dsh-perm-gate 5.4.1 → 5.4.2

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- **拦截意见不再冒充用户消息**：被拦后给主模型的 `工具审核意见` 曾以 `mode:'queue'` 投到 next-turn——那是用户的输入队列，意见投进去会在 input-traffic 等待区里像用户自己排的一条，并与待发消息抢队列，且要等整个回合结束才送达（模型多反刍一轮）。现在交由 `buildBlockNoteSender` 投递：首选 `agent.inject()`（next-step 带内、不唤醒 driver，贴着被拒的 tool 结果在下一个 pre-step 送达）并标上自有 `source.kind='perm-gate'`，因为宿主的语义里只有 `source.kind==='user'`（带 `rpcId`）才是“人说的话”，其余一律按注入上下文渲染；没有活 agent 时才回退到 steer 车道（`session.prompt mode:'steer'`），绝不静默降级成 `followup`。yolo / 机械直通 / 降级审查 / 确定性 deny 四条拦截路径统一如此；评审页「撤销此改动」仍走 next-turn（那是人想发的一句话）。
+- 配套：`dsh-input-traffic` 同步把「插话中」限定为真人插话（`source.kind === 'user'`），宿主自有通知（如 `user-approval` 的审批策略变更）与第三方意见不再占位等待区；没带 `source` 的旧行仍照常显示，不会误伤真队列。
+
 ## 5.4.0 (2026-10-30)
 
 - 凭据类型阶梯：七个内置族（ssh / cloud / package / gitcreds / env / cli / db），每类四档 deny / ask（默认）/ readonly / readwrite。档位状态就住在规则文档本身——每类一条 `[deny-rule:cred.<family>]` 行（分区 + enabled）加成对的 volatile `credWriteExemptFamilies` 清单；设置卡经 `GET/POST /api/dsh-perm-gate/cred` 一条 update 成对读写，无本地镜像、无半态。readwrite 需卡内二次确认，且只退让 P0 的一条判据（凭据 store 写）；根盘、受保护路径、.dsh、外发在任何档位不让；自定义 credentialPaths 永不参与写豁免。

package/README.md

@@ -381,7 +381,9 @@ Three switches change **who decides**, seven keys change **what is known**. They
 
 - `yolo` (the `permissive-yolo` tier) — never raises a confirmation. A dangerous ask
   (irreversible, unlearnable, an unreadable payload, or a hard-risk verdict from the configured
-  reviewer) is blocked and the reason comes back to the agent as a `工具审核意见` message;
+  reviewer) is blocked and the reason comes back to the agent as a `工具审核意见` message on
+  the **steering lane** (`next-step`: beside the refused tool result, at the same turn's
+  next step) rather than the user's input queue;
   everything else runs. With no reviewer in seat the tier does not quietly allow — the mechanical
   screen settles it and the event is recorded as `yolo-allow-no-reviewer`, because a tier that
   advertises a model must not report one it never got.

package/README.zh.md

@@ -274,7 +274,7 @@ outside the design set get none*。`permissive` 是内置值，所以「自动
 
 三个开关改变“谁来定”，七个键改变“能看见什么”。它们全部 volatile：设置卡改完下一个工具调用即生效，无需重载。
 
-- `yolo`（负责 `permissive-yolo` 那一档）— 永不弹人工确认。危险 ask（不可逆 / 不可沉淀 / 载荷读不懂 / 审查模型报硬风险）被拦截，理由以 `工具审核意见` 消息回喂主模型；其余照常执行。审查模型不在场时它不静默放行：由机械审查器裁定，并把事件记为 `yolo-allow-no-reviewer`——一档既然声称有模型，就不能把没答上的模型报成答过了。
+- `yolo`（负责 `permissive-yolo` 那一档）— 永不弹人工确认。危险 ask（不可逆 / 不可沉淀 / 载荷读不懂 / 审查模型报硬风险）被拦截，理由以 `工具审核意见` 消息经 **steer 车道**（`next-step`，贴着被拒的工具结果、在同一回合的下一步送达）回喂主模型，不占用户输入队列；其余照常执行。审查模型不在场时它不静默放行：由机械审查器裁定，并把事件记为 `yolo-allow-no-reviewer`——一档既然声称有模型，就不能把没答上的模型报成答过了。
 - `rulesFallback` — 降级审查。仅当**没有审查模型**（未配置，或端点未能给出裁决）时生效：改由确定性规则网裁定，不再把调用挂在没人应答的确认框上。模型正常应答时行为不变。它只作用于普通的自动审查档（`permissive` / `permissive-full`）；那三颗各自拥有一档的开关已经写明由谁回答，不会被它降级。
 - `scriptReview`（默认开）— 调用跑脚本时读取它的正文（有界、绝不执行），同时交给审查模型、人工卡片与规则网：只在 `clean-home.sh` 里看到的删除从此按代码判定。正文全读到就不再是“读不懂的载荷”，从而脱离 U 档。关掉可不让文件内容离开本机，代价是工作区外脚本回到“看不清、问人”。
 

