dsh-perm-gate 5.1.0 → 5.1.2-compat.10

package/CHANGELOG.md

@@ -9,6 +9,19 @@ undefined
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.1.2-compat.9] - 2026-10-08
+
+### Changed
+
+- **回退家族 tab 收拢（用户定案：自动审查门不在 tab 化范围内）**：顶级
+  `settings.section`（侧栏「自动审查门」独立节，order 30）恢复为唯一设置导航
+  入口；同日上午加入的 `dsh-family.tab`（order 45）撤除。
+- `settings.plugins.tab`（插件页 tab，0.1.0 实测与独立节双渲染）与
+  `settings.plugin.item`（≤0.1.5 派发卡）维持退役——与独立节重复；
+  `plugins.bundle.config` 详情卡与 `shell.overlay` 浮窗齿轮不变。
+- 席位契约测试（test/client-settings-seat.spec.ts）改钉单节形态：
+  settings.section 恰一次（order 30 / PermissiveCard），三个退役席位断言缺席。
+
 ## [2.6.0] - 2026-09-17
 
 ### Added

package/dsh.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "dsh-perm-gate",
   "name": "dsh-perm-gate",
-  "version": "5.1.0",
+  "version": "5.1.2-compat.9",
   "description": {
     "en": "Deterministic-first, fail-closed permission gate for DeepSeek Harness 0.1.2+: a P0 hard-deny -> P1 precise session grant -> P2 static allow/deny rule chain -> P3 optional LLM classifier -> P4 ask pipeline over the tools/pre-execute waterfall, with a standalone CLI dry-run evaluator and an auditable decision log. It only vetoes with deny/ask and always delegates otherwise, and unknown or malformed rules fail loud instead of silently standing the gate down.",
     "zh": "面向 DeepSeek Harness 0.1.2+ 的确定性优先、失败即拒的权限闸门：在 tools/pre-execute 瀑布上串起 P0 硬拒绝 → P1 精确会话授权 → P2 静态 allow/deny 规则链 → P3 可选 LLM 语义分类 → P4 ask，并附带独立 CLI 干跑评估器与可审计的决策日志。只以 deny/ask 否决、其余一律放行，规则未知或非法时直接报错，绝不静默失效。"

package/lib/bridge.d.ts

@@ -0,0 +1,41 @@
+/**
+ * settings bridge — T12（spec webServer 数据桥规范）：describe/mutate 两端点。
+ *
+ * 桥只是 HTTP 皮：读 = svc.describe 取自家 ns 描述符；写 = svc.mutate 转 ops 落
+ * 宿主 settings 服务（不落盘不缓存第二份，天然规避双写/锁竞争）。mutate 成功即
+ * describe 回填，带 expectedRevision 乐观并发。守卫：POST-only + ns 硬编码自家
+ * allowlist + 秘密不回读（redactSecrets）。
+ *
+ * 数据面消费方 = client BridgeDocHandle（T13b 双轨数据源：0.1.7+ 原生句柄优先，
+ * ≤0.1.5 settingsScope 不解析时落到本桥——free-search 同架构）。
+ *
+ * T20-b 泛化（2026-10-08）：路由从 ns 参数派生（bridgeRoutesFor），一个宿主进程
+ * 可为多个 ns 各注册一对端点（steward 双 ns：会话管家 + 搜索索引）——客户端与
+ * 服务端各自持同一派生式，测试钉死两半一致，URL 契约不可能漂移。
+ */
+interface SettingsServiceLike {
+    update(ns: string, patch: object): Promise<void>;
+    register?(ns: string, schema: unknown, options?: {
+        base?: unknown;
+    }): unknown;
+    installSection?(owner: unknown, ns: string, schema: unknown, entry: unknown, hooks: unknown): unknown;
+    describe?(o?: {
+        redactSecrets?: boolean;
+    }): Array<{
+        ns: unknown;
+        [k: string]: unknown;
+    }>;
+    mutate?(ns: string, ops: Array<{
+        op: string;
+        path: string[];
+        value?: unknown;
+    }>, expectedRevision?: number): Promise<unknown>;
+    writable?: boolean;
+}
+/** 一个 settings ns 的桥路由对——client 与 server 必须同式派生（测试钉死一致）。 */
+export declare function bridgeRoutesFor(ns: string): {
+    describe: string;
+    mutate: string;
+};
+export declare function registerSettingsBridgeRoutes(server: unknown, getSettingsSvc: () => SettingsServiceLike | undefined, ns: string): Array<() => void>;
+export {};

