dsh-perm-gate 5.4.1 → 5.4.3

package/lib/config.d.ts

@@ -22,6 +22,8 @@ export declare function dataDirReady(dataDir: string): boolean;
  * applies `defaultAction`), so the fallback never fails the plugin load.
  */
 export declare function resolveRulesFile(configured: string | undefined, dataDir: string): string;
+/** Reasoning effort the host reviewer may request; empty = let the host decide. */
+export type ClassifierEffort = '' | 'off' | 'low' | 'medium' | 'high';
 export interface PermGateConfig {
     /** Absolute or `./`-relative path to the YAML permissions document. */
     readonly rulesFile?: string;
@@ -34,7 +36,19 @@ export interface PermGateConfig {
     /** Enable the optional LLM semantic classifier (P3). Default false. */
     readonly classifierEnabled?: boolean;
     readonly classifierEndpoint?: string;
+    /**
+     * Model id for the llmAssist receiver. Unset in host mode means **inherit the
+     * host model-group selection** — an inherited default here (the old
+     * `deepseek-chat`) pinned the reviewer to an unrelated model while the provider
+     * followed the host (issue #8). Custom-endpoint mode still falls back to
+     * `deepseek-chat` at request time.
+     */
     readonly classifierModel?: string;
+    /**
+     * Reasoning effort for host reviews (`off` | `low` | `medium` | `high`).
+     * Empty omits the field so the host model configuration decides (issue #8).
+     */
+    readonly classifierEffort?: ClassifierEffort;
     readonly classifierApiKey?: string;
     /** Abort the llmAssist risk call after this many milliseconds. Default 20000. */
     readonly riskTimeoutMs?: number;
@@ -483,7 +497,8 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     caseInsensitivePaths: z<boolean, boolean, "defined">;
     classifierEnabled: z<boolean, boolean, "defined">;
     classifierEndpoint: z<string, string, "plain">;
-    classifierModel: z<string, string, "defined">;
+    classifierModel: z<string, string, "plain">;
+    classifierEffort: z<"" | "off" | "low" | "medium" | "high", "" | "off" | "low" | "medium" | "high", "defined">;
     classifierApiKey: z<string, string, "plain">;
     riskTimeoutMs: z<number, number, "defined">;
     riskLearning: z<boolean, boolean, "defined">;
@@ -557,7 +572,7 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     sandboxEnabled: z<boolean, boolean, "defined">;
     sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "defined">;
     sandboxProxy: z<string, string, "defined">;
-    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "defined">;
+    sandboxLoopback: z<"off" | "exempt", "off" | "exempt", "defined">;
     rules: z<RulesConfig>;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
@@ -568,7 +583,8 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     caseInsensitivePaths: z<boolean, boolean, "defined">;
     classifierEnabled: z<boolean, boolean, "defined">;
     classifierEndpoint: z<string, string, "plain">;
-    classifierModel: z<string, string, "defined">;
+    classifierModel: z<string, string, "plain">;
+    classifierEffort: z<"" | "off" | "low" | "medium" | "high", "" | "off" | "low" | "medium" | "high", "defined">;
     classifierApiKey: z<string, string, "plain">;
     riskTimeoutMs: z<number, number, "defined">;
     riskLearning: z<boolean, boolean, "defined">;
@@ -642,7 +658,7 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     sandboxEnabled: z<boolean, boolean, "defined">;
     sandboxMode: z<"read-only" | "workspace-write", "read-only" | "workspace-write", "defined">;
     sandboxProxy: z<string, string, "defined">;
-    sandboxLoopback: z<"exempt" | "off", "exempt" | "off", "defined">;
+    sandboxLoopback: z<"off" | "exempt", "off" | "exempt", "defined">;
     rules: z<RulesConfig>;
     watch: z<boolean, boolean, "defined">;
     watchDebounceMs: z<number, number, "defined">;
@@ -650,12 +666,12 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
 /** Live reference the 0.1.7 loader hands `apply` for `.volatile()` config fields. */
 export type VolatileRef<T> = Volatile<T>;
 /** The config fields marked `.volatile()` — live refs inside `apply`'s config. */
-export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "yolo", "rulesFallback", "unattendedTiers", "safenetPass", "safenetAsk", "allowProtectedBranchPush", "credWriteExemptFamilies", "presetRulesVersion", "scriptReview", "permissiveStrategies", "allowlist", "denyKeywords", "denyKeywordsExtra", "credentialPaths", "extraContentArgKeys", "extraOperationArgKeys", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
+export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierEffort", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "yolo", "rulesFallback", "unattendedTiers", "safenetPass", "safenetAsk", "allowProtectedBranchPush", "credWriteExemptFamilies", "presetRulesVersion", "scriptReview", "permissiveStrategies", "allowlist", "denyKeywords", "denyKeywordsExtra", "credentialPaths", "extraContentArgKeys", "extraOperationArgKeys", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
 /** Resolve one possibly-volatile field: a live ref on 0.1.7+, a plain value otherwise. */
 export declare function readVolatileValue<T>(value: T | Volatile<T> | undefined): VolatileSnapshot<T> | undefined;
 /** Shallow-resolve every volatile field into a plain snapshot (one per read). */
 export declare function resolveVolatileConfig(config: object): Record<string, unknown>;
-export type ResolvedPermGateConfig = Required<Pick<PermGateConfig, 'caseInsensitivePaths' | 'grantTtlMs' | 'grantMaxUses' | 'permissive' | 'riskTimeoutMs' | 'riskLearning' | 'riskThreshold'>> & Pick<PermGateConfig, 'rulesFile' | 'dshHome' | 'defaultAction' | 'classifierEnabled' | 'classifierEndpoint' | 'classifierModel' | 'classifierApiKey' | 'learningFile' | 'eventsFile'> & {
+export type ResolvedPermGateConfig = Required<Pick<PermGateConfig, 'caseInsensitivePaths' | 'grantTtlMs' | 'grantMaxUses' | 'permissive' | 'riskTimeoutMs' | 'riskLearning' | 'riskThreshold'>> & Pick<PermGateConfig, 'rulesFile' | 'dshHome' | 'defaultAction' | 'classifierEnabled' | 'classifierEndpoint' | 'classifierModel' | 'classifierEffort' | 'classifierApiKey' | 'learningFile' | 'eventsFile'> & {
     readonly permissiveStrategies: PermissiveStrategies;
     readonly gatePresets: readonly string[];
 };

