dsh-perm-gate 4.1.1 → 4.1.2

package/CHANGELOG.ja.md

@@ -5,6 +5,32 @@
 形式は [Keep a Changelog](https://keepachangelog.com/ja/1.1.0/) に従い、
 このプロジェクトは [Semantic Versioning](https://semver.org/spec/v2.0.0.html) に準拠します。
 
+## [4.1.2] - 2026-09-25
+
+### 修正
+
+- **入力欄グリフのパッチが DSH 0.1.5 で再び機能します。** `scripts/patch-permission-glyph.mjs`
+  は `["permissive",` の直後にエントリを挿入していましたが、そのキーは DSH 0.1.2 がグリフを
+  描いていた値で、0.1.5-rc.2 のバンドルにはどこにも存在しません。そのためパッチは
+  `anchor not found` で失敗し、両ティアはテキストのみのままでした。取得元はティアごとに
+  `GLYPH_TARGETS` で宣言し、アンカーは**解決**します —— まず `["<key>",`、次にバンドルが使う
+  定数別名（`danger-full-access` は `[FULL_ACCESS,`）。ホストが描かないキーは、Map が実際に
+  持つキーと一緒に報告されます。
+- **UI を提供していない DSH インストールにパッチを当てなくなりました。** 候補は profile
+  スコープを先、CLI インストールを次に並べ、同じバンドルを持つ**他の**インストールは黙って
+  見送らず出力に列挙します。このプロジェクトのホストで実測：グローバル CLI インストールが
+  ランチャー管理のランタイムを隠していたため、パッチは成功と報告しつつピッカーは
+  アイコンなしのままでした。
+
+### 変更
+
+- **各ティアは、共有するファイルサンドボックスのグリフを付けます（共通の盾＋目ではなく）。**
+  「自动审查」は `workspace-write` のグリフを、「自动审查（高权限）」は `danger-full-access` の
+  グリフをコピーするため、アイコンはそのティアが実際に与えるアクセスと一致します。同一アイコンの
+  旧挙動は、`permissive` のグリフを持っていた 0.1.2 の Map に由来します。
+- **2 つのグリフは両方適用するか、両方とも適用しません。** 解決できない取得元キーは何も書かない
+  拒否であり、部分的にパッチされたバンドルにはなりません。
+
 ## [2.4.1] - 2026-09-17
 
 ### 修正

package/CHANGELOG.ko.md

@@ -5,6 +5,30 @@
 형식은 [Keep a Changelog](https://keepachangelog.com/ko/1.1.0/)을 따르며,
 이 프로젝트는 [Semantic Versioning](https://semver.org/spec/v2.0.0.html)을 준수합니다.
 
+## [4.1.2] - 2026-09-25
+
+### 수정됨
+
+- **입력창 글리프 패치가 DSH 0.1.5에서 다시 동작합니다.** `scripts/patch-permission-glyph.mjs`는
+  `["permissive",` 뒤에 항목을 끼워 넣었지만, 그 키는 DSH 0.1.2가 글리프를 그리던 값이고
+  0.1.5-rc.2 번들에는 어디에도 없습니다. 그래서 패치는 `anchor not found`로 실패했고 두 티어는
+  텍스트만 표시했습니다. 이제 원본은 티어별로 `GLYPH_TARGETS`에 선언하고, 앵커는 **해석**합니다
+  —— 먼저 `["<key>",`, 다음으로 번들이 쓰는 상수 별칭(`danger-full-access`는 `[FULL_ACCESS,`).
+  호스트가 그리지 않는 키는 Map이 실제로 가진 키와 함께 보고됩니다.
+- **UI를 제공하지 않는 DSH 설치에는 더 이상 패치하지 않습니다.** 후보는 profile 스코프를
+  먼저, CLI 설치를 다음으로 정렬하고, 같은 번들을 가진 **다른** 설치는 조용히 넘기지 않고
+  출력에 나열합니다. 이 프로젝트의 호스트에서 실측: 전역 CLI 설치가 런처가 관리하는
+  런타임을 가려서, 패치는 성공을 보고했지만 선택기는 아이콘 없이 남아 있었습니다.
+
+### 변경됨
+
+- **각 티어는 공유하는 파일 샌드박스의 글리프를 답니다(공통 방패+눈이 아니라).** 「自动审查」는
+  `workspace-write` 글리프를, 「自动审查（高权限）」는 `danger-full-access` 글리프를 복사하므로
+  아이콘이 그 티어가 실제로 부여하는 접근 권한과 일치합니다. 동일 아이콘 쌍은 `permissive`
+  글리프를 갖고 있던 0.1.2의 Map에서 온 동작입니다.
+- **두 글리프는 모두 적용되거나 모두 적용되지 않습니다.** 해석할 수 없는 원본 키는 아무것도 쓰지
+  않는 거부이며, 일부만 패치된 번들이 되지 않습니다.
+
 ## [2.4.1] - 2026-09-17
 
 ### 수정됨

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.1.2] - 2026-09-25
+
+### Fixed
+
+- **The composer glyph patch works on DSH 0.1.5 again.** `scripts/patch-permission-glyph.mjs`
+  spliced its entry after `["permissive",` — a key DSH 0.1.2 rendered a glyph for and 0.1.5-rc.2
+  no longer contains anywhere in the bundle — so the patch died with `anchor not found` and both
+  plugin tiers stayed text-only. The sources are now declared per tier in `GLYPH_TARGETS` and each
+  anchor is **resolved**: `["<key>",` first, then the constant alias the bundle uses instead
+  (`danger-full-access` is keyed `[FULL_ACCESS,`). A source key this host does not render is
+  reported together with the keys the map does carry.
+- **The probe no longer patches a DSH install that is not serving the UI.** Candidate bundles are
+  ordered profile scope first, CLI install second, and any *other* install carrying the same
+  bundle is listed in the output instead of being silently passed over. Measured on this
+  project's own host: a global CLI install shadowed the launcher-managed runtime, so the patch
+  reported success while the picker stayed icon-free.
+
+### Changed
+
+- **Each tier wears the glyph of the file sandbox it shares, not one shared shield+eye.** 自动审查
+  copies the `workspace-write` glyph and 自动审查（高权限） the `danger-full-access` one, so the icon
+  matches the access the tier actually grants. The old identical-icon pair came from 0.1.2, whose
+  map still keyed a `permissive` glyph that 0.1.5 dropped.
+- **Both glyphs are applied, or neither.** A source key the script cannot resolve is a refusal that
+  writes nothing, rather than a half-patched bundle.
+
 ## [2.6.0] - 2026-09-17
 
 ### Added

package/INSTALL.ja.md

@@ -12,7 +12,7 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-`dsh-perm-gate` バージョン **2.4.1**。判定チェーン、ルールファイル形式、自动审查
+`dsh-perm-gate` バージョン **4.1.2**。判定チェーン、ルールファイル形式、自动审查
 ティアについては [日本語 README](./README.ja.md) を参照してください。
 
 ## 必要条件
@@ -89,13 +89,21 @@ dsh profile reload --profile web
 
 ## **DSH** アップグレード後：入力欄アイコンのパッチを再適用
 
-「自动审查（高权限）」が「自动审查」と同じ盾＋目のアイコンを表示するのは、
+「自动审查」と「自动审查（高权限）」の 2 つのティアにアイコンが付くのは、
 `scripts/patch-permission-glyph.mjs` が **DSH ホストパッケージ内の閉じた Map** に
-その項目を追加したからにすぎません。DSH はプラグイン提供ティアに**設計上アイコンを
-与えません** —— その Map 自身のコメントが *"host-configured names outside the design
-set get none"* と述べています。プラグインが影響できる option オブジェクトは
-`{value, name, description}` しか運ばないため、代わりに使えるプラグイン側のシームは
-存在しません。
+それらを追加したからにすぎません ——「自动审查」は `workspace-write` の盾＋鉛筆を、
+「自动审查（高权限）」は `danger-full-access` の盾＋感嘆符をコピーしており、それぞれが
+実際に共有するファイルサンドボックスのグリフになります。DSH はプラグイン提供ティアに
+**設計上アイコンを与えません** —— その Map 自身のコメントが *"host-configured names
+outside the design set get none"* と述べています。プラグインが影響できる option
+オブジェクトは `{value, name, description}` しか運ばないため、代わりに使えるプラグイン側の
+シームは存在しません。
+
+スクリプトは取得元のキーを**解決**します（`["<key>",` を先に、次にホストが使う定数別名 ——
+0.1.5 の `danger-full-access` は `[FULL_ACCESS,`）。DSH はこの設計セットを一度変更して
+います —— 0.1.2 には `permissive` のグリフがあり、0.1.5 には `read-only` /
+`workspace-write` / `danger-full-access` しかありません。解決できないキーは、Map が実際に
+持つキーと一緒に報告されるため、ティアの付け替えは `GLYPH_TARGETS` の 1 行で済みます。
 
