dsh-perm-gate 5.1.0 → 5.1.2-compat.7

package/dsh.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "dsh-perm-gate",
   "name": "dsh-perm-gate",
-  "version": "5.1.0",
+  "version": "5.1.2-compat.7",
   "description": {
     "en": "Deterministic-first, fail-closed permission gate for DeepSeek Harness 0.1.2+: a P0 hard-deny -> P1 precise session grant -> P2 static allow/deny rule chain -> P3 optional LLM classifier -> P4 ask pipeline over the tools/pre-execute waterfall, with a standalone CLI dry-run evaluator and an auditable decision log. It only vetoes with deny/ask and always delegates otherwise, and unknown or malformed rules fail loud instead of silently standing the gate down.",
     "zh": "面向 DeepSeek Harness 0.1.2+ 的确定性优先、失败即拒的权限闸门：在 tools/pre-execute 瀑布上串起 P0 硬拒绝 → P1 精确会话授权 → P2 静态 allow/deny 规则链 → P3 可选 LLM 语义分类 → P4 ask，并附带独立 CLI 干跑评估器与可审计的决策日志。只以 deny/ask 否决、其余一律放行，规则未知或非法时直接报错，绝不静默失效。"

package/lib/bridge.d.ts

@@ -0,0 +1,34 @@
+/**
+ * settings bridge — T12（spec webServer 数据桥规范）：describe/mutate 两端点。
+ *
+ * 桥只是 HTTP 皮：读 = svc.describe 取自家 ns 描述符；写 = svc.mutate 转 ops 落
+ * 宿主 settings 服务（不落盘不缓存第二份，天然规避双写/锁竞争）。mutate 成功即
+ * describe 回填，带 expectedRevision 乐观并发。守卫：POST-only + ns 硬编码自家
+ * allowlist + 秘密不回读（redactSecrets）。
+ *
+ * 数据面消费方 = client BridgeDocHandle（T13b 双轨数据源：0.1.7+ 原生句柄优先，
+ * ≤0.1.5 settingsScope 不解析时落到本桥——free-search 同架构）。
+ */
+interface SettingsServiceLike {
+    update(ns: string, patch: object): Promise<void>;
+    register?(ns: string, schema: unknown, options?: {
+        base?: unknown;
+    }): unknown;
+    installSection?(owner: unknown, ns: string, schema: unknown, entry: unknown, hooks: unknown): unknown;
+    describe?(o?: {
+        redactSecrets?: boolean;
+    }): Array<{
+        ns: unknown;
+        [k: string]: unknown;
+    }>;
+    mutate?(ns: string, ops: Array<{
+        op: string;
+        path: string[];
+        value?: unknown;
+    }>, expectedRevision?: number): Promise<unknown>;
+    writable?: boolean;
+}
+export declare const BRIDGE_DESCRIBE_ROUTE = "/api/dsh-perm-gate/settings/describe";
+export declare const BRIDGE_MUTATE_ROUTE = "/api/dsh-perm-gate/settings/mutate";
+export declare function registerSettingsBridgeRoutes(server: unknown, getSettingsSvc: () => SettingsServiceLike | undefined, ns: string): Array<() => void>;
+export {};

package/lib/bridge.js

@@ -0,0 +1,125 @@
+export const BRIDGE_DESCRIBE_ROUTE = '/api/dsh-perm-gate/settings/describe';
+export const BRIDGE_MUTATE_ROUTE = '/api/dsh-perm-gate/settings/mutate';
+function readJsonBody(reqRaw, limit = 256 * 1024) {
+    const req = reqRaw;
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            const buf = chunk;
+            size += buf.length;
+            if (size > limit) {
+                reject(new Error('bridge body too large'));
+                req.resume?.();
+                return;
+            }
+            chunks.push(buf);
+        });
+        req.on('end', () => {
+            const raw = Buffer.concat(chunks).toString('utf8');
+            if (raw === '') {
+                resolve({});
+                return;
+            }
+            try {
+                resolve(JSON.parse(raw));
+            }
+            catch (e) {
+                reject(e instanceof Error ? e : new Error(String(e)));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+function sendJson(res, code, body) {
+    res.writeHead(code, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-cache' });
+    res.end(JSON.stringify(body));
+}
+function isConflict(e) {
+    return e instanceof Error && /conflict|revision/i.test(e.message);
+}
+export function registerSettingsBridgeRoutes(server, getSettingsSvc, ns) {
+    if (typeof server !== 'object' || server === null)
+        return [];
+    const ws = typeof server.register === 'function' ? server : undefined;
+    if (ws === undefined)
+        return [];
+    const offs = [];
+    offs.push(ws.register({
+        kind: 'exact',
+        path: BRIDGE_DESCRIBE_ROUTE,
+        handler: (rawReq, rawRes) => {
+            const req = rawReq;
+            const res = rawRes;
+            if (req.method !== 'POST') {
+                sendJson(res, 405, { ok: false, code: 'method-not-allowed' });
+                return;
+            }
+            const svc = getSettingsSvc();
+            if (svc === undefined || typeof svc.describe !== 'function') {
+                sendJson(res, 200, { ok: false, code: 'settings-unavailable', message: 'settings service not resolved yet' });
+                return;
+            }
+            try {
+                const descriptor = svc
+                    .describe({ redactSecrets: true })
+                    .find((d) => d.ns === ns);
+                if (descriptor === undefined) {
+                    sendJson(res, 200, { ok: false, code: 'ns-not-registered', message: `settings namespace "${ns}" is not registered` });
+                    return;
+                }
+                sendJson(res, 200, { ok: true, value: { descriptor, writable: svc.writable !== false } });
+            }
+            catch (e) {
+                sendJson(res, 200, { ok: false, code: 'internal', message: e instanceof Error ? e.message : String(e) });
+            }
+        },
+    }));
+    offs.push(ws.register({
+        kind: 'exact',
+        path: BRIDGE_MUTATE_ROUTE,
+        handler: (rawReq, rawRes) => {
+            const req = rawReq;
+            const res = rawRes;
+            if (req.method !== 'POST') {
+                sendJson(res, 405, { ok: false, code: 'method-not-allowed' });
+                return;
+            }
+            const svc = getSettingsSvc();
+            const mutate = svc === undefined ? undefined : svc.mutate;
+            if (typeof mutate !== 'function') {
+                sendJson(res, 200, { ok: false, code: 'settings-unavailable', message: 'settings service mutate not available' });
+                return;
+            }
+            readJsonBody(req).then((body) => {
+                const ops = body.ops;
+                if (!Array.isArray(ops) || ops.some((op) => !op || typeof op !== 'object' || !(op.op in { set: 1, unset: 1 }))) {
+                    sendJson(res, 200, { ok: false, code: 'settings-rejected', message: 'malformed bridge mutate ops' });
+                    return;
+                }
+                const expectedRevision = typeof body.expectedRevision === 'number' ? body.expectedRevision : undefined;
+                mutate
+                    .call(svc, ns, ops, expectedRevision)
+                    .then(() => {
+                    // mutate 成功即 describe 回填（规范：写路径仍归口宿主服务，无第二份状态）
+                    const descriptor = svc
+                        .describe({ redactSecrets: true })
+                        .find((d) => d.ns === ns);
+                    if (descriptor === undefined) {
+                        sendJson(res, 200, { ok: false, code: 'internal', message: `namespace "${ns}" disposed after mutate` });
+                        return;
+                    }
+                    sendJson(res, 200, { ok: true, value: { descriptor } });
+                })
+                    .catch((e) => {
+                    sendJson(res, 200, isConflict(e)
+                        ? { ok: false, code: 'settings-conflict', message: e instanceof Error ? e.message : String(e) }
+                        : { ok: false, code: 'internal', message: e instanceof Error ? e.message : String(e) });
+                });
+            }).catch((e) => {
+                sendJson(res, 200, { ok: false, code: 'bad-request', message: e instanceof Error ? e.message : String(e) });
+            });
+        },
+    }));
+    return offs;
+}

