dsh-perm-gate 5.2.0 → 5.3.1

package/lib/unattended.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Unattended tiers — which human-free implementations exist, and which permission preset
+ * each one owns.
+ *
+ * The shape, and why it is shaped this way: a mode is a property of the preset the user
+ * picks in the composer, never a background flow the gate adds to a session it was not
+ * asked to change. So each implementation has exactly one preset and exactly one switch
+ * that says whether it exists at all — one switch, one implementation, one tier. They do
+ * not cross: turning `safenetPass` off cannot make 自动审查 behave differently, and
+ * selecting `permissive-mech` does nothing unless that implementation is switched on.
+ *
+ * | switch       | preset            | who settles an ask                                   | model |
+ * | ------------ | ----------------- | ---------------------------------------------------- | ----- |
+ * | `permissive` | permissive(-full) | machine screen + grader refine, then a PERSON        | yes   |
+ * | `safenetAsk` | permissive-snet   | machine screen, then a PERSON — no grader at all      | no    |
+ * | `safenetPass`| permissive-mech   | the machine screen alone: named danger blocked+fed    | no    |
+ * | `yolo`       | permissive-yolo   | the grader answers in place of the person, always     | yes   |
+ *
+ * `yolo` is the model-backed tier and says so: with no reviewer in seat it is NOT silently
+ * a pass-through. The caller still has to decide what a missing grader means (see
+ * {@link YOLO_WITHOUT_REVIEWER}) but it must record that the tier could not do the thing it
+ * advertises, and the settings face must say so out loud.
+ *
+ * Everything here is pure string/enum work so the browser half can reuse the same truth.
+ */
+/** The three human-free implementations, named by what they do with an ask. */
+export type UnattendedMode = 'safety-net-ask' | 'safety-net-passthrough' | 'yolo';
+/** The preset each implementation owns. One switch, one preset — they never cross. */
+export declare const MODE_PRESETS: Readonly<Record<UnattendedMode, string>>;
+/** Every accepted mode, in the order the settings face should offer them. */
+export declare const UNATTENDED_MODES: readonly UnattendedMode[];
+/** The switches that decide whether each implementation exists. */
+export interface UnattendedSwitches {
+    readonly safenetAsk?: boolean;
+    readonly safenetPass?: boolean;
+    readonly yolo?: boolean;
+}
+/**
+ * The mode for one call, from the session's current permission preset plus which
+ * implementations are switched on.
+ *
+ * `null` means no human-free implementation owns this preset: the ordinary flow runs, and
+ * an ask goes to a person. A preset whose switch is off also returns `null` — the tier may
+ * still exist in the picker (profiles are not rewritten here), it simply has no
+ * implementation behind it, which is the honest reading of "the switch controls whether the
+ * implementation exists".
+ */
+export declare function resolveTierMode(preset: string | undefined, switches: UnattendedSwitches): UnattendedMode | null;
+/**
+ * Whether a mode takes the human out of the loop. `safety-net-ask` keeps them in — it
+ * exists to grade without a model, not to stop asking — so the decision seam only branches
+ * on the other two, and `safety-net-ask` instead suppresses the grader refine pass.
+ */
+export declare function isHumanFree(mode: UnattendedMode): boolean;
+/**
+ * What YOLO does when its grader is not in seat. It stays human-free (that is the tier's
+ * promise), settles on the mechanical screen alone, and the caller records that the model
+ * never answered — a tier that quietly becomes a different tier is the failure mode this
+ * whole module exists to avoid.
+ */
+export declare const YOLO_WITHOUT_REVIEWER: "settle-mechanically-and-label";