 このパッチは**ホスト**のファイルを書き換えるので、**DSH のアップグレードや再インストールで
 失われます**。*本プラグイン*のアップグレードでは失われません。アイコンは元々プラグインの
@@ -114,11 +122,15 @@ dsh profile reload --profile web
 プラグインが許可なく自分の harness を書き換えてよい理由はありません。適用の有無にかかわらず
 DSH の動作に影響はなく、ティア自体はそのまま機能します。
 
-このスクリプトは冪等（2 回目は no-op）で、バックアップは 1 度だけ取り、壊れたスライスを
-書き込もうとしません —— 結果に対して `node --check` を実行し、失敗すればバックアップを
-復元します —— したがって DSH アップグレードのたびに無条件で再実行して安全です。
-実行中の `node` バイナリからパッケージを逆算するため、nvm のバージョン変更や
-インストール symlink の貼り替えでも壊れません。
+このスクリプトは冪等（2 回目は no-op）で、バックアップは 1 度だけ取り、2 つのグリフは
+両方適用するか両方とも適用しないか（解決できない取得元キーは拒否であり、部分適用では
+ありません）のいずれかで、壊れたスライスを書き込もうとしません —— 結果に対して
+`node --check` を実行し、失敗すればバックアップを復元します —— したがって DSH
+アップグレードのたびに無条件で再実行して安全です。
+呼び出し元の profile スコープを先に、CLI インストールを次に探すため、nvm のバージョン
+変更やインストール symlink の貼り替えでも壊れません。マシンに複数の DSH インストールが
+ある場合、**パッチを当てなかった**方は出力に列挙されます —— 目の前の UI を提供している
+のはそのうち 1 つだけなので、必要ならそのパスを引数で明示してください。
 
 **プラグインを再インストールしてもアイコンは戻りません。**
 `dsh plugin --profile web add …` は profile ディレクトリ内の pnpm に引数を転送し、
@@ -194,10 +206,12 @@ DSH の bundle patch は `permission.config.presets` を key 単位でマージ
 します。profile を再読込して `cordis.patch.yml` を再適用し、後から読み込まれる
 プラグインが `presets` を上書きしていないか確認してください。
 
-**「自动审查（高权限）」の入力欄アイコンが消えた。**
+**「自动审查」ティアの入力欄アイコンが消えた。**
 DSH のアップグレードまたは再インストールが、パッチを当てたホスト bundle を置き換え
 ました。プラグインを再インストールしても戻りません。
-`npx dsh-perm-gate-patch-glyph` を実行して再読込してください。
+`npx dsh-perm-gate-patch-glyph` を実行して再読込してください。取得元キーが無いと
+報告された場合は DSH がグリフ表を再度変更しています —— エラーが現在のキー一覧を
+示すので、`GLYPH_TARGETS` の該当ティアを付け替えてください。
 ティア自体は影響を受けません —— パッチなしでもラベルとゲートは動作します。
 
 **ルールファイルがあるのに `--list` が `ruleCount: 0` を返す。**

package/INSTALL.ko.md

@@ -12,7 +12,7 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-`dsh-perm-gate` 버전 **2.4.1**. 결정 체인, 규칙 파일 형식, 自动审查 티어는
+`dsh-perm-gate` 버전 **4.1.2**. 결정 체인, 규칙 파일 형식, 自动审查 티어는
 [한국어 README](./README.ko.md)를 참고하세요.
 
 ## 요구 사항
@@ -90,13 +90,21 @@ dsh profile reload --profile web
 
 ## **DSH** 업그레이드 후: 입력창 아이콘 패치 재적용
 
-「自动审查（高权限）」가 「自动审查」와 같은 방패+눈 아이콘을 보여 주는 것은
-`scripts/patch-permission-glyph.mjs`가 **DSH 호스트 패키지 안의 닫힌 Map**에 그 항목을
-추가했기 때문일 뿐입니다. DSH는 플러그인이 제공한 티어에 **설계상 아이콘을 주지
+「自动审查」와「自动审查（高权限）」두 티어에 아이콘이 붙는 것은
+`scripts/patch-permission-glyph.mjs`가 **DSH 호스트 패키지 안의 닫힌 Map**에 두 항목을
+추가했기 때문입니다 ——「自动审查」는 `workspace-write`의 방패+연필을,
+「自动审查（高权限）」는 `danger-full-access`의 방패+느낌표를 복사해 각자가 실제로 공유하는
+파일 샌드박스의 글리프를 갖습니다. DSH는 플러그인이 제공한 티어에 **설계상 아이콘을 주지
 않습니다** —— 그 Map 자체의 주석이 *"host-configured names outside the design set get
 none"*이라고 말합니다. 플러그인이 영향을 줄 수 있는 option 객체는
 `{value, name, description}`만 나르므로, 대신 쓸 수 있는 플러그인 측 이음새가 없습니다.
 
+스크립트는 원본 키를 **해석**합니다(`["<key>",`를 먼저, 다음으로 호스트가 쓰는 상수 별칭 ——
+0.1.5의 `danger-full-access`는 `[FULL_ACCESS,`). DSH는 이 설계 집합을 이미 한 번 바꿨습니다 ——
+0.1.2에는 `permissive` 글리프가 있었고 0.1.5에는 `read-only` / `workspace-write` /
+`danger-full-access`만 있습니다. 해석할 수 없는 키는 Map이 실제로 가진 키와 함께 보고되므로
+티어 교체는 `GLYPH_TARGETS` 한 줄이면 됩니다.
+
 이 패치는 **호스트** 파일을 고치므로 **DSH 업그레이드나 재설치에서 사라집니다**.
 *이 플러그인*을 업그레이드할 때는 사라지지 않습니다. 아이콘은 애초에 플러그인 소유가
 아니었고, 플러그인 자신의 기여(`cordis.patch.yml`의 `name:` / `description:`)는
@@ -114,10 +122,13 @@ dsh profile reload --profile web
 플러그인이 허락 없이 자신이 설치된 harness를 다시 쓸 이유는 없습니다. 적용 여부와 무관하게
 DSH 동작에는 영향이 없고 티어 자체는 그대로 기능합니다.
 
-이 스크립트는 멱등이며(두 번째 실행은 no-op), 백업은 한 번만 뜨고, 잘못 잘린 조각을
-쓰지 않습니다 —— 결과에 `node --check`를 돌려 실패하면 백업을 복원합니다 —— 따라서
-DSH 업그레이드 때마다 무조건 다시 실행해도 안전합니다. 실행 중인 `node` 바이너리에서
-패키지를 역산하므로 nvm 버전 변경이나 설치 symlink 재지정에도 깨지지 않습니다.
+이 스크립트는 멱등이며(두 번째 실행은 no-op), 백업은 한 번만 뜨고, 두 글리프를 모두
+적용하거나 모두 적용하지 않으며(해석할 수 없는 원본 키는 거부이지 부분 적용이 아닙니다),
+잘못 잘린 조각을 쓰지 않습니다 —— 결과에 `node --check`를 돌려 실패하면 백업을 복원합니다
+—— 따라서 DSH 업그레이드 때마다 무조건 다시 실행해도 안전합니다. 호출자의 profile 스코프를 먼저, CLI 설치를 다음으로 탐색하므로 nvm 버전 변경이나 설치
+symlink 재지정에도 깨지지 않습니다. 머신에 DSH 설치가 여러 개면 **패치하지 않은** 쪽이
+출력에 나열됩니다 —— 눈앞의 UI를 제공하는 것은 그중 하나뿐이므로, 필요하면 그 경로를
+인수로 명시하세요.
 
 **플러그인을 재설치해도 아이콘은 돌아오지 않습니다.**
 `dsh plugin --profile web add …`는 profile 디렉터리 안의 pnpm으로 인자를 넘기고
@@ -190,11 +201,12 @@ DSH 번들 패치는 `permission.config.presets`를 key 단위로 병합하지
 합니다. profile을 다시 불러와 `cordis.patch.yml`을 재적용하고, 더 늦게 로드되는
 플러그인이 `presets`를 덮어쓰지 않는지 확인하세요.
 
