dsh-perm-gate 5.1.0 → 5.1.2-compat.7

package/lib/debug-generation.d.ts

@@ -0,0 +1,21 @@
+/**
+ * debug-generation — T10b served 集合诊断端点（临时，上线前删，spec served 七步第 2 步）。
+ *
+ * GET /api/dsh-perm-gate/debug-generation
+ * 返回插件持有的 settings 服务实例自检：全量 describe 的 ns 列表 + 方法面。
+ * 判读：ns 列表若同时含 dsh-perm-gate / dsh-session-guard / dsh-free-search-settings
+ * 等其他插件命名空间 → 持有的是宿主共享单例（identitySame=TRUE，H3 孤儿假设死）；
+ * 若只有自家 ns → 孤儿实例坐实（H3 成立）。
+ */
+export interface SettingsServiceLike {
+    update(ns: string, patch: object): Promise<void>;
+    register?(ns: string, schema: unknown, options?: {
+        base?: unknown;
+    }): unknown;
+    installSection?(owner: unknown, ns: string, schema: unknown, entry: unknown, hooks: unknown): unknown;
+    describe?(): Array<{
+        ns: unknown;
+    }>;
+}
+export declare const DEBUG_GENERATION_ROUTE = "/api/dsh-perm-gate/debug-generation";
+export declare function registerDebugGenerationRoute(server: unknown, getSettingsSvc: () => SettingsServiceLike | undefined): (() => void) | undefined;

package/lib/debug-generation.js

@@ -0,0 +1,44 @@
+export const DEBUG_GENERATION_ROUTE = '/api/dsh-perm-gate/debug-generation';
+export function registerDebugGenerationRoute(server, getSettingsSvc) {
+    if (typeof server !== 'object' || server === null)
+        return undefined;
+    const ws = typeof server.register === 'function' ? server : undefined;
+    if (ws === undefined || typeof ws.register !== 'function')
+        return undefined;
+    return ws.register({
+        kind: 'exact',
+        path: DEBUG_GENERATION_ROUTE,
+        handler: (rawReq, rawRes) => {
+            const req = rawReq;
+            const res = rawRes;
+            if (req.method !== 'GET' && req.method !== 'HEAD') {
+                res.writeHead(405);
+                res.end();
+                return;
+            }
+            const svc = getSettingsSvc();
+            let namespaces = [];
+            let describeError;
+            if (svc !== undefined && typeof svc.describe === 'function') {
+                try {
+                    const descriptors = svc.describe();
+                    namespaces = descriptors.map((d) => String(d.ns));
+                }
+                catch (e) {
+                    describeError = e instanceof Error ? e.message : String(e);
+                }
+            }
+            res.writeHead(200, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({
+                hasSvc: svc !== undefined,
+                describeError,
+                namespaces,
+                methods: svc === undefined ? null : {
+                    register: typeof svc.register === 'function',
+                    installSection: typeof svc.installSection === 'function',
+                    update: typeof svc.update === 'function',
+                },
+            }, null, 2));
+        },
+    });
+}