package/lib/bridge.js

@@ -0,0 +1,128 @@
+/** 一个 settings ns 的桥路由对——client 与 server 必须同式派生（测试钉死一致）。 */
+export function bridgeRoutesFor(ns) {
+    return { describe: `/api/${ns}/settings/describe`, mutate: `/api/${ns}/settings/mutate` };
+}
+function readJsonBody(reqRaw, limit = 256 * 1024) {
+    const req = reqRaw;
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            const buf = chunk;
+            size += buf.length;
+            if (size > limit) {
+                reject(new Error('bridge body too large'));
+                req.resume?.();
+                return;
+            }
+            chunks.push(buf);
+        });
+        req.on('end', () => {
+            const raw = Buffer.concat(chunks).toString('utf8');
+            if (raw === '') {
+                resolve({});
+                return;
+            }
+            try {
+                resolve(JSON.parse(raw));
+            }
+            catch (e) {
+                reject(e instanceof Error ? e : new Error(String(e)));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+function sendJson(res, code, body) {
+    res.writeHead(code, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-cache' });
+    res.end(JSON.stringify(body));
+}
+function isConflict(e) {
+    return e instanceof Error && /conflict|revision/i.test(e.message);
+}
+export function registerSettingsBridgeRoutes(server, getSettingsSvc, ns) {
+    if (typeof server !== 'object' || server === null)
+        return [];
+    const ws = typeof server.register === 'function' ? server : undefined;
+    if (ws === undefined)
+        return [];
+    const offs = [];
+    const routes = bridgeRoutesFor(ns);
+    offs.push(ws.register({
+        kind: 'exact',
+        path: routes.describe,
+        handler: (rawReq, rawRes) => {
+            const req = rawReq;
+            const res = rawRes;
+            if (req.method !== 'POST') {
+                sendJson(res, 405, { ok: false, code: 'method-not-allowed' });
+                return;
+            }
+            const svc = getSettingsSvc();
+            if (svc === undefined || typeof svc.describe !== 'function') {
+                sendJson(res, 200, { ok: false, code: 'settings-unavailable', message: 'settings service not resolved yet' });
+                return;
+            }
+            try {
+                const descriptor = svc
+                    .describe({ redactSecrets: true })
+                    .find((d) => d.ns === ns);
+                if (descriptor === undefined) {
+                    sendJson(res, 200, { ok: false, code: 'ns-not-registered', message: `settings namespace "${ns}" is not registered` });
+                    return;
+                }
+                sendJson(res, 200, { ok: true, value: { descriptor, writable: svc.writable !== false } });
+            }
+            catch (e) {
+                sendJson(res, 200, { ok: false, code: 'internal', message: e instanceof Error ? e.message : String(e) });
+            }
+        },
+    }));
+    offs.push(ws.register({
+        kind: 'exact',
+        path: routes.mutate,
+        handler: (rawReq, rawRes) => {
+            const req = rawReq;
+            const res = rawRes;
+            if (req.method !== 'POST') {
+                sendJson(res, 405, { ok: false, code: 'method-not-allowed' });
+                return;
+            }
+            const svc = getSettingsSvc();
+            const mutate = svc === undefined ? undefined : svc.mutate;
+            if (typeof mutate !== 'function') {
+                sendJson(res, 200, { ok: false, code: 'settings-unavailable', message: 'settings service mutate not available' });
+                return;
+            }
+            readJsonBody(req).then((body) => {
+                const ops = body.ops;
+                if (!Array.isArray(ops) || ops.some((op) => !op || typeof op !== 'object' || !(op.op in { set: 1, unset: 1 }))) {
+                    sendJson(res, 200, { ok: false, code: 'settings-rejected', message: 'malformed bridge mutate ops' });
+                    return;
+                }
+                const expectedRevision = typeof body.expectedRevision === 'number' ? body.expectedRevision : undefined;
+                mutate
+                    .call(svc, ns, ops, expectedRevision)
+                    .then(() => {
+                    // mutate 成功即 describe 回填（规范：写路径仍归口宿主服务，无第二份状态）
+                    const descriptor = svc
+                        .describe({ redactSecrets: true })
+                        .find((d) => d.ns === ns);
+                    if (descriptor === undefined) {
+                        sendJson(res, 200, { ok: false, code: 'internal', message: `namespace "${ns}" disposed after mutate` });
+                        return;
+                    }
+                    sendJson(res, 200, { ok: true, value: { descriptor } });
+                })
+                    .catch((e) => {
+                    sendJson(res, 200, isConflict(e)
+                        ? { ok: false, code: 'settings-conflict', message: e instanceof Error ? e.message : String(e) }
+                        : { ok: false, code: 'internal', message: e instanceof Error ? e.message : String(e) });
+                });
+            }).catch((e) => {
+                sendJson(res, 200, { ok: false, code: 'bad-request', message: e instanceof Error ? e.message : String(e) });
+            });
+        },
+    }));
+    return offs;
+}