-**「自动审查（高权限）」의 입력창 아이콘이 사라졌습니다.**
+**「自动审查」티어의 입력창 아이콘이 사라졌습니다.**
 DSH 업그레이드나 재설치가 패치해 둔 호스트 번들을 교체했습니다. 플러그인을
 재설치해도 되돌아오지 않습니다. `npx dsh-perm-gate-patch-glyph`를 실행하고
-다시 불러오세요. 티어 자체는 영향받지 않습니다 —— 패치가 없어도 라벨과 게이트는
-정상 동작합니다.
+다시 불러오세요. 원본 키가 없다고 보고되면 DSH가 글리프 표를 다시 바꾼 것입니다 ——
+오류가 현재 키 목록을 알려 주므로 `GLYPH_TARGETS`에서 해당 티어를 다시 지정하세요.
+티어 자체는 영향받지 않습니다 —— 패치가 없어도 라벨과 게이트는 정상 동작합니다.
 
 **규칙 파일이 있는데 `--list`가 `ruleCount: 0`을 표시합니다.**
 `rulesFile`은 플러그인 디렉터리가 아니라 Harness 프로세스의 CWD에서 해석됩니다.

package/INSTALL.md

@@ -12,7 +12,7 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-`dsh-perm-gate` version **2.4.1**. Continue with the [README](./README.md) for the
+`dsh-perm-gate` version **4.1.2**. Continue with the [README](./README.md) for the
 decision chain, the rules file format and the 自动审查 tier.
 
 ## Requirements
@@ -90,12 +90,21 @@ dsh profile reload --profile web
 
 ## After a **DSH** upgrade: re-apply the composer glyph patch
 
-The 自动审查（高权限） tier shows the same shield+eye glyph as 自动审查 only because
-`scripts/patch-permission-glyph.mjs` added it to a **closed map inside a DSH host
-package**. DSH gives host-configured tiers no glyph by design — the map's own
-comment reads *"host-configured names outside the design set get none"* — and the
-option objects a plugin can influence carry only `{value, name, description}`, so
-there is no plugin-side seam to use instead.
+Both 自动审查 tiers draw an icon only because `scripts/patch-permission-glyph.mjs`
+added them to a **closed map inside a DSH host package**: 自动审查 copies the
+`workspace-write` glyph and 自动审查（高权限） the `danger-full-access` one — the
+built-in tier each shares a file sandbox with. DSH gives host-configured tiers no
+glyph by design — the map's own comment reads *"host-configured names outside the
+design set get none"* — and the option objects a plugin can influence carry only
+`{value, name, description}`, so there is no plugin-side seam to use instead.
+
+The script resolves each source key instead of assuming its spelling: `["<key>",`
+first, then the constant alias the bundle may use instead (`[FULL_ACCESS,` for
+`danger-full-access`). DSH has already changed this design set once — 0.1.2 keyed a
+`permissive` glyph, 0.1.5 keeps only `read-only` / `workspace-write` /
+`danger-full-access` — and a source key it cannot resolve is reported together with
+the keys the map does carry, so re-pointing a tier is a one-line edit to
+`GLYPH_TARGETS`.
 
 That patch edits a **host** file, so a DSH upgrade or reinstall erases it. Upgrading
 *this plugin* does not: the plugin never owned the glyph, and its own contribution
@@ -112,11 +121,16 @@ the `dsh-perm-gate-patch-glyph` bin — so no source checkout is needed. It is d
 **not** wired to `postinstall`: it edits a host package, and a plugin must not rewrite its
 harness uninvited. Running DSH is unaffected either way; the tier works with or without it.
 
-It is idempotent (a second run is a no-op), backs the bundle up once, and refuses to
-write a mis-sliced bundle — it runs `node --check` on the result and restores the
-backup if that fails — so it is safe to run unconditionally after every DSH upgrade.
-It locates the bundle from the running `node` binary, so an nvm version change or a
-re-pointed install symlink does not break it.
+It is idempotent (a second run is a no-op), backs the bundle up once, applies both
+glyphs or neither (a source key it cannot resolve is a refusal, not a half-patch),
+and refuses to write a mis-sliced bundle — it runs `node --check` on the result and
+restores the backup if that fails — so it is safe to run unconditionally after every
+DSH upgrade.
+It locates the bundle from the caller's profile scope first and the CLI install second,
+so an nvm version change or a re-pointed install symlink does not break it — and when the
+machine carries more than one DSH install, the ones it did **not** patch are listed in the
+output, because only one of them serves the UI in front of you. Pass that path explicitly
+to patch it.
 
 **Reinstalling the plugin does not restore the glyph.** `dsh plugin --profile web
 add …` forwards to pnpm inside the profile directory and writes the profile's own
@@ -191,11 +205,13 @@ The DSH bundle patch replaces the whole `permission.config.presets` map instead
 merging per key. Reload the profile so `cordis.patch.yml` is re-applied, and make
 sure no later plugin overwrites `presets`.
 
-**自动审查（高权限） lost its icon in the composer.**
-A DSH upgrade or reinstall replaced the host bundle the glyph was patched into;
+**A 自动审查 tier lost its icon in the composer.**
+A DSH upgrade or reinstall replaced the host bundle the glyphs were patched into;
 re-running the plugin install will not bring it back. Run
-`npx dsh-perm-gate-patch-glyph` and reload. The tier itself is
-unaffected — its label and its gating keep working without the patch.
+`npx dsh-perm-gate-patch-glyph` and reload. If it reports that a source key is gone,
+DSH changed the glyph map again: the error names the keys the map now carries, so
+re-point the affected tier in `GLYPH_TARGETS`. The tiers themselves are
+unaffected — their labels and their gating keep working without the patch.
 
 **`--list` reports `ruleCount: 0` although my rules file exists.**
 `rulesFile` is resolved against the process CWD of the harness, not the plugin

package/INSTALL.zh.md

@@ -12,7 +12,7 @@
 - [日本語 changelog](./CHANGELOG.ja.md)
 - [한국어 changelog](./CHANGELOG.ko.md)
 
-`dsh-perm-gate` 版本 **2.4.1**。裁决链、规则文件格式与自动审查档位请见
+`dsh-perm-gate` 版本 **4.1.2**。裁决链、规则文件格式与自动审查档位请见
 [中文 README](./README.zh.md)。
 
 ## 前置条件
@@ -87,11 +87,18 @@ dsh profile reload --profile web
 
 ## **DSH** 升级后：重打输入区图标补丁
 
-「自动审查（高权限）」之所以和「自动审查」一样显示盾+眼图标，只是因为
-`scripts/patch-permission-glyph.mjs` 把这一项加进了 **DSH 宿主包里的一张封闭 Map**。
-DSH 对插件档位**设计上就不给图标** —— 那张表自己的注释写着 *"host-configured
-names outside the design set get none"*；而插件能影响的 option 对象只携带
-`{value, name, description}`，所以插件侧没有可用的接缝。
+两个「自动审查」档位之所以有图标，只是因为 `scripts/patch-permission-glyph.mjs`
+把它们加进了 **DSH 宿主包里的一张封闭 Map**：「自动审查」复制 `workspace-write` 的
+盾+铅笔，「自动审查（高权限）」复制 `danger-full-access` 的盾+感叹号 —— 各自对应
+自己实际共用的文件沙箱。DSH 对插件档位**设计上就不给图标** —— 那张表自己的注释写着
+*"host-configured names outside the design set get none"*；而插件能影响的 option 对象
+只携带 `{value, name, description}`，所以插件侧没有可用的接缝。
+
+脚本会**解析**源键而不是假定它的写法：先找 `["<key>",`，再找宿主可能改用的常量别名
+（`danger-full-access` 在 0.1.5 里就写作 `[FULL_ACCESS,`）。宿主已经改过一次设计集 ——
+0.1.2 有 `permissive` 图标，0.1.5 只剩 `read-only` / `workspace-write` /
+`danger-full-access` —— 解析不到的源键会在报错里连同「表里实际有哪些键」一起给出，
+所以改档位只需改 `GLYPH_TARGETS` 一行。
 
 该补丁改的是**宿主**文件，因此 **DSH 升级或重装会把它抹掉**。升级*本插件*不会：
 图标从来不属于插件，而插件自己的贡献（`cordis.patch.yml` 里的 `name:` /
@@ -108,9 +115,12 @@ dsh profile reload --profile web
 `postinstall` 上：它改的是宿主包，插件不该未经许可改写自己所在的 harness。有没有它
 都不影响 DSH 运行，档位本身照常工作。
 
-脚本是幂等的（重复执行是 no-op），只备份一次，且拒绝写坏切片 —— 它会对结果跑
-`node --check`，失败即还原备份 —— 所以每次 DSH 升级后无条件重跑都是安全的。
-它从运行中的 `node` 二进制反推包路径，因此 nvm 换版本或安装软链重指都不会让它失效。
+脚本是幂等的（重复执行是 no-op），只备份一次，两个图标要么都打要么都不打（源键解析不到
+即拒绝，不会打出半个补丁），且拒绝写坏切片 —— 它会对结果跑 `node --check`，失败即还原
+备份 —— 所以每次 DSH 升级后无条件重跑都是安全的。
+它先探测调用方自己的 profile 作用域，再看 CLI 安装目录，因此 nvm 换版本或安装软链重指都
+不会让它失效；当机器上存在多份 DSH 安装时，**没有**被打补丁的那些会列在输出里 —— 因为
+真正服务你面前界面的只有其中一份，需要时把那个路径作为参数显式传入。
 
 **重装插件并不会恢复图标。**`dsh plugin --profile web add …` 只是把参数转发给
 profile 目录里的 pnpm，只写 profile 自己的 `node_modules`；`-w`
@@ -180,9 +190,10 @@ DSH 的 bundle patch 是整体替换 `permission.config.presets`，而非逐 key
 请重载 profile 让 `cordis.patch.yml` 重新生效，并确认没有更晚加载的插件覆盖了
 `presets`。
 
-**「自动审查（高权限）」在输入区丢了图标。**
+**某个「自动审查」档位在输入区丢了图标。**
 DSH 升级或重装替换了被打了补丁的宿主 bundle；重装插件不会把它带回来。执行
-`npx dsh-perm-gate-patch-glyph` 后重载即可。档位本身不受影响 ——
+`npx dsh-perm-gate-patch-glyph` 后重载即可。若报错说某个源键不存在，说明宿主又改了
+图标表 —— 报错会列出表里现有的键，按提示改 `GLYPH_TARGETS` 即可。档位本身不受影响 ——
 没有补丁，它的标签与门禁照常工作。
 
 **规则文件存在但 `--list` 显示 `ruleCount: 0`。**

package/README.ja.md

@@ -45,7 +45,7 @@
 > メソッドであるため、`typeof` プロブで読み取り、欠落時やエラー時には「ポリシー
 > 不明」にフォールバックします。
 
-バージョン **2.4.1** — 変更履歴は [日本語 changelog](./CHANGELOG.ja.md) を参照。
+バージョン **4.1.2** — 変更履歴は [日本語 changelog](./CHANGELOG.ja.md) を参照。
 
 DeepSeek Harness 向けの、単一・自己完結・決定論優先・fail-closed な権限ゲートです。
 
@@ -93,6 +93,31 @@ DSH の安全まわりのエコシステムでは、この役割が `dsh-permiss
    オンにすると、ゲートが許可した呼び出しを `callId` で正確に一致させてここで直接回答
    します。
 
+## スクリーンショット
+
+**設定カード — 自动审查ティア**：フロントが露出するのは単一スイッチのみで、バックエンドの
+4 戦略は組み合わせ可能です。`LlmAssist` はセッションの現在のモデルに追従するか、
+Provider / Model を固定でき、ヘルスチェックと裁決学習を備えます：
+
+![設定カード — 自动审查ティア](assets/setting-head.png)
+![LlmAssist — Provider / Model / API Key](assets/llms.png)
+
+**ゲートが実際に読み込んだルール** — `dsh-perm-gate-rules` 設定名前空間から直接読み出した
+読み取り専用ビューです。パネルからは変更できません：
+
+![組み込みルール（読み取り専用）](assets/setting-rules.png)
+
+**権限承認記録** — このセッションのすべての裁決を新しい順に、モデルが見た理由つきで表示します：
+
+![権限承認記録](assets/permlist.png)
+
+**裁決ストリップ** — 自動許可は根拠（読み取り専用ツール、または LLM の `safe` 判定）を明示し、
+ゲートの停止も決して無言では起きません：
+
+![ALLOW ストリップ — 読み取り専用ツール](assets/allow1.png)
+![ALLOW ストリップ — llm-assist が safe](assets/allow2.png)
+![GATE OFF ストリップ — ゲート停止](assets/gateoff.png)
+
 ## インストール
 
 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) が導入済みである
@@ -235,9 +260,10 @@ P0–P4 の全チェーンが動作します。ゲートはプリセットの**
 `cordis.patch.yml` は全セッション共通で中国語ラベルを配布します。
 
 **アイコンは別の話です。** 入力欄のグリフ表は閉じており、その表自身のコメントが規則を述べています：
-*host-configured names outside the design set get none*。`permissive` は組み込み値なので
-「自动审查」には元から盾＋目のアイコンがあります。「自动审查（高权限）」が同じアイコンを得るのは、
-`npx dsh-perm-gate-patch-glyph` がその表に 1 項目を追加したからです。このパッチは
+*host-configured names outside the design set get none*。どちらのティアも組み込み値ではないため、
+アイコンは `npx dsh-perm-gate-patch-glyph` がその表に 2 項目を足すことで初めて付きます ——
+「自动审查」は `workspace-write` の盾＋鉛筆を、「自动审查（高权限）」は `danger-full-access` の
+盾＋感嘆符をコピーし、それぞれが実際に共有するファイルサンドボックスのグリフになります。このパッチは
 **ホスト**パッケージを書き換えるため、DSH アップグレードのたびに失われます ——
 [DSH アップグレード後：入力欄アイコンのパッチを再適用](./INSTALL.ja.md) を参照してください。
 
@@ -342,9 +368,10 @@ Full access / `custom`）では、ゲートの判定フローは**一切実行
 人手に回した `ask` は回答が返るまで追跡されます。受動的な `approval/request` オブザーバが閉じた結果を記録し（`allowed-once` → **承認**、`rejected` → **拒否**、`cancelled` → **キャンセル**、`unavailable` → 拒否＝承認チャネルなし）、オブザーバが関連付けできない場合（`callId` 欠落・approval サービスなし・上流リスナーの短絡）は `tools/result` が同じ ask をフォールバックとして解決します。承認時には承認後の学習進捗（`n`/しきい値）を表示し、通知バーも 3 つの終態にラベルを付けます。
 
 さらにプリセットの**拒否キーワード黑名単**（dsh-approval-gate の `DEFAULT_DENY_KEYWORDS` を継承：`rm -rf`、`push --force`、`drop table`、`mkfs`、`git reset --hard`、`docker system prune` など）を備え、テキストがキーワードを含む呼び出し（大小文字を区別しない部分一致）は許可リスト / 許可 / LLM より先に拒否します。設定カードでリストとして編集でき（プリセット項目にはタグ付き、ワンクリック復元対応）、未設定・空ならプリセットを適用します——黑名単が静かに無効化されることはありません。
-「自动审查」と「自动审查（高权限）」はどちらもピッカーに盾＋目のアイコンを描きます —— 前者は
-DSH の組み込み表から、後者はインストールガイドに書かれたホストパッチからです。そのパッチが
-ない場合、2 つ目のティアはどのサーフェスでもテキストのみになります。ラベルとゲートは影響を
+「自动审查」と「自动审查（高权限）」はどちらもピッカーにアイコンを描きます —— インストール
+ガイドに書かれたホストパッチが、それぞれが共有するファイルサンドボックスのティア
+（`workspace-write` と `danger-full-access`）からコピーしたものです。そのパッチが
+ない場合、両ティアはどのサーフェスでもテキストのみになります。ラベルとゲートは影響を
 受けません。
 
 

package/README.ko.md

@@ -43,7 +43,7 @@
 > 모두에서 user-approval 서비스의 **개인** 메소드이므로 `typeof` 프로브를 통해
 > 읽으며, 누락되거나 예외 발생 시 "정책_unknown"으로 후퇴합니다.
 
-버전 **2.4.1** — 변경 내역은 [한국어 changelog](./CHANGELOG.ko.md)를 참고하세요.
+버전 **4.1.2** — 변경 내역은 [한국어 changelog](./CHANGELOG.ko.md)를 참고하세요.
 
 DeepSeek Harness용 단일·자족적·결정론 우선·fail-closed 권한 게이트입니다.
 
