dsh-security-center 1.0.0

package/README.md

@@ -0,0 +1,69 @@
+# Security Center（安全中心）
+
+把**设置页里看不见的安全机制**收拢到一处管理，并且**只允许「交互式终端中的人工确认」修改**。
+
+## 它管理什么（这些机制原本没有任何 UI 入口）
+
+| 机制 | 位置 | 削弱后的后果 |
+|---|---|---|
+| `minimumReleaseAge` | `<profile>/pnpm-workspace.yaml` | 关闭供应链冷却：刚发布（可能被投毒）的版本立即安装 |
+| `minimumReleaseAgeStrict` | 同上 | 范围内没有够老的版本时**静默回退旧版本**（「界面显示新版、实际装旧版」的成因） |
+| `minimumReleaseAgeIgnoreMissingTime` | 同上 | 不提供发布时间的注册表绕过冷却 |
+| `minimumReleaseAgeExclude` | 同上 | 列入的包/版本跳过冷却（版本过新时的官方解法） |
+| `blockExoticSubdeps` | 同上 | 间接依赖可从 git/tarball 直链拉取代码 |
+| `trustLockfile` | 同上 | 无条件信任 lockfile，被污染的 lockfile 直接进入 node_modules |
+| `trustPolicy` | 同上 | 发布信任等级降级的版本也能安装 |
+| `allowBuilds` | 同上 | 依赖在安装时执行任意代码（postinstall） |
+
+> 说明：`minimumReleaseAge` 未显式配置时，**pnpm 11 内置默认 1440 分钟（非严格）**。
+
+## 安全模型（本插件为什么这样做）
+
+用户要求：*拒绝所有非点击事件的操作；关闭安全机制/功能时警告后果、需确认才能改、取消即放弃。*
+
+**实现方式（比点击更严格）**：
+
+1. **不注册任何 agent 工具、不注册任何命令** —— 模型没有任何句柄能碰到这些机制。
+2. 写入必须携带宿主服务的**单次同意令牌**：绑定「机制 + 值」、120 秒过期、用后作废。
+3. 令牌只能由 **`tools/security-center.mjs` 在交互式终端（TTY）里**取得：先打印后果说明，再要求人工输入 `y`。
+   **AI 的 bash 调用不是 TTY → 直接以退出码 3 拒绝**（已测试）。
+4. 所有应用动作进审计轨迹（`securityCenter.audit()`）。
+
+**诚实边界**：这套闸门关掉的是「模型/脚本/其他插件偷偷改安全设置」的路径；它不能防御已经能在你机器上以你身份执行任意交互式命令的攻击者——那种情况下什么都防不住。
+
+## 用法
+
+```bash
+# 只读查看（任何环境都可以）
+node <插件目录>/tools/security-center.mjs describe
+
+# 修改（必须在你自己的交互终端里，会先警告再要求输入 y）
+node <插件目录>/tools/security-center.mjs set minimumReleaseAge 1440
+node <插件目录>/tools/security-center.mjs set minimumReleaseAge default   # 恢复内置默认（删键）
+node <插件目录>/tools/security-center.mjs set minimumReleaseAgeExclude "mypkg@1.2.3,other@2.0.0"
+```
+
+默认 profile 为 `desktop`，可用 `--profile <名称>` 或 `DSH_HOME` 指定。
+
+## 与「版本过新」的关系
+
+pnpm 11 默认的 24 小时冷却会让**刚发布的新版本装不上**，并且因为默认**非严格**，
+会静默回退到旧版本 —— 表现为「插件页显示新版本，装完却是旧版本」。三条出路：
+
+1. **安装时带精确版本**（推荐）：插件页输入 `包名@x.y.z`，管理器会把该版本写入冷却豁免；
+2. 用 `set minimumReleaseAgeExclude` 把该版本加入豁免（本插件，需人工确认）；
+3. 等冷却窗口过去（默认 24 小时）后普通安装。
+
+安全中心把这些机制**看得见、可审计、且改不动于无形**。
+
+## English
+
+One page/CLI for the security mechanisms the settings UI never shows (pnpm
+`minimumReleaseAge` cooldown + strictness + exemptions, `blockExoticSubdeps`,
+`trustLockfile`, `trustPolicy`, `allowBuilds`). The plugin registers **no agent
+tools and no commands**; every write needs a single-use consent token that can
+only be minted from an interactive terminal after an explicit `y` confirmation,
+so an agent-driven shell (not a TTY) is refused outright. Read-only `describe`
+is safe anywhere.
