dsh-packycode-api 1.3.9 → 1.4.0

package/SECURITY.md

@@ -15,18 +15,18 @@
 
 ## Claude requests
 
-- Claude requests use one of two transports, chosen by the request key's PackyCode groups (or the user's pin): keys in `cc` send them through this device's official Claude Code CLI; every other key uses the plugin's HTTP Messages route. Both carry the same payload; neither has any fallback to the other, to another provider, or to another credential.
+- Claude requests use one of two routes, chosen only by the request key's PackyCode groups: on keys in `cc`, and on a key whose groups are not read yet, this device's official Claude Code CLI carries out the session as the agent; every other key uses the plugin's HTTP Messages route with DSH's own agent. A turn that starts on the CLI finishes there. Neither route has any fallback to the other after a failure, to another provider, or to another credential.
 - The HTTP route's compatibility headers and session metadata do not load a CLI login or external configuration. Bearer authentication uses only the plugin's selected conversation key; images keep their separate credential record.
-- DSH owns tool execution, permissions, plan mode, attachments and history on both routes. Wire tool aliases are restored only for tools offered on that request; unknown aliases are not decoded into host tools. Saved images from older CLI-backed sessions remain readable without executing their old tools.
+- On the HTTP route DSH owns tool execution, permissions, plan mode, attachments and history. Wire tool aliases are restored only for tools offered on that request; unknown aliases are not decoded into host tools. Saved images from older CLI-backed sessions remain readable without executing their old tools.
 - Captured client-policy refusals do not disable keys or switch providers or transports. The specific pre-stream anomalies covered by the HTTP route may replay the exact bytes and credential once; ordinary policy refusals, HTTP 429 and accepted streams are excluded. Cancellation aborts the replay.
 
-## The Claude Code CLI transport
+## The Claude Code CLI route
 
-- The CLI is a transport, not an agent: it runs with all of its own tools disabled (`--tools ""`), so it cannot read, write or execute anything itself. The tools it can see are the ones DSH offered for that request, served by an MCP bridge; every call is answered with the result DSH produced after running the tool under its own permissions and sandbox.
-- The bridge is a per-process Streamable HTTP server bound to `127.0.0.1` on a random port. It requires a random 256-bit capability on every request, rejects foreign `Host` and `Origin` headers, and closes with its process. The capability lives only in an owner-only (`0600`) config file inside an owner-only run directory under the CLI home; it never appears in a command line.
-- The CLI runs with an isolated config home (`~/.dsh/packycode-claude-cli`), `--setting-sources ""`, `--strict-mcp-config`, `--disable-slash-commands`, `--no-session-persistence`, and CLAUDE.md, auto-memory, auto-update, telemetry and non-essential traffic disabled. Inherited `ANTHROPIC_*`, `CLAUDE_*`, `MCP_*`, `DISABLE_*` and `ENABLE_*` variables are removed, so the user's own Claude Code login, API key, base URL, model and settings never reach it.
-- The request key reaches the child only as `ANTHROPIC_AUTH_TOKEN` in its environment, with the endpoint as `ANTHROPIC_BASE_URL`; it is never written to a file, an argument, a transcript or a log. The DSH system prompt and the conversation transcript the CLI resumes are written to that owner-only run directory and removed when the process ends; directories left by a crashed host are removed after a day.
-- The CLI's own retries, model fallback, refusal fallback and compaction are disabled: one DSH step is one API request, and retries follow DSH's policy. Processes are stopped on cancellation, after 20 idle minutes, beyond eight live conversations, and when the plugin unloads.
+- Claude Code is the agent: it runs with its own system prompt and its own tools, so it reads, writes and executes on this device itself, with the user's privileges and outside DSH's sandbox. The plugin never adds DSH's prompt or tools to it, and of DSH's messages it passes on only the user's own (DSH's runtime context, skill catalog, `AGENTS.md` and notices stay in DSH).
+- Every permission prompt it sends (`--permission-prompt-tool stdio`) is answered by DSH: the call appears as a `claude_code` tool card, and DSH's approval — the user, or Auto review under the `auto` preset — decides it under the session's permission preset. The CLI's permission mode follows that preset: plan mode is `plan`, `workspace-write` is `acceptEdits`, `read-only` and `auto` are `default`, and only `danger-full-access` (approval `never`) is `bypassPermissions`, which asks nothing. A refusal is passed back with its reason and the call does not run. Calls the CLI allows by itself (reads, read-only commands) run without a prompt and are shown afterwards. Prompts about calls DSH never showed (a subagent's) go to DSH's approval without a card. Plans go to DSH's plan review and questions to DSH's question UI; the plugin never answers a prompt on its own.
+- The CLI runs with an isolated config home (`~/.dsh/packycode-claude-cli`), `--setting-sources user` (only that home's settings: never `~/.claude` or a project's `.claude/settings.json` and hooks) and `--strict-mcp-config` with no servers (never a project's `.mcp.json`), so a repository cannot point the CLI at another endpoint or run hooks with the key. Auto-memory, background tasks, auto-update, telemetry and non-essential traffic are disabled. Inherited `ANTHROPIC_*`, `CLAUDE_*`, `MCP_*`, `DISABLE_*` and `ENABLE_*` variables are removed, so the user's own Claude Code login, API key, base URL, model and settings never reach it. A project's `CLAUDE.md` is read as Claude Code always reads it.
+- The request key reaches the child only as `ANTHROPIC_AUTH_TOKEN` in its environment, with the endpoint as `ANTHROPIC_BASE_URL`; it is never written to a file, an argument, a transcript or a log. Claude Code keeps its own session records and plan files in the CLI home's `projects/dsh-packycode` and `plans` directories; when a session is rebuilt from DSH's history, the plugin writes that transcript there as an owner-only (`0600`) file. `dsh-sessions.json` maps DSH sessions to Claude Code sessions by ids and response fingerprints only.
+- The CLI's own retries and model and refusal fallbacks are disabled: one DSH step is one API request, and retries follow DSH's policy. Turns Claude Code would start on its own (scheduled prompts) are interrupted, because DSH could not show them. Processes are stopped on cancellation, after 20 idle minutes, beyond eight live conversations, and when the plugin unloads.
 - Installing the CLI from the settings panel runs `npm install -g @anthropic-ai/claude-code` with constant arguments; on Windows the npm launcher is resolved to the program it forwards to, so no shell parses user text.
 