package/lib/unattended.js

@@ -0,0 +1,77 @@
+/**
+ * Unattended tiers — which human-free implementations exist, and which permission preset
+ * each one owns.
+ *
+ * The shape, and why it is shaped this way: a mode is a property of the preset the user
+ * picks in the composer, never a background flow the gate adds to a session it was not
+ * asked to change. So each implementation has exactly one preset and exactly one switch
+ * that says whether it exists at all — one switch, one implementation, one tier. They do
+ * not cross: turning `safenetPass` off cannot make 自动审查 behave differently, and
+ * selecting `permissive-mech` does nothing unless that implementation is switched on.
+ *
+ * | switch       | preset            | who settles an ask                                   | model |
+ * | ------------ | ----------------- | ---------------------------------------------------- | ----- |
+ * | `permissive` | permissive(-full) | machine screen + grader refine, then a PERSON        | yes   |
+ * | `safenetAsk` | permissive-snet   | machine screen, then a PERSON — no grader at all      | no    |
+ * | `safenetPass`| permissive-mech   | the machine screen alone: named danger blocked+fed    | no    |
+ * | `yolo`       | permissive-yolo   | the grader answers in place of the person, always     | yes   |
+ *
+ * `yolo` is the model-backed tier and says so: with no reviewer in seat it is NOT silently
+ * a pass-through. The caller still has to decide what a missing grader means (see
+ * {@link YOLO_WITHOUT_REVIEWER}) but it must record that the tier could not do the thing it
+ * advertises, and the settings face must say so out loud.
+ *
+ * Everything here is pure string/enum work so the browser half can reuse the same truth.
+ */
+/** The preset each implementation owns. One switch, one preset — they never cross. */
+export const MODE_PRESETS = {
+    'safety-net-ask': 'permissive-snet',
+    'safety-net-passthrough': 'permissive-mech',
+    yolo: 'permissive-yolo',
+};
+/** Every accepted mode, in the order the settings face should offer them. */
+export const UNATTENDED_MODES = [
+    'safety-net-ask',
+    'safety-net-passthrough',
+    'yolo',
+];
+/**
+ * The mode for one call, from the session's current permission preset plus which
+ * implementations are switched on.
+ *
+ * `null` means no human-free implementation owns this preset: the ordinary flow runs, and
+ * an ask goes to a person. A preset whose switch is off also returns `null` — the tier may
+ * still exist in the picker (profiles are not rewritten here), it simply has no
+ * implementation behind it, which is the honest reading of "the switch controls whether the
+ * implementation exists".
+ */
+export function resolveTierMode(preset, switches) {
+    if (preset === undefined)
+        return null;
+    for (const mode of UNATTENDED_MODES) {
+        if (MODE_PRESETS[mode] !== preset)
+            continue;
+        const on = mode === 'safety-net-ask'
+            ? switches.safenetAsk === true
+            : mode === 'safety-net-passthrough'
+                ? switches.safenetPass === true
+                : switches.yolo === true;
+        return on ? mode : null;
+    }
+    return null;
+}
+/**
+ * Whether a mode takes the human out of the loop. `safety-net-ask` keeps them in — it
+ * exists to grade without a model, not to stop asking — so the decision seam only branches
+ * on the other two, and `safety-net-ask` instead suppresses the grader refine pass.
+ */
+export function isHumanFree(mode) {
+    return mode === 'safety-net-passthrough' || mode === 'yolo';
+}
+/**
+ * What YOLO does when its grader is not in seat. It stays human-free (that is the tier's
+ * promise), settles on the mechanical screen alone, and the caller records that the model
+ * never answered — a tier that quietly becomes a different tier is the failure mode this
+ * whole module exists to avoid.
+ */
+export const YOLO_WITHOUT_REVIEWER = 'settle-mechanically-and-label';

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "dsh-perm-gate",
-  "version": "5.2.0",
+  "version": "5.3.1",
   "publishConfig": {
+    "registry": "https://registry.npmjs.org",
     "tag": "latest"
   },
   "description": "DSH permission-gate for the DeepSeek Harness 0.1.5 line: a single self-sufficient, deterministic-first, fail-closed gate covering P0 hard-deny -> P1 session grant -> P2 static rule (allow/deny) chain -> P3 optional LLM semantic classifier -> P4 ask, with command whitelist/blacklist.",
@@ -68,15 +69,15 @@
   },
   "engines": {
     "node": ">=24",
-    "dsh": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2"
+    "dsh": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-rc.1"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
-    "@deepseek-ai/dsh-settings": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2"
+    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-rc.1",
+    "@deepseek-ai/dsh-settings": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-rc.1"
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.4",

package/scripts/patch-permission-glyph.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Add `permissive-full` to the DSH composer's permission-glyph map.
+ * Add the plugin's own permission tiers to the DSH composer's permission-glyph map.
  *
  * WHY THIS EXISTS
  * ---------------
@@ -52,9 +52,11 @@ import { homedir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 
-/** The map key whose entry is cloned, and the key it is cloned onto. */
+/** The map key whose entry is cloned, and every key it must be cloned onto. */
 export const SOURCE_KEY = 'permissive'
-export const TARGET_KEY = 'permissive-full'
+export const TARGET_KEYS = ['permissive-full', 'permissive-snet', 'permissive-mech', 'permissive-yolo']
+/** The first target, kept as a named export because the spec and the docs quote it. */
+export const TARGET_KEY = TARGET_KEYS[0]
 