package/lib/config.js

@@ -180,7 +180,8 @@ export const Config = z.object({
     caseInsensitivePaths: vol(z.boolean().default(true)),
     classifierEnabled: vol(z.boolean().default(false)),
     classifierEndpoint: vol(z.string()),
-    classifierModel: vol(z.string().default('deepseek-chat')),
+    classifierModel: vol(z.string()),
+    classifierEffort: vol(z.union(['', 'off', 'low', 'medium', 'high']).default('')),
     classifierApiKey: vol(z.string()),
     riskTimeoutMs: vol(z.number().min(1000).default(20_000)),
     riskLearning: vol(z.boolean().default(true)),
@@ -264,7 +265,7 @@ export const Config = z.object({
 /** The config fields marked `.volatile()` — live refs inside `apply`'s config. */
 export const VOLATILE_CONFIG_KEYS = [
     'defaultAction', 'caseInsensitivePaths', 'classifierEnabled', 'classifierEndpoint',
-    'classifierModel', 'classifierApiKey', 'riskTimeoutMs', 'riskLearning', 'riskSediment',
+    'classifierModel', 'classifierEffort', 'classifierApiKey', 'riskTimeoutMs', 'riskLearning', 'riskSediment',
     'classifierSource', 'classifierProvider', 'riskThreshold', 'grantTtlMs', 'grantMaxUses',
     'permissive', 'yolo', 'rulesFallback', 'unattendedTiers', 'safenetPass', 'safenetAsk', 'allowProtectedBranchPush', 'credWriteExemptFamilies', 'presetRulesVersion', 'scriptReview', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'denyKeywordsExtra', 'credentialPaths', 'extraContentArgKeys', 'extraOperationArgKeys', 'presetRulesSeeded', 'autoAllowTools',
     'sessionSweep', 'searchUp', 'badFilePolicy', 'maxChainLength',
@@ -303,7 +304,9 @@ export function resolveConfig(config = {}) {
         caseInsensitivePaths: parsed.caseInsensitivePaths ?? true,
         classifierEnabled: parsed.classifierEnabled ?? false,
         classifierEndpoint: parsed.classifierEndpoint,
-        classifierModel: parsed.classifierModel ?? 'deepseek-chat',
+        // Not defaulted on purpose: unset means "inherit the host model" (issue #8).
+        classifierModel: parsed.classifierModel,
+        classifierEffort: parsed.classifierEffort ?? '',
         classifierApiKey: parsed.classifierApiKey,
         riskTimeoutMs: parsed.riskTimeoutMs ?? 20_000,
         riskLearning: parsed.riskLearning ?? false,