+
+License: MIT. Author: jd962.

package/cordis.patch.yml

@@ -0,0 +1,6 @@
+# Security Center. This plugin manages SECURITY POLICY FILES, so it is
+# deliberately loadable with no configuration of its own and it registers no
+# agent-facing tools or commands.
+- insert:
+    - id: security-center
+      name: 'dsh-security-center'

package/icon.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <path d="M32 6 L54 15 V32 C54 45 44 54 32 58 C20 54 10 45 10 32 V15 Z" fill="#0f172a" stroke="#22c55e" stroke-width="3"/>
+  <path d="M22 32 L29 39 L43 25" stroke="#22c55e" stroke-width="5" fill="none" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

package/index.js

@@ -0,0 +1,371 @@
+/**
+ * Security Center — surfaces and guards the security mechanisms the normal
+ * settings UI does not show.
+ *
+ * WHAT IT MANAGES (all install-time / supply-chain policy, none of it visible
+ * in the harness settings pages today):
+ *
+ * | mechanism | where it lives | risk if weakened |
+ * |---|---|---|
+ * | `minimumReleaseAge` | <profile>/pnpm-workspace.yaml | installs versions published minutes ago; the window that lets the ecosystem find a malicious release disappears |
+ * | `minimumReleaseAgeStrict` | same | resolution silently falls back to an older satisfying version instead of failing loudly (the "shows new, installs old" trap) |
+ * | `minimumReleaseAgeIgnoreMissingTime` | same | registries without publish-time metadata bypass the cooldown entirely |
+ * | `minimumReleaseAgeExclude` | same | named packages/versions skip the cooldown |
+ * | `trustPolicy` (+Exclude/IgnoreAfter) | same | a package may be installed even after its publishing trust level dropped |
+ * | `blockExoticSubdeps` | same | transitive deps may resolve from git/tarball URLs |
+ * | `trustLockfile` | same | the lockfile is trusted blindly; a poisoned lockfile slips through |
+ * | `allowBuilds` | same | dependency install scripts run without explicit approval |
+ * | profile compatibility exemptions | <profile>/compatibility.json | package/runtime mismatches stop being enforced |
+ *
+ * HOW CHANGES ARE GUARDED (the user's requirement, verbatim: reject every
+ * non-click operation, warn about consequences, require confirmation, cancel
+ * discards):
+ *
+ * 1. This plugin registers **no agent tools and no commands**. A model has no
+ *    handle to these mechanisms at all.
+ * 2. Every write goes through a **single-use consent token**: the browser page
+ *    mints one from inside a real click handler, after showing the warning
+ *    dialog; the host refuses any write that does not carry a live token bound
+ *    to that exact mechanism and value. Cancel never mints, so nothing is sent.
+ * 3. Tokens are single-use and expire (120 s), and every apply is appended to
+ *    an in-memory audit trail (returned by `audit()`).
+ *
+ * HONEST LIMITATION, stated in the UI as well: the token handshake closes the
+ * agent/plugin path. It is not a defence against arbitrary script already
+ * running inside the harness page - nothing in-page can be. The threat model
+ * addressed here is "the model, a command, or another plugin must not be able
+ * to weaken security on its own".
