 @@ export class PermissionLedger {
  * `respond` would answer `unknown_request`.
  */
 export function permissionReplayFrames(pending: readonly PendingPermissionView[]): AcpEvent[] {
-  const requests: AcpEvent[] = pending.map(p => ({
-    type: 'permission/request' as const,
-    requestId: p.requestId,
-    sessionId: p.sessionId,
-    toolCall: p.toolCall,
-    options: p.options,
-  }))
+  const requests: AcpEvent[] = pending.map(permissionRequestFrame)
   return [...requests, { type: 'permission/synced', requestIds: pending.map(p => p.requestId) }]
 }
 
@@ -1761,12 +1792,6 @@ export interface AcpManager {
    * cache (newly published models appear, withdrawn ones drop out).
    */
   cachedAgentModels?(agentId: string): AgentProbeModelsResult | undefined
-  /**
-   * True when ACP permission asks are routed to the host's native approval
-   * service (answered in the chat composer) instead of the settings-panel
-   * ledger. Read-only capability report for `agents/list`.
-   */
-  approvalRouting?(): boolean
   /**
    * ACP agent sessions backing one DSH chat session (looked up by chat session
    * id), so the composer can offer the agent's OWN mode list. Empty when no
@@ -1881,12 +1906,7 @@ export async function dispatchRpc(manager: AcpManager, endpoint: string, payload
   try {
     switch (endpoint) {
       case 'agents/list':
-        // `approvalRouted` is a capability report, not a command: the browser
-        // uses it to decide whether the settings panel still owns approvals.
-        return ok({
-          agents: manager.agentViews(),
-          approvalRouted: manager.approvalRouting?.() ?? false,
-        })
+        return ok({ agents: manager.agentViews() })
       case 'agents/detect':
         return ok({ agents: await (manager.detectAgents?.() ?? Promise.resolve([])) })
       case 'agent/save': {

package/src/index.ts

@@ -11,32 +11,15 @@ import type { ConnectionRpcHandler, HostConnectionHandle } from '@deepseek-ai/ds
 import { ACP_PRESET_ID, AcpLlmAdapter, BridgeManager } from './bridge.ts'
 import { EventHub, dispatchRpc, permissionReplayFrames, sessionAgentPreset, sessionAgentPresetFromLog, validateConfig } from './impl.ts'
 import type { AcpEvent, ApprovalDeadlineKey } from './protocol.ts'
-import type { ApprovalOutcome } from './bridge.ts'
 import type { RosterPresetRow, SessionLogLike } from './impl.ts'
 
 export const name = 'dsh-ntr'
-// `approval` / `agents` are deliberately NOT listed here: they are optional
-// collaborators probed structurally below. A hard dependency would make the
-// whole plugin fail to load on a deployment without them (see the LLM service
-// probe, which follows the same shape).
+// Deliberately minimal: every other host service is probed structurally
+// (`ctx.get` + a late `ctx.inject`) so a deployment without one still loads
+// this plugin. ACP permission asks are answered through this plugin's own
+// ledger, so the host approval service is not a collaborator at all.
 export const inject = ['webServer', 'connection']
 
-/** Structural view of the host approval service (`@deepseek-ai/dsh-user-approval`). */
-interface ApprovalServiceLike {
-  request(req: { agent: unknown; toolName: string; reason?: string; callId?: string; signal?: AbortSignal }): Promise<ApprovalOutcome>
-  /**
-   * Present on the host service, but NEVER read by this plugin: the only call
-   * made here is `request` (see `wireApproval`). A deployment-wide default
-   * policy is the host's own business.
-   */
-  config?: { policy?: string }
-}
-
-/** Structural view of the host agent registry (`ctx.agents`), keyed by chat session id. */
-interface AgentsServiceLike {
-  get(sessionId: string): unknown | undefined
-}
-
 /** Structural view of the host sandbox policy service (`@deepseek-ai/dsh-sandbox-policy`). */
 interface SandboxPolicyLike {
   resolve(request: { session?: unknown }): { mode?: unknown; workspaceRoot?: unknown }
@@ -166,40 +149,6 @@ export function apply(ctx: Context, config?: unknown): void {
     ctx.inject(['agentPresets'], () => { wirePresetRoster() })
   }
 