@@ -90,6 +90,31 @@ DSH 안전 생태계에서는 이 역할이 `dsh-permission-rules` / `dsh-auto-m
    없고, 게이트가 자동 허용한 호출에도 확인 프롬프트가 나타납니다. 이 전략을 켜면 게이트가
    `callId`로 이미 허용한 호출을 정확히 매칭하여 여기서 직접 응답합니다.
 
+## 스크린샷
+
+**설정 카드 — 自动审查 티어**: 프론트는 단일 스위치만 노출하고, 백엔드의 네 전략은 조합
+가능합니다. `LlmAssist`는 세션의 현재 모델을 따르거나 Provider / Model을 고정할 수 있으며,
+헬스 테스트와 판정 학습을 갖춥니다:
+
+![설정 카드 — 自动审查 티어](assets/setting-head.png)
+![LlmAssist — Provider / Model / API Key](assets/llms.png)
+
+**게이트가 실제로 로드한 규칙** — `dsh-perm-gate-rules` 설정 네임스페이스에서 직접 읽은
+읽기 전용 뷰입니다. 패널에서는 바꿀 수 없습니다:
+
+![내장 규칙(읽기 전용)](assets/setting-rules.png)
+
+**권한 승인 기록** — 이 세션의 모든 판정을 최신순으로, 모델이 본 이유와 함께 표시합니다:
+
+![권한 승인 기록](assets/permlist.png)
+
+**판정 스트립** — 자동 허용은 근거(읽기 전용 도구 또는 LLM의 `safe` 판정)를 밝히고,
+게이트 정지도 결코 조용히 일어나지 않습니다:
+
+![ALLOW 스트립 — 읽기 전용 도구](assets/allow1.png)
+![ALLOW 스트립 — llm-assist safe](assets/allow2.png)
+![GATE OFF 스트립 — 게이트 정지](assets/gateoff.png)
+
 ## 설치
 
 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)가 설치되어 있어야
@@ -230,9 +255,10 @@ DSH **자신**의 트래픽 —— 내장 네트워크 도구와 LLM 전송 —
 라벨을 배포합니다.
 
 **아이콘은 다른 이야기입니다.** 입력창의 글리프 표는 닫혀 있고, 그 표 자체의 주석이 규칙을
-말합니다: *host-configured names outside the design set get none*. `permissive`는 내장 값이라
-「自动审查」에는 원래부터 방패+눈 아이콘이 있습니다. 「自动审查（高权限）」가 같은 아이콘을
-갖는 것은 `npx dsh-perm-gate-patch-glyph`가 그 표에 항목 하나를 추가했기 때문입니다.
+말합니다: *host-configured names outside the design set get none*. 두 티어 모두 내장 값이 아니므로
+아이콘은 `npx dsh-perm-gate-patch-glyph`가 그 표에 항목 두 개를 넣어야 생깁니다 ——
+「自动审查」는 `workspace-write`의 방패+연필을, 「自动审查（高权限）」는 `danger-full-access`의
+방패+느낌표를 복사해 각자가 실제로 공유하는 파일 샌드박스의 글리프를 갖습니다.
 이 패치는 **호스트** 패키지를 고치므로 DSH 업그레이드마다 사라집니다 ——
 [DSH 업그레이드 후: 입력창 아이콘 패치 재적용](./INSTALL.ko.md)을 참고하세요.
 
@@ -343,9 +369,10 @@ host는 네임스페이스를 live로 읽으므로 변경은 재시작 없이
 카드에서 목록으로 편집할 수 있고(프리셋 항목에는 태그 표시, 원클릭 복원 지원) 미설정·빈 목록 시 프리셋이
 적용됩니다——블랙리스트가 조용히 꺼지지 않습니다.
 블랙리스트가 조용히 꺼지는 일은 없습니다.
-「自动审查」와 「自动审查（高权限）」는 둘 다 선택기에 방패+눈 아이콘을 그립니다 — 전자는
-DSH 내장 표에서, 후자는 설치 안내에 적힌 호스트 패치에서 옵니다. 그 패치가 없으면 두 번째
-티어는 모든 화면에서 텍스트만 표시됩니다. 라벨과 게이트는 영향을 받지 않습니다.
+「自动审查」와 「自动审查（高权限）」는 둘 다 선택기에 아이콘을 그립니다 — 설치 안내에 적힌
+호스트 패치가 각자가 공유하는 파일 샌드박스 티어(`workspace-write`와 `danger-full-access`)에서
+복사한 것입니다. 그 패치가 없으면 두 티어 모두 모든 화면에서 텍스트만 표시됩니다.
+라벨과 게이트는 영향을 받지 않습니다.
 
 
 ## CLI(독립 실행 dry-run)

package/README.md

@@ -42,7 +42,7 @@
 > **private** method of the user-approval service on both, so it is read behind a
 > `typeof` probe and degrades to “policy unknown” when absent or throwing.
 
-Version **2.6.0** — see the [Changelog](./CHANGELOG.md).
+Version **4.1.2** — see the [Changelog](./CHANGELOG.md).
 
 A single, self-sufficient, deterministic-first, fail-closed permission gate for DeepSeek Harness.
 
@@ -104,6 +104,31 @@ grants and LLM. It is editable as a list in the settings card (preset entries ar
 one-click restore brings the preset back); unset or empty applies the preset — the blacklist
 never silently turns off.
 
+## Screenshots
+
+**The settings card — the 自动审查 tier.** The front end exposes a single switch; the four back-end
+strategies combine. `LlmAssist` can follow the session's current model or be pinned to a provider /
+model, and carries its own health test and verdict learning:
+
+![Settings card — the 自动审查 tier](assets/setting-head.png)
+![LlmAssist — provider, model, API key](assets/llms.png)
+
+**The rules the gate actually loaded**, read straight from the `dsh-perm-gate-rules` settings
+namespace — the panel is read-only by design, so it can never edit what it shows:
+
+![Built-in rules, read-only](assets/setting-rules.png)
+
+**Approval decision log** — every verdict in this session, newest first, with the reason the model saw:
+
+![Approval decision log](assets/permlist.png)
+
+**Decision strips** — an auto-allow states its basis (a read-only tool, or an LLM `safe` verdict),
+and a stand-down is never silent:
+
+![ALLOW strip — read-only internal tool](assets/allow1.png)
+![ALLOW strip — llm-assist risk: safe](assets/allow2.png)
+![GATE OFF strip — the gate stood down](assets/gateoff.png)
+
 ## Install
 
 Requires an existing [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) installation.
@@ -264,9 +289,10 @@ default row and the composer picker) and only supplies its own localized labels
 built-in values, so `cordis.patch.yml` ships the Chinese label for every session.
 
 The **icon** is a different story. The composer's glyph map is closed, and its own comment states
-the rule: *host-configured names outside the design set get none.* `permissive` is a built-in
-value, so 自动审查 already has a shield+eye glyph; `permissive-full` gets the same glyph only
-because `npx dsh-perm-gate-patch-glyph` adds it to that map. That patch edits a **host**
+the rule: *host-configured names outside the design set get none.* Neither tier is a built-in value,
+so both get an icon only because `npx dsh-perm-gate-patch-glyph` adds them to that map — 自动审查
+copies the `workspace-write` glyph, 自动审查（高权限） the `danger-full-access` one, so each tier
+shows the glyph of the file sandbox it actually shares. That patch edits a **host**
 package, so it is lost on every DSH upgrade — see
 [After a DSH upgrade](./INSTALL.md#after-a-dsh-upgrade-re-apply-the-composer-glyph-patch).
 
@@ -374,9 +400,10 @@ channel existed), with `tools/result` settling the same ask as a fallback when t
 correlate it. Approvals report the post-approval learning progress (`n`/threshold), and the notice
 strip labels all three terminal states.
 
-自动审查 and 自动审查（高权限） both draw the shield+eye glyph in the picker — the first from DSH's
-built-in map, the second from the host patch the installation guide describes. Without that patch
-the second tier is text-only on every surface; its label and its gating are unaffected.
+自动审查 and 自动审查（高权限） both draw a glyph in the picker — copied from the built-in tiers whose
+file sandbox they share (`workspace-write` and `danger-full-access`) by the host patch the
+installation guide describes. Without that patch both tiers are text-only on every surface; their
+labels and their gating are unaffected.
 