package/lib/events.js

@@ -822,7 +822,14 @@ export function registerHealthRoute(server, provider) {
                 json(res, 405, { ok: false, error: 'method not allowed' });
                 return;
             }
-            provider.check().then((result) => json(res, 200, { ...result, ok: true }), (e) => json(res, 500, { ok: false, error: String(e?.message ?? e) }));
+            provider.check().then(
+            // The check's own `ok` decides the answer. Spelling `ok: true` after the
+            // spread overwrote a resolved `{ ok: false }` and reported a dead review
+            // connection as healthy (issue #8).
+            (result) => json(res, 200, {
+                ...result,
+                ok: result?.ok === true,
+            }), (e) => json(res, 500, { ok: false, error: String(e?.message ?? e) }));
         },
     });
 }

package/lib/host-llm.d.ts

@@ -47,12 +47,29 @@ export interface HostModelSelection {
 }
 /** Fallback matching dsh-approval-gate's resolveModel default. */
 export declare const DEFAULT_HOST_MODEL: HostModelSelection;
+/** Optional knobs for one host completion. */
+export interface HostCallOptions {
+    /**
+     * Reasoning effort to request. Empty/undefined **omits** the field entirely so
+     * the host's own model configuration decides — a hardcoded value is rejected by
+     * host validation when the selected model does not advertise it (issue #8).
+     */
+    readonly effort?: string;
+    readonly maxTokens?: number;
+}
 /**
  * One completion through the host `llm` service with an abort timeout.
+ *
+ * Only **final text** is the answer: `reasoning-delta` chunks are the model's
+ * private working, never a verdict, and a stream that ends on `max-tokens` (or
+ * any other truncating finish) is a failure rather than a short answer. Both
+ * used to be accepted, which let a reasoning-only or cut-off stream reach the
+ * verdict parser and be read as `safe` (issue #7).
+ *
  * Resolves `{ ok: true, content }` with the accumulated assistant text, or
- * `{ ok: false, error }` on stream failure, abort, or an empty answer.
+ * `{ ok: false, error }` on stream failure, abort, truncation, or an empty answer.
  */
-export declare function completeViaHost(hostLlm: HostLlmLike, selection: HostModelSelection, system: string, user: string, timeoutMs: number): Promise<{
+export declare function completeViaHost(hostLlm: HostLlmLike, selection: HostModelSelection, system: string, user: string, timeoutMs: number, opts?: HostCallOptions): Promise<{
     ok: true;
     content: string;
 } | {

package/lib/host-llm.js

@@ -10,35 +10,58 @@
  */
 /** Fallback matching dsh-approval-gate's resolveModel default. */
 export const DEFAULT_HOST_MODEL = { provider: 'deepseek-official', model: 'deepseek-v4-flash' };
+/**
+ * Finish kinds that mean "what you got is not the whole answer". Graded as a
+ * failure: a truncated or filtered stream is not a verdict (issue #7).
+ */
+const TRUNCATED_FINISH_KINDS = new Set([
+    'max-tokens', 'max_tokens', 'length', 'truncated', 'content-filter', 'content_filter',
+]);
 /**
  * One completion through the host `llm` service with an abort timeout.
+ *
+ * Only **final text** is the answer: `reasoning-delta` chunks are the model's
+ * private working, never a verdict, and a stream that ends on `max-tokens` (or
+ * any other truncating finish) is a failure rather than a short answer. Both
+ * used to be accepted, which let a reasoning-only or cut-off stream reach the
+ * verdict parser and be read as `safe` (issue #7).
+ *
  * Resolves `{ ok: true, content }` with the accumulated assistant text, or
- * `{ ok: false, error }` on stream failure, abort, or an empty answer.
+ * `{ ok: false, error }` on stream failure, abort, truncation, or an empty answer.
  */
-export async function completeViaHost(hostLlm, selection, system, user, timeoutMs) {
+export async function completeViaHost(hostLlm, selection, system, user, timeoutMs, opts = {}) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
         let text = '';
+        let finishKind;
+        const effort = typeof opts.effort === 'string' && opts.effort !== '' ? opts.effort : undefined;
         const stream = hostLlm.stream({
             provider: selection.provider,
             model: selection.model,
             messages: [{ role: 'user', content: [{ type: 'text', text: user }] }],
             system,
             temperature: 0,
-            reasoningEffort: 'off',
-            maxTokens: 256,
+            ...(effort !== undefined ? { reasoningEffort: effort } : {}),
+            maxTokens: opts.maxTokens ?? 256,
             signal: controller.signal,
         });
         for await (const chunk of stream) {
-            if ((chunk.type === 'text-delta' || chunk.type === 'reasoning-delta') && typeof chunk.text === 'string') {
+            if (chunk.type === 'text-delta' && typeof chunk.text === 'string') {
                 text += chunk.text;
             }
-            else if (chunk.type === 'finish' && chunk.reason !== undefined && (chunk.reason.kind === 'error' || chunk.reason.kind === 'aborted')) {
-                const failure = chunk.reason.failure?.message;
-                return { ok: false, error: failure ?? chunk.reason.kind };
+            else if (chunk.type === 'finish') {
+                const kind = chunk.reason?.kind;
+                if (kind === 'error' || kind === 'aborted') {
+                    const failure = chunk.reason?.failure?.message;
+                    return { ok: false, error: failure ?? kind };
+                }
+                finishKind = kind;
             }
         }
+        if (finishKind !== undefined && TRUNCATED_FINISH_KINDS.has(finishKind)) {
+            return { ok: false, error: `truncated answer (finish: ${finishKind})` };
+        }
         if (text.trim() === '')
             return { ok: false, error: 'empty answer' };
         return { ok: true, content: text };

package/lib/index.d.ts

@@ -7,6 +7,7 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import { Config } from './config.js';
+import { type SessionSender } from './events.js';
 import { PermGateRuntime, type PreToolDecisionLike, type ToolExecutionLike } from './runtime.js';
 export declare const name = "dsh-perm-gate";
 /**
@@ -20,6 +21,51 @@ export declare const inject: string[];
 export { Config };
 /** Runtime settings namespace: `permissive` + `permissiveStrategies` (editable in the UI). */
 export declare const PERMISSIVE_NAMESPACE = "dsh-perm-gate";
+/**
+ * The `source.kind` the gate stamps on its own block opinions.
+ *
+ * The host's vocabulary is explicit about this: `source.kind === 'user'` (with an
+ * `rpcId`) means *a human typed it*, and `ui-trajectory` / `ui-chat` render any
+ * other kind as injected **context**, not as a queued user input. The host's own
+ * notices use the same convention (`user-approval`, `policy`, `time-context`…).
+ * A gate note is the gate talking, so it must not borrow the human's identity —
+ * otherwise the waiting area lists it as a message the person can plan, reorder
+ * or resend.
+ */
+export declare const BLOCK_NOTE_SOURCE_KIND = "perm-gate";
+/**
+ * Deliver the gate's block opinion into the running turn.
+ *
+ * The opinion is model-facing context, not user input, so this uses the host's
+ * injection lane (`agent.inject`: same `next-step` band as steering, but the
+ * note waits for the next pre-step instead of waking a driver) and stamps
+ * {@link BLOCK_NOTE_SOURCE_KIND} on it. The role stays `user` — that is the only
+ * role a model reads as an instruction — but the source says who really spoke.
+ *
+ * Falls back to {@link buildSessionSender}'s steering lane when no live agent is
+ * reachable (a hosted runtime that only exposes the typert gateway): the note
+ * then arrives as a steer, which the UI may show as a pending message — worse,
+ * but never a dropped block reason.
+ */
+export declare function buildBlockNoteSender(get: (name: string) => unknown): SessionSender;
+/**
+ * Deliver a message into a conversation. A DSH user message content must be a
+ * block array — a bare string is rendered per character by the GUI — and two
+ * channels are tried in order: the typert gateway, then the live agent's own
+ * inbox method.
+ *
+ * `mode` picks the lane, and the lanes are physically different queues:
+ *
+ * - `queue` → `agent.followup` → **next-turn**: a new user turn. That is the
+ *   lane for an instruction the person means to type (the review page's
+ *   "撤销此改动"), and it shares the queue the user's own input waits in.
+ * - `steer` → `agent.steer` → **next-step**: lands beside the tool result that
+ *   is about to be delivered, inside the *running* turn. That is the lane for
+ *   the gate's own block opinion — it must not cost the user a turn, must not
+ *   look like something they typed, and must reach the model at the very next
+ *   step boundary rather than after the turn ends.
+ */
+export declare function buildSessionSender(get: (name: string) => unknown, mode?: 'queue' | 'steer'): SessionSender;
 /**
  * Build the `approval/request` listener (exported for tests).
  *