 ## Reporting

package/lib/client.js

@@ -124,10 +124,11 @@ window.__ModuleLoader__.load({
 			groupsStale: "分组为上次读取的结果",
 			keyClaudeCli: "Claude 经官方 CLI",
 			keyClaudeHttp: "Claude 经 HTTP",
-			keyClaudeCliHint: "分组 {groups} 只接受官方 Claude Code 客户端，这个 Key 的 Claude 请求由本机 Claude Code CLI 发出。",
+			keyClaudeCliHint: "分组 {groups} 只接受官方 Claude Code 客户端，这个 Key 的 Claude 会话由本机 Claude Code CLI 直接完成。",
 			keyClaudeHttpHint: "这个 Key 的 Claude 请求走插件内置的 HTTP 通道。",
+			keyClaudeCliUnreadHint: "还没读到这个 Key 的分组，Claude 会话先交给本机 Claude Code CLI；读到分组后按分组选通道。",
 			cliTitle: "Claude Code CLI",
-			cliIntro: "cc 分组只接受官方 Claude Code 客户端，这些 Key 的 Claude 请求由本机的 Claude Code CLI 发出；cc-sale、cc-expensive、claude-officially 等分组继续走插件内置的 HTTP 通道。通道由 Key 所在的分组决定。两种通道都由 DSH 执行工具、审批权限、计划模式、附件和历史，体验一致，CLI 只负责把请求发给 PackyCode。",
+			cliIntro: "cc 分组只接受官方 Claude Code 客户端，所以这些 Key 的 Claude 会话由本机的 Claude Code CLI 直接完成：它用自己的系统提示词和工具，自己读写文件、执行命令。DSH 把每次工具调用显示成卡片；Claude Code 请求授权时，按当前权限预设由你或自动审查决定，计划和提问也交给 DSH 审阅。命令不经过 DSH 的沙箱，DSH 自己的工具（子代理、todo、生图等）在这些会话里不可用。cc-sale、cc-expensive、claude-officially 等分组继续走插件内置的 HTTP 通道，通道由 Key 所在的分组决定。",
 			cliProcesses: "运行中的 CLI 会话 {live} 个 · 已启动 {opened} 次 · 续接 {continued} 次",
 			cliChecking: "正在检测本机的 Claude Code CLI…",
 			cliInstalled: "已安装",
@@ -364,10 +365,11 @@ window.__ModuleLoader__.load({
 			groupsStale: "groups from the last read",
 			keyClaudeCli: "Claude via official CLI",
 			keyClaudeHttp: "Claude via HTTP",
-			keyClaudeCliHint: "Group {groups} only serves the official Claude Code client, so this key's Claude requests are sent by this device's Claude Code CLI.",
+			keyClaudeCliHint: "Group {groups} only serves the official Claude Code client, so this key's Claude sessions are carried out by this device's Claude Code CLI.",
 			keyClaudeHttpHint: "This key's Claude requests use the plugin's built-in HTTP route.",
+			keyClaudeCliUnreadHint: "This key's groups are not read yet, so its Claude sessions go to this device's Claude Code CLI until they are.",
 			cliTitle: "Claude Code CLI",
-			cliIntro: "The cc group only serves the official Claude Code client, so Claude requests on cc keys go through this device's Claude Code CLI; cc-sale, cc-expensive, claude-officially and other groups keep the built-in HTTP route. The key's groups decide the route. Either way DSH runs the tools, permissions, plan mode, attachments and history the same; the CLI only carries the request to PackyCode.",
+			cliIntro: "The cc group only serves the official Claude Code client, so Claude sessions on cc keys are carried out by this device's Claude Code CLI itself, with its own system prompt and tools: it reads and writes files and runs commands. DSH shows each tool call as a card; when Claude Code asks for permission, you or Auto review decide under the session's permission preset, and plans and questions come to DSH for review. Commands run outside DSH's sandbox, and DSH's own tools (subagents, todos, image generation and so on) are not available in these sessions. cc-sale, cc-expensive, claude-officially and other groups keep the built-in HTTP route; the key's groups decide the route.",
 			cliProcesses: "{live} CLI session(s) running · started {opened} · continued {continued}",
 			cliChecking: "Checking this device for the Claude Code CLI…",
 			cliInstalled: "Installed",
@@ -2090,7 +2092,7 @@ window.__ModuleLoader__.load({
 		function ClaudeRoute({ group, t }) {
 			const route = group.claudeTransport;
 			if (route === void 0 || !CLAUDE_MODELS.some((id) => group.coverage?.[id] === true)) return null;
-			const hint = route.transport === "cli" ? fill(t("keyClaudeCliHint"), { groups: (route.groups ?? []).join(" / ") || "cc" }) : t("keyClaudeHttpHint");
+			const hint = route.transport !== "cli" ? t("keyClaudeHttpHint") : route.reason === "unknown" ? t("keyClaudeCliUnreadHint") : fill(t("keyClaudeCliHint"), { groups: (route.groups ?? []).join(" / ") || "cc" });
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 				className: "pkc-groups",
 				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {