dsh-perm-gate 3.0.0 → 4.0.0

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.0] - 2026-09-14
+
+### Changed
+
+- **This branch is the DSH 0.1.5 line: version series `3.x`, `engines.dsh`
+  `>=0.1.5-rc.1 <0.2.0-0`, npm dist-tag `dsh-0.1.5`.** It is a **packaging delta only** —
+  the code is `main`'s, aligned to `main@42dabae`; the major bump is the fence, so a `^2.x`
+  install never resolves `3.x` and vice versa.
+- `dsh.plugin.json` now carries the same version and range as `package.json` (it still said
+  `2.6.0` / `>=0.1.2-alpha.1`), and the README version reference follows.
+- **`3.x` is not on npm yet.** No `3.x` version and no `dsh-0.1.5` dist-tag have been
+  published, so `dsh-perm-gate@dsh-0.1.5` does not resolve; until the release is cut, a
+  `0.1.5-rc.x` host installs this branch directly
+  (`github:drscrewdriver/dsh-perm-gate#sync/0.1.5-from-main`) or takes `@latest`.
+
 ## [2.6.0] - 2026-09-17
 
 ### Added

package/INSTALL.ja.md

@@ -12,13 +12,13 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-`dsh-perm-gate` バージョン **2.6.0**。判定チェーン、ルールファイル形式、自动审查
+`dsh-perm-gate` バージョン **3.0.0**。判定チェーン、ルールファイル形式、自动审查
 ティアについては [日本語 README](./README.ja.md) を参照してください。
 
 ## 必要条件
 
 - [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) がインストール済みであること。
-- Node.js **>= 20**（`package.json` の `engines` を参照）。
+- Node.js **>= 24**（`package.json` の `engines` を参照）。
 - `dsh` CLI が `PATH` に存在すること。
 - インストール先の profile。ブラウザ側は `web` profile 向けにのみビルドされます
   （`package.json` の `dsh.client.platform = "web"`）。
@@ -73,10 +73,10 @@ profile の `cordis.yml` にプラグインを追加します：
     defaultAction: ask              # allow | ask | deny
 ```
 
-2.6.0 から、ルール本体は `dsh-perm-gate-rules` settings 名前空間に保存され、変更の
-たびにゲートがその場で再コンパイルされます。上記の YAML ファイルは任意になりました。
-名前空間が未設定の間だけ読み込まれ、プラグインが最初にルールを書き込む際（許可リスト
-の承認、または設定 UI での編集）にファイルのルールが自動的に取り込まれます。
+ルール本体は `dsh-perm-gate-rules` settings 名前空間に保存され、変更のたびにゲートが
+その場で再コンパイルされます。上記の YAML ファイルは任意です。名前空間が未設定の間
+だけ読み込まれ、プラグインが最初にルールを書き込む際（許可リストの承認、または設定
+UI での編集）にファイルのルールが自動的に取り込まれます。
 
 まずは [examples/permissions.example.yaml](./examples/permissions.example.yaml)
 から始め、profile を再読込してください。

package/INSTALL.ko.md

@@ -12,13 +12,13 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-`dsh-perm-gate` 버전 **2.6.0**. 결정 체인, 규칙 파일 형식, 自动审查 티어는
+`dsh-perm-gate` 버전 **3.0.0**. 결정 체인, 규칙 파일 형식, 自动审查 티어는
 [한국어 README](./README.ko.md)를 참고하세요.
 
 ## 요구 사항
 
 - [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)가 설치되어 있어야 합니다.
-- Node.js **>= 20** (`package.json`의 `engines` 참고).
+- Node.js **>= 24** (`package.json`의 `engines` 참고).
 - `dsh` CLI가 `PATH`에 있어야 합니다.
 - 설치할 profile. 브라우저 절반은 `web` profile용으로만 빌드됩니다
   (`package.json`의 `dsh.client.platform = "web"`).
@@ -74,8 +74,8 @@ profile의 `cordis.yml`에 플러그인을 추가합니다:
     defaultAction: ask              # allow | ask | deny
 ```
 
-2.6.0부터 규칙 본체는 `dsh-perm-gate-rules` settings 네임스페이스에 저장되며, 변경 시
-마다 게이트가 그 자리에서 다시 컴파일됩니다. 위의 YAML 파일은 선택 사항이 되었습니다.
+규칙 본체는 `dsh-perm-gate-rules` settings 네임스페이스에 저장되며, 변경 시마다
+게이트가 그 자리에서 다시 컴파일됩니다. 위의 YAML 파일은 선택 사항입니다.
 네임스페이스가 설정되지 않은 동안에만 읽히며, 플러그인이 처음으로 규칙을 쓸 때(허용
 목록 승인 또는 설정 UI에서의 편집) 파일의 규칙이 자동으로 흡수됩니다.
 

package/INSTALL.md

@@ -12,13 +12,13 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-`dsh-perm-gate` version **2.6.0**. Continue with the [README](./README.md) for the
+`dsh-perm-gate` version **3.0.0**. Continue with the [README](./README.md) for the
 decision chain, the rules file format and the 自动审查 tier.
 
 ## Requirements
 
 - An existing [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) installation.
-- Node.js **>= 20** (see `engines` in `package.json`).
+- Node.js **>= 24** (see `engines` in `package.json`).
 - The `dsh` CLI on your `PATH`.
 - A profile to install into — the browser half only ships for the `web` profile
   (`dsh.client.platform = "web"` in `package.json`).
@@ -75,11 +75,11 @@ Add the plugin to your profile's `cordis.yml`:
     gatePresets: [permissive]       # tiers where the gate is active at all (default)
 ```
 
-Since 2.6.0 the rules themselves are stored in the `dsh-perm-gate-rules` settings
-namespace, and every change recompiles the gate in place. The YAML file above is
-optional: it is only read while the namespace is untouched, and the first rules
-write from the plugin (an allowlist approval, or an edit in the settings UI)
-absorbs the file's rules automatically.
+Rules are stored in the `dsh-perm-gate-rules` settings namespace, and every
+change recompiles the gate in place. The YAML file above is optional: it is only
+read while the namespace is untouched, and the first rules write from the plugin
+(an allowlist approval, or an edit in the settings UI) absorbs the file's rules
+automatically.
 
 Start from [examples/permissions.example.yaml](./examples/permissions.example.yaml),
 then reload the profile.

package/INSTALL.zh.md

@@ -12,13 +12,13 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-`dsh-perm-gate` 版本 **2.6.0**。裁决链、规则文件格式与自动审查档位请见
+`dsh-perm-gate` 版本 **3.0.0**。裁决链、规则文件格式与自动审查档位请见
 [中文 README](./README.zh.md)。
 
 ## 前置条件
 
 - 已安装 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)。
-- Node.js **>= 20**（见 `package.json` 的 `engines`）。
+- Node.js **>= 24**（见 `package.json` 的 `engines`）。
 - `dsh` CLI 已在 `PATH` 中。
 - 需要一个目标 profile —— 浏览器端只为 `web` profile 构建（`package.json`
   里 `dsh.client.platform = "web"`）。
@@ -71,9 +71,9 @@ dsh plugin --profile web add .
     defaultAction: ask              # allow | ask | deny
 ```
 
-自 2.6.0 起，规则本体存储在 `dsh-perm-gate-rules` settings 命名空间中，每次变更都会
-就地重编译闸门。上面的 YAML 文件变为可选：只有命名空间未被配置时才会读取它，插件
-发起的首次规则写入（白名单批准或设置界面编辑）会自动收编文件中的规则。
+规则本体存储在 `dsh-perm-gate-rules` settings 命名空间中，每次变更都会就地重编译
+闸门。上面的 YAML 文件是可选的：只有命名空间未被配置时才会读取它，插件发起的首次
+规则写入（白名单批准或设置界面编辑）会自动收编文件中的规则。
 
