dsh-perm-gate 0.2.1-beta.5 → 1.0.0

package/README.md

@@ -12,7 +12,7 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-> **Compatibility note:** v0.2.1-beta.5 ships `ja` / `ko` dictionaries, but official DSH exposes
+> **Compatibility note:** v1.0.0 ships `ja` / `ko` dictionaries, but official DSH exposes
 > only `zh` / `en` through `LocaleRuntime` (`LOCALE_IDS = ["zh", "en"]`). On stock DSH,
 > selecting `ja` / `ko` fails with `locale "<id>" is not registered`. Use a DSH fork that
 > updates `LOCALE_IDS` (locale-settings.ts) and `LOCALES` labels (client/index.ts), then
@@ -37,7 +37,7 @@
 > **private** method of the user-approval service on both, so it is read behind a
 > `typeof` probe and degrades to “policy unknown” when absent or throwing.
 
-Version **0.2.1-beta.5** — see the [Changelog](./CHANGELOG.md).
+Version **1.0.0** — see the [Changelog](./CHANGELOG.md).
 
 A single, self-sufficient, deterministic-first, fail-closed permission gate for DeepSeek Harness.
 
@@ -72,11 +72,10 @@ cross-plugin version coupling.
   malformed rules, and source-hash compile caching.
 - **Audit** — every decision is logged as an `{ignorable:true}` event with its `callId`; the
   model-visible reason matches the recorded outcome.
-- **自动审查 tier** (`permissive`) — an **independent approval mode** (separate from read-only,
-  full-access and whitelist tiers) that is neither "auto-approve" nor blanket trust. Front-end
-  exposes a **single switch** (`permissive`); the four backend strategies are **combinable** and
-  driven by plugin settings — still fail-closed against P0. The permission picker and the
-  settings row both show it under the product label 自动审查, with no icon.
+- **Permissive tier** — an **independent approval mode** (separate from read-only, full-access
+  and whitelist tiers) that is neither "auto-approve" nor blanket trust. Front-end exposes a
+  **single switch** (`permissive`); the four backend strategies are **combinable** and driven
+  by plugin settings — still fail-closed against P0.
 - **Sandbox-escalation auto-answer** (`trustEscalation`) — a sandbox escalation is asked from
   *inside* the shell / pwsh / edit tool body, after `tools/pre-execute`, so the gate never saw
   it and a call it auto-allowed still prompted you to approve the widening. With this strategy
@@ -149,18 +148,12 @@ permissions:
 A command entry `word#flag` matches the command word (`word`) with the modifier `recursive` or
 `force` — so `rm#recursive` matches `rm -rf`, `env rm -rf`, and `sh -c "rm -rf /"`.
 
-## The 自动审查 tier (machine value `permissive`)
+## Permissive mode
 
-自动审查 is an **independent approval tier** in the DSH permission picker, parallel to
-Read Only / Workspace Write / Full access / Whitelist. It is **not** generic "auto-approval" and
-never mints blanket authority: it only narrows or widens the seam *before* the human/LLM step
-while P0 hard-deny stays monotonic and non-negotiable.
-
-The picker label is a **host-supplied product string**, not a per-locale dictionary entry: DSH
-0.1.2 renders a plugin tier's `name:` verbatim on both permission surfaces (the General-settings
-default row and the composer picker) and only supplies its own localized labels for the three
-built-in values, so `cordis.patch.yml` ships the Chinese label for every session. The tier draws
-**no icon** — the composer renders glyphs only for the built-in values.
+Permissive is an **independent approval tier** in the DSH permission picker, parallel to
+Read Only / Workspace Write / Full access / Whitelist. It is **not** "auto-approval" and never
+mints blanket authority: it only narrows or widens the seam *before* the human/LLM step while
+P0 hard-deny stays monotonic and non-negotiable.
 
 In `cordis.yml`:
 
@@ -201,7 +194,7 @@ prompt asking you to approve the sandbox widening.
 the host's `callId`, which the escalation request repeats) and answers the escalation
 `allowed-once` itself. It applies only when *all* hold:
 
-- the 自动审查 tier is on and `trustEscalation` is on;
+- the Permissive tier is on and `trustEscalation` is on;
 - the request carries a `callId` the gate cleared, with a matching tool name;
 - the reason is a recognized escalation naming `workspace-write` or `danger-full-access`.
 