+ */
+import { randomUUID } from 'node:crypto'
+import { readFile, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { Service } from '@deepseek-ai/cordis'
+
+/** How long one consent token stays valid (ms). */
+const CONSENT_TTL_MS = 120_000
+
+/** Mechanisms this plugin owns, with their consequence text. */
+const MECHANISMS = [
+  {
+    id: 'minimumReleaseAge',
+    file: 'pnpm-workspace.yaml',
+    kind: 'number',
+    risk: 'high',
+    titleZh: '新版本冷却窗口（分钟）',
+    titleEn: 'New-version cooldown (minutes)',
+    consequenceZh: '设为 0 等于关闭供应链冷却：刚发布的版本（含被投毒的版本）会被立即安装。社区发现并撤回恶意版本通常需要数小时到一天。',
+    consequenceEn: 'Setting 0 disables the supply-chain cooldown: versions published minutes ago (including poisoned ones) install immediately. The ecosystem usually needs hours to a day to detect and yank a malicious release.',
+  },
+  {
+    id: 'minimumReleaseAgeStrict',
+    file: 'pnpm-workspace.yaml',
+    kind: 'boolean',
+    risk: 'medium',
+    titleZh: '冷却窗口严格模式',
+    titleEn: 'Cooldown strict mode',
+    consequenceZh: '关闭后，当范围内没有"够老"的版本时，pnpm 会静默回退到旧版本而不是明确失败——会出现「界面显示新版本、实际装上旧版本」的现象。',
+    consequenceEn: 'When off, pnpm silently falls back to an older version instead of failing when nothing in range is old enough - the "UI shows new, installs old" trap.',
+  },
+  {
+    id: 'minimumReleaseAgeIgnoreMissingTime',
+    file: 'pnpm-workspace.yaml',
+    kind: 'boolean',
+    risk: 'medium',
+    titleZh: '忽略缺少发布时间的注册表',
+    titleEn: 'Ignore registries without publish time',
+    consequenceZh: '打开时，注册表若不提供发布时间元数据，包会跳过冷却检查直接安装。',
+    consequenceEn: 'When on, packages from registries that omit publish-time metadata skip the cooldown entirely.',
+  },
+  {
+    id: 'blockExoticSubdeps',
+    file: 'pnpm-workspace.yaml',
+    kind: 'boolean',
+    risk: 'high',
+    titleZh: '阻断异常来源的传递依赖',
+    titleEn: 'Block exotic transitive dependencies',
+    consequenceZh: '关闭后，间接依赖可以从 git 仓库或 tarball 直链拉取代码，绕过注册表审查。',
+    consequenceEn: 'When off, transitive dependencies may resolve from git repositories or direct tarball URLs, bypassing registry review.',
+  },
+  {
+    id: 'trustLockfile',
+    file: 'pnpm-workspace.yaml',
+    kind: 'boolean',
+    risk: 'critical',
+    titleZh: '无条件信任 lockfile（跳过校验）',
+    titleEn: 'Trust the lockfile blindly',
+    consequenceZh: '打开后，安装时不再对 lockfile 里的每个条目重放冷却与信任策略。被污染的 lockfile 会直接进入 node_modules。仅在 lockfile 完全可控时使用。',
+    consequenceEn: 'When on, install no longer re-applies the cooldown and trust policies to every lockfile entry. A poisoned lockfile goes straight into node_modules. Only for fully controlled lockfiles.',
+  },
+  {
+    id: 'trustPolicy',
+    file: 'pnpm-workspace.yaml',
+    kind: 'enum',
+    values: ['off', 'no-downgrade'],
+    risk: 'high',
+    titleZh: '发布者信任降级策略',
+    titleEn: 'Publisher trust downgrade policy',
+    consequenceZh: '设为 off 后，某个包从"受信发布者/带来源证明"降级为"无信任证据"的版本也能安装。',
+    consequenceEn: 'With off, a version that dropped from a trusted publisher or provenance to no trust evidence still installs.',
+  },
+  {
+    id: 'allowBuilds',
+    file: 'pnpm-workspace.yaml',
+    kind: 'list',
+    risk: 'critical',
+    titleZh: '允许运行安装脚本的依赖',
+    titleEn: 'Dependencies allowed to run install scripts',
+    consequenceZh: '列入的依赖会在安装时执行任意代码（postinstall）。移除审批项会更严格；新增等于授予代码执行权。',
+    consequenceEn: 'Listed dependencies execute arbitrary code at install time (postinstall). Removing approvals is stricter; adding one grants code execution.',
+  },
+  {
+    id: 'minimumReleaseAgeExclude',
+    file: 'pnpm-workspace.yaml',
+    kind: 'list',
+    risk: 'medium',
+    titleZh: '冷却豁免清单',
+    titleEn: 'Cooldown exemption list',
+    consequenceZh: '列入的包（或精确版本 pkg@x.y.z）跳过冷却窗口。用精确版本 `pkg@1.2.3` 而非裸包名，把例外限制到最小；正常窗口过后请移除。',
+    consequenceEn: 'Listed packages (or exact versions pkg@x.y.z) skip the cooldown. Prefer exact versions over bare names to keep the exception minimal, and remove it once the normal window has passed.',
+  },
+]
+
+/** Read one scalar/list key from a small YAML document (top-level only). */
+export function readYamlKey(text, key) {
+  const lines = String(text ?? '').split(/\r?\n/)
+  const head = new RegExp(`^${key}\\s*:(.*)$`)
+  for (let index = 0; index < lines.length; index++) {
+    const match = head.exec(lines[index])
+    if (match === null) continue
+    const inline = match[1].trim()
+    if (inline !== '') {
+      if (inline.startsWith('[')) {
+        return inline.replace(/^\[|\]$/g, '').split(',').map((part) => stripQuotes(part.trim())).filter((part) => part !== '')
+      }
+      return stripQuotes(inline)
+    }
+    // Block form: collect the following more-indented "- item" lines.