 可从 [examples/permissions.example.yaml](./examples/permissions.example.yaml) 起步，
 然后重载 profile。

package/README.ja.md

@@ -27,8 +27,7 @@
 > | DSH バージョン | ブランチ | バージョン | npm タグ |
 > | --- | --- | --- | --- |
 > | 0.1.0-rc.7 ~ 0.1.1-rc.x | `legacy` | `1.x` | `@legacy` |
-> | 0.1.2-alpha.1 ~ 0.1.5-rc.0 | `main` | `2.x` | `@latest` / `@dsh-0.1.2` （`@2.x` は範囲） |
-> | 0.1.5-rc.1+ | `sync/0.1.5-from-main`（=`compat/0.1.5`） | `3.x` | GitHub ref インストール（dist-tag 未公開） |
+> | 0.1.2-alpha.1+（0.1.5-rc.2を含む） | `main` | `2.x` | `@latest` / `@dsh-0.1.2` （`@2.x` は範囲） |
 >
 > バージョン系列は **DSH ライン**を追います（`1.x` = DSH ≤ 0.1.1、`2.x` = DSH 0.1.2+）。
 > メジャー同士が互いを遮断するため、`^1.x` のインストールが `2.x` を解決することは
@@ -46,7 +45,7 @@
 > メソッドであるため、`typeof` プロブで読み取り、欠落時やエラー時には「ポリシー
 > 不明」にフォールバックします。
 
-バージョン **2.6.0** — 変更履歴は [日本語 changelog](./CHANGELOG.ja.md) を参照。
+バージョン **2.4.1** — 変更履歴は [日本語 changelog](./CHANGELOG.ja.md) を参照。
 
 DeepSeek Harness 向けの、単一・自己完結・決定論優先・fail-closed な権限ゲートです。
 

package/README.ko.md

@@ -27,8 +27,7 @@
 > | DSH 버전 | 브랜치 | 버전 | npm 태그 |
 > | --- | --- | --- | --- |
 > | 0.1.0-rc.7 ~ 0.1.1-rc.x | `legacy` | `1.x` | `@legacy` |
-> | 0.1.2-alpha.1 ~ 0.1.5-rc.0 | `main` | `2.x` | `@latest` / `@dsh-0.1.2` (`@2.x`는 범위) |
-> | 0.1.5-rc.1+ | `sync/0.1.5-from-main` (=`compat/0.1.5`) | `3.x` | GitHub ref 설치 (dist-tag 미게시) |
+> | 0.1.2-alpha.1+ (0.1.5-rc.2 포함) | `main` | `2.x` | `@latest` / `@dsh-0.1.2` (`@2.x`는 범위) |
 >
 > 버전 계열은 **DSH 라인**을 따릅니다(`1.x` = DSH ≤ 0.1.1, `2.x` = DSH 0.1.2+). 메이저
 > 버전이 서로를 차단하므로 `^1.x` 설치가 `2.x`를 해석하는 일은 없고 그 반대도
@@ -44,7 +43,7 @@
 > 모두에서 user-approval 서비스의 **개인** 메소드이므로 `typeof` 프로브를 통해
 > 읽으며, 누락되거나 예외 발생 시 "정책_unknown"으로 후퇴합니다.
 
-버전 **2.6.0** — 변경 내역은 [한국어 changelog](./CHANGELOG.ko.md)를 참고하세요.
+버전 **2.4.1** — 변경 내역은 [한국어 changelog](./CHANGELOG.ko.md)를 참고하세요.
 