 ### A selectable session tier
 

package/README.zh.md

@@ -39,7 +39,7 @@
 > 线上都是 user-approval 服务的**私有**方法，因此通过 `typeof` 探测读取，缺失
 > 或抛错时降级为「策略未知」。
 
-版本 **2.4.1** —— 变更见 [Changelog](./CHANGELOG.md)。
+版本 **4.1.2** —— 变更见 [Changelog](./CHANGELOG.md)。
 
 一个**单一自足、确定性优先、fail-closed** 的 DeepSeek Harness 权限门插件。
 
@@ -65,6 +65,27 @@
 - **自动审查档位**（机器值 `permissive`）——一个**独立审批模式**（区别于只读、完全权限与白名单档），既不是"自动审批"，也不授予泛化权限。前端只暴露**一个开关**（`permissive`），后台四个审批策略**可组合**、由插件设置决定——仍对 P0 保持 fail-closed。权限下拉框与设置行都按产品名「自动审查」显示；图标见下文（内置档自带，插件档需补丁）。
 - **沙箱提权自动答复**（`trustEscalation`）— 沙箱提权是从 shell / pwsh / edit 工具**体内部**（`tools/pre-execute` 之后）发出的，所以门禁从未见过它，一个它自动放行的调用仍会弹出确认。开启后，门禁以 `callId` 精确匹配已放行调用并直接答复。
 
+## 界面预览
+
+**设置卡片 —— 自动审查档位**：前端只暴露一个开关，后台四个策略可组合；`LlmAssist` 可跟随会话当前模型，也可钉住 Provider / Model，并自带健康测试与裁决学习：
+
+![设置卡片 —— 自动审查档位](assets/setting-head.png)
+![LlmAssist —— Provider / Model / API Key](assets/llms.png)
+
+**门禁实际加载的规则**——直接读自 `dsh-perm-gate-rules` 设置命名空间；面板按设计只读，改不了它显示的内容：
+
+![内置规则（只读）](assets/setting-rules.png)
+
+**权限审批记录**——本会话每一次裁决，最新在上，附带模型看到的理由：
+
+![权限审批记录](assets/permlist.png)
+
+**裁决条**——自动放行会写明依据（只读工具，或 LLM 判定 `safe`）；停摆也绝不静默：
+
+![ALLOW 条 —— 只读内置工具](assets/allow1.png)
+![ALLOW 条 —— llm-assist 判定 safe](assets/allow2.png)
+![GATE OFF 条 —— 门禁停摆](assets/gateoff.png)
+
 ## 安装
 
 需要先安装 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)。
@@ -180,9 +201,10 @@ MSYS2/Cygwin 的 `sh.exe`、ConPTY 都会以 `Win32 error 5` / `couldn't create
 标签，因此 `cordis.patch.yml` 直接写中文名，对所有会话一致。
 
 **图标是另一回事。** 输入栏的图标表是闭合的，表自己的注释写明了规则：*host-configured names
-outside the design set get none*。`permissive` 是内置值，所以「自动审查」本来就有盾+眼图标；
-「自动审查（高权限）」能拿到同一个图标，靠的是 `npx dsh-perm-gate-patch-glyph` 往那张表里
-加了一项。该补丁改的是**宿主**包，每次 DSH 升级都会丢 —— 见
+outside the design set get none*。两个档位都不是内置值，图标全靠
+`npx dsh-perm-gate-patch-glyph` 往那张表里补两项 ——「自动审查」复制 `workspace-write` 的
+盾+铅笔，「自动审查（高权限）」复制 `danger-full-access` 的盾+感叹号，各自对应自己实际共用的
+文件沙箱。该补丁改的是**宿主**包，每次 DSH 升级都会丢 —— 见
 [DSH 升级后：重打输入区图标补丁](./INSTALL.zh.md)。
 
 `cordis.yml`：
@@ -275,9 +297,9 @@ LLM 评定为 `safe` 且门禁自动放行的调用因此仍会弹出确认。
 调用文本命中任一关键词（大小写不敏感子串）即直接拒绝，且先于白名单 / 授权 / LLM。黑名单在设置
 卡片中按列表查看与增删（预置条目带标签，可一键恢复预置）；未设置或为空时应用预置列表——黑名单
 不会静默关闭。
-「自动审查」与「自动审查（高权限）」在选择器里都画盾+眼图标 —— 前者来自 DSH 内置表，后者来自
-安装指南里描述的那次宿主补丁。没有该补丁时，第二个档位在所有界面上都是纯文字；它的标签与门禁
-不受影响。
+「自动审查」与「自动审查（高权限）」在选择器里都画图标 —— 图标由安装指南里描述的那次宿主补丁
+从各自共用的文件沙箱档位复制而来（`workspace-write` 与 `danger-full-access`）。没有该补丁时，
+两个档位在所有界面上都是纯文字；它们的标签与门禁不受影响。
 
 
 ## CLI（独立 dry-run）

package/cordis.patch.yml

@@ -17,14 +17,17 @@
 # The composer's permission picker draws an icon per preset from a CLOSED map
 # inside @deepseek-ai/dsh-client-ui-conversation (`permissionGlyphs`), whose
 # source states the rule: "host-configured names outside the design set get
-# none". DSH ships a shield+eye glyph for `permissive`, so 自动审查 has an icon,
-# but a second plugin tier has none — it falls back to text in the trigger. The
-# map is a closure variable with no plugin-facing seam (the option objects the
-# host supplies carry only {value, name, description}), so the only way to give
-# BOTH tiers the same glyph is to extend that map.
-# `scripts/patch-permission-glyph.mjs` does exactly that, duplicating the
-# `permissive` entry under `permissive-full`. It patches a HOST package, so it
-# must be re-run after any DSH upgrade or reinstall.
+# none". Neither tier is a built-in value, so DSH renders no glyph for either
+# — the map is a closed closure variable and its only plugin-facing input is
+# {value, name, description} on the option objects, which carries no icon. The
+# only way to give a tier an icon is to add an entry to that map.
+# `scripts/patch-permission-glyph.mjs` does exactly that, copying the glyph of
+# the built-in tier whose file sandbox each of ours shares:
+#   permissive       <- ["workspace-write",  (same sandbox: workspace-write)
+#   permissive-full  <- [FULL_ACCESS,        (same sandbox: danger-full-access)
+# The source key is RESOLVED, not assumed (0.1.2 keyed a `permissive` glyph that
+# 0.1.5 dropped, so a literal anchor died with "anchor not found"). It patches a
+# HOST package, so it must be re-run after any DSH upgrade or reinstall.
 #
 # The DSH bundle patch REPLACES the whole `permission.config.presets` map (it
 # does not merge per key), so this file MUST restate every tier that should

package/dsh.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "dsh-perm-gate",
   "name": "dsh-perm-gate",
-  "version": "4.1.1",
+  "version": "4.1.2",
   "description": {
     "en": "Deterministic-first, fail-closed permission gate for DeepSeek Harness 0.1.2+: a P0 hard-deny -> P1 precise session grant -> P2 static allow/deny rule chain -> P3 optional LLM classifier -> P4 ask pipeline over the tools/pre-execute waterfall, with a standalone CLI dry-run evaluator and an auditable decision log. It only vetoes with deny/ask and always delegates otherwise, and unknown or malformed rules fail loud instead of silently standing the gate down.",
     "zh": "面向 DeepSeek Harness 0.1.2+ 的确定性优先、失败即拒的权限闸门：在 tools/pre-execute 瀑布上串起 P0 硬拒绝 → P1 精确会话授权 → P2 静态 allow/deny 规则链 → P3 可选 LLM 语义分类 → P4 ask，并附带独立 CLI 干跑评估器与可审计的决策日志。只以 deny/ask 否决、其余一律放行，规则未知或非法时直接报错，绝不静默失效。"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-perm-gate",
-  "version": "4.1.1",
+  "version": "4.1.2",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "access": "public",