package/lib/index.js

@@ -52,18 +52,79 @@ function asSurface(value) {
         : undefined;
 }
 /**
- * Deliver a revert instruction into a conversation (the review page's "撤销此改动").
- * A DSH user message content must be a block array — a bare string is rendered
- * per character by the GUI — and two channels are tried in order: the typert
- * gateway, then the live agent's followup.
+ * The `source.kind` the gate stamps on its own block opinions.
+ *
+ * The host's vocabulary is explicit about this: `source.kind === 'user'` (with an
+ * `rpcId`) means *a human typed it*, and `ui-trajectory` / `ui-chat` render any
+ * other kind as injected **context**, not as a queued user input. The host's own
+ * notices use the same convention (`user-approval`, `policy`, `time-context`…).
+ * A gate note is the gate talking, so it must not borrow the human's identity —
+ * otherwise the waiting area lists it as a message the person can plan, reorder
+ * or resend.
  */
-function buildSessionSender(get) {
+export const BLOCK_NOTE_SOURCE_KIND = 'perm-gate';
+/**
+ * Deliver the gate's block opinion into the running turn.
+ *
+ * The opinion is model-facing context, not user input, so this uses the host's
+ * injection lane (`agent.inject`: same `next-step` band as steering, but the
+ * note waits for the next pre-step instead of waking a driver) and stamps
+ * {@link BLOCK_NOTE_SOURCE_KIND} on it. The role stays `user` — that is the only
+ * role a model reads as an instruction — but the source says who really spoke.
+ *
+ * Falls back to {@link buildSessionSender}'s steering lane when no live agent is
+ * reachable (a hosted runtime that only exposes the typert gateway): the note
+ * then arrives as a steer, which the UI may show as a pending message — worse,
+ * but never a dropped block reason.
+ */
+export function buildBlockNoteSender(get) {
+    const steer = buildSessionSender(get, 'steer');
+    return async (sessionId, content) => {
+        const agents = get('agents');
+        if (agents !== undefined && typeof agents.get === 'function') {
+            const agent = agents.get(sessionId);
+            if (agent !== undefined && typeof agent.inject === 'function') {
+                try {
+                    agent.inject({
+                        id: 'pg-note-' + Date.now().toString(36) + '-' + Math.floor(Math.random() * 1e9).toString(36),
+                        role: 'user',
+                        content: [{ type: 'text', text: content }],
+                        source: { kind: BLOCK_NOTE_SOURCE_KIND },
+                    });
+                    return { ok: true, via: 'inject' };
+                }
+                catch {
+                    // fall through to the steering lane
+                }
+            }
+        }
+        return steer(sessionId, content);
+    };
+}
+/**
+ * Deliver a message into a conversation. A DSH user message content must be a
+ * block array — a bare string is rendered per character by the GUI — and two
+ * channels are tried in order: the typert gateway, then the live agent's own
+ * inbox method.
+ *
+ * `mode` picks the lane, and the lanes are physically different queues:
+ *
+ * - `queue` → `agent.followup` → **next-turn**: a new user turn. That is the
+ *   lane for an instruction the person means to type (the review page's
+ *   "撤销此改动"), and it shares the queue the user's own input waits in.
+ * - `steer` → `agent.steer` → **next-step**: lands beside the tool result that
+ *   is about to be delivered, inside the *running* turn. That is the lane for
+ *   the gate's own block opinion — it must not cost the user a turn, must not
+ *   look like something they typed, and must reach the model at the very next
+ *   step boundary rather than after the turn ends.
+ */
+export function buildSessionSender(get, mode = 'queue') {
     return async (sessionId, content) => {
         const textBlock = [{ type: 'text', text: content }];
         const gateway = get('typertGateway');
         if (gateway !== undefined && typeof gateway.invoke === 'function') {
             try {
-                await gateway.invoke({ namespace: 'session', method: 'prompt', args: { sessionId, mode: 'queue', content: textBlock } });
+                await gateway.invoke({ namespace: 'session', method: 'prompt', args: { sessionId, mode, content: textBlock } });
                 return { ok: true, via: 'gateway' };
             }
             catch {
@@ -73,14 +134,18 @@ function buildSessionSender(get) {
         const agents = get('agents');
         if (agents !== undefined && typeof agents.get === 'function') {
             const agent = agents.get(sessionId);
-            if (agent !== undefined && typeof agent.followup === 'function') {
-                agent.followup({
-                    id: 'pg-revert-' + Date.now().toString(36) + '-' + Math.floor(Math.random() * 1e9).toString(36),
+            // The fallback stays on the requested lane: silently degrading a steer to
+            // followup would put the block opinion back in the user's turn queue — the
+            // exact confusion this lane split exists to remove.
+            const push = mode === 'steer' ? agent?.steer : agent?.followup;
+            if (agent !== undefined && typeof push === 'function') {
+                push.call(agent, {
+                    id: `pg-${mode}-` + Date.now().toString(36) + '-' + Math.floor(Math.random() * 1e9).toString(36),
                     role: 'user',
                     content: textBlock,
                     source: { kind: 'user' },
                 });
-                return { ok: true, via: 'followup' };
+                return { ok: true, via: mode };
             }
         }
         return { ok: false, error: '没有可用的消息投递通道' };
@@ -445,7 +510,15 @@ export function apply(ctx, config = {}) {
     // channel in buildSessionSender.
     let approvalService;
     const runtime = new PermGateRuntime({
-        ...config,
+        // The host hands `.volatile()` fields to apply() as **live refs**. Resolve
+        // them once before spreading, or a ref object becomes a static option — the
+        // ruleset default among them, where no deny/ask branch matches it and every
+        // unmatched call was allowed unreviewed (issue #6). Anything that must stay