 DeepSeek Harness용 단일·자족적·결정론 우선·fail-closed 권한 게이트입니다.
 

package/README.md

@@ -26,8 +26,7 @@
 > | DSH version | Branch | Version | npm tag |
 > | --- | --- | --- | --- |
 > | 0.1.0-rc.7 ~ 0.1.1-rc.x | `legacy` | `1.x` | `@legacy` |
-> | 0.1.2-alpha.1 ~ 0.1.5-rc.0 | `main` | `2.x` | `@latest` / `@dsh-0.1.2` (`@2.x` is a range) |
-> | 0.1.5-rc.1+ | `sync/0.1.5-from-main` (=`compat/0.1.5`) | `3.x` | GitHub ref install (no dist-tag yet) |
+> | 0.1.2-alpha.1+ (incl. 0.1.5-rc.2) | `main` | `2.x` | `@latest` / `@dsh-0.1.2` (`@2.x` is a range) |
 >
 > The series number tracks the **DSH line** (`1.x` = DSH ≤ 0.1.1, `2.x` = DSH 0.1.2+),
 > and the majors fence each other: a `^1.x` install never resolves a `2.x` release and
@@ -43,7 +42,7 @@
 > **private** method of the user-approval service on both, so it is read behind a
 > `typeof` probe and degrades to “policy unknown” when absent or throwing.
 
-Version **2.6.0** — see the [Changelog](./CHANGELOG.md).
+Version **3.0.0** — see the [Changelog](./CHANGELOG.md).
 
 A single, self-sufficient, deterministic-first, fail-closed permission gate for DeepSeek Harness.
 

package/README.zh.md

@@ -25,8 +25,7 @@
 > | DSH 版本 | 分支 | 版本号 | npm 标签 |
 > | --- | --- | --- | --- |
 > | 0.1.0-rc.7 ~ 0.1.1-rc.x | `legacy` | `1.x` | `@legacy` |
-> | 0.1.2-alpha.1 ~ 0.1.5-rc.0 | `main` | `2.x` | `@latest` / `@dsh-0.1.2` （`@2.x` 是范围） |
-> | 0.1.5-rc.1+ | `sync/0.1.5-from-main`（=`compat/0.1.5`） | `3.x` | GitHub ref 安装（暂无 dist-tag） |
+> | 0.1.2-alpha.1+（含 0.1.5-rc.2） | `main` | `2.x` | `@latest` / `@dsh-0.1.2` （`@2.x` 是范围） |
 >
 > 版本序列号跟的是 **DSH 线**（`1.x` = DSH ≤ 0.1.1，`2.x` = DSH 0.1.2+），两条大版本互
 > 相隔离：锁在 `^1.x` 的安装绝不会解析到 `2.x`，反之亦然。`engines.dsh` 表达同样的
@@ -40,7 +39,7 @@
 > 线上都是 user-approval 服务的**私有**方法，因此通过 `typeof` 探测读取，缺失
 > 或抛错时降级为「策略未知」。
 
-版本 **2.6.0** —— 变更见 [Changelog](./CHANGELOG.md)。
+版本 **2.4.1** —— 变更见 [Changelog](./CHANGELOG.md)。
 
 一个**单一自足、确定性优先、fail-closed** 的 DeepSeek Harness 权限门插件。
 

package/dsh.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "dsh-perm-gate",
   "name": "dsh-perm-gate",
-  "version": "2.6.0",
+  "version": "3.0.0",
   "description": {
     "en": "Deterministic-first, fail-closed permission gate for DeepSeek Harness 0.1.2+: a P0 hard-deny -> P1 precise session grant -> P2 static allow/deny rule chain -> P3 optional LLM classifier -> P4 ask pipeline over the tools/pre-execute waterfall, with a standalone CLI dry-run evaluator and an auditable decision log. It only vetoes with deny/ask and always delegates otherwise, and unknown or malformed rules fail loud instead of silently standing the gate down.",
     "zh": "面向 DeepSeek Harness 0.1.2+ 的确定性优先、失败即拒的权限闸门：在 tools/pre-execute 瀑布上串起 P0 硬拒绝 → P1 精确会话授权 → P2 静态 allow/deny 规则链 → P3 可选 LLM 语义分类 → P4 ask，并附带独立 CLI 干跑评估器与可审计的决策日志。只以 deny/ask 否决、其余一律放行，规则未知或非法时直接报错，绝不静默失效。"
@@ -13,7 +13,7 @@
   },
   "license": "MIT",
   "engines": {
-    "dsh": ">=0.1.2-alpha.1"
+    "dsh": ">=0.1.5-rc.1 <0.2.0-0"
   },
   "components": {
     "host": "lib/index.js",