package/dsh.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "dsh-perm-gate",
   "name": "dsh-perm-gate",
-  "version": "5.4.1",
+  "version": "5.4.2",
   "description": {
     "en": "Deterministic-first, fail-closed permission gate for DeepSeek Harness 0.1.2+: a P0 hard-deny -> P1 precise session grant -> P2 static allow/deny rule chain -> P3 optional LLM classifier -> P4 ask pipeline over the tools/pre-execute waterfall, with a standalone CLI dry-run evaluator and an auditable decision log. Credential handling is a seven-family ladder (ssh/cloud/package/gitcreds/env/cli/db) with deny/ask/readonly/readwrite rungs kept in the rules document plus a paired write-exemption list; a protected-branch push switch keeps the P0 floor by default. It only vetoes with deny/ask and always delegates otherwise, and unknown or malformed rules fail loud instead of silently standing the gate down.",
     "zh": "面向 DeepSeek Harness 0.1.2+ 的确定性优先、失败即拒的权限闸门：在 tools/pre-execute 瀑布上串起 P0 硬拒绝 → P1 精确会话授权 → P2 静态 allow/deny 规则链 → P3 可选 LLM 语义分类 → P4 ask，并附带独立 CLI 干跑评估器与可审计的决策日志。凭据处理为七族阶梯（ssh/cloud/package/gitcreds/env/cli/db）× deny/ask/readonly/readwrite 四档，档位存规则文档 + 成对写豁免清单；保护分支强推开关默认保留 P0 地板。只以 deny/ask 否决、其余一律放行，规则未知或非法时直接报错，绝不静默失效。"

package/lib/index.d.ts

@@ -7,6 +7,7 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import { Config } from './config.js';
+import { type SessionSender } from './events.js';
 import { PermGateRuntime, type PreToolDecisionLike, type ToolExecutionLike } from './runtime.js';
 export declare const name = "dsh-perm-gate";
 /**
@@ -20,6 +21,51 @@ export declare const inject: string[];
 export { Config };
 /** Runtime settings namespace: `permissive` + `permissiveStrategies` (editable in the UI). */
 export declare const PERMISSIVE_NAMESPACE = "dsh-perm-gate";
+/**
+ * The `source.kind` the gate stamps on its own block opinions.
+ *
+ * The host's vocabulary is explicit about this: `source.kind === 'user'` (with an
+ * `rpcId`) means *a human typed it*, and `ui-trajectory` / `ui-chat` render any
+ * other kind as injected **context**, not as a queued user input. The host's own
+ * notices use the same convention (`user-approval`, `policy`, `time-context`…).
+ * A gate note is the gate talking, so it must not borrow the human's identity —
+ * otherwise the waiting area lists it as a message the person can plan, reorder
+ * or resend.
+ */
+export declare const BLOCK_NOTE_SOURCE_KIND = "perm-gate";
+/**
+ * Deliver the gate's block opinion into the running turn.
+ *
+ * The opinion is model-facing context, not user input, so this uses the host's
+ * injection lane (`agent.inject`: same `next-step` band as steering, but the
+ * note waits for the next pre-step instead of waking a driver) and stamps
+ * {@link BLOCK_NOTE_SOURCE_KIND} on it. The role stays `user` — that is the only
+ * role a model reads as an instruction — but the source says who really spoke.
+ *
+ * Falls back to {@link buildSessionSender}'s steering lane when no live agent is
+ * reachable (a hosted runtime that only exposes the typert gateway): the note
+ * then arrives as a steer, which the UI may show as a pending message — worse,
+ * but never a dropped block reason.
+ */
+export declare function buildBlockNoteSender(get: (name: string) => unknown): SessionSender;
+/**
+ * Deliver a message into a conversation. A DSH user message content must be a
+ * block array — a bare string is rendered per character by the GUI — and two
+ * channels are tried in order: the typert gateway, then the live agent's own
+ * inbox method.
+ *
+ * `mode` picks the lane, and the lanes are physically different queues:
+ *
+ * - `queue` → `agent.followup` → **next-turn**: a new user turn. That is the
+ *   lane for an instruction the person means to type (the review page's
+ *   "撤销此改动"), and it shares the queue the user's own input waits in.
+ * - `steer` → `agent.steer` → **next-step**: lands beside the tool result that
+ *   is about to be delivered, inside the *running* turn. That is the lane for
+ *   the gate's own block opinion — it must not cost the user a turn, must not
+ *   look like something they typed, and must reach the model at the very next
+ *   step boundary rather than after the turn ends.
+ */
+export declare function buildSessionSender(get: (name: string) => unknown, mode?: 'queue' | 'steer'): SessionSender;
 /**
  * Build the `approval/request` listener (exported for tests).
  *