package/lib/index.js

@@ -1,10 +1,12 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { SandboxController } from './appcontainer/index.js';
-import { Config, ensureDataDir, readRulesFromSettings, readVolatileValue, resolveVolatileConfig, resolveDshHome, resolveDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
+import { Config, ensureDataDir, readRulesFromSettings, readVolatileValue, resolveVolatileConfig, resolveConfig, resolveDshHome, resolveDataDir, resolveGatePresets, resolvePermissiveStrategies, resolveRulesFile } from './config.js';
 import { appendAllowToSettings, readRulesFileDoc, replaceAllowInSettings } from './allowlist.js';
 import { runDryRun } from './dry-run.js';
 import { registerDryRunRoute, registerEventsRoute, registerHealthRoute, registerLearningRoute, registerNetworkRoute, registerReceiverRoute, registerReviewRoutes, registerRulesRoute } from './events.js';
+// T12 设置数据桥（describe/mutate；client BridgeDocHandle 消费）
+import { registerSettingsBridgeRoutes } from './bridge.js';
 import { buildReceiverInfo } from './receiver-info.js';
 import { readRulesView, readRulesViewFromSettings } from './rules-view.js';
 import { PermGateRuntime } from './runtime.js';
@@ -188,7 +190,7 @@ export function makePreExecuteListener(runtime) {
 export function apply(ctx, config = {}) {
     // Runtime-adjustable config: 0.1.7 hands `.volatile()` fields to apply() as
     // live refs; `current()` shallow-resolves one snapshot per read.
-    const current = () => resolveVolatileConfig(config);
+    let current = () => resolveVolatileConfig(config);
     // ─── Rules (volatile `rules` field on this entry) ─────────────────────────
     // The rules document is a `.volatile()` whole-object field of the plugin's
     // own entry (0.1.7 has no second projectable namespace). Unconfigured
@@ -207,17 +209,104 @@ export function apply(ctx, config = {}) {
     ctx.inject(['settings'], (child) => {
         const svc = child.settings;
         settingsRef.svc = svc;
+        if (svc === undefined)
+            return;
+        // setSource 换绑运行时读取源:source 可能是 () => values(≤0.1.5 scope.get)
+        // 或普通对象;base 与运行时读分用两个 resolve(手册 §P1-3)。
+        const rebindFrom = (source) => {
+            current = () => resolveVolatileConfig((typeof source === 'function' ? source() : (source ?? config)));
+        };
+        const seedDoc = () => ({ ...readRulesFileDoc(rulesFilePath), initialized: true });
+        const seedUpdate = () => svc.update(ENTRY_ID, { rules: seedDoc() });
+        // F4 加固（spec served 段判「无论如何无条件做」）：宿主 installSection 在
+        // register 之后同步调 setSource（dsh-settings 0.1.5 lib/index.js:332），换绑
+        // 或 onChange 抛错会从 installSection 一路抛穿插件加载、连带注册失败——
+        // 这里兜住异常保住注册（卡派发依赖 ns∈served，注册比换绑成败更金贵）。
+        const guardedSetSource = (source) => {
+            try {
+                rebindFrom(source);
+                hooks.onChange();
+            }
+            catch (e) {
+                console.warn('[dsh-perm-gate] setSource rebind failed (registration kept):', e);
+            }
+        };
+        const hooks = {
+            setSource: guardedSetSource,
+            onChange: () => { applyVolatileUpdate(); },
+        };
         // Activation-time seed: a never-configured `rules` field is populated once
         // — from the rules file when one exists (implicit migration), otherwise a
         // bare starter document — and marked `initialized`, so the panel shows a
         // live rules document from the first boot instead of a missing-file
         // fallback. The field watcher below picks the seed up via reload.
-        if (svc !== undefined && readRulesDocument() === undefined) {
-            const seed = { ...readRulesFileDoc(rulesFilePath), initialized: true };
-            void svc.update(ENTRY_ID, { rules: seed }).catch((e) => {
-                console.warn('[dsh-perm-gate] rules seed write failed:', e);
+        // ── 三代 waist:三分支执行体互斥(P1-1/P1-2),register-retry 仅存活于
+        // 兜底分支且在 rc.1+ 永不命中;rc.1+ 不引入 configure(P1-5)。
+        if (typeof svc.installSection === 'function') {
+            console.warn('[dsh-perm-gate] settings generation = service.installSection (0.1.2/0.1.5 line)');
+            svc.installSection(ctx, ENTRY_ID, Config, resolveConfig(config), {
+                setSource: guardedSetSource,
+                onChange: () => { applyVolatileUpdate(); },
             });
+            if (readRulesDocument() === undefined) {
+                void seedUpdate().catch((e) => {
+                    console.warn('[dsh-perm-gate] legacy seed update failed:', e);
+                });
+            }
+            return;
         }
+        void (async () => {
+            try {
+                // 变量说明符:dsh-settings 现为 optional peer(T35,2026-10-07——dependencies
+                // 硬钉 0.1.1-rc.2 已删:六线运行时它本来就无效——0.1.5 分支互斥不加载、老线
+                // nested 链接悬空后动态 import 经 node 向上解析落宿主自身副本,见
+                // cross-version-adaptation-all/findings.md T10b 附录)。变量形式让 TS 按 any
+                // 解析不做模块查证;另注意 ctx.get 不跨插件隔离上下文(index.ts:44),
+                // legacy 分支只能动态 import,不能 ctx.get 直取宿主单例。
+                const legacySpecifier = '@deepseek-ai/dsh-settings';
+                const legacy = (await import(legacySpecifier));
+                if (typeof legacy.installSettingsSection === 'function' && typeof legacy.settingsNamespace === 'function') {
+                    console.warn('[dsh-perm-gate] settings generation = module.installSettingsSection (0.1.0/0.1.1 line)');
+                    legacy.installSettingsSection(ctx, legacy.settingsNamespace(ENTRY_ID), Config, resolveConfig(config), {
+                        setSource: (source) => {
+                            rebindFrom(source);
+                            hooks.onChange();
+                        },
+                        onChange: () => { applyVolatileUpdate(); },
+                    });
+                    if (readRulesDocument() === undefined) {
+                        await seedUpdate().catch((e) => {
+                            console.warn('[dsh-perm-gate] legacy seed update failed:', e);
+                        });
+                    }
+                    return;
+                }
+            }
+            catch {
+                // 模块级 legacy API 缺失/导入失败 → 落到 rc.1 兜底
+            }
+            console.warn('[dsh-perm-gate] settings generation = rc1.loader (rc.1+: loader 自动注册 ns,update 直接成功;register-retry 兜底永不命中)');
+            if (readRulesDocument() === undefined) {
+                void (async () => {
+                    try {
+                        await seedUpdate();
+                    }
+                    catch (e) {
+                        const message = e instanceof Error ? e.message : String(e);
+                        // register-retry 兜底:rc.1+ 上 ns 已被 loader 占用,永不命中
+                        if (!/not registered/i.test(message) || typeof svc.register !== 'function') {
+                            throw e;
+                        }
+                        console.warn(`[dsh-perm-gate] legacy fallback: registering settings namespace ${ENTRY_ID}`);
+                        svc.register(ENTRY_ID, Config, { base: { rules: seedDoc() } });
+                        await seedUpdate();
+                        console.warn('[dsh-perm-gate] legacy fallback registered + seeded');
+                    }
+                })().catch((e) => {
+                    console.warn('[dsh-perm-gate] rules seed write failed:', e);
+                });
+            }
+        })();
     });
     const settingsWrite = (write) => {
         const svc = settingsRef.svc;
@@ -478,7 +567,7 @@ export function apply(ctx, config = {}) {
     // The host no longer seeds settings (there is no write path): an empty
     // `allowlist` keeps the rules-file default via `runtime.allowlist()`.
     let lastRulesDocKey;
-    ctx.on('loader/volatile-update', () => {
+    function applyVolatileUpdate() {
         const next = asSurface(current());
         if (next !== undefined) {
             if (Array.isArray(next.allowlist)) {
@@ -506,6 +595,10 @@ export function apply(ctx, config = {}) {
             if (changed)
                 runtime.reload();
         }
+    }
+    ;
+    ctx.on('loader/volatile-update', () => {
+        applyVolatileUpdate();
     });
     // Event feed HTTP API (best effort): the dsh webServer service exposes the
     // JSONL decision events to the browser half; without it events stay on disk.
@@ -546,6 +639,10 @@ export function apply(ctx, config = {}) {
             const offHealth = registerHealthRoute(webServer, { check: () => runtime.healthCheck() });
             if (offHealth !== undefined)
                 ctx.effect(() => () => { offHealth(); }, 'dsh-perm-gate: health route');
+            // T12: 设置数据桥（client 卡在 settingsScope 不解析的线上由此取数/写回）
+            for (const offBridge of registerSettingsBridgeRoutes(webServer, () => settingsRef.svc, ENTRY_ID)) {
+                ctx.effect(() => () => { offBridge(); }, 'dsh-perm-gate: settings bridge route');
+            }
             // Network diagnostics: mode, bind, port, proxy liveness, env injection,
             // block counters and recent blocks. Read-only.
             const offNetwork = registerNetworkRoute(webServer, {