package/lib/client.js

@@ -89,8 +89,6 @@ window.__ModuleLoader__.load({
 			"card.llmPresetHost": "DSH 模型组（选择后自动切换为会话模式）",
 			"card.networkEnabled": "网络拦截（networkEnabled）",
 			"card.networkEnabledHint": "开启后启动本地代理拦截子进程出站连接，按规则放行/阻断。关闭则零行为变更。",
-			"card.watch": "规则热重载（watch）",
-			"card.watchHint": "开启后自动监听规则文件变更并即时生效，无需手动 reload。",
 			"card.networkRebindNote": "切换后立即生效（自动重绑，无需重载插件）。",
 			"card.networkInjectEnv": "注入代理环境变量（networkInjectEnv）",
 			"card.networkInjectEnvHint": "开启后为子进程写入 HTTP(S)_PROXY / ALL_PROXY（并清空 NO_PROXY）。关闭则只启动监听、不改变任何进程环境。",
@@ -241,8 +239,6 @@ window.__ModuleLoader__.load({
 			"card.llmPresetHost": "DSH model groups (selecting one switches to the session receiver)",
 			"card.networkEnabled": "Network interception (networkEnabled)",
 			"card.networkEnabledHint": "When on, starts a local proxy that intercepts outbound subprocess connections and applies allow/deny rules. Off = zero behavior change.",
-			"card.watch": "Rule hot-reload (watch)",
-			"card.watchHint": "When on, automatically watches rule files for changes and applies them instantly without manual reload.",
 			"card.networkRebindNote": "Takes effect immediately — the proxy rebinds automatically, no plugin reload needed.",
 			"card.networkInjectEnv": "Inject proxy environment (networkInjectEnv)",
 			"card.networkInjectEnvHint": "Writes HTTP(S)_PROXY / ALL_PROXY for subprocesses (and clears NO_PROXY). Off = the listener runs but no process environment is changed.",
@@ -405,7 +401,6 @@ window.__ModuleLoader__.load({
 		* learning.json store the gate reads); actions POST back. Best-effort: a
 		* missing route renders the empty state, never an error.
 		*/
-		const POLL_MS$2 = 5e3;
 		const itemStyle = {
 			display: "flex",
 			alignItems: "center",
@@ -435,6 +430,8 @@ window.__ModuleLoader__.load({
 		};
 		function SedimentSection({ t }) {
 			const [body, setBody] = (0, react.useState)(null);
+			/** Latest loader, so a mutation can refresh the list without owning the fetch. */
+			const reloadRef = (0, react.useRef)(() => {});
 			(0, react.useEffect)(() => {
 				let alive = true;
 				const load = () => {
@@ -444,11 +441,18 @@ window.__ModuleLoader__.load({
 						if (alive) setBody({});
 					});
 				};
+				reloadRef.current = load;
 				load();
-				const timer = setInterval(load, POLL_MS$2);
+				const onVisible = () => {
+					if (document.visibilityState === "visible") load();
+				};
+				window.addEventListener("focus", onVisible);
+				document.addEventListener("visibilitychange", onVisible);
 				return () => {
 					alive = false;
-					clearInterval(timer);
+					reloadRef.current = () => {};
+					window.removeEventListener("focus", onVisible);
+					document.removeEventListener("visibilitychange", onVisible);
 				};
 			}, []);
 			const post = (payload) => {
@@ -456,6 +460,8 @@ window.__ModuleLoader__.load({
 					method: "POST",
 					headers: { "content-type": "application/json" },
 					body: JSON.stringify(payload)
+				}).then(() => {
+					reloadRef.current();
 				}).catch(() => {});
 			};
 			const threshold = body?.threshold ?? 3;
@@ -1923,7 +1929,7 @@ window.__ModuleLoader__.load({
 								})
 							]
 						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+						value.networkEnabled === true ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 							style: sectionStyle,
 							children: [
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
@@ -1954,39 +1960,7 @@ window.__ModuleLoader__.load({
 									})]
 								})
 							]
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
-							style: sectionStyle,
-							children: [