package/lib/index.js

@@ -52,18 +52,79 @@ function asSurface(value) {
         : undefined;
 }
 /**
- * Deliver a revert instruction into a conversation (the review page's "撤销此改动").
- * A DSH user message content must be a block array — a bare string is rendered
- * per character by the GUI — and two channels are tried in order: the typert
- * gateway, then the live agent's followup.
+ * The `source.kind` the gate stamps on its own block opinions.
+ *
+ * The host's vocabulary is explicit about this: `source.kind === 'user'` (with an
+ * `rpcId`) means *a human typed it*, and `ui-trajectory` / `ui-chat` render any
+ * other kind as injected **context**, not as a queued user input. The host's own
+ * notices use the same convention (`user-approval`, `policy`, `time-context`…).
+ * A gate note is the gate talking, so it must not borrow the human's identity —
+ * otherwise the waiting area lists it as a message the person can plan, reorder
+ * or resend.
+ */
+export const BLOCK_NOTE_SOURCE_KIND = 'perm-gate';
+/**
+ * Deliver the gate's block opinion into the running turn.
+ *
+ * The opinion is model-facing context, not user input, so this uses the host's
+ * injection lane (`agent.inject`: same `next-step` band as steering, but the
+ * note waits for the next pre-step instead of waking a driver) and stamps
+ * {@link BLOCK_NOTE_SOURCE_KIND} on it. The role stays `user` — that is the only
+ * role a model reads as an instruction — but the source says who really spoke.
+ *
+ * Falls back to {@link buildSessionSender}'s steering lane when no live agent is
+ * reachable (a hosted runtime that only exposes the typert gateway): the note
+ * then arrives as a steer, which the UI may show as a pending message — worse,
+ * but never a dropped block reason.
  */
-function buildSessionSender(get) {
+export function buildBlockNoteSender(get) {
+    const steer = buildSessionSender(get, 'steer');
+    return async (sessionId, content) => {
+        const agents = get('agents');
+        if (agents !== undefined && typeof agents.get === 'function') {
+            const agent = agents.get(sessionId);
+            if (agent !== undefined && typeof agent.inject === 'function') {
+                try {
+                    agent.inject({
+                        id: 'pg-note-' + Date.now().toString(36) + '-' + Math.floor(Math.random() * 1e9).toString(36),
+                        role: 'user',
+                        content: [{ type: 'text', text: content }],
+                        source: { kind: BLOCK_NOTE_SOURCE_KIND },
+                    });
+                    return { ok: true, via: 'inject' };
+                }
+                catch {
+                    // fall through to the steering lane
+                }
+            }
+        }
+        return steer(sessionId, content);
+    };
+}
+/**
+ * Deliver a message into a conversation. A DSH user message content must be a
+ * block array — a bare string is rendered per character by the GUI — and two
+ * channels are tried in order: the typert gateway, then the live agent's own
+ * inbox method.
+ *
+ * `mode` picks the lane, and the lanes are physically different queues:
+ *
+ * - `queue` → `agent.followup` → **next-turn**: a new user turn. That is the
+ *   lane for an instruction the person means to type (the review page's
+ *   "撤销此改动"), and it shares the queue the user's own input waits in.
+ * - `steer` → `agent.steer` → **next-step**: lands beside the tool result that
+ *   is about to be delivered, inside the *running* turn. That is the lane for
+ *   the gate's own block opinion — it must not cost the user a turn, must not
+ *   look like something they typed, and must reach the model at the very next
+ *   step boundary rather than after the turn ends.
+ */
+export function buildSessionSender(get, mode = 'queue') {
     return async (sessionId, content) => {
         const textBlock = [{ type: 'text', text: content }];
         const gateway = get('typertGateway');
         if (gateway !== undefined && typeof gateway.invoke === 'function') {
             try {
-                await gateway.invoke({ namespace: 'session', method: 'prompt', args: { sessionId, mode: 'queue', content: textBlock } });
+                await gateway.invoke({ namespace: 'session', method: 'prompt', args: { sessionId, mode, content: textBlock } });
                 return { ok: true, via: 'gateway' };