@@ -260,18 +253,18 @@ channel existed), with `tools/result` settling the same ask as a fallback when t
 correlate it. Approvals report the post-approval learning progress (`n`/threshold), and the notice
 strip labels all three terminal states.
 
-The tier draws no icon in the permission picker: the composer's glyphs are keyed to the three
-built-in values, so a plugin-contributed tier is text-only on every surface.
+The Permissive tier keeps its shield icon in the permission picker — on both the
+menu item and the collapsed picker trigger.
 
 ### A selectable session tier
 
 `cordis.patch.yml` adds a `permissive` preset (`sandbox: workspace-write`, `approval: ask`, name
-**自动审查**) between Workspace Write and Full access. The DSH bundle patch replaces the whole
+**Permissive**) between Workspace Write and Full access. The DSH bundle patch replaces the whole
 `permission.config.presets` map rather than merging per key, so the file also restates the three
 built-ins (`read-only` / `workspace-write` / `danger-full-access`, from
 `@deepseek-ai/dsh-base/cordis.patch.yml`); `test/patch-presets.spec.ts` pins that key set. So the
-session permission picker offers 自动审查 as an independent selectable approval tier, not a
-generic "auto-approval" mode.
+session permission picker offers Permissive as an independent selectable approval tier, not an
+"auto-approval" mode.
 
 The gate is active **only in the tiers listed in `gatePresets`** (default `['permissive']`, the
 tier this plugin adds). In every other tier — Read Only, Workspace Write, Full access,
@@ -286,11 +279,11 @@ session's effective approval policy is `never`.
 
 ### Configurable in the UI
 
-The tier is also adjustable at runtime from **Settings → Plugins → 自动审查**
+The tier is also adjustable at runtime from **Settings → Plugins → Permissive approval tier**
 (a `settings.plugins.tab` page rendered by the plugin's browser client): one switch toggles
 `permissive`, and four toggles edit the backend `permissiveStrategies`. The host reads the
 namespace live, so a change applies to the next tool call without a restart. This is an
-independent approval class, NOT a generic "auto-approval" mode.
+independent approval class, NOT the DSH "auto-approval" mode.
 
 ## CLI
 

package/README.zh.md

@@ -12,7 +12,7 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-> **兼容性说明：** v0.2.1-beta.5 自带 `ja` / `ko` 字典，但官方 DSH 的 `LocaleRuntime`
+> **兼容性说明：** v1.0.0 自带 `ja` / `ko` 字典，但官方 DSH 的 `LocaleRuntime`
 > 只暴露 `zh` / `en`（`LOCALE_IDS = ["zh", "en"]`）。在原版 DSH 上选择 `ja` / `ko`
 > 会报 `locale "<id>" is not registered`。请使用更新了 `LOCALE_IDS`
 > （locale-settings.ts）与 `LOCALES` 标签（client/index.ts）的 DSH fork 并重新构建。
@@ -35,7 +35,7 @@
 > 线上都是 user-approval 服务的**私有**方法，因此通过 `typeof` 探测读取，缺失
 > 或抛错时降级为「策略未知」。
 
-版本 **0.2.1-beta.5** —— 变更见 [Changelog](./CHANGELOG.md)。
+版本 **1.0.0** —— 变更见 [Changelog](./CHANGELOG.md)。
 