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-									style: labelStyle,
-									children: t("card.watch")
-								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-									style: hintStyle,
-									children: t("card.watchHint")
-								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-									style: {
-										display: "flex",
-										alignItems: "center",
-										gap: "8px",
-										marginTop: "6px"
-									},
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-										type: "checkbox",
-										checked: value.watch !== false,
-										disabled: readonly,
-										onChange: (event) => {
-											scope.set("watch", event.currentTarget.checked);
-										}
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										style: { fontSize: "13px" },
-										children: value.watch !== false ? "ON" : "OFF"
-									})]
-								})
-							]
-						}),
+						}) : null,
 						!snapshot.writable && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 							style: {
 								margin: "8px 0 0",
@@ -2009,6 +1983,95 @@ window.__ModuleLoader__.load({
 			const body = await res.json();
 			return Array.isArray(body.events) ? body.events : [];
 		}
+		/** The host's push route (see src/events.ts); the browser half prefers it to polling. */
+		const STREAM_ROUTE = "/api/dsh-perm-gate/stream";
+		/** Stream attempts before the route is written off as unsupported and polling takes over. */
+		const STREAM_RETRIES = 3;
+		const STREAM_RETRY_MS = 3e3;
+		/**
+		* Degraded path only: a host predating the stream route still gets a servable
+		* strip. Deliberately slower than the old 2 s tick — it now also pauses while
+		* the tab is hidden, so a backgrounded page costs nothing.
+		*/
+		const FALLBACK_POLL_MS = 5e3;
+		/**
+		* Follow one session's decision feed until the returned close is called.
+		*
+		* Prefers the host's `text/event-stream` route, which pushes each decision as
+		* the gate appends it — no timer, no repeated re-read of the event log. When
+		* the stream is unavailable (an older host, a proxy that buffers it) this
+		* degrades to polling the JSON route, gated on page visibility.
+		*
+		* @param sessionId - the session whose decisions to follow.
+		* @param getSince - cursor supplier, read at connect and on every fallback poll.
+		* @param onBatch - receives the backlog, then live batches.
+		* @returns the close: ends the stream and any fallback timer.
+		*/
+		function followEvents(sessionId, getSince, onBatch) {
+			let closed = false;
+			let source = null;
+			let pollTimer = null;
+			let retries = 0;
+			let polls = 0;
+			const stopPolling = () => {
+				if (pollTimer === null) return;
+				clearInterval(pollTimer);
+				pollTimer = null;
+			};
+			const poll = () => {
+				if (closed) return;
+				if (typeof document !== "undefined" && document.visibilityState === "hidden") return;
+				const backlog = polls === 0;
+				polls += 1;
+				fetchEvents(sessionId, getSince()).then((events) => {
+					if (!closed) onBatch({
+						events,
+						backlog
+					});
+				}).catch(() => {});
+			};
+			const startPolling = () => {
+				if (closed || pollTimer !== null) return;
+				polls = 0;
+				poll();
+				pollTimer = setInterval(poll, FALLBACK_POLL_MS);
+			};
+			const connect = () => {
+				if (closed) return;
+				const query = `?sessionId=${encodeURIComponent(sessionId)}&since=${getSince()}`;
+				const next = new EventSource(`${STREAM_ROUTE}${query}`);
+				source = next;
+				next.onopen = () => {
+					retries = 0;
+					stopPolling();
+				};
+				next.onmessage = (message) => {