package/lib/client.js

@@ -1701,6 +1701,13 @@ window.__ModuleLoader__.load({
 		* default so the section reads as an open page of drawers.
 		*/
 		function PermissiveCard({ t, scope }) {
+			if (!scope) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: {
+					padding: 16,
+					color: "var(--dsw-alias-label-tertiary, #888)"
+				},
+				children: [t("card.unavailable"), "（scope 未解析 — 诊断占位）"]
+			});
 			const [open, setOpen] = (0, react.useState)(true);
 			const [apiKeyDraft, setApiKeyDraft] = (0, react.useState)("");
 			const [allowText, setAllowText] = (0, react.useState)("");
@@ -1708,7 +1715,13 @@ window.__ModuleLoader__.load({
 			const snapshot = (0, react.useSyncExternalStore)((listener) => scope.subscribe(listener), () => scope.getSnapshot());
 			const unavailable = snapshot.status === "unavailable";
 			const readonly = unavailable || !snapshot.writable;
-			const value = snapshot.value ?? {};
+			const raw = snapshot.value ?? {};
+			const listOf = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+			const value = {
+				...raw,
+				allowlist: listOf(raw.allowlist),
+				denyKeywords: listOf(raw.denyKeywords)
+			};
 			const strategies = value.permissiveStrategies ?? {};
 			const hasApiKey = typeof value.classifierApiKey === "string" && value.classifierApiKey !== "";
 			const effective = value.permissive === true;
@@ -3087,6 +3100,83 @@ window.__ModuleLoader__.load({
 				}) : null]
 			});
 		}
+		/** 浮窗齿轮 + 固定定位浮层承载完整审批门卡。自绘定位,不依赖宿主容器布局。 */
+		function FloatingPermissiveGate(props) {
+			const [open, setOpen] = (0, react.useState)(false);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: {
+					position: "fixed",
+					right: 16,
+					bottom: 64,
+					zIndex: 1e4
+				},
+				children: [
+					open ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						onClick: () => setOpen(false),
+						style: {
+							position: "fixed",
+							top: 0,
+							left: 0,
+							right: 0,
+							bottom: 0,
+							background: "rgba(0,0,0,.45)",
+							zIndex: 1e4
+						}
+					}) : null,
+					open ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						style: {
+							position: "fixed",
+							top: "6vh",
+							left: "50%",
+							transform: "translateX(-50%)",
+							width: "min(760px, 92vw)",
+							maxHeight: "84vh",
+							overflowY: "auto",
+							zIndex: 10001
+						},
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							onClick: () => setOpen(false),
+							style: {
+								position: "sticky",
+								top: 6,
+								float: "right",
+								marginRight: 8,
+								zIndex: 2,
+								font: "inherit",
+								cursor: "pointer",
+								borderRadius: 8,
+								border: "1px solid rgba(127,127,127,.4)",
+								background: "rgba(30,30,32,.85)",
+								color: "inherit",
+								padding: "2px 10px"
+							},
+							children: "✕ 关闭"
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PermissiveCard, {
+							t: props.t,
+							scope: props.scope
+						})]
+					}) : null,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						title: "审批门设置",
+						onClick: () => setOpen(!open),
+						style: {
+							width: 40,
+							height: 40,
+							borderRadius: "50%",
+							border: "1px solid rgba(127,127,127,.4)",
+							background: "rgba(30,30,32,.85)",
+							color: "inherit",
+							cursor: "pointer",
+							fontSize: 16,
+							boxShadow: "0 4px 16px rgba(0,0,0,.35)"
+						},
+						children: "🛡"
+					})
+				]
+			});
+		}
 		//#endregion
 		//#region src/client/feed.ts
 		/** Fetch decision events for one session; `since > 0` returns only newer ones. */
@@ -4234,17 +4324,118 @@ window.__ModuleLoader__.load({
 		*
 		* Both variants are scoped sub-injects: on a host without the service the fiber
 		* waits forever WITHOUT blocking the plugin's other faces (same posture as the
-		* notice strip's slot-inject when its slot holder is absent).
+		* notice strip's slot-inject when its slot holder is absent). session-guard
+		* 4.1.0 proves the `settingsScope` branch resolves on 0.1.5-rc.3 (its
+		* shell.overlay gear registers inside this callback and renders there).
 		*/
 		function resolveSettingsScope(ctx, namespace, onScope) {
 			ctx.inject(["configForms"], (configForms) => {
-				onScope(configForms.get(namespace));
+				onScope(configForms.get(namespace), "configForms");
 			});
 			ctx.inject(["settingsScope"], (settingsScope) => {
-				onScope(settingsScope.bind({ namespace }));
+				onScope(settingsScope.bind({ namespace }), "settingsScope");
 			});
 		}
 		//#endregion
+		//#region src/client/bridge-scope.ts
+		const DESCRIBE = "/api/dsh-perm-gate/settings/describe";
+		const MUTATE = "/api/dsh-perm-gate/settings/mutate";
+		var BridgeDocHandle = class {
+			snapshot = {
+				status: "pending",
+				value: void 0,
+				writable: true
+			};
+			listeners = /* @__PURE__ */ new Set();
+			revision;
+			inflight;