 一个**单一自足、确定性优先、fail-closed** 的 DeepSeek Harness 权限门插件。
 
@@ -58,7 +58,7 @@
 - **会话放行** — 精确的 `(工具, 规范化 fingerprint)` grant，带 `TTL` + `maxUses`；换目标绝不复用。子代理继承但不可自授。
 - **纯函数规则引擎** — glob/regex 编译 + ReDoS 上限、坏规则 loud fail、按源内容哈希缓存。
 - **审计** — 每次决策写为 `{ignorable:true}` 事件并带 `callId`；模型可见理由与记录一致。
-- **自动审查档位**（机器值 `permissive`）——一个**独立审批模式**（区别于只读、完全权限与白名单档），既不是"自动审批"，也不授予泛化权限。前端只暴露**一个开关**（`permissive`），后台四个审批策略**可组合**、由插件设置决定——仍对 P0 保持 fail-closed。权限下拉框与设置行都按产品名「自动审查」显示，且不带图标。
+- **Permissive 档位** — 一个**独立审批模式**（区别于只读、完全权限与白名单档），既不是"自动审批"，也不授予泛化权限。前端只暴露**一个开关**（`permissive`），后台四个审批策略**可组合**、由插件设置决定——仍对 P0 保持 fail-closed。
 - **沙箱提权自动答复**（`trustEscalation`）— 沙箱提权是从 shell / pwsh / edit 工具**体内部**（`tools/pre-execute` 之后）发出的，所以门禁从未见过它，一个它自动放行的调用仍会弹出确认。开启后，门禁以 `callId` 精确匹配已放行调用并直接答复。
 
 ## 安装
@@ -88,17 +88,12 @@ dsh plugin --profile web add dsh-perm-gate
 
 规则示例：见 [examples/permissions.example.yaml](./examples/permissions.example.yaml)。
 
-## 自动审查档位（机器值 `permissive`）
+## Permissive 档位
 
-自动审查是权限下拉框里一个**独立审批档**，与只读 / 工作区内修改 / 完全权限 / 白名单平行。
-它不是泛化的"自动审批"、也不授予泛化权限：只会在人类/LLM 接缝**之前**收窄或放宽决策，
+Permissive 是权限下拉框里一个**独立审批档**，与 Read Only / Workspace Write / Full access /
+Whitelist 平行。它**不叫"自动审批"**、也不授予泛化权限：只会在人类/LLM 接缝**之前**收窄或放宽决策，
 P0 硬拒绝始终单调且不可协商。
 