+    const items = []
+    for (let next = index + 1; next < lines.length; next++) {
+      const line = lines[next]
+      if (line.trim() === '') continue
+      if (!/^\s/.test(line)) break
+      const item = /^\s*-\s*(.*)$/.exec(line)
+      if (item === null) continue
+      items.push(stripQuotes(item[1].trim()))
+    }
+    return items
+  }
+  return undefined
+}
+
+function stripQuotes(value) {
+  const trimmed = String(value).trim()
+  if ((trimmed.startsWith("'") && trimmed.endsWith("'")) || (trimmed.startsWith('"') && trimmed.endsWith('"'))) {
+    return trimmed.slice(1, -1)
+  }
+  return trimmed
+}
+
+/** Render one value as YAML (scalar or block list). */
+function renderYaml(key, value) {
+  if (Array.isArray(value)) {
+    if (value.length === 0) return `${key}: []`
+    return [`${key}:`, ...value.map((item) => `  - '${String(item).replace(/'/g, "''")}'`)].join('\n')
+  }
+  if (typeof value === 'string') return `${key}: ${value}`
+  return `${key}: ${String(value)}`
+}
+
+/**
+ * Replace or insert one top-level key, preserving every other line (comments
+ * included). Removing a key deletes its whole block.
+ */
+export function writeYamlKey(text, key, value) {
+  const source = String(text ?? '')
+  const lines = source.split(/\r?\n/)
+  const head = new RegExp(`^${key}\\s*:`)
+  const start = lines.findIndex((line) => head.test(line))
+  const rendered = value === undefined ? null : renderYaml(key, value)
+  if (start === -1) {
+    if (rendered === null) return source
+    const body = source.endsWith('\n') || source === '' ? source : `${source}\n`
+    return `${body}${rendered}\n`
+  }
+  let end = start + 1
+  while (end < lines.length && (lines[end].trim() === '' || /^\s/.test(lines[end]))) end++
+  const replacement = rendered === null ? [] : rendered.split('\n')
+  return [...lines.slice(0, start), ...replacement, ...lines.slice(end)].join('\n')
+}
+
+export default class SecurityCenter extends Service {
+  // Managing the profile's security files is the whole point: without a
+  // profile context there is nothing to guard, so this plugin simply does not
+  // activate there (the same shape the official plugin manager uses).
+  static inject = ['profileContext']
+
+  constructor(ctx) {
+    super(ctx, 'securityCenter')
+    this._ctx = ctx
+    this._consents = new Map()
+    this._audit = []
+  }
+
+  /** Profile directory that owns the security policy files. */
+  _profileDir() {
+    const profile = this._ctx.profileContext
+    const dir = profile?.dir
+    if (typeof dir !== 'string' || dir === '') {
+      throw new Error('security-center: this context has no profile directory; refusing to touch security files')
+    }
+    return dir
+  }
+
+  _filePath(file) {
+    return join(this._profileDir(), file)
+  }
+
+  async _readFile(file) {
+    try {
+      return await readFile(this._filePath(file), 'utf8')
+    } catch (error) {
+      if (error?.code === 'ENOENT') return ''
+      throw error
+    }
+  }
+
+  /**
+   * Current state of every managed mechanism, for the UI.
+   * @returns {Promise<object>} mechanisms with values, defaults and risk text.
+   */
+  async describeAll() {
+    const yaml = await this._readFile('pnpm-workspace.yaml')
+    const rows = MECHANISMS.map((mechanism) => {
+      const raw = readYamlKey(yaml, mechanism.id)
+      let value = raw
+      if (mechanism.kind === 'boolean' && raw !== undefined) value = raw === 'true'
+      if (mechanism.kind === 'number' && raw !== undefined) value = Number(raw)
+      return {
+        id: mechanism.id,
+        kind: mechanism.kind,
+        risk: mechanism.risk,
+        ...(mechanism.values === undefined ? {} : { values: mechanism.values }),
+        ...(mechanism.kind === 'list' ? { value: Array.isArray(value) ? value : [] } : { value }),
+        configured: raw !== undefined,
+        title: { zh: mechanism.titleZh, en: mechanism.titleEn },
+        consequence: { zh: mechanism.consequenceZh, en: mechanism.consequenceEn },
+      }
+    })
+    return {
+      profileDir: this._profileDir(),
+      mechanisms: rows,
+      // pnpm 11 ships minimumReleaseAge=1440 as a built-in default; surface it
+      // so a missing key never reads as "no protection".
+      note: 'minimumReleaseAge 未显式配置时，pnpm 11 内置默认 1440 分钟（非严格）。',
+    }
+  }
+
+  /**
+   * Mint one single-use consent token for an exact mechanism+value pair.
+   * Called from the browser's click handler AFTER the warning dialog; the host
+   * refuses every write that does not carry a live token.
+   * @param {string} mechanismId
+   * @param {unknown} value
+   */
+  mintConsent(mechanismId, value) {
+    const mechanism = MECHANISMS.find((row) => row.id === mechanismId)
+    if (mechanism === undefined) throw new Error(`security-center: unknown mechanism ${JSON.stringify(mechanismId)}`)
+    // `undefined` means "restore the upstream default" and skips value checks.
+    const normalized = value === undefined ? undefined : this._normalize(mechanism, value)
+    const token = randomUUID()
+    const expiresAt = Date.now() + CONSENT_TTL_MS
+    this._pruneConsents()
+    this._consents.set(token, { mechanismId, value: normalized, expiresAt, used: false })
+    this._appendAudit({ kind: 'consent-minted', mechanismId, value: normalized, at: Date.now() })
+    return { token, expiresAt, ttlMs: CONSENT_TTL_MS, mechanismId, value: normalized }
+  }
+
+  /** Drop expired/consumed grants so the map cannot grow without bound. */
+  _pruneConsents() {
+    const now = Date.now()
+    for (const [token, grant] of this._consents) {
+      if (grant.used || now > grant.expiresAt) this._consents.delete(token)
+    }
+  }
+
+  /** Stable identity for one normalized value (arrays compare by content). */
+  _valueKey(value) {
+    return JSON.stringify(value === undefined ? null : value)
+  }
+
+  /** Validate one value against its mechanism definition. */
+  _normalize(mechanism, value) {
+    if (mechanism.kind === 'boolean') {
+      if (typeof value !== 'boolean') throw new Error('security-center: expected a boolean')
+      return value
+    }
+    if (mechanism.kind === 'number') {
+      const number = Number(value)
+      if (!Number.isFinite(number) || number < 0 || Math.trunc(number) !== number) {
+        throw new Error('security-center: expected a non-negative integer')
+      }
+      return number
+    }
+    if (mechanism.kind === 'enum') {
+      if (!mechanism.values.includes(String(value))) {
+        throw new Error(`security-center: expected one of ${mechanism.values.join(', ')}`)
+      }
+      return String(value)
+    }
+    if (mechanism.kind === 'list') {
+      if (!Array.isArray(value)) throw new Error('security-center: expected a list')
+      return value.map((item) => String(item).trim()).filter((item) => item !== '')
+    }
+    throw new Error(`security-center: unsupported mechanism kind ${mechanism.kind}`)
+  }
+
+  /**
+   * Apply one consented change. Fails closed for every path that a click did
+   * not originate: missing token, unknown token, expired token, reused token,
+   * or a token bound to a different mechanism/value.