package/scripts/patch-permission-glyph.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 /**
- * Add `permissive-full` to the DSH composer's permission-glyph map.
+ * Give this plugin's own permission tiers the composer glyphs the host will not
+ * draw for them.
  *
  * WHY THIS EXISTS
  * ---------------
@@ -9,22 +10,40 @@
  *
  *     const permissionGlyphs = new Map([
  *       ["read-only", <svg …/>],
- *       ["permissive", <svg …/>],          // the 自动审查 tier's shield+eye
  *       ["workspace-write", <svg …/>],
- *       ["danger-full-access", <svg …/>],
+ *       [FULL_ACCESS, <svg …/>],      // const FULL_ACCESS = "danger-full-access"
  *     ]);
  *     function permissionGlyph(value) { return permissionGlyphs.get(value); }
  *
  * The source comment states the rule: "host-configured names outside the design
  * set get none." There is no plugin-facing seam — the option objects the host
  * supplies carry only `{value, name, description}`, and the map itself is a
- * closure variable. So a plugin-contributed tier such as `permissive-full`
- * renders with no icon in the dropdown and falls back to plain text in the
- * trigger, while the built-in `permissive` tier shows the shield+eye.
+ * closure variable. So a plugin-contributed tier renders with no icon in the
+ * dropdown and falls back to plain text in the trigger.
  *
- * The only way to give our tier the same glyph is to add an entry to that map.
- * This script does exactly that: it duplicates the `permissive` entry under the
- * `permissive-full` key, so the two tiers of one plugin look alike.
+ * The only way to give our tiers the same glyph is to add entries to that map.
+ * This script does exactly that — one glyph per tier, copied from the built-in
+ * tier whose file sandbox the plugin tier shares:
+ *
+ *     permissive       sandbox: workspace-write    <- the ["workspace-write",] entry
+ *     permissive-full  sandbox: danger-full-access <- the [FULL_ACCESS,] entry
+ *
+ * WHY THE SOURCES ARE DECLARED AND THE ANCHOR IS RESOLVED
+ * -------------------------------------------------------
+ * DSH 0.1.2 shipped four glyphs, `permissive` among them; 0.1.5-rc.2 ships three
+ * (`read-only` / `workspace-write` / `danger-full-access`) and the string
+ * `permissive` no longer occurs anywhere in the bundle — so a splice anchored on
+ * `["permissive",` dies with "anchor not found" on the current host. Two
+ * properties keep this working across such a design-set change:
+ *
+ *   1. the source key is a declaration (`GLYPH_TARGETS`) rather than a literal
+ *      buried in the splice, so re-pointing a tier is a one-line edit; and
+ *   2. the anchor for a key is RESOLVED, not assumed to be a string literal:
+ *      `["<key>",` first, then the constant alias the bundle may use instead
+ *      (`[FULL_ACCESS,` for `"danger-full-access"`).
+ *
+ * When a declared source key is gone, the refusal names the keys the map DOES
+ * carry, so the next drift is diagnosed from the error text alone.
  *
  * VOLUNTARY, NOT AUTOMATIC
  * ------------------------
@@ -42,8 +61,11 @@
  *   npx dsh-perm-gate-patch-glyph --check      # report only; exit 1 if missing
  *   node scripts/patch-permission-glyph.mjs <path/to/client.js>
  *
- * With no argument it probes the usual global-install locations. The script is
- * idempotent (a second run is a no-op), backs the file up once, and refuses to
+ * With no argument it probes the profile scopes first and the CLI install second,
+ * and lists any other DSH install that carries the same bundle — on a host with
+ * both, only one of them serves the UI, so the explicit-path form is the answer
+ * when the probe picks the wrong one. The script is idempotent (a second run is a
+ * no-op), backs the file up once, applies every target or none, and refuses to
  * write a bundle it cannot slice correctly, so it can never half-apply.
  */
 import { existsSync, readFileSync, writeFileSync, copyFileSync } from 'node:fs'
@@ -52,13 +74,23 @@ import { homedir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 
-/** The map key whose entry is cloned, and the key it is cloned onto. */
-export const SOURCE_KEY = 'permissive'
-export const TARGET_KEY = 'permissive-full'
-
 /** Relative path from a package root to the bundle holding the map. */
 const BUNDLE = join('@deepseek-ai', 'dsh-client-ui-conversation', 'lib', 'client.js')
 
+/**
+ * The glyphs to add: each plugin tier, and the built-in tier it copies.
+ *
+ * The pairing is by file-sandbox meaning, not by name similarity — `permissive`
+ * runs in the same sandbox as `workspace-write`, `permissive-full` in the same
+ * sandbox as `danger-full-access` — so the icon a user sees matches the access
+ * the tier actually grants. A tier listed here gets that built-in's entry
+ * verbatim apart from its key.
+ */
+export const GLYPH_TARGETS = [
+  { target: 'permissive', source: 'workspace-write' },
+  { target: 'permissive-full', source: 'danger-full-access' },
+]
+
 /** Thrown for every refusal; the CLI turns it into an exit code 1. */
 export class GlyphPatchError extends Error {}
 
@@ -66,6 +98,15 @@ export class GlyphPatchError extends Error {}
  * Candidate bundle paths, most specific first. Pure: no filesystem access, so
  * the probe order is unit-testable.
  *
+ * Profile scope before CLI-install scope, and that order is load-bearing on a
+ * machine with more than one DSH: a profile's UI is served by the profile's own
+ * dependency scope, not by whichever global CLI install happens to sit beside the
+ * running `node`. Measured on this project's own host — a global install under
+ * `dirname(node)` existed and shadowed the profile's bundle under an older probe
+ * order, so the patch reported success while the picker stayed icon-free. On a
+ * stock single-install machine every candidate is one inode, so the order decides
+ * nothing there; it only matters exactly when guessing wrong is silent.
+ *
  * `execDir` is `dirname(process.execPath)`. Deriving from the running node
  * binary — never from a hardcoded nvm version or install path — is what keeps
  * the script working across node upgrades and re-pointed install symlinks.
@@ -75,19 +116,111 @@ export class GlyphPatchError extends Error {}
  */
 export function candidateBundles({ execDir, cwd, dshHome }) {
   return [
-    // 1. `@deepseek-ai` scope hoisted beside the running node binary.
-    join(execDir, 'node_modules', BUNDLE),
-    // 2. The same scope nested inside the `dsh` package itself.
-    join(execDir, 'node_modules', '@deepseek-ai', 'dsh', 'node_modules', BUNDLE),
-    // 3. Whatever profile the caller is standing in.
+    // 1. Whatever profile the caller is standing in.
     join(cwd, 'node_modules', BUNDLE),
-    // 4. The hoisted scope shared by every profile under DSH_HOME.
+    // 2. The hoisted scope every profile under DSH_HOME shares.
     join(dshHome, 'profiles', 'node_modules', BUNDLE),
+    // 3. `@deepseek-ai` scope hoisted beside the running node binary.
+    join(execDir, 'node_modules', BUNDLE),
+    // 4. The same scope nested inside the `dsh` package itself.
+    join(execDir, 'node_modules', '@deepseek-ai', 'dsh', 'node_modules', BUNDLE),
   ]
 }
 