-下拉框里的名字是**宿主提供的产品名**，不是逐语言的字典项：DSH 0.1.2 对插件档位在**两个**权限界面上
-（通用设置默认档行、输入栏权限选择器）都原样渲染补丁里的 `name:`，只给三个内置档提供自己的本地化
-标签，因此 `cordis.patch.yml` 直接写中文名，对所有会话一致。该档位**不画图标**——选择器的图标只按
-三个内置值取。
-
 `cordis.yml`：
 
 ```yaml
@@ -134,7 +129,7 @@ LLM 评定为 `safe` 且门禁自动放行的调用因此仍会弹出确认。
 `trustEscalation` 填补这个缺口。门禁记住每个它正面向上放行的调用（以宿主 `callId` 为键，提权
 请求会重复该值），并在本处自行答复 `allowed-once`。它仅在**全部满足**时适用：
 
-- 自动审查档位开启且 `trustEscalation` 开启；
+- Permissive 档位开启且 `trustEscalation` 开启；
 - 请求携带门禁放行的 `callId`，且工具名匹配；
 - 原因为已知的提权，指明 `workspace-write` 或 `danger-full-access`。
 
@@ -146,11 +141,11 @@ LLM 评定为 `safe` 且门禁自动放行的调用因此仍会弹出确认。
 ### 权限下拉里可选档位
 
 `cordis.patch.yml` 在 DSH 的 `permission.config.presets` 里新增了 `permissive` preset
-（`sandbox: workspace-write`、`approval: ask`、名称 **自动审查**），位于工作区内修改与
-完全权限之间。DSH 的 bundle patch 对这个 map 是**整表替换**而非逐键合并，所以该文件还必须重述三个内置档
+（`sandbox: workspace-write`、`approval: ask`、名称 **Permissive**），位于 Workspace Write 与
+Full access 之间。DSH 的 bundle patch 对这个 map 是**整表替换**而非逐键合并，所以该文件还必须重述三个内置档
 （`read-only` / `workspace-write` / `danger-full-access`，取自
 `@deepseek-ai/dsh-base/cordis.patch.yml`）；`test/patch-presets.spec.ts` 固定了这份键集合。因此会话权限
-下拉里会出现「自动审查」这个**独立可选审批档**，而不是"auto-approval"档。
+下拉里会出现 Permissive 这个**独立可选审批档**，而不是"auto-approval"档。
 
 门禁**只在 `gatePresets` 列出的档位里生效**（默认 `['permissive']`，即本插件新增的那一档）。在其余任何档位
 （Read Only、Workspace Write、Full access、`custom`）里，门禁的判定流程**完全不运行**：不放行、不弹审批、
@@ -162,7 +157,7 @@ LLM 评定为 `safe` 且门禁自动放行的调用因此仍会弹出确认。
 
 ### 在 UI 里可配置
 
-该档位也可在运行时从 **设置 → 插件 → 自动审查** 调整（插件浏览器端渲染的
+该档位也可在运行时从 **设置 → 插件 → Permissive 审批档** 调整（插件浏览器端渲染的
 `settings.plugins.tab` 页面）：一个开关切换 `permissive`，四个开关编辑后台
 `permissiveStrategies`。host 端 live 读取该命名空间，改动对下一条工具调用即时生效，无需重启。
 这是一个独立审批类，**不是** DSH 的"auto-approval"档。
@@ -187,7 +182,7 @@ LLM 评定为 `safe` 且门禁自动放行的调用因此仍会弹出确认。
 调用文本命中任一关键词（大小写不敏感子串）即直接拒绝，且先于白名单 / 授权 / LLM。黑名单在设置
 卡片中按列表查看与增删（预置条目带标签，可一键恢复预置）；未设置或为空时应用预置列表——黑名单
 不会静默关闭。
-该档位在权限选择器中**不显示图标**：选择器的图标只按三个内置值取，插件新增的档位是纯文字。
+Permissive 档在权限选择器中保留盾形图标——菜单项与折叠触发按钮均有图标。
 
 
 ## CLI（独立 dry-run）

package/cordis.patch.yml

@@ -1,22 +1,10 @@
 # dsh-perm-gate profile patch.
 #
 # Two jobs:
-# 1) Add the plugin's own "自动审查" session approval tier to the DSH
+# 1) Add the plugin's own "Permissive" session approval tier to the DSH
 #    permission picker, and restate the built-in tiers it must not drop.
 # 2) Insert the plugin itself (host half) into the profile.
 #
-# The tier's DISPLAY NAME is the Chinese product label, matching every official
-# 0.1.2 permission label (仅可查看 / 工作区内修改 / 完全权限) in a zh session. Both
-# permission surfaces — the General-settings default row and the composer
-# picker — render a host-supplied name verbatim unless the value is one of the
-# three built-ins, so a single `name:` string is what both show; neither surface
-# is localized per-dictionary for plugin-contributed tiers. The machine value
-# stays `permissive`: it is the key `gatePresets` matches and the value the
-# permission projection reports, so only the label text is user-facing.
-#
-# The tier carries no icon. The built-in glyphs the composer draws are keyed by
-# the three built-in values, and a plugin tier deliberately has none.
-#
 # The DSH bundle patch REPLACES the whole `permission.config.presets` map (it
 # does not merge per key), so this file MUST restate every tier that should
 # survive. The authoritative built-in set is
@@ -43,8 +31,8 @@
       permissive:
         sandbox: workspace-write
         approval: ask
-        name: 自动审查
-        description: 独立审批档 —— 作用域内安全操作自动放行，危险/未知越界转人工确认（审批强度可在「设置 → 插件 → 自动审查」调整）。
+        name: Permissive
+        description: Independent approval tier — safe in-scope ops auto-allow, dangerous crossings ask (approval strengths tunable under Settings → Plugins → Permissive approval tier).
       danger-full-access:
         sandbox: danger-full-access
         approval: never