+					try {
+						const body = JSON.parse(message.data);
+						if (Array.isArray(body.events)) onBatch({
+							events: body.events,
+							backlog: body.backlog === true
+						});
+					} catch {}
+				};
+				next.onerror = () => {
+					if (source === next) source = null;
+					next.close();
+					if (closed) return;
+					retries += 1;
+					startPolling();
+					if (retries <= STREAM_RETRIES) setTimeout(connect, STREAM_RETRY_MS);
+				};
+			};
+			if (typeof EventSource === "undefined") startPolling();
+			else connect();
+			return () => {
+				closed = true;
+				source?.close();
+				source = null;
+				stopPolling();
+			};
+		}
 		/** Resolve the current session id from slot props (top level, nested, or hook). */
 		function resolveSessionId(props) {
 			const direct = props?.sessionId;
@@ -2195,15 +2258,15 @@ window.__ModuleLoader__.load({
 		* dsh-perm-gate (a simplified version of the review-feed pattern demonstrated
 		* by dsh-approval-gate).
 		*
-		* Polls the host's `GET /api/dsh-perm-gate/events?sessionId=&since=` feed every
-		* 2 s and shows the latest decision above the conversation input: auto-allows
-		* (green) and denies (red) auto-dismiss after a few seconds; an ask (amber)
-		* stays until the next event because it needs the human's attention.
+		* Follows the host's decision feed (`GET /api/dsh-perm-gate/stream`, an SSE
+		* push; see `followEvents` for the older-host polling fallback) and shows the
+		* latest decision above the conversation input: auto-allows (green) and denies
+		* (red) auto-dismiss after a few seconds; an ask (amber) stays until the next
+		* event because it needs the human's attention.
 		*
 		* Everything is best-effort: no session id, a missing route, or any fetch
 		* failure simply means "render nothing". No @deepseek-ai value imports.
 		*/
-		const POLL_MS$1 = 2e3;
 		const AUTO_HIDE_MS = 4e3;
 		/** Localized tag for a manual terminal state; other kinds keep their short tag. */
 		function manualTagKey(kind) {
@@ -2224,35 +2287,27 @@ window.__ModuleLoader__.load({
 				setNotice(null);
 				if (sessionId === null) return;
 				let alive = true;
-				let timer = null;
-				const startPolling = () => {
-					if (!alive) return;
-					timer = setInterval(() => {
-						fetchEvents(sessionId, sinceRef.current).then((events) => {
-							if (!alive || events.length === 0) return;
-							const last = events[events.length - 1];
-							if (last === void 0 || last.id <= shownIdRef.current) return;
-							shownIdRef.current = last.id;
-							sinceRef.current = last.id;
-							setNotice(last);
-							if (hideTimerRef.current !== null) clearTimeout(hideTimerRef.current);
-							if (!presentation(last.kind).sticky) hideTimerRef.current = setTimeout(() => {
-								setNotice(null);
-							}, AUTO_HIDE_MS);
-						}).catch(() => {});
-					}, POLL_MS$1);
-				};
-				fetchEvents(sessionId, 0).then((events) => {
-					if (!alive) return;
-					if (events.length > 0) {
-						sinceRef.current = events[events.length - 1]?.id ?? 0;
+				const onBatch = (batch) => {
+					if (!alive || batch.events.length === 0) return;
+					const last = batch.events[batch.events.length - 1];
+					if (last === void 0) return;
+					if (last.id > sinceRef.current) sinceRef.current = last.id;
+					if (batch.backlog) {
 						shownIdRef.current = sinceRef.current;
+						return;
 					}
-					startPolling();
-				}).catch(startPolling);
+					if (last.id <= shownIdRef.current) return;
+					shownIdRef.current = last.id;
+					setNotice(last);
+					if (hideTimerRef.current !== null) clearTimeout(hideTimerRef.current);