             }
             catch {
@@ -73,14 +134,18 @@ function buildSessionSender(get) {
         const agents = get('agents');
         if (agents !== undefined && typeof agents.get === 'function') {
             const agent = agents.get(sessionId);
-            if (agent !== undefined && typeof agent.followup === 'function') {
-                agent.followup({
-                    id: 'pg-revert-' + Date.now().toString(36) + '-' + Math.floor(Math.random() * 1e9).toString(36),
+            // The fallback stays on the requested lane: silently degrading a steer to
+            // followup would put the block opinion back in the user's turn queue — the
+            // exact confusion this lane split exists to remove.
+            const push = mode === 'steer' ? agent?.steer : agent?.followup;
+            if (agent !== undefined && typeof push === 'function') {
+                push.call(agent, {
+                    id: `pg-${mode}-` + Date.now().toString(36) + '-' + Math.floor(Math.random() * 1e9).toString(36),
                     role: 'user',
                     content: textBlock,
                     source: { kind: 'user' },
                 });
-                return { ok: true, via: 'followup' };
+                return { ok: true, via: mode };
             }
         }
         return { ok: false, error: '没有可用的消息投递通道' };
@@ -853,11 +918,17 @@ export function apply(ctx, config = {}) {
     catch {
         // webServer unavailable: the feed remains disk-only, sediment is view-only in files
     }
-    // YOLO feedback: when a call is blocked (YOLO block **or** a deterministic deny in
-    // any mode), append a user-role "工具审核意见" message to the owning session so the
-    // main LLM sees why + which rule + a disposition and self-corrects — modeled on
-    // cc-safety-net's BLOCKED message. Best-effort; a failed delivery never un-blocks.
-    const yoloSender = buildSessionSender(fallbackGet);
+    // Block feedback: when a call is blocked (YOLO / mechanical / degraded-review block
+    // **or** a deterministic deny in any mode), the gate hands the main LLM a
+    // `工具审核意见` note telling it why, which rule fired and what to do instead.
+    //
+    // The note is context the gate injects, not something the person typed:
+    // `buildBlockNoteSender` uses `agent.inject` (next-step band, no driver wake) and
+    // stamps its own `source.kind`, so it lands beside the refused tool result at the
+    // next pre-step, never in the next-turn queue the user's own input waits in, and
+    // never claims to be a human message in the waiting area.
+    // Best-effort; a failed delivery never un-blocks.
+    const blockSender = buildBlockNoteSender(fallbackGet);
     const blockedSubject = (exec) => {
         const args = exec.arguments ?? {};
         const cmd = (typeof exec.commandText === 'string' && exec.commandText !== ''
@@ -868,18 +939,18 @@ export function apply(ctx, config = {}) {
         const p = ['file_path', 'path', 'cwd', 'workdir'].map((k) => args[k]).find((v) => typeof v === 'string');
         return `${exec.name}${typeof p === 'string' ? ': ' + p : ''}`;
     };
-    const yoloFeedback = (exec, decision) => {
+    const blockFeedback = (exec, decision) => {
         const sessionId = (typeof exec.sessionId === 'string' && exec.sessionId !== ''
             ? exec.sessionId
             : (exec.agent?.sessionId ?? exec.agent?.session?.id) ?? '');
         if (sessionId === '')
             return;
         const { text } = composeReviewOpinion({ command: blockedSubject(exec), reason: decision.reason, locale: 'zh' });
-        void yoloSender(sessionId, `工具审核意见: "${text}"`).catch(() => {
+        void blockSender(sessionId, `工具审核意见: "${text}"`).catch(() => {
             // no delivery channel — the block still stands, the LLM just gets no note.
         });
     };
-    const listener = makePreExecuteListener(runtime, yoloFeedback);
+    const listener = makePreExecuteListener(runtime, blockFeedback);
     // `tools/pre-execute` / `tools/result` / `approval/request` are service events,
     // not part of cordis core's typed `Events`, so they are registered through the
     // string overload.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-perm-gate",
-  "version": "5.4.1",
+  "version": "5.4.2",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "tag": "latest"