+			constructor() {
+				this.refresh();
+			}
+			getSnapshot() {
+				return this.snapshot;
+			}
+			subscribe(listener) {
+				this.listeners.add(listener);
+				return () => {
+					this.listeners.delete(listener);
+				};
+			}
+			async set(field, value) {
+				await this.mutate([{
+					op: "set",
+					path: [field],
+					value
+				}]);
+			}
+			async unset(field) {
+				await this.mutate([{
+					op: "unset",
+					path: [field]
+				}]);
+			}
+			notify() {
+				for (const l of [...this.listeners]) l();
+			}
+			async request(path, body) {
+				const response = await fetch(path, {
+					method: "POST",
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify(body ?? {})
+				});
+				if (!response.ok) throw new Error(`bridge ${path} HTTP ${response.status}`);
+				return await response.json();
+			}
+			async refresh() {
+				if (this.inflight !== void 0) return this.inflight;
+				this.inflight = (async () => {
+					try {
+						const body = await this.request(DESCRIBE);
+						if (body.ok && body.value?.descriptor !== void 0) {
+							const d = body.value.descriptor;
+							this.revision = typeof d.revision === "number" ? d.revision : void 0;
+							this.snapshot = {
+								status: "ready",
+								value: d.value,
+								writable: body.value.writable !== false
+							};
+						} else this.snapshot = {
+							status: "error",
+							value: void 0,
+							writable: false
+						};
+					} catch {
+						this.snapshot = {
+							status: "error",
+							value: void 0,
+							writable: false
+						};
+					} finally {
+						this.inflight = void 0;
+					}
+					this.notify();
+				})();
+				return this.inflight;
+			}
+			async mutate(ops) {
+				const body = await this.request(MUTATE, {
+					ops,
+					expectedRevision: this.revision
+				});
+				if (body.ok && body.value?.descriptor !== void 0) {
+					const d = body.value.descriptor;
+					this.revision = typeof d.revision === "number" ? d.revision : void 0;
+					this.snapshot = {
+						status: "ready",
+						value: d.value,
+						writable: this.snapshot.writable
+					};
+				} else if (body.code === "settings-conflict") await this.refresh();
+				else throw new Error(`bridge mutate failed: ${body.code ?? "unknown"} ${body.message ?? ""}`);
+				this.notify();
+			}
+		};
+		//#endregion
 		//#region src/client/index.ts
 		/** The profile entry id of this plugin — the `configForms` key (kept in lockstep with cordis.patch.yml). */
 		const PERMISSIVE_NS = "dsh-perm-gate";
@@ -4283,7 +4474,21 @@ window.__ModuleLoader__.load({
 				}, HistoryView);
 			});
 			const t = ctx.locale.bind(NS);
-			resolveSettingsScope(ctx, PERMISSIVE_NS, (scope) => {
+			const safe = (tag, fn) => {
+				try {
+					fn();
+				} catch (e) {
+					(globalThis.__pgSurf ??= []).push(`${tag}: ${e?.message ?? String(e)}`);
+					console.warn(`[dsh-perm-gate] client surface '${tag}' failed:`, e);
+				}
+			};
+			const scopeRef = {};
+			resolveSettingsScope(ctx, PERMISSIVE_NS, (scope, _generation) => {
+				scopeRef.scope = scope;
+			});
+			const bridgeScope = new BridgeDocHandle();
+			const cardInjected = () => ({ scope: scopeRef.scope ?? bridgeScope });
+			safe("settings.section", () => {
 				ctx.slots.inject("settings.section", function* () {
 					yield ctx.slots.register({
 						name: "settings.section",
@@ -4291,16 +4496,50 @@ window.__ModuleLoader__.load({
 						order: 30,
 						label: () => t("section.title"),
 						locale: NS,
-						inject: () => ({ scope })
+						inject: cardInjected
 					}, PermissiveCard);
 				});
+			});
+			safe("plugins.bundle.config", () => {
 				ctx.slots.inject("plugins.bundle.config", () => ctx.slots.register({
 					name: "plugins.bundle.config",
 					key: "dsh-perm-gate",
 					locale: NS,
-					inject: () => ({ scope })
+					inject: cardInjected
+				}, PermissiveCard));
+			});
+			safe("settings.plugins.tab", () => {
+				ctx.slots.inject("settings.plugins.tab", () => ctx.slots.register({
+					name: "settings.plugins.tab",
+					id: PERMISSIVE_NS,
+					order: 50,
+					label: () => t("section.title"),
+					locale: NS,
+					inject: cardInjected
+				}, PermissiveCard));
+			});
+			safe("settings.plugin.item", () => {
+				const itemSlots = ctx.slots;
+				itemSlots.inject("settings.plugin.item", () => itemSlots.register({
+					name: "settings.plugin.item",
+					id: PERMISSIVE_NS,
+					key: PERMISSIVE_NS,
+					order: 40,
+					locale: NS,
+					inject: cardInjected
 				}, PermissiveCard));
 			});
+			safe("shell.overlay", () => {
+				const overlaySlots = ctx.slots;
+				overlaySlots.inject("shell.overlay", () => overlaySlots.register({
+					name: "shell.overlay",
+					id: PERMISSIVE_NS,
+					inject: () => ({
+						t,
+						scope: scopeRef.scope ?? bridgeScope
+					})
+				}, FloatingPermissiveGate));
+			});
 		}
 		//#endregion
 		exports.apply = apply;