+        // live is read through its own `read*` hook below.
+        ...resolveVolatileConfig(config),
+        // Read live *and* validated: `coerceRuleAction` refuses a non-literal value
+        // instead of letting it fall through the runtime's action branches.
+        readDefaultAction: () => current().defaultAction,
         hostLlm,
         // Raise a network approval through the DSH approval seam. The service
         // applies the session policy, routes the prompt to the agent, and appends
@@ -517,13 +590,26 @@ export function apply(ctx, config = {}) {
         // same namespace, so editing the settings card applies to the next tool call.
         readClassifyConfig: () => {
             const c = current();
+            const source = c.classifierSource === 'host' ? 'host' : 'custom';
             return {
                 endpoint: c.classifierEndpoint,
-                model: c.classifierModel,
+                // Host mode: an unset model means "inherit the host selection" — the old
+                // schema default (`deepseek-chat`) came back on every clear and was then
+                // treated as an explicit override, so provider and model diverged (issue
+                // #8). Custom-endpoint mode keeps the historical default.
+                model: typeof c.classifierModel === 'string' && c.classifierModel !== ''
+                    ? c.classifierModel
+                    : source === 'custom' ? 'deepseek-chat' : undefined,
                 apiKey: c.classifierApiKey,
                 timeoutMs: c.riskTimeoutMs ?? 20_000,
             };
         },
+        // Host reviews: an empty effort sends no `reasoningEffort` at all, so the host
+        // model configuration decides instead of a value it may reject (issue #8).
+        readClassifyEffort: () => {
+            const effort = current().classifierEffort;
+            return typeof effort === 'string' && effort !== '' ? effort : undefined;
+        },
         // Read the verdict-learning switch and threshold live.
         readRiskLearning: () => {
             const c = current();
@@ -686,6 +772,9 @@ export function apply(ctx, config = {}) {
     // The host no longer seeds settings (there is no write path): an empty
     // `allowlist` keeps the rules-file default via `runtime.allowlist()`.
     let lastRulesDocKey;
+    // Root compile-time inputs (default action, path case-fold). Seeded on the first
+    // pass so a startup value is not mistaken for an edit.
+    let lastStaticKey;
     function applyVolatileUpdate() {
         const next = asSurface(current());
         if (next !== undefined) {
@@ -714,6 +803,17 @@ export function apply(ctx, config = {}) {
             if (changed)
                 runtime.reload();
         }
+        // The root `defaultAction` (and the path case-fold) are compile-time inputs of
+        // the ruleset. Without this the settings switch persisted but never reached the
+        // live ruleset — "default value changes also miss invalidation" (issue #6).
+        const staticKey = `${String(current().defaultAction)}\u0000${String(current().caseInsensitivePaths)}`;
+        if (lastStaticKey === undefined) {
+            lastStaticKey = staticKey;
+        }
+        else if (lastStaticKey !== staticKey) {
+            lastStaticKey = staticKey;
+            runtime.reload();
+        }
     }
     ;
     ctx.on('loader/volatile-update', () => {
@@ -853,11 +953,17 @@ export function apply(ctx, config = {}) {
     catch {
         // webServer unavailable: the feed remains disk-only, sediment is view-only in files
     }
-    // YOLO feedback: when a call is blocked (YOLO block **or** a deterministic deny in
-    // any mode), append a user-role "工具审核意见" message to the owning session so the
-    // main LLM sees why + which rule + a disposition and self-corrects — modeled on
-    // cc-safety-net's BLOCKED message. Best-effort; a failed delivery never un-blocks.
-    const yoloSender = buildSessionSender(fallbackGet);
+    // Block feedback: when a call is blocked (YOLO / mechanical / degraded-review block
+    // **or** a deterministic deny in any mode), the gate hands the main LLM a
+    // `工具审核意见` note telling it why, which rule fired and what to do instead.
+    //
+    // The note is context the gate injects, not something the person typed:
+    // `buildBlockNoteSender` uses `agent.inject` (next-step band, no driver wake) and
+    // stamps its own `source.kind`, so it lands beside the refused tool result at the
+    // next pre-step, never in the next-turn queue the user's own input waits in, and
+    // never claims to be a human message in the waiting area.
+    // Best-effort; a failed delivery never un-blocks.
+    const blockSender = buildBlockNoteSender(fallbackGet);
     const blockedSubject = (exec) => {
         const args = exec.arguments ?? {};
         const cmd = (typeof exec.commandText === 'string' && exec.commandText !== ''
@@ -868,18 +974,18 @@ export function apply(ctx, config = {}) {
         const p = ['file_path', 'path', 'cwd', 'workdir'].map((k) => args[k]).find((v) => typeof v === 'string');
         return `${exec.name}${typeof p === 'string' ? ': ' + p : ''}`;
     };
-    const yoloFeedback = (exec, decision) => {
+    const blockFeedback = (exec, decision) => {
         const sessionId = (typeof exec.sessionId === 'string' && exec.sessionId !== ''
             ? exec.sessionId
             : (exec.agent?.sessionId ?? exec.agent?.session?.id) ?? '');
         if (sessionId === '')
             return;
         const { text } = composeReviewOpinion({ command: blockedSubject(exec), reason: decision.reason, locale: 'zh' });
-        void yoloSender(sessionId, `工具审核意见: "${text}"`).catch(() => {
+        void blockSender(sessionId, `工具审核意见: "${text}"`).catch(() => {
             // no delivery channel — the block still stands, the LLM just gets no note.
         });
     };
-    const listener = makePreExecuteListener(runtime, yoloFeedback);
+    const listener = makePreExecuteListener(runtime, blockFeedback);
     // `tools/pre-execute` / `tools/result` / `approval/request` are service events,
     // not part of cordis core's typed `Events`, so they are registered through the
     // string overload.