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "dsh-perm-gate",
-  "version": "5.1.0",
+  "version": "5.1.2-compat.7",
   "publishConfig": {
-    "tag": "latest"
+    "tag": "compat"
   },
   "description": "DSH permission-gate for the DeepSeek Harness 0.1.5 line: a single self-sufficient, deterministic-first, fail-closed gate covering P0 hard-deny -> P1 session grant -> P2 static rule (allow/deny) chain -> P3 optional LLM semantic classifier -> P4 ask, with command whitelist/blacklist.",
   "type": "module",
@@ -73,7 +73,9 @@
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/dsh-client-locale": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
     "@deepseek-ai/dsh-client-ui-renderer": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2"
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
+    "@deepseek-ai/dsh-settings": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2"
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.4",
@@ -94,7 +96,25 @@
     "tsdown": "^0.22.14",
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.69.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.0.0",
+    "@deepseek-ai/dsh-settings": "0.1.1-rc.2"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsdown",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run build",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.client.json --noEmit",
+    "lint": "eslint src test scripts tsdown.config.ts eslint.config.mjs",
+    "test": "vitest run",
+    "patch:glyph": "node scripts/patch-permission-glyph.mjs",
+    "patch:glyph:check": "node scripts/patch-permission-glyph.mjs --check",
+    "verify:line": "node scripts/verify-line.mjs new",
+    "verify:lines": "node scripts/verify-line.mjs both",
+    "check:line": "node scripts/sync-0.1.5-line.mjs check",
+    "release:latest": "npm publish --tag latest",
+    "release:2x": "npm publish --tag 2.x",
+    "release:legacy": "npm publish --tag legacy",
+    "release:3x": "npm publish --tag dsh-0.1.5"
   },
   "license": "MIT",
   "repository": {
@@ -138,21 +158,12 @@
     },
     "@deepseek-ai/dsh-client-ui-settings": {
       "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-conversation": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-settings": {
+      "optional": true
     }
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json && tsdown",
-    "typecheck": "tsc --noEmit && tsc -p tsconfig.client.json --noEmit",
-    "lint": "eslint src test scripts tsdown.config.ts eslint.config.mjs",
-    "test": "vitest run",
-    "patch:glyph": "node scripts/patch-permission-glyph.mjs",
-    "patch:glyph:check": "node scripts/patch-permission-glyph.mjs --check",
-    "verify:line": "node scripts/verify-line.mjs new",
-    "verify:lines": "node scripts/verify-line.mjs both",
-    "check:line": "node scripts/sync-0.1.5-line.mjs check",
-    "release:latest": "npm publish --tag latest",
-    "release:2x": "npm publish --tag 2.x",
-    "release:legacy": "npm publish --tag legacy",
-    "release:3x": "npm publish --tag dsh-0.1.5"
   }
-}
+}