-  /**
-   * Native approval routing: answer ACP `session/request_permission` through
-   * the host approval chain so the question takes over the chat composer
-   * (`ApprovalPanel`) instead of the settings panel.
-   *
-   * `approval.request` needs the live agent object (its session carries the
-   * audit pair, and the ask must land inside an open turn) and the chat
-   * session id our adapter already knows. Any missing piece — service absent,
-   * unknown session, a rejecting service — degrades to `'unavailable'`, which
-   * sends the ask back to the ledger/panel path rather than losing it.
-   */
-  const wireApproval = (): void => {
-    const approval = (typeof ctx.get === 'function' ? ctx.get('approval') : (ctx as unknown as { approval?: ApprovalServiceLike }).approval) as ApprovalServiceLike | undefined
-    const agents = (typeof ctx.get === 'function' ? ctx.get('agents') : (ctx as unknown as { agents?: AgentsServiceLike }).agents) as AgentsServiceLike | undefined
-    if (approval === undefined || agents === undefined) return
-    manager.setApprovalRequester(async ({ dshSessionId, toolName, reason, callId, signal }) => {
-      if (dshSessionId === undefined) return 'unavailable'
-      const agent = agents.get(dshSessionId)
-      if (agent === undefined) return 'unavailable'
-      try {
-        return await approval.request({
-          agent,
-          toolName,
-          ...(reason === undefined ? {} : { reason }),
-          ...(callId === undefined ? {} : { callId }),
-          ...(signal === undefined ? {} : { signal }),
-        })
-      } catch {
-        // Never propagate: a failed ask must fall back, not break the turn.
-        return 'unavailable'
-      }
-    })
-  }
-
   /**
    * Workspace routing: the sidebar's selected workspace IS the chat session's
    * workspace, so the agent's session and its process both run there (see
@@ -288,11 +237,10 @@ export function apply(ctx: Context, config?: unknown): void {
     }
   }
 
-  wireApproval()
   wireWorkspace()
   if (typeof ctx.inject === 'function') {
-    // Late arrival for the workspace collaborators; kept separate from the
-    // approval probe so a deployment missing one service still wires the other.
+    // Late arrival for the workspace collaborators: a deployment missing one
+    // service must not fail this plugin's activation.
     ctx.inject(['sandboxPolicy', 'sessions'], () => {
       wireWorkspace()
     })
@@ -305,13 +253,6 @@ export function apply(ctx: Context, config?: unknown): void {
       wireAcpMode()
     })
   }
-  if (typeof ctx.inject === 'function') {
-    // Late arrival: both services may still be loading when this plugin
-    // applies (profile order is not ours to control).
-    ctx.inject(['approval', 'agents'], () => {
-      wireApproval()
-    })
-  }
 
   /** Registration handle: callable disposer, plus `replace` to re-announce routes. */
   interface LlmAdapterHandle {

package/src/protocol.ts

@@ -332,18 +332,44 @@ export type AcpEvent =
    * same as unset — no `agentId@choice` variants.
    */
   | { type: 'agent/exposure'; agentId: string; exposedModels: string[]; autoDiscoverModels: boolean }
-  | { type: 'permission/request'; requestId: string; sessionId: string; toolCall: unknown; options: PermissionOptionView[] }
+  /**
+   * One outstanding ask, broadcast ONCE when it is created and replayed as-is
+   * to every freshly connected client (see `permission/synced`).
+   *
+   * Every ACP permission ask carries everything the conversation card needs:
+   * who owns it (`dshSessionId`), what it is about (`toolCall` + the derived
+   * `toolName` / `reason`), the options to render verbatim, and the deadline in
+   * force. The host never answers on its own outside an expired `abort` /
+   * `auto` deadline, so this frame (and its replay) is the answer entry.
+   */
+  | {
+      type: 'permission/request'
+      requestId: string
+      /** ACP session id the ask belongs to. */
+      sessionId: string
+      /** DSH chat session id; absent for `/acp` RPC-only sessions. */
+      dshSessionId?: string
+      /** Raw ACP `ToolCallUpdate` the agent sent — never summarized away. */
+      toolCall: unknown
+      /** Host-derived human name (`permissionToolName`, `_meta` fallback included). */
+      toolName: string
+      /** One-line detail from the agent's declared input, when it has any. */
+      reason?: string
+      options: PermissionOptionView[]
+      /** What an unanswered ask does when its deadline fires. */
+      timeoutMode: PermissionTimeoutMode
+      /** Epoch ms of the deadline; absent in `wait` mode (no deadline). */
+      deadlineAt?: number
+    }
   | { type: 'permission/resolved'; requestId: string; sessionId: string; outcome: PermissionOutcome }
   /**
    * An ask whose deadline fired and was settled by the plugin itself — refused
    * (`abort`), or answered with the option the agent's own kinds imply
    * (`auto`).
    *
-   * A native ask (the composer takeover) never became a ledger entry, so this
-   * frame is the ONLY trace of the expiry in the conversation: without it the
-   * user would watch the composer card vanish with nothing said about it. The
-   * ledger path does not need it — its card sits on the settings panel and the
-   * chat line already pointed there.
+   * This is the conversation's record of the expiry: the card it was answering
+   * is gone, so without this frame the user would see it vanish with nothing
+   * said about it.
    */
   | {
       type: 'permission/expired'
@@ -429,12 +455,6 @@ export type RpcResult<T> = {
 
 export interface AgentsListResult {
   agents: AgentView[]
-  /**
-   * True when permission asks are routed to the host approval chain and the
-   * browser must stop rendering the settings-panel permission card. False (or
-   * absent on an older host) keeps the degraded ledger path visible.
-   */
-  approvalRouted?: boolean
 }
 export type SessionPromptResult = { accepted: true; turnId: string }
 export type TranscriptResult = { session: SessionView; entries: Array<{ seq: number; update: SessionUpdate }> }