package/lib/risk.js

@@ -135,13 +135,11 @@ export function parseRiskVerdict(content) {
         return undefined;
     }
     catch {
-        // Lenient fallback for models that ignore response_format: bare keyword scan.
-        // A bare "risky" carries no trustworthy category, so it stays unresolved —
-        // the caller keeps the human ask rather than guessing a category.
-        if (/\brisky\b/i.test(trimmed))
-            return undefined;
-        if (/\bsafe\b/i.test(trimmed))
-            return { kind: 'safe' };
+        // No lenient keyword scan. A bare `safe` used to be accepted from prose such
+        // as "not safe" or from a half-written JSON object, which is exactly how a
+        // truncated stream could be read as an all-clear (issue #7). Anything that is
+        // not the protocol object is `undefined` — the caller keeps the human ask
+        // and learns nothing.
         return undefined;
     }
 }

package/lib/rule.d.ts

@@ -86,6 +86,17 @@ export interface CompileOptions {
     readonly maxGlobStars?: number;
     readonly caseInsensitivePaths?: boolean;
 }
+/**
+ * Coerce a configuration-supplied value into a decision action, fail-closed.
+ *
+ * The host hands `.volatile()` fields to `apply` as **live refs**, and the runtime
+ * options are built by spreading that config. A ref that reaches the ruleset
+ * un-unwrapped is not one of the three literals, so every deny/ask branch in the
+ * runtime misses it and the call falls through to allow — an ask the user
+ * configured, silently skipped. Anything unrecognised therefore becomes `ask`:
+ * the conservative action, never a bypass (issue #6).
+ */
+export declare function coerceRuleAction(value: unknown, fallback?: RuleAction): RuleAction;
 export declare class RuleError extends Error {
     constructor(message: string);
 }