package/lib/client.js

@@ -1701,6 +1701,13 @@ window.__ModuleLoader__.load({
 		* default so the section reads as an open page of drawers.
 		*/
 		function PermissiveCard({ t, scope }) {
+			if (!scope) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: {
+					padding: 16,
+					color: "var(--dsw-alias-label-tertiary, #888)"
+				},
+				children: [t("card.unavailable"), "（scope 未解析 — 诊断占位）"]
+			});
 			const [open, setOpen] = (0, react.useState)(true);
 			const [apiKeyDraft, setApiKeyDraft] = (0, react.useState)("");
 			const [allowText, setAllowText] = (0, react.useState)("");
@@ -1708,7 +1715,13 @@ window.__ModuleLoader__.load({
 			const snapshot = (0, react.useSyncExternalStore)((listener) => scope.subscribe(listener), () => scope.getSnapshot());
 			const unavailable = snapshot.status === "unavailable";
 			const readonly = unavailable || !snapshot.writable;
-			const value = snapshot.value ?? {};
+			const raw = snapshot.value ?? {};
+			const listOf = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+			const value = {
+				...raw,
+				allowlist: listOf(raw.allowlist),
+				denyKeywords: listOf(raw.denyKeywords)
+			};
 			const strategies = value.permissiveStrategies ?? {};
 			const hasApiKey = typeof value.classifierApiKey === "string" && value.classifierApiKey !== "";
 			const effective = value.permissive === true;
@@ -4234,17 +4247,125 @@ window.__ModuleLoader__.load({
 		*
 		* Both variants are scoped sub-injects: on a host without the service the fiber
 		* waits forever WITHOUT blocking the plugin's other faces (same posture as the
-		* notice strip's slot-inject when its slot holder is absent).
+		* notice strip's slot-inject when its slot holder is absent). session-guard
+		* 4.1.0 proves the `settingsScope` branch resolves on 0.1.5-rc.3 (its
+		* shell.overlay gear registers inside this callback and renders there).
 		*/
 		function resolveSettingsScope(ctx, namespace, onScope) {
 			ctx.inject(["configForms"], (configForms) => {
-				onScope(configForms.get(namespace));
+				onScope(configForms.get(namespace), "configForms");
 			});
 			ctx.inject(["settingsScope"], (settingsScope) => {
-				onScope(settingsScope.bind({ namespace }));
+				onScope(settingsScope.bind({ namespace }), "settingsScope");
 			});
 		}
 		//#endregion
+		//#region src/client/bridge-scope.ts
+		/** 与 server 侧 bridgeRoutesFor（src/bridge.ts）必须逐字符一致。 */
+		function bridgeRoutesFor(ns) {
+			return {
+				describe: `/api/${ns}/settings/describe`,
+				mutate: `/api/${ns}/settings/mutate`
+			};
+		}
+		var BridgeDocHandle = class {
+			snapshot = {
+				status: "pending",
+				value: void 0,
+				writable: true
+			};
+			listeners = /* @__PURE__ */ new Set();
+			revision;
+			inflight;
+			routes;
+			constructor(ns) {
+				this.routes = bridgeRoutesFor(ns);
+				this.refresh();
+			}
+			getSnapshot() {
+				return this.snapshot;
+			}
+			subscribe(listener) {
+				this.listeners.add(listener);
+				return () => {
+					this.listeners.delete(listener);
+				};
+			}
+			async set(field, value) {
+				await this.mutate([{
+					op: "set",
+					path: [field],
+					value
+				}]);
+			}
+			async unset(field) {
+				await this.mutate([{
+					op: "unset",
+					path: [field]
+				}]);
+			}
+			notify() {
+				for (const l of [...this.listeners]) l();
+			}
+			async request(path, body) {
