dsh-perm-gate 5.2.0 → 5.3.1

package/lib/client.js

@@ -29,6 +29,30 @@ window.__ModuleLoader__.load({
 				"card.description": "独立审批档位：与只读 / 完全权限 / 白名单平行，在会话权限下拉中显示为「自动审查」。前端只暴露一个开关；后台四个审批策略可组合、由此处设置决定，仍对 P0 硬拒绝保持 fail-closed。",
 				"card.permissive": "启用自动审查档位",
 				"card.permissiveHint": "关闭时门禁行为与此前完全一致。",
+				"card.unattended": "无人值守档位（三套实现，每颗开关决定自己那一档是否存在）",
+				"card.unattendedHint": "三颗开关，每颗只管它旁边标着的那一档：关掉即实现不存在，那一档退回普通人工流，不会偷偷变成别的档。",
+				"card.mode.ask": "保留人工",
+				"card.mode.pass": "机械直通",
+				"card.askHint": "机械先筛并列出疑点，但确认仍交给人，且一次审查模型都不叫——适用于无审查 LLM 可用、或不值当花 token 的运行。",
+				"card.passHint": "只跑确定性机械审查器：命中不可逆 / 不可沉淀 / 读不懂的载荷就拦截并把理由回喂主模型，其余照常执行。零模型调用、永不问人——相当于 approval: never 的有审查版，也是 yolo 拿掉 LLM 后的劣化形态。",
+				"card.tierScopeHint": "只有落在门禁作用域（%scope）里的预设才会走到这一步；预设不在作用域内时整个门禁停用，任何开关都不会接管它的确认。",
+				"card.yolo": "YOLO — 永不人工确认：危险才拦，其余放行",
+				"card.yoloHint": "命中不可逆 / 不可沉淀 / 读不懂的载荷，或模型报硬风险时拦截，并把理由以「工具审核意见」回喂主模型；其余照常执行。没有可用模型时只靠确定性规则网拦截。",
+				"card.rulesFallback": "无模型时降级成规则闸门（cc-safety-net 级）",
+				"card.rulesFallbackHint": "只在审查模型未配置、或模型未能给出裁决时生效：按确定性规则拦危险、放行其余，不再把调用挂在没人应答的确认框上。模型正常回答时行为与之前完全一致。",
+				"card.scriptReview": "脚本正文随审查一并送审（默认开）",
+				"card.scriptReviewHint": "调用运行脚本文件时读取它的正文：审查模型与人看的是同一份代码，规则层也按正文判定不可逆（文件名看不出危险的删除正是这么漏掉的）。正文出境前脱敏并截断；关掉它就不会让文件内容离开本机，代价是工作区外的脚本回到「看不清」档位。",
+				"card.credentialPaths": "自定义凭据路径（长尾）",
+				"card.credentialPathsHint": "插件内置清单之外的机密文件。写法是路径 glob：双星跨目录、单星与问号只在一段内；不含通配符时按路径片段匹配（token 不会命中 ambient.txt）；行首 ~/ 会展开为你的 home；相对写法也在任意深度匹配（secrets/*.env 覆盖 a/b/secrets/prod.env）。命中后与 .ssh 同档：工作区外读取被硬拒、被文件工具改写被硬拒（这一档不可申诉，也不会被审查模型放行），所以只写确实需要保护的路径。",
+				"card.credentialPathsPlaceholder": "新路径，如 ~/.myco/vault.token 或 secrets/*.env",
+				"card.denyKeywordsExtra": "追加黑名单关键词（不替换预置）",
+				"card.denyKeywordsExtraHint": "在你自己的命令词上加一道确定性拦截，例如公司内部 CLI 的吊销/清库子命令或自有令牌前缀。这里只做追加：无论上面「黑名单」是预置还是你替换过，这些词都会并进去。",
+				"card.listRemove": "移除该条目",
+				"card.extraContentArgKeys": "追加正文键（这些参数不被当操作读）",
+				"card.extraContentArgKeysHint": "内置清单（content/text/plan…）之外的文档字段名，例如某个自有工具的 steps/notes：加进来后，它的文字不再进入危险词与凭据形态的扁平扫描。只追加、不替换内置表——漏写一个内置键就会重现“把计划当操作拒掉”的静默失效。被执行的命令本身与被改写的路径走各自判据，这张表关不掉它们。",
+				"card.extraContentArgKeysPlaceholder": "新参数名，如 steps",
+				"card.extraOperationArgKeys": "追加操作键（把该字段当会执行的代码读）",
+				"card.extraOperationArgKeysHint": "给「正文其实会被执行」的字段开口子（如 workflowYaml）：它的文本会进入黑名单与凭据预筛；与上一张表撞名时本表获胜。代价：把真正的文档字段写进来，就等于让「计划里提到 rm -rf」重新变成拒绝理由。",
 				"card.scopeNote": "档位作用域：本门禁仅在会话权限档位为 %scope 时生效。其他档位下整个门禁停用（含 P0 硬拒绝），由所选档位自身的策略接管；停用时会写入一条 stand-down 事件，并在输入框上方常驻一条提示条。",
 				"card.strategies": "后台审批策略（至少一个生效；可组合）",
 				"card.strategy.trustAutoAllow": "trustAutoAllow — 作用域内安全操作自动放行，危险/未知转 ask（中间档基线）",
@@ -191,6 +215,30 @@ window.__ModuleLoader__.load({
 				"card.description": "Independent approval tier, parallel to read-only / full-access / whitelist, shown as 自动审查 in the session permission picker. The front-end exposes a single switch; the four backend approval strategies are combinable via this panel and still fail-closed against P0 hard-deny.",
 				"card.permissive": "Enable the 自动审查 tier",
 				"card.permissiveHint": "When off, the gate behaves exactly as before.",
+				"card.unattended": "Unattended tiers (three implementations — each switch decides whether its own tier exists)",
+				"card.unattendedHint": "Three switches, each governing only the tier named beside it: switching an implementation off returns that tier to the ordinary human flow — it never quietly becomes a different tier.",
+				"card.mode.ask": "Keep human",
+				"card.mode.pass": "Mechanical pass-through",
+				"card.askHint": "The mechanical screen still filters and lists its doubts, but the ask stays with a person and no grader is called at all — the shape for runs with no reviewer LLM connected, or where the tokens are not worth spending.",
+				"card.passHint": "Runs the deterministic mechanical judge only: an irreversible, unlearnable or unreadable call is blocked and the reason fed back to the main model, everything else runs. No model call, no human prompt — the reviewed form of approval: never, and YOLO with the model taken away.",
+				"card.tierScopeHint": "Only presets inside the gate's scope (%scope) reach this step; outside it the whole gate stands down, so no switch takes over its confirmations.",
+				"card.yolo": "YOLO — never ask a human: block the dangerous, run the rest",
+				"card.yoloHint": "Blocks an irreversible / unlearnable / unreadable payload, or a hard-risk verdict from the model, and feeds the reason back to the main LLM as a 工具审核意见 message; everything else executes. With no reviewer available only the deterministic nets catch anything.",
+				"card.rulesFallback": "Degrade to a rule-only gate when there is no model (cc-safety-net class)",
+				"card.rulesFallbackHint": "Takes effect only when the risk reviewer is not configured or gave no verdict: the deterministic nets block what they can name and let the rest through, instead of parking the call on a popup nobody will answer. While a reviewer answers, behaviour is unchanged.",
+				"card.scriptReview": "Attach script bodies to the review (on by default)",
+				"card.scriptReviewHint": "When a call runs a script file, its body is read and given to the risk model and the human alike, and the deterministic nets grade the body too (a delete that only shows up inside the file is exactly what used to slip through). Bodies are redacted and length-capped before leaving the host; switching this off keeps file contents local at the cost of sending out-of-workspace scripts back to the unreadable tier.",
+				"card.credentialPaths": "Custom credential paths (the long tail)",
+				"card.credentialPathsHint": "Secret files the built-in list does not know. Entries are path globs: a double star crosses directories, a single star and a question mark stay inside one segment; without a wildcard it matches a whole path fragment (token will not hit ambient.txt); a leading ~/ expands to your home; a relative pattern also matches at any depth (secrets/*.env covers a/b/secrets/prod.env). A hit is held to the same standard as .ssh: reading it outside the workspace is hard-denied, mutating it with a file tool is hard-denied — that tier cannot be appealed or talked past by the reviewer, so declare only paths you truly need protected.",
+				"card.credentialPathsPlaceholder": "New path, e.g. ~/.myco/vault.token or secrets/*.env",
+				"card.denyKeywordsExtra": "Appended blacklist keywords (never replaces the preset)",
+				"card.denyKeywordsExtraHint": "A deterministic block on words of your own — a revoke/wipe subcommand of a company CLI, a token prefix you issue. This list only ever appends: whatever the blacklist above holds (preset or your own replacement), these words are merged in.",
+				"card.listRemove": "Remove this entry",
+				"card.extraContentArgKeys": "Appended document keys (never read as an operation)",
+				"card.extraContentArgKeysHint": "Document field names beyond the built-in list (content/text/plan…): once listed, their text stops entering the flattened scan that the destructive-word blacklist and the credential pre-screen read. Additive only — the built-in list cannot be replaced, because dropping one of its keys would silently re-create the bug where a plan gets refused for describing work. The executed command and the mutated path are judged on their own terms; this list cannot switch them off.",
+				"card.extraContentArgKeysPlaceholder": "New argument name, e.g. steps",
+				"card.extraOperationArgKeys": "Appended operation keys (read this field as code that runs)",
+				"card.extraOperationArgKeysHint": "Opens a route for fields whose body really is executed (workflowYaml and friends): their text enters the blacklist and the credential screen, and this list wins when both name the same key. Cost: naming a genuine document field here makes “the plan mentions rm -rf” a refusal reason again.",
 				"card.scopeNote": "Preset scope: this gate only acts while the session permission preset is %scope. Under any other preset the whole gate stands down — P0 hard-deny included — and the selected preset's own policy takes over. A stand-down records one event and leaves a sticky strip above the input.",
 				"card.strategies": "Backend approval strategies (at least one effective; combinable)",
 				"card.strategy.trustAutoAllow": "trustAutoAllow — safe in-scope ops auto-allow; dangerous/unknown ask (baseline middle tier)",
@@ -353,6 +401,30 @@ window.__ModuleLoader__.load({
 				"card.description": "read-only / full-access / whitelist と並ぶ独立の承認モード。セッション権限ピッカーでは「自动审查」と表示されます。フロントは単一スイッチのみ。バックエンドの 4 つの承認戦略はこのパネルで組み合わせ可能で、P0 ハード拒否に対して依然 fail-closed。",
 				"card.permissive": "自动审查ティアを有効化",