+					if (!presentation(last.kind).sticky) hideTimerRef.current = setTimeout(() => {
+						setNotice(null);
+					}, AUTO_HIDE_MS);
+				};
+				const close = followEvents(sessionId, () => sinceRef.current, onBatch);
 				return () => {
 					alive = false;
-					if (timer !== null) clearInterval(timer);
+					close();
 					if (hideTimerRef.current !== null) clearTimeout(hideTimerRef.current);
 				};
 			}, [sessionId]);
@@ -2335,7 +2390,8 @@ window.__ModuleLoader__.load({
 		* Approval-history view — the `conversation.view` face of dsh-perm-gate,
 		* following the session-scoped review-page pattern demonstrated by
 		* dsh-approval-gate: a timeline of every gate decision in the current
-		* conversation, newest first, refreshed by polling.
+		* conversation, newest first, loaded once and then extended by the host's push
+		* feed (see `followEvents`).
 		*
 		* Beyond the decision timeline this view owns the review data plane: a snapshot
 		* inventory bar (with session/all clearing), per-event file chips, and a diff
@@ -2347,7 +2403,6 @@ window.__ModuleLoader__.load({
 		* routes. Everything is best-effort: no session id or any fetch failure renders
 		* the empty / error state. No @deepseek-ai value imports.
 		*/
-		const POLL_MS = 5e3;
 		/** Tag text per event kind, keyed into the plugin dictionary. */
 		const TAG_KEYS = {
 			auto: "history.tag.auto",
@@ -2761,29 +2816,47 @@ window.__ModuleLoader__.load({
 				setEvents(null);
 				setError(null);
 				setStats(null);
+				if (sessionId === null) {
+					setEvents([]);
+					return;
+				}
 				let alive = true;
-				const load = () => {
+				let cursor = 0;
+				let closeStream = null;
+				fetchSnapshotStats(sessionId).then((next) => {
+					if (alive) setStats(next);
+				});
+				/**
+				* Decisions landing after the initial load. Both the stream's pushes and the
+				* fallback's ticks carry only events past the cursor, so they merge the same
+				* way; a batch is also the point where the snapshot inventory can have grown.
+				*/
+				const onBatch = (batch) => {
+					if (!alive || batch.events.length === 0) return;
+					for (const ev of batch.events) if (ev.id > cursor) cursor = ev.id;
+					setEvents((current) => {
+						const known = new Set((current ?? []).map((ev) => ev.id));
+						const added = batch.events.filter((ev) => !known.has(ev.id));
+						return added.length === 0 ? current : [...added, ...current ?? []].sort((a, b) => b.id - a.id);
+					});
+					setError(null);
 					fetchSnapshotStats(sessionId).then((next) => {
 						if (alive) setStats(next);
 					});
-					if (sessionId === null) {
-						setEvents([]);
-						return;
-					}
-					fetchEvents(sessionId, 0).then((loaded) => {
-						if (!alive) return;
-						setEvents([...loaded].sort((a, b) => b.id - a.id));
-						setError(null);
-					}).catch((e) => {
-						if (!alive) return;
-						setError(String(e?.message ?? e));
-					});
 				};
-				load();
-				const timer = setInterval(load, POLL_MS);
+				fetchEvents(sessionId, 0).then((loaded) => {
+					if (!alive) return;
+					setEvents([...loaded].sort((a, b) => b.id - a.id));
+					setError(null);
+					cursor = loaded.reduce((max, ev) => ev.id > max ? ev.id : max, 0);
+				}).catch((e) => {
+					if (alive) setError(String(e?.message ?? e));
+				}).finally(() => {
+					if (alive) closeStream = followEvents(sessionId, () => cursor, onBatch);
+				});
 				return () => {
 					alive = false;
-					clearInterval(timer);
+					closeStream?.();
 				};
 			}, [sessionId]);
 			/** Whether one event has a snapshot covering this file (chip is clickable). */