package/lib/client.js

@@ -12,9 +12,9 @@ window.__ModuleLoader__.load({
 		const NS = "dsh-perm-gate";
 		/** Simplified Chinese dictionary (the key-set source of truth). */
 		const zh = {
-			"card.title": "自动审查",
-			"card.description": "独立审批档位：与只读 / 完全权限 / 白名单平行，在会话权限下拉中显示为「自动审查」。前端只暴露一个开关；后台四个审批策略可组合、由此处设置决定，仍对 P0 硬拒绝保持 fail-closed。",
-			"card.permissive": "启用自动审查档位",
+			"card.title": "Permissive 审批档",
+			"card.description": "独立审批模式档位：与只读 / 完全权限 / 白名单平行。前端只暴露一个开关；后台三个审批策略可组合、由此处设置决定，仍对 P0 硬拒绝保持 fail-closed。",
+			"card.permissive": "启用 Permissive 档位",
 			"card.permissiveHint": "关闭时门禁行为与此前完全一致。",
 			"card.strategies": "后台审批策略（至少一个生效；可组合）",
 			"card.strategy.trustAutoAllow": "trustAutoAllow — 作用域内安全操作自动放行，危险/未知转 ask（中间档基线）",
@@ -121,9 +121,9 @@ window.__ModuleLoader__.load({
 		};
 		/** English dictionary (keys mirror zh). */
 		const en = {
-			"card.title": "自动审查 (Auto review)",
-			"card.description": "Independent approval tier, parallel to read-only / full-access / whitelist, shown as 自动审查 in the session permission picker. The front-end exposes a single switch; the four backend approval strategies are combinable via this panel and still fail-closed against P0 hard-deny.",
-			"card.permissive": "Enable the 自动审查 tier",
+			"card.title": "Permissive approval tier",
+			"card.description": "Independent approval mode tier, parallel to read-only / full-access / whitelist. The front-end exposes a single switch; the three backend approval strategies are combinable via this panel and still fail-closed against P0 hard-deny.",
+			"card.permissive": "Enable Permissive tier",
 			"card.permissiveHint": "When off, the gate behaves exactly as before.",
 			"card.strategies": "Backend approval strategies (at least one effective; combinable)",
 			"card.strategy.trustAutoAllow": "trustAutoAllow — safe in-scope ops auto-allow; dangerous/unknown ask (baseline middle tier)",
@@ -1417,6 +1417,115 @@ window.__ModuleLoader__.load({
 			});
 		}
 		//#endregion
+		//#region src/client/permission-icon.ts
+		/**
+		* Permission-picker icon decoration for the Permissive tier.
+		*
+		* dsh-auto-mode injects a shield glyph onto its "Auto" permission menu item
+		* via a `data-*` attribute + a CSS mask. This module does the same for the
+		* "Permissive" preset so the two approval tiers look consistent in the
+		* dropdown. It only annotates the item; the preset itself comes from
+		* `cordis.patch.yml` (the `permission.config.presets` table).
+		*
+		* Pure DOM + CSS, no @deepseek-ai value imports (client bundle purity).
+		*/
+		const PLUGIN_ID = "dsh-perm-gate";
+		const ICON_ATTRIBUTE = "data-dsh-perm-gate-icon";
+		/** Labels of the Permissive preset item, current + future localized variants. */
+		const PERMISSIVE_LABELS = /* @__PURE__ */ new Set([
+			"Permissive",
+			"Permissive 审批档",
+			"Permissive 审批档位"
+		]);
+		/** Same shield glyph as dsh-auto-mode so the two approval tiers match visually. */
+		const ICON_SVG = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 16 16\"><path d=\"M8.21.9l6.58 2.47v3.64c0 4.99-3.74 7.2-6.58 8.29C5.36 14.21 1.62 12 1.62 7.01V3.37L8.21.9Z\" fill=\"none\" stroke=\"black\" stroke-width=\"1.32\" stroke-linejoin=\"round\"/><path d=\"M8.75 3.65 5.95 8.2h2.08l-.78 4.15 2.82-4.9H8.12l.63-3.8Z\" fill=\"black\"/></svg>";
+		function iconStyles() {
+			const mask = `url("data:image/svg+xml,${encodeURIComponent(ICON_SVG)}")`;
+			return `
+[${ICON_ATTRIBUTE}]::before {
+  content: "";
+  display: inline-block;
+  flex: 0 0 auto;
+  width: 16px;
+  height: 16px;
+  background-color: var(--dsw-alias-label-tertiary, currentColor);
+  -webkit-mask-image: ${mask};
+  mask-image: ${mask};
+  -webkit-mask-position: center;
+  mask-position: center;
+  -webkit-mask-repeat: no-repeat;
+  mask-repeat: no-repeat;
+  -webkit-mask-size: contain;
+  mask-size: contain;
+}