+				const response = await fetch(path, {
+					method: "POST",
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify(body ?? {})
+				});
+				if (!response.ok) throw new Error(`bridge ${path} HTTP ${response.status}`);
+				return await response.json();
+			}
+			async refresh() {
+				if (this.inflight !== void 0) return this.inflight;
+				this.inflight = (async () => {
+					try {
+						const body = await this.request(this.routes.describe);
+						if (body.ok && body.value?.descriptor !== void 0) {
+							const d = body.value.descriptor;
+							this.revision = typeof d.revision === "number" ? d.revision : void 0;
+							this.snapshot = {
+								status: "ready",
+								value: d.value,
+								writable: body.value.writable !== false
+							};
+						} else this.snapshot = {
+							status: "error",
+							value: void 0,
+							writable: false
+						};
+					} catch {
+						this.snapshot = {
+							status: "error",
+							value: void 0,
+							writable: false
+						};
+					} finally {
+						this.inflight = void 0;
+					}
+					this.notify();
+				})();
+				return this.inflight;
+			}
+			async mutate(ops) {
+				const body = await this.request(this.routes.mutate, {
+					ops,
+					expectedRevision: this.revision
+				});
+				if (body.ok && body.value?.descriptor !== void 0) {
+					const d = body.value.descriptor;
+					this.revision = typeof d.revision === "number" ? d.revision : void 0;
+					this.snapshot = {
+						status: "ready",
+						value: d.value,
+						writable: this.snapshot.writable
+					};
+				} else if (body.code === "settings-conflict") await this.refresh();
+				else throw new Error(`bridge mutate failed: ${body.code ?? "unknown"} ${body.message ?? ""}`);
+				this.notify();
+			}
+		};
+		//#endregion
 		//#region src/client/index.ts
 		/** The profile entry id of this plugin — the `configForms` key (kept in lockstep with cordis.patch.yml). */
 		const PERMISSIVE_NS = "dsh-perm-gate";
@@ -4283,7 +4404,21 @@ window.__ModuleLoader__.load({
 				}, HistoryView);
 			});
 			const t = ctx.locale.bind(NS);
-			resolveSettingsScope(ctx, PERMISSIVE_NS, (scope) => {
+			const safe = (tag, fn) => {
+				try {
+					fn();
+				} catch (e) {
+					(globalThis.__pgSurf ??= []).push(`${tag}: ${e?.message ?? String(e)}`);
+					console.warn(`[dsh-perm-gate] client surface '${tag}' failed:`, e);
+				}
+			};
+			const scopeRef = {};
+			resolveSettingsScope(ctx, PERMISSIVE_NS, (scope, _generation) => {
+				scopeRef.scope = scope;
+			});
+			const bridgeScope = new BridgeDocHandle(PERMISSIVE_NS);
+			const cardInjected = () => ({ scope: scopeRef.scope ?? bridgeScope });
+			safe("settings.section", () => {
 				ctx.slots.inject("settings.section", function* () {
 					yield ctx.slots.register({
 						name: "settings.section",
@@ -4291,14 +4426,16 @@ window.__ModuleLoader__.load({
 						order: 30,
 						label: () => t("section.title"),
 						locale: NS,
-						inject: () => ({ scope })
+						inject: cardInjected
 					}, PermissiveCard);
 				});
+			});
+			safe("plugins.bundle.config", () => {
 				ctx.slots.inject("plugins.bundle.config", () => ctx.slots.register({
 					name: "plugins.bundle.config",
 					key: "dsh-perm-gate",
 					locale: NS,
-					inject: () => ({ scope })
+					inject: cardInjected
 				}, PermissiveCard));
 			});
 		}