 /** Relative path from a package root to the bundle holding the map. */
 const BUNDLE = join('@deepseek-ai', 'dsh-client-ui-conversation', 'lib', 'client.js')
@@ -117,20 +119,31 @@ export function sliceEntry(source, key) {
 }
 
 /**
- * Clone the `permissive` glyph entry onto the `permissive-full` key.
+ * Clone the `permissive` glyph entry onto every plugin-contributed tier that lacks one.
+ *
+ * The composer renders "outside the design set get no icon" for any key the closed map does
+ * not hold, so all four of this plugin's tiers would otherwise read as bare text next to the
+ * built-in shields. Each missing key gets a byte-identical clone under its own name; keys
+ * already present are left alone, so re-running is a no-op.
  *
  * @param {string} source the bundle's text
- * @returns {{ changed: boolean, source: string, entry: string | null }}
- *   `changed: false` means the target key was already present (idempotent no-op).
+ * @returns {{ changed: boolean, source: string, entry: string | null, added: string[] }}
+ *   `changed: false` means every target key was already present (idempotent no-op).
  */
 export function applyGlyphPatch(source) {
-  if (source.includes(`["${TARGET_KEY}",`)) return { changed: false, source, entry: null }
+  const missing = TARGET_KEYS.filter((key) => !source.includes(`["${key}",`))
+  if (missing.length === 0) return { changed: false, source, entry: null, added: [] }
   const sourceEntry = sliceEntry(source, SOURCE_KEY)
   if (!sourceEntry.includes('svg')) {
     throw new GlyphPatchError(`the ["${SOURCE_KEY}",] entry does not look like a glyph`)
   }
-  const clonedEntry = sourceEntry.replace(`["${SOURCE_KEY}",`, `["${TARGET_KEY}",`)
-  return { changed: true, source: source.replace(sourceEntry, `${sourceEntry},\n\t\t\t${clonedEntry}`), entry: clonedEntry }
+  const clones = missing.map((key) => sourceEntry.replace(`["${SOURCE_KEY}",`, `["${key}",`))
+  return {
+    changed: true,
+    source: source.replace(sourceEntry, [sourceEntry, ...clones].join(',\n\t\t\t')),
+    entry: clones[0] ?? null,
+    added: missing,
+  }
 }
 
 /** Resolve the bundle to patch, or throw with an explanation. */
@@ -161,15 +174,16 @@ function main(argv) {
 
   const bundle = findBundle(argv, where)
   const original = readFileSync(bundle, 'utf8')
-  const { changed, source: patched } = applyGlyphPatch(original)
+  const { changed, source: patched, added } = applyGlyphPatch(original)
+  const listed = added.length > 0 ? added.join('", ["') : TARGET_KEYS.join('", ["')
 
   if (!changed) {
-    process.stdout.write(`patch-permission-glyph: ["${TARGET_KEY}",] already present in\n  ${bundle}\n`)
+    process.stdout.write(`patch-permission-glyph: ["${TARGET_KEYS.join('", ["')}",] already present in\n  ${bundle}\n`)
     return 0
   }
   if (check) {
     process.stdout.write(
-      `patch-permission-glyph: ["${TARGET_KEY}",] is MISSING from\n  ${bundle}\n` +
+      `patch-permission-glyph: ["${listed}",] is MISSING from\n  ${bundle}\n` +
       '  (--check: nothing written; re-run without --check to apply)\n',
     )
     return 1
@@ -189,7 +203,7 @@ function main(argv) {
   }
 
   process.stdout.write(
-    `patch-permission-glyph: added ["${TARGET_KEY}",] to\n  ${bundle}\n` +
+    `patch-permission-glyph: added ["${listed}",] to\n  ${bundle}\n` +
     `  backup: ${backup}\n` +
     '  NOTE: this edits a DSH package — re-run after any DSH upgrade or reinstall.\n',
   )