 				"card.permissiveHint": "オフのときは以前と完全に同じ動作です。",
+				"card.unattended": "無人確認ティア（3 つの実装 — スイッチは各自のティアの有無を決めます）",
+				"card.unattendedHint": "スイッチは三つ。それぞれ脇に書いたティアだけを制御します。実装をオフにするとそのティアは通常の人確認に戻り、別のティアに化けることはありません。",
+				"card.mode.ask": "人手確認を残す",
+				"card.mode.pass": "機械直通",
+				"card.askHint": "機械スクリーニングは引き続き危険を絞り疑点を列挙しますが、確認は人に残り審査モデルは一度も呼びません — 審査 LLM 未接続、またはトークンを費やさない運用の形です。",
+				"card.passHint": "決定論的な機械審査器のみを実行：不可逆 / 復元不能 / 読めない処理を検知したら遮断して理由を主モデルへ返し、それ以外は実行します。モデル呼び出しゼロ・人手確認なし。approval: never の審査付き版であり、LLM を外した YOLO の劣化形態でもあります。",
+				"card.tierScopeHint": "このステップまで到達するのはゲートの適用範囲（%scope）内のプリセットだけです。範囲外ではゲート全体が停止し、どのスイッチも確認を代行しません。",
+				"card.yolo": "YOLO — 人工確認は決して求めない：危険のみ遮断、他は実行",
+				"card.yoloHint": "復元不能 / 学習不能 / 読解不能なペイロード、またはモデルの重リスク判定を遮断し、理由を「工具審核意見」メッセージでメイン LLM に返します。それ以外は実行されます。レビューモデルが無い場合は決定論的ネットのみが機能します。",
+				"card.rulesFallback": "モデル不在時はルールゲートへ劣化（cc-safety-net 級）",
+				"card.rulesFallbackHint": "レビューモデルが未設定、または判定を返せなかったときだけ発効します。決定論的ルールが名指しできる危険を遮断し、残りは通します。誰も答えない確認画面で処理を止めないためです。モデルが答えている間は挙動は変わりません。",
+				"card.scriptReview": "スクリプト本文をレビューに添付（既定はオン）",
+				"card.scriptReviewHint": "呼び出しがスクリプトファイルを実行するとき、その本文を読み取り、レビューモデルと人が同じコードを見ます。決定論的ネットも本文を評価します（ファイル名からは見えない削除がまさに通過していた箇所）。送出前に秘匿化と長さ制限を実施。オフにするとファイル内容が外部へ出ませんが、ワークスペース外のスクリプトは「読解不能」ティアに戻ります。",
+				"card.credentialPaths": "カスタム認証情報パス（長尾）",
+				"card.credentialPathsHint": "内蔵リスト外の機密ファイル。書き方はパス glob：双アスタリスクはディレクトリを横断、単アスタリスクとはてなは 1 段内。ワイルドカードなしならパス断片として一致（token は ambient.txt に掛からない）。先頭の ~/ は home に展開、相対指定は任意の深さでも一致（secrets/*.env は a/b/secrets/prod.env を覆う）。該当すれば .ssh と同格：ワークスペース外からの読み取りもファイルツールでの書き換えも強制拒否——このティアは異議申立て、レビューモデルの通過も不可なので、本当に守るべきパスだけを宣言してください。",
+				"card.credentialPathsPlaceholder": "新しいパス、例：~/.myco/vault.token または secrets/*.env",
+				"card.denyKeywordsExtra": "ブラックリスト追加キーワード（プリセットを置き換えない）",
+				"card.denyKeywordsExtraHint": "自社 CLI の取消し／消去サブコマンドや自社トークン接頭語など、自分の語彙に決定論的な遮断を一段足します。ここは追加のみ：上のブラックリストがプリセットでも自分で置き換えたものでも、これらの語はマージされます。",
+				"card.listRemove": "この項目を削除",
+				"card.extraContentArgKeys": "追加のドキュメントキー（操作として読ませない）",
+				"card.extraContentArgKeysHint": "内蔵リスト（content/text/plan…）外のドキュメント項目名。追加すると、その文言は危険語と認証情報の平坦スキャンに入らなくなります。追加専用で内蔵表は置き換えません——内蔵キーを一つ落とすと「計画書を書いたという理由で拒否される」不具合が静かに復活します。実行されるコマンド自体と書き換えられるパスはそれぞれの判別経路なので、この表では無効化できません。",
+				"card.extraContentArgKeysPlaceholder": "新しい引数名、例：steps",
+				"card.extraOperationArgKeys": "追加の操作キー（その項目を実行されるコードとして読む）",
+				"card.extraOperationArgKeysHint": "本文が実際に実行される項目（workflowYaml など）用の出口です。その文言はブラックリストと認証情報スクリーンに入り、上の表と同名ならこちらが勝ちます。代償：本物のドキュメント項目を指定すると、「計画に rm -rf と書いた」ことが再び拒否理由になります。",
 				"card.scopeNote": "プリセットスコープ: このゲートはセッションの権限プリセットが %scope のときだけ動作します。それ以外のプリセットでは P0 ハード拒否を含むゲート全体が停止し、選択されたプリセット自身のポリシーが引き継ぎます。停止時は stand-down イベントを 1 件記録し、入力欄の上に常駐表示します。",
 				"card.strategies": "バックエンド承認戦略（少なくとも 1 つ有効、組み合わせ可）",
 				"card.strategy.trustAutoAllow": "trustAutoAllow — スコープ内の安全操作は自動許可、危険/不明は ask（中間ティアのベースライン）",
@@ -515,6 +587,30 @@ window.__ModuleLoader__.load({
 				"card.description": "read-only / full-access / whitelist와 나란한 독립 승인 모드. 세션 권한 선택기에서는 「自动审查」로 표시됩니다. 프론트는 단일 스위치만 노출. 백엔드의 네 가지 승인 전략은 이 패널에서 조합 가능하며 P0 하드 거부에 대해 여전히 fail-closed.",
 				"card.permissive": "自动审查 티어 활성화",
 				"card.permissiveHint": "꺼져 있으면 이전과 완전히 동일하게 동작합니다.",
+				"card.unattended": "무인 등급(구현 세 개 — 각 스위치가 자기 등급의 존재 여부를 정합니다)",
+				"card.unattendedHint": "스위치는 셋, 각자 옆에 적힌 등급만 제어합니다. 구현을 끄면 그 등급은 보통의 사람 확인으로 돌아가며, 다른 등급으로 몰래 바뀌지 않습니다.",
+				"card.mode.ask": "사람 확인 유지",
+				"card.mode.pass": "기계 직통과",
+				"card.askHint": "기계 선별로 위험을 걸러 내고 의문점을 적지만, 확인은 그대로 사람에게 남고 심사 모델은 한 번도 부르지 않습니다 — 심사 LLM 미연결이나 토큰을 아끼는 운용에 맞는 형태입니다.",
+				"card.passHint": "결정론적 기계 심사기만 실행：되돌릴 수 없음 / 복원 불가 / 읽히지 않는 처리를 감지하면 차단하고 이유를 주모델에 되돌려 보내며, 나머지는 실행합니다. 모델 호출 0회·사람 확인 없음. approval: never 의 심사판이며, LLM 을 뺀 YOLO 의 열화된 형태이기도 합니다.",
+				"card.tierScopeHint": "게이트 적용 범위(%scope) 안의 프리셋만 이 단계까지 옵니다. 범위 밖에서는 게이트 전체가 중지되므로 어떤 스위치도 확인을 대신하지 않습니다.",
+				"card.yolo": "YOLO — 사람 확인은 절대 요구하지 않음: 위험만 차단하고 나머지는 실행",
+				"card.yoloHint": "복구 불가 / 학습 불가 / 해석 불가 페이로드, 또는 모델이 위험 판정을 내리면 차단하고 이유를 「工具审核意见」 메시지로 메인 LLM에 알려합니다. 나머지는 그대로 실행됩니다. 검토 모델이 없으면 결정론적 규칙망만 작동합니다.",
+				"card.rulesFallback": "모델이 없을 때 규칙 게이트로 강등 (cc-safety-net 급)",
+				"card.rulesFallbackHint": "검토 모델이 설정되지 않았거나 판정을 내리지 못했을 때만 발동합니다. 결정론적 규칙이 식별한 위험은 차단하고 나머지는 통과시켜, 아무도 응답하지 않는 확인 창에 호출을 대기시키지 않습니다. 모델이 정상 응답하는 동안에는 동작이 변하지 않습니다.",
+				"card.scriptReview": "스크립트 본문 검토 함께 전송 (기본 켜짐)",
+				"card.scriptReviewHint": "호출이 스크립트 파일을 실행하면 본문을 읽어 검토 모델과 사람이 같은 코드를 보게 하고, 결정론적 규칙도 본문을 평가합니다 (파일명으로는 위험이 보이지 않는 삭제가 바로 그 통과 지점이었습니다). 전송 전 마스킹과 길이 제한을 적용합니다. 끄면 파일 내용이 외부로 나가지 않지만, 작업 공간 외부 스크립트는 다시 해석 불가 등급이 됩니다.",
+				"card.credentialPaths": "사용자 정의 자격증명 경로 (롱테일)",
+				"card.credentialPathsHint": "내장 목록이 모르는 비밀 파일입니다. 항목은 경로 glob: 이중 별은 디렉터리를 횡단하고 단별과 물음표는 한 단계 안에서만 동작합니다. 와일드카드가 없으면 경로 단편 전체로 일치 (token 은 ambient.txt 에 걸리지 않음). 선행 ~/ 는 home 으로 확장되고, 상대 지정은 어떤 깊이에서도 일치합니다 (secrets/*.env 는 a/b/secrets/prod.env 를 커버). 걸리면 .ssh 와 동일한 등급: 작업 공간 외부 읽기와 파일 도구 통한 변경 모두 경성 거부입니다—이 등급은 이의 제기나 검토 모델 우회가 불가능하니 정말 보호할 경로만 선언하세요.",
+				"card.credentialPathsPlaceholder": "새 경로, 예: ~/.myco/vault.token 또는 secrets/*.env",
+				"card.denyKeywordsExtra": "추가 블랙리스트 키워드 (프리셋을 대체하지 않음)",
+				"card.denyKeywordsExtraHint": "사내 CLI 의 폐기/삭제 서브커맨드나 자체 토큰 접두사처럼 자신만의 용어에 결정론적 차단을 한 겹 더합니다. 여기는 추가만 합니다: 위의 블랙리스트가 프리셋이든 대체한 것이든 이 단어들은 병합됩니다.",
+				"card.listRemove": "이 항목 삭제",
+				"card.extraContentArgKeys": "추가 문서 키 (작업으로 읽지 않음)",
+				"card.extraContentArgKeysHint": "내장 목록(content/text/plan…) 밖의 문서 필드명입니다. 추가하면 그 텍스트가 위험 단어 · 자격증물 평탄화 스캔에 들어가지 않습니다. 추가 전용이며 내장 표를 대체하지 않습니다 — 내장 키 하나를 빠뜨리면 『계획서를 작성했다는 이유로 거부되는』 결함이 조용히 부활합니다. 실제로 실행되는 명령과 변경되는 경로는 각자의 판정을 따르므로 이 표로는 끌 수 없습니다.",
+				"card.extraContentArgKeysPlaceholder": "새 인자 이름, 예: steps",
+				"card.extraOperationArgKeys": "추가 작업 키 (해당 필드를 실행되는 코드로 읽음)",
+				"card.extraOperationArgKeysHint": "본문이 실제로 실행되는 필드(workflowYaml 등)를 위한 통로입니다. 텍스트가 블랙리스트와 자격증물 스크린에 들어가며 위 표와 같은 키를 지정하면 이쪽이 이깁니다. 대가: 진짜 문서 필드를 지정하면 『계획에 rm -rf 가 적혀 있다』는 다시 거부 이유가 됩니다.",
 				"card.scopeNote": "프리셋 범위: 이 게이트는 세션 권한 프리셋이 %scope일 때만 동작합니다. 다른 프리셋에서는 P0 하드 거부를 포함한 게이트 전체가 정지하고, 선택된 프리셋 자체의 정책이 대신합니다. 정지 시 stand-down 이벤트가 1건 기록되고 입력창 위에 상시 표시됩니다.",
 				"card.strategies": "백엔드 승인 전략(하나 이상 유효, 조합 가능)",
 				"card.strategy.trustAutoAllow": "trustAutoAllow — 범위 내 안전 작업은 자동 허용, 위험/미확인은 ask(중간 티어 기준)",
@@ -677,6 +773,30 @@ window.__ModuleLoader__.load({
 				"card.description": "Niveau d'approbation indépendant : parallèle à lecture seule / accès complet / liste blanche, affiché comme « Examen automatique » dans le sélecteur de permissions de session. Le front-end n'expose qu'un seul interrupteur ; les quatre stratégies d'approbation backend sont combinables via ce panneau et restent fail-closed contre le refus dur P0.",
 				"card.permissive": "Activer le niveau d'examen automatique",
 				"card.permissiveHint": "Lorsqu'il est désactivé, la porte se comporte exactement comme avant.",
+				"card.unattended": "Modes sans supervision (trois implémentations ; chaque interrupteur décide si son palier existe)",
+				"card.unattendedHint": "Trois interrupteurs, chacun ne régit que le palier nommé à côté : éteindre une implémentation rend ce palier au flux humain ordinaire — il ne devient jamais un autre palier en secret.",
+				"card.mode.ask": "Garder l'humain",
+				"card.mode.pass": "Passage mécanique",
+				"card.askHint": "Le tamis mécanique filtre toujours et expose ses doutes, mais la demande reste soumise à une personne et aucun évaluateur n'est appelé — la forme qui convient quand aucun LLM relecteur n'est branché, ou quand les jetons ne valent pas la dépense.",
+				"card.passHint": "N'exécute que le juge mécanique déterministe : une opération irréversible, irrécupérable ou illisible est bloquée et justifiée en retour au modèle principal, le reste s'exécute. Aucun appel de modèle, aucune demande humaine — la version examinée de approval: never, et le YOLO privé de son modèle.",
+				"card.tierScopeHint": "Seuls les préréglages compris dans le périmètre du garde (%scope) atteignent cette étape ; en dehors, le garde s'efface complètement et aucun interrupteur ne prend ses confirmations en charge.",
+				"card.yolo": "YOLO — ne jamais demander un humain : bloquer le dangereux, exécuter le reste",
+				"card.yoloHint": "Bloque une charge irréversible / inapprenable / illisible, ou un verdict à risque dur du modèle, et renvoie la raison au LLM principal dans un message 工具审核意见 ; tout le reste s'exécute. Sans modèle disponible, seules les filets déterministes bloquent.",
+				"card.rulesFallback": "Dégrader vers une porte à règles quand il n'y a pas de modèle (classe cc-safety-net)",
+				"card.rulesFallbackHint": "Ne s'applique que lorsque le relecteur de risque n'est pas configuré ou n'a pas rendu de verdict : les filets déterministes bloquent ce qu'ils peuvent nommer et laissent passer le reste, au lieu de immobiliser l'appel sur une popup que personne ne répondra. Tant qu'un relecteur répond, le comportement est inchangé.",
+				"card.scriptReview": "Joindre le contenu des scripts à la revue (activé par défaut)",
+				"card.scriptReviewHint": "Quand un appel exécute un fichier script, son corps est lu et donné au modèle de risque comme à l'humain, et les filets déterministes évaluent aussi ce corps (une suppression invisible dans le nom de fichier est précisément ce qui passait). Le corps est masqué et borné avant sortie ; le désactiver garde le contenu des fichiers en local, au prix de renvoyer les scripts hors espace de travail dans le palier « illisible ».",
+				"card.credentialPaths": "Chemins de credentials personnalisés (la longue traîne)",
+				"card.credentialPathsHint": "Des fichiers secrets que la liste intégrée ne connaît pas. Les entrées sont des globs de chemin : une double étoile traverse les répertoires, une étoile simple et un point d'interrogation restent dans un segment ; sans joker, la correspondance se fait sur un fragment de chemin entier (token ne touchera pas ambient.txt) ; un ~/ initial se développe vers votre home ; un motif relatif correspond aussi à n'importe quelle profondeur (secrets/*.env couvre a/b/secrets/prod.env). Une correspondance est tenue au même standard que .ssh : la lecture hors espace de travail et la mutation par un outil de fichier sont refusées durablement — ce niveau n'est ni contestable ni franchissable par le relecteur, ne déclarez donc que les paths à protéger vraiment.",
+				"card.credentialPathsPlaceholder": "Nouveau chemin, ex. ~/.myco/vault.token ou secrets/*.env",
+				"card.denyKeywordsExtra": "Mots-clés blacklist ajoutés (ne remplace pas le prédéfini)",
+				"card.denyKeywordsExtraHint": "Un blocage déterministe sur vos propres termes — une sous-commande de révocation d'un CLI interne, un préfixe de jeton qui vous est propre. Cette liste n'ajoute que des termes : quel que soit le contenu de la blacklist au-dessus (prédéfinie ou remplacée par vous), ces mots sont fusionnés.",
+				"card.listRemove": "Retirer cette entrée",
+				"card.extraContentArgKeys": "Clés de document ajoutées (jamais lues comme une opération)",
+				"card.extraContentArgKeysHint": "Des noms de champs documentaires absents de la liste intégrée (content/text/plan…) : une fois déclarés, leur texte ne participe plus à la lecture à plat des mots dangereux et des formes d'identifiants. Purement additif : la liste intégrée ne peut pas être remplacée, car oublier une de ses clés ferait reparaître en silence le bug où un plan est refusé pour décrire une action. La commande réellement exécutée et le chemin modifié jugés par leurs propres voies, cette liste ne peut pas les éteindre.",
+				"card.extraContentArgKeysPlaceholder": "Nouveau nom d'argument, ex. steps",
+				"card.extraOperationArgKeys": "Clés d'opération ajoutées (lire ce champ comme du code exécuté)",
+				"card.extraOperationArgKeysHint": "Un passage pour les champs dont le corps est réellement exécuté (workflowYaml etc.) : leur texte entre dans la blacklist et l'écran d'identifiants, et cette liste gagne en cas de doublon. Coût : désigner un vrai champ documentaire rend de nouveau « le plan mentionne rm -rf » motif de refus.",
 				"card.scopeNote": "Portée du préréglage : cette porte n'agit que lorsque le préréglage de permission de session est %scope. Sous tout autre préréglage, la porte entière se met en veille — y compris le refus dur P0 — et la politique du préréglage sélectionné prend le relais. La mise en veille enregistre un événement et affiche une bande persistante au-dessus de la saisie.",
 				"card.strategies": "Stratégies d'approbation backend (au moins une active ; combinables)",
 				"card.strategy.trustAutoAllow": "trustAutoAllow — les opérations sûres dans le périmètre sont auto-autorisées ; dangereuses/inconnues → demande (niveau intermédiaire de base)",
@@ -839,6 +959,30 @@ window.__ModuleLoader__.load({
 				"card.description": "Unabhängige Genehmigungsstufe: parallel zu Nur-Lesen / Vollzugriff / Whitelist, angezeigt als „Automatische Überprüfung\" im Sitzungs-Berechtigungswähler. Das Frontend bietet einen einzigen Schalter; die vier Backend-Genehmigungsstrategien sind über dieses Panel kombinierbar und bleiben fail-closed gegen P0-Hartablehnung.",
 				"card.permissive": "Stufe „Automatische Überprüfung\" aktivieren",
 				"card.permissiveHint": "Wenn deaktiviert, verhält sich das Gate genau wie zuvor.",
+				"card.unattended": "Unbeaufsichtigte Stufen (drei Implementierungen; jeder Schalter entscheidet, ob seine Stufe existiert)",
+				"card.unattendedHint": "Drei Schalter, jeder steuert nur die Stufe daneben: wer die Implementierung abschaltet, lässt diese Stufe zum normalen Menschenablauf zurückkehren — sie wird nie stillschweigend zu einer anderen.",
+				"card.mode.ask": "Mensch behalten",
+				"card.mode.pass": "Mechanischer Durchlass",
+				"card.askHint": "Die mechanische Vorprüfung filtert und nennt ihre Zweifel, aber die Anfrage bleibt bei einem Menschen, und das Bewertungsmodell wird kein einziges Mal aufgerufen — die Form für Läufe ohne verbundenen Reviewer-LLM oder wenn sich die Tokens nicht lohnen.",
+				"card.passHint": "Lässt nur den deterministischen mechanischen Prüfer laufen: eine irreversible, nicht rücknehmbare oder unlesbare Anfrage wird blockt und dem Hauptmodell begründet zurückgemeldet, alles andere läuft. Kein Modellaufruf, keine Frage an einen Menschen — die geprüfte Form von approval: never und YOLO ohne Modell.",
+				"card.tierScopeHint": "Nur Presets innerhalb des Gate-Umfangs (%scope) erreichen diesen Schritt; außerhalb davon schaltet sich das Gate komplett ab, kein Schalter übernimmt dann dessen Bestätigungen.",
+				"card.yolo": "YOLO — niemals einen Menschen fragen: nur Gefährliches blockieren, Rest ausführen",
+				"card.yoloHint": "Blockiert eine unwiderrufliche / nicht lernbare / unlesbare Last oder ein Hartrisiko-Urteil des Modells und meldet den Grund dem Haupt-LLM als 工具审核意见-Nachricht; alles andere läuft. Ohne erreichbares Review-Modell fangen nur die deterministischen Netze.",
+				"card.rulesFallback": "Ohne Modell zu einem Regel-Gate degradieren (cc-safety-net-Klasse)",
+				"card.rulesFallbackHint": "Greift nur, wenn das Review-Modell nicht konfiguriert ist oder kein Urteil geliefert hat: die deterministischen Netze blockieren, was sie benennen können, und lassen den Rest durch, statt den Aufruf in einem Popup warten zu lassen, das niemand beantwortet. Solange ein Modell antwortet, bleibt das Verhalten unverändert.",
+				"card.scriptReview": "Skriptinhalte der Prüfung beifügen (standardmäßig an)",
+				"card.scriptReviewHint": "Führt ein Aufruf eine Skriptdatei aus, wird ihr Inhalt gelesen und dem Risikomodell wie dem Menschen gezeigt, und die deterministischen Netze bewerten ebenfalls den Inhalt (ein Löschen, das nur in der Datei sichtbar ist, war genau das, was durchrutschte). Inhalte werden vor dem Verlassen des Rechners maskiert und begrenzt; abschalten hält Dateiinhalte lokal, kostet aber, dass Skripte außerhalb des Arbeitsbereichs wieder als „unlesbar“ gelten.",
+				"card.credentialPaths": "Eigene Credential-Pfade (der lange Schwanz)",
+				"card.credentialPathsHint": "Geheime Dateien, die die eingebaute Liste nicht kennt. Einträge sind Pfad-Globs: ein Doppelstern überquert Verzeichnisse, ein Einzelstern und ein Fragezeichen bleiben in einem Segment; ohne Joker wird über ein ganzes Pfadfragment verglichen (token trifft nicht ambient.txt); ein führendes ~/ wird zu Ihrem Home aufgelöst; ein relativer Muster passt auch in jeder Tiefe (secrets/*.env deckt a/b/secrets/prod.env ab). Ein Treffer gilt nach demselben Maßstab wie .ssh: Lesen außerhalb des Arbeitsbereichs und Ändern durch ein Dateiwerkzeug werden hart abgelehnt — diese Stufe ist weder anfechtbar noch vom Prüfer umgehbar, erklären Sie also nur Pfade, die wirklich geschützt müssen werden.",
+				"card.credentialPathsPlaceholder": "Neuer Pfad, z. B. ~/.myco/vault.token oder secrets/*.env",
+				"card.denyKeywordsExtra": "Zusätzliche Blacklist-Schlüsselwörter (ersetzt den Voreinstellung nicht)",
+				"card.denyKeywordsExtraHint": "Eine deterministische Blockierung für Ihre eigenen Begriffe — ein Sperr-/Lösch-Unterbefehl einer firmeneigenen CLI, ein von Ihnen ausgegebener Token-Präfix. Diese Liste fügt nur hinzu: was die Blacklist oben enthält (Voreinstellung oder eigene Ersetzung), diese Wörter werden übernommen.",
+				"card.listRemove": "Diesen Eintrag entfernen",
+				"card.extraContentArgKeys": "Zusätzliche Dokument-Schlüssel (nicht als Operation gelesen)",
+				"card.extraContentArgKeysHint": "Feldnamen außerhalb der eingebauten Liste (content/text/plan…): gelistet, gelangt ihr Text nicht mehr in das flache Lesen von Gefahrwörtern und Credential-Formen. Nur ergänzend — die eingebaute Liste ist nicht ersetzbar, denn ein fehlender Schlüssel würde den Fehler leise zurückbringen, dass ein Plan für das bloße Beschreiben einer Arbeit abgelehnt wird. Das tatsächlich ausgeführte Kommando und der geänderte Pfad werden auf eigenen Wegen geprüft; diese Liste kann sie nicht abschalten.",
+				"card.extraContentArgKeysPlaceholder": "Neuer Argumentname, z. B. steps",
+				"card.extraOperationArgKeys": "Zusätzliche Operations-Schlüssel (Feld als ausgeführten Code lesen)",
+				"card.extraOperationArgKeysHint": "Ein Weg für Felder, deren Inhalt wirklich ausgeführt wird (workflowYaml u. ä.): ihr Text erreicht Blacklist und Credential-Prüfung, und bei Namensgleichheit gewinnt diese Liste. Preis: ein echtes Dokumentfeld hier einzutragen macht „der Plan erwähnt rm -rf\" wieder zum Ablehnungsgrund.",
 				"card.scopeNote": "Voreinstellungsbereich: Dieses Gate wirkt nur, während die Sitzungsberechtigungsvoreinstellung %scope ist. Unter jeder anderen Voreinstellung tritt das gesamte Gate zurück — einschließlich P0-Hartablehnung — und die Richtlinie der gewählten Voreinstellung übernimmt. Der Rücktritt protokolliert ein Ereignis und zeigt einen dauerhaften Hinweis über der Eingabe.",
 				"card.strategies": "Backend-Genehmigungsstrategien (mindestens eine aktiv; kombinierbar)",
 				"card.strategy.trustAutoAllow": "trustAutoAllow — sichere Operationen im Bereich werden automatisch erlaubt; gefährliche/unbekannte → Nachfrage (mittlere Baseline-Stufe)",
@@ -1001,6 +1145,30 @@ window.__ModuleLoader__.load({
 				"card.description": "Livello di approvazione indipendente: parallelo a sola lettura / accesso completo / whitelist, mostrato come «Revisione automatica» nel selettore delle autorizzazioni della sessione. Il front-end espone un unico interruttore; le quattro strategie di approvazione backend sono combinabili tramite questo pannello e restano fail-closed contro il rifiuto rigido P0.",
 				"card.permissive": "Abilita il livello di revisione automatica",
 				"card.permissiveHint": "Quando disattivato, il portale si comporta esattamente come prima.",
+				"card.unattended": "Modalità senza supervisione (tre implementazioni; ogni interruttore decide se il proprio livello esiste)",
+				"card.unattendedHint": "Tre interruttori, ciascuno governa solo il livello scritto accanto: spegnere un'implementazione fa tornare quel livello al flusso umano ordinario, senza che diventi di nascosto un altro.",
+				"card.mode.ask": "Mantieni umano",
+				"card.mode.pass": "Passaggio meccanico",
+				"card.askHint": "La selezione meccanica filtra ed elenca i dubbi, ma la richiesta resta a una persona e il modello revisore non viene chiamato nemmeno una volta — la forma adatta quando nessun LLM revisore è collegato o quando i token non valgono la spesa.",
+				"card.passHint": "Esegue solo il giudice meccanico deterministico: un'operazione irreversibile, irrecuperabile o illeggibile viene bloccata e motivata al modello principale, il resto esegue. Nessuna chiamata al modello, nessuna richiesta umana: la forma esaminata di approval: never, e YOLO privato del modello.",
+				"card.tierScopeHint": "Solo i preset dentro l'ambito del gate (%scope) arrivano a questo passo; fuori dall'ambito il gate si disattiva del tutto e nessun interruttore prende in carico le sue conferme.",
+				"card.yolo": "YOLO — non chiedere mai un umano: blocca il pericoloso, esegui il resto",
+				"card.yoloHint": "Blocca un carico irreversibile / non apprendibile / illeggibile, o un verdetto a rischio duro del modello, e restituisce il motivo al LLM principale come messaggio 工具审核意见; tutto il resto viene eseguito. Senza un modello disponibile, solo le reti deterministiche intercettano.",
+				"card.rulesFallback": "Degradare a una porta a regole quando non c’è modello (classe cc-safety-net)",
+				"card.rulesFallbackHint": "Agisce solo quando il revisore di rischio non è configurato o non ha dato un verdetto: le reti deterministiche bloccano ciò che sanno nominare e lasciano passare il resto, invece di parcheggiare la chiamata su un popup che nessuno risponderà. Finché un modello risponde, il comportamento resta invariato.",
+				"card.scriptReview": "Allega il contenuto degli script alla revisione (attivo per impostazione predefinita)",
+				"card.scriptReviewHint": "Quando una chiamata esegue uno script, il suo corpo viene letto e mostrato al modello di rischio come all’umano, e le reti deterministiche valutano anch’esse il corpo (un’eliminazione visibile solo dentro il file è esattamente ciò che passava). I corpi sono oscurati e limitati prima di lasciare l’host; disattivarli tiene il contenuto dei file in locale, al prezzo di rimandare gli script fuori dal workspace nel livello «illeggibile».",
+				"card.credentialPaths": "Percorsi di credenziali personalizzati (la coda lunga)",
+				"card.credentialPathsHint": "File segreti che l’elenco integrato non conosce. Le voci sono glob di percorso: un doppio asterisco attraversa le directory, un asterisco semplice e un punto di domanda restano dentro un segmento; senza jolly si confronta un frammento di percorso intero (token non colpisce ambient.txt); un ~/ iniziale si espande nella tua home; un modello relativo corrisponde anche a qualsiasi profondità (secrets/*.env copre a/b/secrets/prod.env). Una corrispondenza è trattata allo stesso livello di .ssh: la lettura fuori dal workspace e la modifica tramite strumento di file sono rifiutate in modo duro — questo livello non è appellabile né aggirabile dal revisore, dichiara solo percorsi che devi davvero proteggere.",
+				"card.credentialPathsPlaceholder": "Nuovo percorso, es. ~/.myco/vault.token o secrets/*.env",
+				"card.denyKeywordsExtra": "Parole chiave blacklist aggiunte (non sostituiscono il preset)",
+				"card.denyKeywordsExtraHint": "Un blocco deterministico per termini tuoi — un sottocomando di revoca/cancellazione di una CLI aziendale, un prefisso di token che emetti. Questa lista aggiunge soltanto: qualunque cosa contenga la blacklist sopra (preset o tua sostituzione), queste parole vengono unite.",
+				"card.listRemove": "Rimuovi questa voce",
+				"card.extraContentArgKeys": "Chiavi documento aggiunte (mai lette come operazione)",
+				"card.extraContentArgKeysHint": "Nomi di campi documentali fuori dall’elenco integrato (content/text/plan…): una volta dichiarati, il loro testo non entra più nella scansione piatta di parole pericolose e forme di credenziali. Solo in aggiunta: l’elenco integrato non è sostituibile, perché dimenticare una chiave riporterebbe in silenzio il bug per cui un piano viene rifiutato per aver descritto un’azione. Il comando effettivamente eseguito e il percorso modificato sono giudicati sui propri binari; questo elenco non può disattivarli.",
+				"card.extraContentArgKeysPlaceholder": "Nuovo nome argomento, es. steps",
+				"card.extraOperationArgKeys": "Chiavi operazione aggiunte (leggi il campo come codice eseguito)",
+				"card.extraOperationArgKeysHint": "Un passaggio per i campi il cui corpo è davvero eseguito (workflowYaml e simili): il testo raggiunge blacklist e controllo credenziali, e in caso di omonimia questo elenco vince. Costo: indicare un campo documentale reale rende di nuovo «il piano menziona rm -rf» un motivo di rifiuto.",
 				"card.scopeNote": "Ambito del preset: questo portale agisce solo quando il preset di autorizzazione della sessione è %scope. Con qualsiasi altro preset l'intero portale si mette in pausa — incluso il rifiuto rigido P0 — e la politica del preset selezionato prende il controllo. La pausa registra un evento e lascia una striscia persistente sopra l'input.",
 				"card.strategies": "Strategie di approvazione backend (almeno una attiva; combinabili)",
 				"card.strategy.trustAutoAllow": "trustAutoAllow — le operazioni sicure nell'ambito sono auto-consentite; pericolose/sconosciute → richiesta (livello intermedio di base)",
@@ -1163,6 +1331,30 @@ window.__ModuleLoader__.load({
 				"card.description": "Независимый уровень одобрения: параллельно с «только чтение» / «полный доступ» / «белый список», отображается как «Автоматическая проверка» в выборе разрешений сессии. Фронтенд предоставляет один переключатель; четыре серверные стратегии одобрения комбинируемы через эту панель и остаются fail-closed против жёсткого отказа P0.",
 				"card.permissive": "Включить уровень автоматической проверки",
 				"card.permissiveHint": "Когда выключено, шлюз ведёт себя точно так же, как раньше.",
+				"card.unattended": "Режимы без подтверждения человеком (три реализации; каждый переключатель решает, существует ли его уровень)",
+				"card.unattendedHint": "Переключателя три, каждый управляет только тем уровнем, что написан рядом: выключить реализацию — значит вернуть этот уровень обычному человеческому потоку; тайно стать другим он не может.",
+				"card.mode.ask": "Оставить человека",
+				"card.mode.pass": "Механический пропуск",
+				"card.askHint": "Механический отбор фильтрует и перечисляет сомнения, но запрос остаётся человеку, а модель-ревизор не вызывается ни разу — это форма для запусков без подключённого LLM-ревизора или когда токены не стоят затрат.",
+				"card.passHint": "Работает только детерминированный механический судья: необратимое, невосстановимое или нечитаемое действие блокируется с причиной обратно основной модели, остальное выполняется. Ни вызова модели, ни вопроса человеку — проверенная форма approval: never и YOLO без модели.",
+				"card.tierScopeHint": "До этого шага доходят только пресеты внутри области гейта (%scope); вне области гейт отключается целиком, и ни один переключатель не берёт его подтверждения на себя.",
+				"card.yolo": "YOLO — никогда не спрашивать человека: блокировать опасное, остальное выполнять",
+				"card.yoloHint": "Блокирует необратимую / необучаемую / неразбираемую нагрузку или жёсткий вердикт модели и возвращает причину основной LLM сообщением 工具审核意见; остальное выполняется. Когда доступной модели нет, срабатывают только детерминированные сети.",
+				"card.rulesFallback": "Деградировать в шлюз по правилам, когда модели нет (класс cc-safety-net)",
+				"card.rulesFallbackHint": "Действует только когда проверяющая модель не настроена или не дала вердикта: детерминированные сети блокируют то, что могут назвать, и пропускают остальное, вместо того чтобы вешать вызов на окно, которое никто не ответит. Пока модель отвечает, поведение не меняется.",
+				"card.scriptReview": "Прилагать содержимое скриптов к проверке (по умолчанию включено)",
+				"card.scriptReviewHint": "Когда вызов запускает скрипт-файл, его тело читается и даётся модели риска и человеку, и детерминированные сети тоже оценивают тело (удаление, видимое только внутри файла, — ровно то, что пропускалось). Тела маскируются и ограничиваются по длине до отправки; отключение оставляет содержимое файлов локально, ценой возврата скриптов вне рабочей области в уровень «неразбираемо».",
+				"card.credentialPaths": "Свои пути к учётным данным (длинный хвост)",
+				"card.credentialPathsHint": "Секретные файлы, которых нет во встроенном списке. Записи — это глобы путей: двойная звёздочка переходит между каталогами, одиночная звёздочка и вопросительный знак остаются внутри одного сегмента; без маска-символов совпадение идёт по целому фрагменту пути (token не попадёт в ambient.txt); ведущий ~/ раскрывается в ваш home; относительный шаблон совпадает и на любой глубине (secrets/*.env покрывает a/b/secrets/prod.env). Совпадение держится по тому же стандарту, что и .ssh: чтение вне рабочей области и изменение файловым инструментом жёстко отклоняются — этот уровень нельзя оспорить и не обходят проверяющей моделью, поэтому объявляйте только те пути, которые действительно нужно защитить.",
+				"card.credentialPathsPlaceholder": "Новый путь, напр. ~/.myco/vault.token или secrets/*.env",
+				"card.denyKeywordsExtra": "Добавляемые ключевые слова чёрного списка (не заменяют пресет)",
+				"card.denyKeywordsExtraHint": "Детерминированная блокировка для ваших собственных терминов — подкоманда отзыва/стирания внутреннего CLI, префикс выдаваемого вами токена. Этот список только добавляет: что бы ни содержал чёрный список выше (пресет или ваша замена), эти слова сливаются с ним.",
+				"card.listRemove": "Удалить эту запись",
+				"card.extraContentArgKeys": "Дополнительные ключи документов (не читаются как операция)",
+				"card.extraContentArgKeysHint": "Имена полей вне встроенного списка (content/text/plan…): после добавления их текст не попадает в плоское чтение опасных слов и форм учётных данных. Только дополняет — встроенный список не заменяется, потому что пропуск одного из его ключей молча вернёт баг, когда план отклоняют за само описание работы. Реально выполняемая команда и изменяемый путь проверяются своими путями; этот список их не отключает.",
+				"card.extraContentArgKeysPlaceholder": "Новое имя аргумента, напр. steps",
+				"card.extraOperationArgKeys": "Дополнительные ключи операций (читать поле как исполняемый код)",
+				"card.extraOperationArgKeysHint": "Канал для полей, чьё тело действительно исполняется (workflowYaml и т. п.): их текст попадает в чёрный список и проверку учётных данных, и при совпадении ключа выигрывает этот список. Цена: вписав сюда настоящий документ, вы снова делаете «в плане упоминается rm -rf» причиной отказа.",
 				"card.scopeNote": "Область пресета: этот шлюз действует только когда пресет разрешений сессии — %scope. При любом другом пресете весь шлюз отключается — включая жёсткий отказ P0 — и политика выбранного пресета берёт управление на себя. Отключение записывает событие и оставляет постоянную полоску над полем ввода.",
 				"card.strategies": "Серверные стратегии одобрения (хотя бы одна активна; комбинируемы)",
 				"card.strategy.trustAutoAllow": "trustAutoAllow — безопасные операции в области автоматически разрешаются; опасные/неизвестные → запрос (базовый средний уровень)",
@@ -1325,6 +1517,30 @@ window.__ModuleLoader__.load({
 				"card.description": "Nivel de aprobación independiente: paralelo a solo lectura / acceso completo / lista blanca, mostrado como «Revisión automática» en el selector de permisos de sesión. El frontend expone un único interruptor; las cuatro estrategias de aprobación del backend son combinables mediante este panel y permanecen fail-closed contra la denegación dura P0.",
 				"card.permissive": "Habilitar el nivel de revisión automática",
 				"card.permissiveHint": "Cuando está desactivado, la compuerta se comporta exactamente igual que antes.",
+				"card.unattended": "Modos sin supervisión (tres implementaciones; cada interruptor decide si su nivel existe)",
+				"card.unattendedHint": "Tres interruptores, cada uno gobierna solo el nivel escrito a su lado: apagar una implementación devuelve ese nivel al flujo humano ordinario, sin convertirse a escondidas en otro.",
+				"card.mode.ask": "Mantener humano",
+				"card.mode.pass": "Paso mecánico",
+				"card.askHint": "El tamiz mecánico filtra y enumera sus dudas, pero la solicitud sigue quedando con una persona y no se llama al modelo revisor ni una vez — la forma para ejecuciones sin LLM revisor conectado, o cuando los tokens no valen la pena.",
+				"card.passHint": "Ejecuta solo el juez mecánico determinista: una operación irreversible, irrecuperable o ilegible se bloquea y se devuelve justificada al modelo principal; lo demás corre. Ninguna llamada al modelo, ninguna pregunta humana: la forma revisada de approval: never, y un YOLO sin modelo.",
+				"card.tierScopeHint": "Solo los presets dentro del alcance del gate (%scope) llegan a este paso; fuera de él el gate se aparta por completo y ningún interruptor toma sus confirmaciones.",
+				"card.yolo": "YOLO — nunca pedir un humano: bloquear lo peligroso, ejecutar el resto",
+				"card.yoloHint": "Bloquea una carga irreversible / no aprendible / ilegible, o un veredicto de riesgo duro del modelo, y devuelve la razón al LLM principal como mensaje 工具审核意见; todo lo demás se ejecuta. Sin un modelo disponible, solo las redes deterministas interceptan.",
+				"card.rulesFallback": "Degradar a una compuerta de reglas cuando no hay modelo (clase cc-safety-net)",
+				"card.rulesFallbackHint": "Solo actúa cuando el revisor de riesgo no está configurado o no dio veredicto: las redes deterministas bloquean lo que saben nombrar y dejan pasar el resto, en lugar de dejar la llamada colgada en un emergente que nadie responderá. Mientras un modelo responde, el comportamiento no cambia.",
+				"card.scriptReview": "Adjuntar el contenido de los scripts a la revisión (activado por defecto)",
+				"card.scriptReviewHint": "Cuando una llamada ejecuta un archivo script, su cuerpo se lee y se da al modelo de riesgo y al humano por igual, y las redes deterministas también evalúan el cuerpo (un borrado que solo se ve dentro del archivo es justo lo que se escapaba). Los cuerpos se redactan y limitan antes de salir del host; desactivarlo mantiene el contenido de archivos local, al costo de devolver los scripts fuera del espacio de trabajo al nivel «ilegible».",
+				"card.credentialPaths": "Rutas de credenciales personalizadas (la cola larga)",
+				"card.credentialPathsHint": "Archivos secretos que la lista integrada no conoce. Las entradas son globos de ruta: un doble asterisco cruza directorios, un asterisco simple y un signo de interrogación se quedan dentro de un segmento; sin comodines se compara un fragmento de ruta completo (token no toca ambient.txt); un ~/ inicial se expande a tu home; un patrón relativo también coincide a cualquier profundidad (secrets/*.env cubre a/b/secrets/prod.env). Una coincidencia se trata al mismo estándar que .ssh: leerla fuera del espacio de trabajo y mutarla con una herramienta de archivo se deniegan de forma dura — ese nivel no se puede apelar ni sortear por el revisor, así que declara solo las rutas que de verdad necesitas proteger.",
+				"card.credentialPathsPlaceholder": "Nueva ruta, p. ej. ~/.myco/vault.token o secrets/*.env",
+				"card.denyKeywordsExtra": "Palabras clave añadidas a la blacklist (no reemplaza el preajuste)",
+				"card.denyKeywordsExtraHint": "Un bloqueo determinista sobre términos propios — una subcomando de revocación/borrado de una CLI interna, un prefijo de token que emites. Esta lista solo añade: lo que contenga la blacklist de arriba (preajuste o tu propio reemplazo), estas palabras se fusionan.",
+				"card.listRemove": "Quitar esta entrada",
+				"card.extraContentArgKeys": "Claves de documento añadidas (nunca leídas como operación)",
+				"card.extraContentArgKeysHint": "Nombres de campos documentales fuera de la lista integrada (content/text/plan…): una vez declarados, su texto deja de entrar en la lectura plana de palabras peligrosas y formas de credenciales. Solo se añade: la lista integrada no se reemplaza, porque olvidar una de sus claves traería de vuelta en silencio el fallo por el que un plan se rechaza por describir una acción. El comando realmente ejecutado y la ruta modificada se juzgan por sus propios caminos; esta lista no puede apagarlos.",
+				"card.extraContentArgKeysPlaceholder": "Nuevo nombre de argumento, p. ej. steps",
+				"card.extraOperationArgKeys": "Claves de operación añadidas (leer el campo como código que se ejecuta)",
+				"card.extraOperationArgKeysHint": "Una vía para campos cuyo cuerpo sí se ejecuta (workflowYaml etc.): su texto entra en la blacklist y en el filtro de credenciales, y esta lista gana si ambas nombran la misma clave. Costo: declarar aquí un campo documental real vuelve a hacer que «el plan menciona rm -rf» sea motivo de rechazo.",
 				"card.scopeNote": "Ámbito del preajuste: esta compuerta solo actúa mientras el preajuste de permisos de la sesión sea %scope. Bajo cualquier otro preajuste la compuerta completa se retira — incluida la denegación dura P0 — y la política del preajuste seleccionado toma el control. La retirada registra un evento y deja una franja persistente sobre la entrada.",
 				"card.strategies": "Estrategias de aprobación del backend (al menos una activa; combinables)",
 				"card.strategy.trustAutoAllow": "trustAutoAllow — las operaciones seguras dentro del ámbito se auto-permiten; peligrosas/desconocidas → consulta (nivel intermedio base)",
@@ -1483,6 +1699,42 @@ window.__ModuleLoader__.load({
 			}
 		};
 		//#endregion
+		//#region src/client/switch-state.ts
+		/**
+		* The optimistic state machine behind the settings card's pill switch and its tier
+		* picker, kept out of the components so its three rules are testable without a DOM
+		* renderer (the client half ships no react-dom).
+		*
+		* The posture: the control flips the instant it is clicked and holds that
+		* position while the write round-trips through the host settings service — a
+		* checkbox that waits for the snapshot reads as a dead control. The store stays
+		* the truth, so the local override is dropped the moment the snapshot agrees
+		* with it, on a rejected write, and on a watchdog in case a host line neither
+		* applies nor reports the change.
+		*/
+		/** How long an unconfirmed click is allowed to hold the control before it snaps back. */
+		const SWITCH_SETTLE_MS = 4e3;
+		/**
+		* What the control displays: the pending click wins over the store until the store
+		* catches up (or the watchdog gives up on it). Generic because the same posture covers a
+		* two-state pill and a multi-state tier picker alike.
+		*/
+		function shownValue(pending, checked) {
+			return pending ?? checked;
+		}
+		/**
+		* Store update: once the snapshot reports the requested value the override is redundant,
+		* and handing the visual back to the snapshot is what keeps the control honest if another
+		* writer (a patch file, the app's own plugin manager) moved the same field meanwhile.
+		*/
+		function pendingAfterSync(pending, checked) {
+			return pending !== null && pending === checked ? null : pending;
+		}
+		/** A write that came back rejected: fall back to whatever the store holds. */
+		function pendingAfterFailure(_pending) {
+			return null;
+		}
+		//#endregion
 		//#region src/deny-defaults.ts
 		/**
 		* Preset deny keywords inherited from dsh-approval-gate's `DEFAULT_DENY_KEYWORDS`
@@ -1551,16 +1803,25 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region src/preset.ts
 		/**
-		* Presets in which the gate is active. It owns both 自动审查 tiers — the plain
-		* one (file sandbox kept) and the full-access one (sandbox restriction lifted,
-		* same approval behaviour) — so a user can have the gate without inheriting a
-		* sandbox that breaks `git` / Cygwin tools. `'*'` makes it global (every
-		* preset, including the hard-deny layer).
+		* Presets in which the gate is active. The plugin ships five 自动审查 tiers of its own
+		* (declared in its `cordis.patch.yml`, which is how they reach the composer picker at all):
+		* the plain one (file sandbox kept), the full-access one (sandbox lifted, same approval
+		* behaviour), and the three human-free / model-free implementations — mechanical takeover of
+		* asks (`permissive-mech`), mechanical screen that still asks (`permissive-snet`), and the
+		* model-backed YOLO. Each has exactly one preset and one switch, so they never cross: a
+		* switch changes the behaviour of its own tier and of nothing else. `'*'` makes the gate
+		* global (every preset, including the hard-deny layer).
 		*
 		* Lives in this dependency-free module (not `config.ts`) so the browser half can
 		* render the scope without pulling schemastery into the client bundle.
 		*/
-		const DEFAULT_GATE_PRESETS = ["permissive", "permissive-full"];
+		const DEFAULT_GATE_PRESETS = [
+			"permissive",
+			"permissive-full",
+			"permissive-mech",
+			"permissive-snet",
+			"permissive-yolo"
+		];
 		//#endregion
 		//#region src/client/sediment.tsx
 		/**
@@ -1785,6 +2046,243 @@ window.__ModuleLoader__.load({
 			lineHeight: "18px",
 			color: "var(--dsw-alias-label-tertiary)"
 		};
+		/** Focus ring for the pill switch. `:focus-visible` cannot be expressed inline, so
+		* the one pseudo-class the card needs rides on a single injected rule. */
+		const switchCss = ".pg-switch:focus-visible{outline:var(--dsw-focus-ring-width,2px) solid var(--dsw-focus-ring-color,var(--dsw-alias-state-business-primary,#3b82f6));outline-offset:2px}.pg-seg:focus-visible{outline:var(--dsw-focus-ring-width,2px) solid var(--dsw-focus-ring-color,var(--dsw-alias-state-business-primary,#3b82f6));outline-offset:1px}";
+		/**
+		* Optimistic control state, shared by the pill switch and the tier picker: show the
+		* requested value the instant it is clicked and hold it while the write round-trips
+		* through the host settings service, then hand the visual back to the store — on the
+		* snapshot catching up, on a rejected write, and on a watchdog for a host line that
+		* neither applies nor reports the change. A control may be fast, but it may not lie.
+		*/
+		function useOptimistic(stored) {
+			const [pending, setPending] = (0, react.useState)(null);
+			(0, react.useEffect)(() => {
+				setPending((current) => pendingAfterSync(current, stored));
+			}, [stored]);
+			(0, react.useEffect)(() => {
+				if (pending === null) return void 0;
+				const timer = setTimeout(() => {
+					setPending(pendingAfterFailure(pending));
+				}, SWITCH_SETTLE_MS);
+				return () => {
+					clearTimeout(timer);
+				};
+			}, [pending]);
+			const commit = (next, write) => {
+				setPending(next);
+				Promise.resolve(write()).catch(() => {
+					setPending(null);
+				});
+			};
+			return [shownValue(pending, stored), commit];
+		}
+		/**
+		* One row of the unattended block: a switch, and the preset it owns.
+		*
+		* The preset id is rendered next to the label because the mapping is the whole design —
+		* one switch, one implementation, one tier — and a person who sees 「机械直通」 in the
+		* composer needs to know which row governs it. The id is a machine key, so it stays
+		* untranslated on purpose.
+		*/
+		function TierRow(props) {
+			const { id, label, preset, checked, disabled, hint, onCommit } = props;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: rowStyle,
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+					htmlFor: id,
+					style: { fontSize: "12px" },
+					children: [label, /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+						style: {
+							color: "var(--dsw-alias-label-tertiary)",
+							fontSize: "11px"
+						},
+						children: [" · ", preset]
+					})]
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PillSwitch, {
+					id,
+					checked,
+					disabled,
+					onCommit
+				})]
+			}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+				style: hintStyle,
+				children: hint
+			})] });
+		}
+		/**
+		* Pill switch — the card's boolean control, cut to the shape of the host's own
+		* `ui-primitives` Switch: 36×20 capsule, 16px thumb, and the on/off appearance
+		* keyed off `aria-checked` so assistive tech can never read a state the eye does
+		* not see.
+		*
+		* Optimistic by design: the capsule flips on click and holds that position while
+		* `scope.set` round-trips through the host settings service. A checkbox that
+		* waits for the snapshot to come back reads as a dead control on a slow write.
+		* The snapshot stays the truth — the state machine lives in `switch-state.ts`
+		* (and under test there) so the pill can never sit in a state the profile does
+		* not have.
+		*
+		* Every colour is a theme token with a fallback: `--dsw-alias-brand-primary`
+		* only exists on newer host lines, and an "on" state that resolves to nothing is
+		* an invisible control in dark mode.
+		*/
+		function PillSwitch(props) {
+			const { id, checked, label, disabled = false, title, onCommit } = props;
+			const [shown, commit] = useOptimistic(checked);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+				id,
+				type: "button",
+				role: "switch",
+				"aria-checked": shown,
+				"aria-label": label,
+				title,
+				disabled,
+				className: "pg-switch",
+				style: {
+					boxSizing: "border-box",
+					position: "relative",
+					flex: "0 0 auto",
+					width: "36px",
+					height: "20px",
+					padding: "2px",
+					border: "0",
+					borderRadius: "999px",
+					background: shown ? "var(--dsw-alias-brand-primary, var(--dsw-alias-state-business-primary, #3b82f6))" : "var(--dsw-alias-border-l3, var(--dsw-alias-border-l2, rgba(128,128,128,0.35)))",
+					cursor: disabled ? "default" : "pointer",
+					opacity: disabled ? .5 : 1,
+					transition: "background 120ms ease"
+				},
+				onClick: () => {
+					const next = !shown;
+					commit(next, () => onCommit(next));
+				},
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+					"aria-hidden": true,
+					style: {
+						display: "block",
+						width: "16px",
+						height: "16px",
+						borderRadius: "50%",
+						background: "var(--dsw-alias-label-primary-foreground, #fff)",
+						transform: shown ? "translateX(16px)" : "translateX(0)",
+						transition: "transform 120ms ease"
+					}
+				})
+			});
+		}
+		/**
+		* A minimal add/remove editor for one string-array setting.
+		*
+		* Deliberately generic and small: the long-tail protection lists (`credentialPaths`,
+		* `denyKeywordsExtra`) are the same shape — lines a person types to protect something
+		* the preset cannot know — and they should not each grow their own copy of the row
+		* markup the deny blacklist already has.
+		*/
+		function StringListField(props) {
+			const [draft, setDraft] = (0, react.useState)("");
+			const add = () => {
+				const next = draft.trim();
+				if (next === "") return;
+				props.onAdd(next);
+				setDraft("");
+			};
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+				/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					style: labelStyle,
+					children: props.label
+				}),
+				/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					style: hintStyle,
+					children: props.hint
+				}),
+				/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					style: {
+						display: "flex",
+						flexDirection: "column",
+						gap: "4px",
+						margin: "6px 0"
+					},
+					children: props.items.map((item, index) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						style: {
+							display: "flex",
+							alignItems: "center",
+							gap: "8px",
+							padding: "4px 8px",
+							borderRadius: "6px",
+							border: "1px solid var(--dsw-alias-border-l2)",
+							background: "var(--dsw-alias-bg-surface, transparent)"
+						},
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", {
+							style: {
+								flex: "1 1 auto",
+								minWidth: 0,
+								overflowWrap: "anywhere",
+								font: "500 12px/18px var(--ds-font-family-code, monospace)",
+								color: "var(--dsw-alias-label-primary)"
+							},
+							children: item
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							"aria-label": props.removeLabel,
+							title: props.removeLabel,
+							disabled: props.locked,
+							onClick: () => {
+								props.onRemove(index);
+							},
+							style: {
+								flex: "0 0 auto",
+								width: "20px",
+								height: "20px",
+								border: "none",
+								borderRadius: "999px",
+								background: "transparent",
+								color: "var(--dsw-alias-label-tertiary)",
+								cursor: props.locked ? "default" : "pointer"
+							},
+							children: "✕"
+						})]
+					}, `${index}:${item}`))
+				}),
+				/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					style: {
+						display: "flex",
+						gap: "6px",
+						marginTop: "6px"
+					},
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+						type: "text",
+						value: draft,
+						disabled: props.locked,
+						placeholder: props.placeholder,
+						spellCheck: false,
+						style: {
+							...controlStyle,
+							flex: "1 1 auto",
+							minWidth: 0
+						},
+						onChange: (event) => {
+							setDraft(event.currentTarget.value);
+						},
+						onKeyDown: (event) => {
+							if (event.key === "Enter") add();
+						}
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						disabled: props.locked || draft.trim() === "",
+						onClick: add,
+						style: {
+							...controlStyle,
+							flex: "0 0 auto",
+							cursor: props.locked || draft.trim() === "" ? "default" : "pointer",
+							opacity: props.locked || draft.trim() === "" ? .5 : 1
+						},
+						children: props.addLabel
+					})]
+				})
+			] });
+		}
 		/**
 		* The card body, wrapped in a disclosure shell like every peer settings card:
 		* a header (name + description + chevron) toggling the body, expanded by
@@ -1810,11 +2308,16 @@ window.__ModuleLoader__.load({
 			const value = {
 				...raw,
 				allowlist: listOf(raw.allowlist),
-				denyKeywords: listOf(raw.denyKeywords)
+				denyKeywords: listOf(raw.denyKeywords),
+				denyKeywordsExtra: listOf(raw.denyKeywordsExtra),
+				credentialPaths: listOf(raw.credentialPaths),
+				extraContentArgKeys: listOf(raw.extraContentArgKeys),
+				extraOperationArgKeys: listOf(raw.extraOperationArgKeys)
 			};
 			const strategies = value.permissiveStrategies ?? {};
 			const hasApiKey = typeof value.classifierApiKey === "string" && value.classifierApiKey !== "";
 			const effective = value.permissive === true;
+			const gateScope = (value.gatePresets ?? []).length > 0 ? value.gatePresets : [...DEFAULT_GATE_PRESETS];
 			const commitApiKey = () => {
 				const next = apiKeyDraft.trim();
 				if (next === "") return;
@@ -2013,20 +2516,18 @@ window.__ModuleLoader__.load({
 						},
 						children: t("card.unavailable")
 					}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("style", { children: switchCss }),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							style: rowStyle,
 							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
 								htmlFor: "plugin-config-perm-gate-permissive",
 								style: labelStyle,
 								children: t("card.permissive")
-							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PillSwitch, {
 								id: "plugin-config-perm-gate-permissive",
-								type: "checkbox",
 								checked: effective,
 								disabled: readonly,
-								onChange: (event) => {
-									scope.set("permissive", event.currentTarget.checked);
-								}
+								onCommit: (next) => scope.set("permissive", next)
 							})]
 						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
@@ -2035,7 +2536,85 @@ window.__ModuleLoader__.load({
 						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 							style: hintStyle,
-							children: t("card.scopeNote").replace("%scope", ((value.gatePresets ?? []).length > 0 ? value.gatePresets : [...DEFAULT_GATE_PRESETS]).join(" / "))
+							children: t("card.scopeNote").replace("%scope", gateScope.join(" / "))
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+							style: sectionStyle,
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									style: labelStyle,
+									children: t("card.unattended")
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									style: hintStyle,
+									children: t("card.unattendedHint")
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TierRow, {
+									id: "plugin-config-perm-gate-yolo",
+									label: t("card.yolo"),
+									preset: "permissive-yolo",
+									checked: value.yolo === true,
+									disabled: readonly,
+									hint: t("card.yoloHint"),
+									onCommit: (next) => scope.set("yolo", next)
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TierRow, {
+									id: "plugin-config-perm-gate-safenet-pass",
+									label: t("card.mode.pass"),
+									preset: "permissive-mech",
+									checked: value.safenetPass !== false,
+									disabled: readonly,
+									hint: t("card.passHint"),
+									onCommit: (next) => scope.set("safenetPass", next)
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TierRow, {
+									id: "plugin-config-perm-gate-safenet-ask",
+									label: t("card.mode.ask"),
+									preset: "permissive-snet",
+									checked: value.safenetAsk === true,
+									disabled: readonly,
+									hint: t("card.askHint"),
+									onCommit: (next) => scope.set("safenetAsk", next)
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									style: hintStyle,
+									children: t("card.tierScopeHint").replace("%scope", gateScope.join(" / "))
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									style: rowStyle,
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
+										htmlFor: "plugin-config-perm-gate-rules-fallback",
+										style: { fontSize: "12px" },
+										children: t("card.rulesFallback")
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PillSwitch, {
+										id: "plugin-config-perm-gate-rules-fallback",
+										checked: value.rulesFallback === true,
+										disabled: readonly,
+										onCommit: (next) => scope.set("rulesFallback", next)
+									})]
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									style: hintStyle,
+									children: t("card.rulesFallbackHint")
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									style: rowStyle,
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
+										htmlFor: "plugin-config-perm-gate-script-review",
+										style: { fontSize: "12px" },
+										children: t("card.scriptReview")
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PillSwitch, {
+										id: "plugin-config-perm-gate-script-review",
+										checked: value.scriptReview !== false,
+										disabled: readonly,
+										onCommit: (next) => scope.set("scriptReview", next)
+									})]
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									style: hintStyle,
+									children: t("card.scriptReviewHint")
+								})
+							]
 						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 							style: sectionStyle,
@@ -2050,17 +2629,14 @@ window.__ModuleLoader__.load({
 										htmlFor: "plugin-config-perm-gate-trust",
 										style: { fontSize: "12px" },
 										children: t("card.strategy.trustAutoAllow")
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PillSwitch, {