 /**
- * Extract the full `["<key>", …]` map entry, by bracket depth.
+ * In-page string constants (`const FULL_ACCESS = "danger-full-access"`), as
+ * name -> value. First declaration wins, so a later reassignment cannot shadow
+ * the spelling the map was built with above it.
+ *
+ * The bundle may key a map entry by such a name rather than by a literal, which
+ * is the whole reason the anchor is resolved instead of concatenated.
+ *
+ * @param {string} source
+ * @returns {Map<string, string>} constant name -> its string value
+ */
+export function pageConstants(source) {
+  const constants = new Map()
+  for (const match of source.matchAll(/(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*"([^"]*)"/g)) {
+    if (!constants.has(match[1])) constants.set(match[1], match[2])
+  }
+  return constants
+}
+
+/**
+ * The `permissionGlyphs` map's text, brackets included.
+ *
+ * Parsed rather than assumed: the map is a `new Map([ … ])` closure variable, so
+ * its extent is found by bracket depth from its `[`. Reading the map (instead of
+ * only probing for one anchor inside it) is what lets a refusal report the keys
+ * the host actually renders.
+ *
+ * @param {string} source
+ * @returns {string} the map array text, from `[` to the matching `]`
+ */
+export function glyphMapText(source) {
+  const start = source.search(/permissionGlyphs\s*=\s*new Map\(\s*\[/)
+  if (start === -1) throw new GlyphPatchError('permissionGlyphs map not found in this bundle')
+  const open = source.indexOf('[', start)
+  let depth = 0
+  for (let i = open; i < source.length; i += 1) {
+    const ch = source[i]
+    if (ch === '[' || ch === '(' || ch === '{') depth += 1
+    else if (ch === ']' || ch === ')' || ch === '}') {
+      depth -= 1
+      if (depth === 0) return source.slice(open, i + 1)
+    }
+  }
+  throw new GlyphPatchError('unterminated permissionGlyphs map')
+}
+
+/**
+ * The preset values the map renders a glyph for — literals as-is, and entries
+ * keyed by an in-page constant resolved to that constant's value.
+ *
+ * @param {string} source
+ * @returns {string[]} e.g. `['read-only', 'workspace-write', 'danger-full-access']`
+ */
+export function glyphKeys(source) {
+  const constants = pageConstants(source)
+  const keys = []
+  for (const match of glyphMapText(source).matchAll(/\[\s*(?:"([^"]+)"|([A-Za-z_$][\w$]*))\s*,/g)) {
+    if (match[1] !== undefined) keys.push(match[1])
+    else keys.push(constants.get(match[2]) ?? match[2])
+  }
+  return keys
+}
+
+/**
+ * Resolve the anchor text of one map entry, literal first, constant alias second.
+ *
+ * @param {string} source the bundle's text
+ * @param {string} key the preset value, e.g. `danger-full-access`
+ * @returns {{ anchor: string, index: number }}
+ * @throws {GlyphPatchError} when the host renders no glyph for `key`
+ */
+export function resolveAnchor(source, key) {
+  for (const anchor of [`["${key}",`, `['${key}',`]) {
+    const index = source.indexOf(anchor)
+    if (index !== -1) return { anchor, index }
+  }
+  const name = [...pageConstants(source)].find(([, value]) => value === key)?.[0]
+  if (name !== undefined) {
+    const anchor = `[${name},`
+    const index = source.indexOf(anchor)
+    if (index !== -1) return { anchor, index }
+    throw new GlyphPatchError(
+      `anchor not found: ${anchor} (the alias for "${key}")`,
+    )
+  }
+  throw new GlyphPatchError(
+    `this host renders no glyph for "${key}" — the map carries: ` +
+    `${glyphKeys(source).map((k) => `"${k}"`).join(', ')}\n` +
+    '  Re-point GLYPH_TARGETS at a key the map does carry.',
+  )
+}
+
+/**
+ * Extract the full `["<key>", …]` (or `[CONST, …]`) map entry, by bracket depth.
  *
  * The scan starts ON the entry's opening `[` (the one immediately before the
  * key), so depth returns to zero exactly at that entry's closing `]`. Starting
@@ -98,12 +231,12 @@ export function candidateBundles({ execDir, cwd, dshHome }) {
  * contain no brackets.
  *
  * @param {string} source
- * @param {string} key
+ * @param {string} anchor the text returned by {@link resolveAnchor}
  * @returns {string} the entry, brackets included
  */
-export function sliceEntry(source, key) {
-  const start = source.indexOf(`["${key}",`)
-  if (start === -1) throw new GlyphPatchError(`anchor not found: ["${key}",`)
+export function sliceEntry(source, anchor) {
+  const start = source.indexOf(anchor)
+  if (start === -1) throw new GlyphPatchError(`anchor not found: ${anchor}`)
   let depth = 0
   for (let i = start; i < source.length; i += 1) {
     const ch = source[i]
@@ -113,24 +246,41 @@ export function sliceEntry(source, key) {
       if (depth === 0) return source.slice(start, i + 1)
     }
   }
-  throw new GlyphPatchError(`unterminated entry for ["${key}",`)
+  throw new GlyphPatchError(`unterminated entry for ${anchor}`)
 }
 
 /**
- * Clone the `permissive` glyph entry onto the `permissive-full` key.
+ * Splice every declared glyph into the map.
+ *
+ * All or nothing: a source key this host does not carry throws before the caller
+ * can write anything, so a partially-glyphed bundle is impossible. Idempotent
+ * per target — a target already present is left untouched and reported as such.
  *
  * @param {string} source the bundle's text
- * @returns {{ changed: boolean, source: string, entry: string | null }}
- *   `changed: false` means the target key was already present (idempotent no-op).
+ * @returns {{ changed: boolean, source: string, added: string[], already: string[] }}
  */
 export function applyGlyphPatch(source) {
-  if (source.includes(`["${TARGET_KEY}",`)) return { changed: false, source, entry: null }
-  const sourceEntry = sliceEntry(source, SOURCE_KEY)
-  if (!sourceEntry.includes('svg')) {
-    throw new GlyphPatchError(`the ["${SOURCE_KEY}",] entry does not look like a glyph`)
+  let next = source
+  const added = []
+  const already = []
+
+  for (const { target, source: sourceKey } of GLYPH_TARGETS) {
+    if (next.includes(`["${target}",`)) {
+      already.push(target)
+      continue
+    }
+    const { anchor } = resolveAnchor(next, sourceKey)
+    const sourceEntry = sliceEntry(next, anchor)
+    if (!sourceEntry.includes('svg')) {
+      throw new GlyphPatchError(`the ${anchor} entry does not look like a glyph`)
+    }
+    const clonedEntry = sourceEntry.replace(anchor, `["${target}",`)
+    // A function replacement: the entry is spliced verbatim, `$` never expanded.
+    next = next.replace(sourceEntry, () => `${sourceEntry},\n\t\t\t${clonedEntry}`)
+    added.push(target)
   }
-  const clonedEntry = sourceEntry.replace(`["${SOURCE_KEY}",`, `["${TARGET_KEY}",`)
-  return { changed: true, source: source.replace(sourceEntry, `${sourceEntry},\n\t\t\t${clonedEntry}`), entry: clonedEntry }
+
+  return { changed: added.length > 0, source: next, added, already }
 }
 
 /** Resolve the bundle to patch, or throw with an explanation. */
@@ -151,8 +301,29 @@ export function findBundle(argv, where) {
   )
 }
 
+/**
+ * A warning block naming the other DSH installs that carry this bundle.
+ *
+ * Reported rather than patched: on a host with a global CLI install and a
+ * launcher-managed runtime, only one of them serves the UI in front of the user,
+ * and picking the wrong one is invisible — the patch succeeds and the picker
+ * stays icon-free. Naming the others turns that into a one-line fix (pass the
+ * path explicitly).
+ *
+ * @param {string[]} others bundle paths that exist but were not chosen
+ * @returns {string} an empty string when there is nothing to report
+ */
+function describeOtherInstalls(others) {
+  if (others.length === 0) return ''
+  return `  note: ${others.length} other DSH install(s) carry this bundle — NOT patched:\n` +
+    others.map((path) => `    ${path}\n`).join('') +
+    '  If the tier still has no icon, the UI is served by one of those; re-run with\n' +
+    '  that path as the argument.\n'
+}
+
 function main(argv) {
   const check = argv.includes('--check')
+  const explicit = argv.slice(2).find((arg) => !arg.startsWith('-'))
   const where = {
     execDir: dirname(process.execPath),
     cwd: process.cwd(),
@@ -160,17 +331,27 @@ function main(argv) {
   }
 
   const bundle = findBundle(argv, where)
+  const others = explicit === undefined
+    ? candidateBundles(where).filter((candidate) => candidate !== bundle && existsSync(candidate))
+    : []
+  const otherNote = describeOtherInstalls(others)
   const original = readFileSync(bundle, 'utf8')
-  const { changed, source: patched } = applyGlyphPatch(original)
+  const { changed, source: patched, added, already } = applyGlyphPatch(original)
 
   if (!changed) {
-    process.stdout.write(`patch-permission-glyph: ["${TARGET_KEY}",] already present in\n  ${bundle}\n`)
+    process.stdout.write(
+      `patch-permission-glyph: all glyphs already present in\n  ${bundle}\n` +
+      `  present: ${already.map((key) => `["${key}",]`).join(' ')}\n` +
+      otherNote,
+    )
     return 0
   }
   if (check) {
     process.stdout.write(
-      `patch-permission-glyph: ["${TARGET_KEY}",] is MISSING from\n  ${bundle}\n` +
-      '  (--check: nothing written; re-run without --check to apply)\n',
+      `patch-permission-glyph: MISSING ${added.map((key) => `["${key}",]`).join(' ')} from\n  ${bundle}\n` +
+      `  present: ${already.length > 0 ? already.map((key) => `["${key}",]`).join(' ') : '(none)'}\n` +
+      '  (--check: nothing written; re-run without --check to apply)\n' +
+      otherNote,
     )
     return 1
   }
@@ -189,9 +370,11 @@ function main(argv) {
   }
 
   process.stdout.write(
-    `patch-permission-glyph: added ["${TARGET_KEY}",] to\n  ${bundle}\n` +
+    `patch-permission-glyph: added ${added.map((key) => `["${key}",]`).join(' ')} to\n  ${bundle}\n` +
+    already.map((key) => `  already present: ["${key}",]\n`).join('') +
     `  backup: ${backup}\n` +
-    '  NOTE: this edits a DSH package — re-run after any DSH upgrade or reinstall.\n',
+    '  NOTE: this edits a DSH package — re-run after any DSH upgrade or reinstall.\n' +
+    otherNote,
   )
   return 0
 }