package/lib/rule.js

@@ -12,6 +12,19 @@ import { parse } from 'yaml';
 import { compileGlob, compileBranchPattern, hashText } from './compiler.js';
 import { parseParamsDimension, parseAbsentDimension, parseAgentsDimension, parseWhenDimension, parseArgvDimension, parseNetworkDimension, parseBranchDimension, } from './rule-dims.js';
 const VALID_ACTIONS = ['allow', 'ask', 'deny'];
+/**
+ * Coerce a configuration-supplied value into a decision action, fail-closed.
+ *
+ * The host hands `.volatile()` fields to `apply` as **live refs**, and the runtime
+ * options are built by spreading that config. A ref that reaches the ruleset
+ * un-unwrapped is not one of the three literals, so every deny/ask branch in the
+ * runtime misses it and the call falls through to allow — an ask the user
+ * configured, silently skipped. Anything unrecognised therefore becomes `ask`:
+ * the conservative action, never a bypass (issue #6).
+ */
+export function coerceRuleAction(value, fallback = 'ask') {
+    return VALID_ACTIONS.includes(value) ? value : fallback;
+}
 const PATH_CANDIDATE_KEYS = [
     'path', 'paths', 'file', 'files', 'file_path', 'dir', 'directory', 'directories',
     'cwd', 'workspace', 'root', 'target', 'targets', 'output',

package/lib/runtime.d.ts

@@ -131,6 +131,13 @@ interface PendingAsk {
     readonly doubtKinds?: readonly string[];
 }
 export interface PermGateRuntimeOptions extends PermGateConfig {
+    /**
+     * Live read of the root `defaultAction`. The host hands `.volatile()` fields to
+     * `apply` as refs, so the value spread into these options may be a ref object —
+     * read through this hook at (re)compile time instead, and let
+     * `coerceRuleAction` refuse anything that is not a literal action (issue #6).
+     */
+    readonly readDefaultAction?: () => unknown;
     /** Workspace root for chain resolution. Defaults to process.cwd(). */
     readonly cwd?: string;
     readonly onRulesChanged?: (ruleset: CompiledRuleset) => void;
@@ -177,8 +184,13 @@ export interface PermGateRuntimeOptions extends PermGateConfig {
      * Defaults to on (`config.scriptReview`).
      */
     readonly readScriptReview?: () => boolean;
-    /** Optional live source of the llmAssist classifier setup. */
+    /** Optional live source of the llmAssist receiver setup (endpoint/model/secret/timeout). */
     readonly readClassifyConfig?: () => ClassifierConfig;
+    /**
+     * Optional live source of the host-review reasoning effort. Undefined/empty
+     * omits the field entirely — see {@link hostEffort} (issue #8).
+     */
+    readonly readClassifyEffort?: () => string | undefined;
     /**
      * Optional live receiver source: `'custom'` (an OpenAI-compatible endpoint,
      * default) or `'host'` (the DSH host `llm` service — the model-group setup
@@ -389,6 +401,14 @@ export declare class PermGateRuntime {
     private readonly cleared;
     constructor(options?: PermGateRuntimeOptions);
     private compileInline;
+    /**
+     * The root default action, read live (the config field is volatile) and
+     * validated. An unrecognised value — most often a `.volatile()` ref that
+     * reached the options un-unwrapped — fails **closed** to `ask`: previously it
+     * became the ruleset default verbatim, both the deny and ask branches missed
+     * it, and every unmatched call was allowed without review (issue #6).
+     */
+    private effectiveDefaultAction;
     /** Reload rules from disk (HMR); on failure keeps the previous rules. */
     reload(): boolean;
     get auditEntries(): readonly AuditEntry[];
@@ -462,6 +482,12 @@ export declare class PermGateRuntime {
     private liveClassifySource;
     /** The host model-group selection, or undefined when unusable. */
     private hostModel;
+    /**
+     * Reasoning effort for host reviews. `undefined` **omits** the field so the host
+     * model configuration decides; the old hardcoded `'off'` was rejected by host
+     * validation for models whose advertised efforts exclude it (issue #8).
+     */
+    private hostEffort;
     private livePermissive;
     /** Whether YOLO mode is live (never human-confirm). */
     isYolo(): boolean;