 										id: "plugin-config-perm-gate-trust",
-										type: "checkbox",
 										checked: strategies.trustAutoAllow ?? true,
 										disabled: readonly || !effective,
-										onChange: (event) => {
-											scope.set("permissiveStrategies", {
-												...strategies,
-												trustAutoAllow: event.currentTarget.checked
-											});
-										}
+										onCommit: (next) => scope.set("permissiveStrategies", {
+											...strategies,
+											trustAutoAllow: next
+										})
 									})]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
@@ -2069,17 +2645,14 @@ window.__ModuleLoader__.load({
 										htmlFor: "plugin-config-perm-gate-confirm",
 										style: { fontSize: "12px" },
 										children: t("card.strategy.alwaysConfirm")
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PillSwitch, {
 										id: "plugin-config-perm-gate-confirm",
-										type: "checkbox",
 										checked: strategies.alwaysConfirm ?? false,
 										disabled: readonly || !effective,
-										onChange: (event) => {
-											scope.set("permissiveStrategies", {
-												...strategies,
-												alwaysConfirm: event.currentTarget.checked
-											});
-										}
+										onCommit: (next) => scope.set("permissiveStrategies", {
+											...strategies,
+											alwaysConfirm: next
+										})
 									})]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
@@ -2088,17 +2661,14 @@ window.__ModuleLoader__.load({
 										htmlFor: "plugin-config-perm-gate-llm",
 										style: { fontSize: "12px" },
 										children: t("card.strategy.llmAssist")
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PillSwitch, {
 										id: "plugin-config-perm-gate-llm",
-										type: "checkbox",
 										checked: strategies.llmAssist ?? false,
 										disabled: readonly || !effective,
-										onChange: (event) => {
-											scope.set("permissiveStrategies", {
-												...strategies,
-												llmAssist: event.currentTarget.checked
-											});
-										}
+										onCommit: (next) => scope.set("permissiveStrategies", {
+											...strategies,
+											llmAssist: next
+										})
 									})]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
@@ -2107,17 +2677,14 @@ window.__ModuleLoader__.load({
 										htmlFor: "plugin-config-perm-gate-escalation",
 										style: { fontSize: "12px" },
 										children: t("card.strategy.trustEscalation")
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PillSwitch, {
 										id: "plugin-config-perm-gate-escalation",
-										type: "checkbox",
 										checked: strategies.trustEscalation ?? true,
 										disabled: readonly || !effective,
-										onChange: (event) => {
-											scope.set("permissiveStrategies", {
-												...strategies,
-												trustEscalation: event.currentTarget.checked
-											});
-										}
+										onCommit: (next) => scope.set("permissiveStrategies", {
+											...strategies,
+											trustEscalation: next
+										})
 									})]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
@@ -2380,14 +2947,11 @@ window.__ModuleLoader__.load({
 												htmlFor: "plugin-config-perm-gate-risk-learning",
 												style: { fontSize: "12px" },
 												children: t("card.riskLearning")
-											}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+											}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PillSwitch, {
 												id: "plugin-config-perm-gate-risk-learning",
-												type: "checkbox",
 												checked: value.riskLearning ?? false,
 												disabled: readonly || !effective,
-												onChange: (event) => {
-													scope.set("riskLearning", event.currentTarget.checked);
-												}
+												onCommit: (next) => scope.set("riskLearning", next)
 											})]
 										}),
 										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
@@ -2423,14 +2987,11 @@ window.__ModuleLoader__.load({
 													htmlFor: "plugin-config-perm-gate-risk-sediment",
 													style: { fontSize: "12px" },
 													children: t("card.riskSediment")
-												}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+												}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PillSwitch, {
 													id: "plugin-config-perm-gate-risk-sediment",
-													type: "checkbox",
 													checked: value.riskSediment ?? true,
 													disabled: readonly || !effective,
-													onChange: (event) => {
-														scope.set("riskSediment", event.currentTarget.checked);
-													}
+													onCommit: (next) => scope.set("riskSediment", next)
 												})]
 											}),
 											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
@@ -2943,6 +3504,74 @@ window.__ModuleLoader__.load({
 								})] }) : null
 							]
 						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+							style: sectionStyle,
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(StringListField, {
+									label: t("card.credentialPaths"),
+									hint: t("card.credentialPathsHint"),
+									placeholder: t("card.credentialPathsPlaceholder"),
+									addLabel: t("card.denylistAdd"),
+									removeLabel: t("card.listRemove"),
+									items: value.credentialPaths ?? [],
+									locked: readonly,
+									onAdd: (entry) => {
+										scope.set("credentialPaths", [...value.credentialPaths ?? [], entry]);
+									},
+									onRemove: (index) => {
+										scope.set("credentialPaths", (value.credentialPaths ?? []).filter((_, i) => i !== index));
+									}
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { style: { height: "10px" } }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(StringListField, {
+									label: t("card.denyKeywordsExtra"),
+									hint: t("card.denyKeywordsExtraHint"),
+									placeholder: t("card.denylistPlaceholder"),
+									addLabel: t("card.denylistAdd"),
+									removeLabel: t("card.listRemove"),
+									items: value.denyKeywordsExtra ?? [],
+									locked: readonly,
+									onAdd: (entry) => {
+										scope.set("denyKeywordsExtra", [...value.denyKeywordsExtra ?? [], entry]);
+									},
+									onRemove: (index) => {
+										scope.set("denyKeywordsExtra", (value.denyKeywordsExtra ?? []).filter((_, i) => i !== index));
+									}
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { style: { height: "10px" } }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(StringListField, {
+									label: t("card.extraContentArgKeys"),
+									hint: t("card.extraContentArgKeysHint"),
+									placeholder: t("card.extraContentArgKeysPlaceholder"),
+									addLabel: t("card.denylistAdd"),
+									removeLabel: t("card.listRemove"),
+									items: value.extraContentArgKeys ?? [],
+									locked: readonly,
+									onAdd: (entry) => {
+										scope.set("extraContentArgKeys", [...value.extraContentArgKeys ?? [], entry]);
+									},
+									onRemove: (index) => {
+										scope.set("extraContentArgKeys", (value.extraContentArgKeys ?? []).filter((_, i) => i !== index));
+									}
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { style: { height: "10px" } }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(StringListField, {
+									label: t("card.extraOperationArgKeys"),
+									hint: t("card.extraOperationArgKeysHint"),
+									placeholder: t("card.extraContentArgKeysPlaceholder"),
+									addLabel: t("card.denylistAdd"),
+									removeLabel: t("card.listRemove"),
+									items: value.extraOperationArgKeys ?? [],
+									locked: readonly,
+									onAdd: (entry) => {
+										scope.set("extraOperationArgKeys", [...value.extraOperationArgKeys ?? [], entry]);
+									},
+									onRemove: (index) => {
+										scope.set("extraOperationArgKeys", (value.extraOperationArgKeys ?? []).filter((_, i) => i !== index));
+									}
+								})
+							]
+						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 							style: sectionStyle,
 							children: [
@@ -3089,24 +3718,20 @@ window.__ModuleLoader__.load({
 									style: hintStyle,
 									children: t("card.networkEnabledHint")
 								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 									style: {
 										display: "flex",
 										alignItems: "center",
 										gap: "8px",
 										marginTop: "6px"
 									},
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-										type: "checkbox",
+									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PillSwitch, {
+										id: "plugin-config-perm-gate-network-enabled",
+										label: t("card.networkEnabled"),
 										checked: value.networkEnabled === true,
 										disabled: readonly,
-										onChange: (event) => {
-											scope.set("networkEnabled", event.currentTarget.checked);
-										}
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										style: { fontSize: "13px" },
-										children: value.networkEnabled === true ? "ON" : "OFF"
-									})]
+										onCommit: (next) => scope.set("networkEnabled", next)
+									})
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 									style: hintStyle,
@@ -3125,24 +3750,20 @@ window.__ModuleLoader__.load({
 									style: hintStyle,
 									children: t("card.networkInjectEnvHint")
 								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 									style: {
 										display: "flex",
 										alignItems: "center",
 										gap: "8px",
 										marginTop: "6px"
 									},
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-										type: "checkbox",
+									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PillSwitch, {
+										id: "plugin-config-perm-gate-network-inject-env",
+										label: t("card.networkInjectEnv"),
 										checked: value.networkInjectEnv !== false,
 										disabled: readonly,
-										onChange: (event) => {
-											scope.set("networkInjectEnv", event.currentTarget.checked);
-										}
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										style: { fontSize: "13px" },
-										children: value.networkInjectEnv !== false ? "ON" : "OFF"
-									})]
+										onCommit: (next) => scope.set("networkInjectEnv", next)
+									})
 								})
 							]
 						}),
@@ -3157,24 +3778,20 @@ window.__ModuleLoader__.load({
 									style: hintStyle,
 									children: t("card.watchHint")
 								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 									style: {
 										display: "flex",
 										alignItems: "center",
 										gap: "8px",
 										marginTop: "6px"
 									},
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-										type: "checkbox",
+									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PillSwitch, {
+										id: "plugin-config-perm-gate-watch",
+										label: t("card.watch"),
 										checked: value.watch !== false,
 										disabled: readonly,
-										onChange: (event) => {
-											scope.set("watch", event.currentTarget.checked);
-										}
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										style: { fontSize: "13px" },
-										children: value.watch !== false ? "ON" : "OFF"
-									})]
+										onCommit: (next) => scope.set("watch", next)
+									})
 								})
 							]
 						}),
@@ -3380,7 +3997,18 @@ window.__ModuleLoader__.load({
 			"human-cancelled": "人工取消",
 			"no-approval-channel": "无审批通道",
 			"preset-passthrough": "审批策略 never · 已放行",
-			"stand-down": "门禁停用"
+			"stand-down": "门禁停用",
+			"yolo-allow": "YOLO 放行",
+			"yolo-allow-no-reviewer": "YOLO 放行（无审查模型·机械处置）",
+			"yolo-block": "YOLO 拦截",
+			"rules-fallback-allow": "无模型规则闸门放行",
+			"rules-fallback-block": "无模型规则闸门拦截",
+			"safety-net-passthrough-allow": "机械审查放行（零模型）",
+			"safety-net-passthrough-block": "机械审查拦截（零模型）",
+			"cleanup-safe": "清理类安全放行",
+			"escalation-auto": "沙箱升级自动放行",
+			"learned-granted": "学习授权放行",
+			"network-ask": "网络审批"
 		};
 		/** Compact wall-clock rendering of an ISO timestamp. */
 		function clockTime(iso) {