+[${ICON_ATTRIBUTE}='trigger']::before {
+  width: 14px;
+  height: 14px;
+  margin-right: 6px;
+}
+`;
+		}
+		/** The permission dropdown menu (lists the permission presets as menuitems). */
+		function isPermissionMenu(menu) {
+			return menu.matches("[role=\"menu\"]") && Array.from(menu.querySelectorAll("button[role=\"menuitem\"]")).length >= 4;
+		}
+		/** Whether one menuitem is the Permissive preset. */
+		function isPermissiveMenuItem(element) {
+			if (!element.matches("button[role=\"menuitem\"]")) return false;
+			const label = (element.textContent ?? "").replace(/\s+/g, " ").trim();
+			if (!PERMISSIVE_LABELS.has(label)) return false;
+			return element.closest("[role=\"menu\"]") !== null;
+		}
+		/** The collapsed permission-picker trigger (opens the presets menu). */
+		function isPermissionTrigger(element) {
+			return element.matches("button[aria-haspopup=\"menu\"]") && PERMISSIVE_LABELS.has((element.textContent ?? "").replace(/\s+/g, " ").trim());
+		}
+		/**
+		* Annotate the Permissive permission menuitems with the icon attribute, plus
+		* the collapsed picker trigger when its label names the Permissive preset.
+		* Unknown DOM shapes simply never match, so decoration stays conservative.
+		*/
+		function decorate(document) {
+			for (const marked of document.querySelectorAll(`[${ICON_ATTRIBUTE}]`)) if (!isPermissiveMenuItem(marked) && !isPermissionTrigger(marked)) marked.removeAttribute(ICON_ATTRIBUTE);
+			for (const menu of document.querySelectorAll("[role=\"menu\"]")) {
+				if (!isPermissionMenu(menu)) continue;
+				for (const item of menu.querySelectorAll("button[role=\"menuitem\"]")) if (isPermissiveMenuItem(item)) item.setAttribute(ICON_ATTRIBUTE, "menu");
+			}
+			for (const trigger of document.querySelectorAll("button[aria-haspopup=\"menu\"]")) if (isPermissionTrigger(trigger)) trigger.setAttribute(ICON_ATTRIBUTE, "trigger");
+		}
+		/** Install the Permissive tile icon into the permission picker; returns the disposer. */
+		function installPermissivePermissionIcon(document) {
+			for (const existing of document.querySelectorAll("style[data-plugin]")) if (existing.getAttribute("data-plugin") === PLUGIN_ID) existing.remove();
+			const style = document.createElement("style");
+			style.dataset.plugin = PLUGIN_ID;
+			style.dataset.pluginCss = `${PLUGIN_ID}/permission-icon`;
+			style.textContent = iconStyles();
+			document.head.appendChild(style);
+			let active = true;
+			let queued = false;
+			const scan = () => {
+				if (!active || queued) return;
+				queued = true;
+				queueMicrotask(() => {
+					queued = false;
+					if (active) decorate(document);
+				});
+			};
+			decorate(document);
+			const observer = new MutationObserver(scan);
+			observer.observe(document.documentElement, {
+				childList: true,
+				characterData: true,
+				subtree: true
+			});
+			return () => {
+				active = false;
+				observer.disconnect();
+				for (const marked of document.querySelectorAll(`[${ICON_ATTRIBUTE}]`)) marked.removeAttribute(ICON_ATTRIBUTE);
+				style.remove();
+			};
+		}
+		//#endregion
 		//#region src/client/feed.ts
 		/** Fetch decision events for one session; `since > 0` returns only newer ones. */
 		async function fetchEvents(sessionId, since) {
@@ -1500,7 +1609,7 @@ window.__ModuleLoader__.load({
 			"deny-keyword": "黑名单关键词",
 			default: "默认策略",
 			ask: "默认策略",
-			permissive: "自动审查放行",
+			permissive: "Permissive 放行",
 			classifier: "LLM 裁决",
 			"llm-safe": "LLM 判定安全",
 			"llm-learned": "LLM 学习放行",
@@ -2466,6 +2575,7 @@ window.__ModuleLoader__.load({
 				zh,
 				en
 			}), "dsh-perm-gate: dictionaries");
+			ctx.effect(() => installPermissivePermissionIcon(globalThis.document), "dsh-perm-gate: permission icon");
 			ctx.slots.inject("conversation.input.dock", function* () {
 				yield ctx.slots.register({
 					name: "conversation.input.dock",