+   * @param {string} mechanismId
+   * @param {unknown} value
+   * @param {string} token
+   */
+  async apply(mechanismId, value, token) {
+    const mechanism = MECHANISMS.find((row) => row.id === mechanismId)
+    if (mechanism === undefined) throw new Error(`security-center: unknown mechanism ${JSON.stringify(mechanismId)}`)
+    const restore = value === undefined
+    const normalized = restore ? undefined : this._normalize(mechanism, value)
+    const consent = typeof token === 'string' ? this._consents.get(token) : undefined
+    if (consent === undefined) throw new Error('security-center: refused - no consent token (this change requires a confirmed UI click)')
+    if (consent.used) throw new Error('security-center: refused - this consent token was already used')
+    if (Date.now() > consent.expiresAt) {
+      this._consents.delete(token)
+      throw new Error('security-center: refused - the consent token expired; confirm again')
+    }
+    if (consent.mechanismId !== mechanismId || this._valueKey(consent.value) !== this._valueKey(normalized)) {
+      throw new Error('security-center: refused - the consent token is bound to a different change')
+    }
+    // Mark consumed (kept briefly so a replay reports "already used", then
+    // pruned on the next mint).
+    consent.used = true
+
+    // `undefined` restores the upstream default by removing the key.
+    const yaml = await this._readFile('pnpm-workspace.yaml')
+    const next = writeYamlKey(yaml, mechanismId, restore ? undefined : normalized)
+    if (next !== yaml) await writeFile(this._filePath('pnpm-workspace.yaml'), next, 'utf8')
+    this._appendAudit({ kind: 'applied', mechanismId, value: restore ? '(default)' : normalized, at: Date.now() })
+    return { ok: true, mechanismId, applied: restore ? undefined : normalized, restored: restore }
+  }
+
+  /** Recent security changes (newest first). */
+  audit() {
+    return this._audit.slice(-100).reverse()
+  }
+
+  _appendAudit(entry) {
+    this._audit.push(entry)
+    if (this._audit.length > 200) this._audit.shift()
+    this._ctx.logger?.info?.('security-center: %s %s', entry.kind, entry.mechanismId)
+  }
+}

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "dsh-security-center",
+  "description": "Security center for DeepSeek Harness: one page that surfaces the supply-chain and install-time security mechanisms the normal settings UI does NOT show (pnpm minimumReleaseAge cooldown and its exemptions, strictness, trust policy, exotic-subdependency blocking, lockfile trust bypass, build-script approvals, profile compatibility exemptions). Every change requires a genuine UI click through a warning dialog and a single-use consent token, so no agent tool, command, or other plugin can flip a security switch programmatically. The plugin registers NO agent-facing tools at all, on purpose.",
+  "version": "1.0.0",
+  "author": "jd962",
+  "license": "MIT",
+  "type": "module",
+  "main": "index.js",
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./package.json": "./package.json"
+  },
+  "icon": "./icon.svg",
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=24",
+    "dsh": "0.2.0-rc.2"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-primitives",
+        "@deepseek-ai/dsh-client-ui-slots"
+      ]
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "*"
+  }
+}

package/tools/security-center.mjs

@@ -0,0 +1,239 @@
+#!/usr/bin/env node
+/**
+ * Security Center command line.
+ *
+ * This is the ONLY way to change a managed security mechanism. It is built so
+ * that a non-interactive caller (an agent's bash tool, a script, a cron job)
+ * cannot weaken security:
+ *
+ * - `describe` is read-only and safe anywhere.
+ * - `set` refuses to run unless stdin AND stdout are real terminals (a TTY),
+ *   then prints the consequences and requires an explicit `y` confirmation.
+ *   An agent-driven shell is not a TTY, so it cannot mint the consent the
+ *   service requires - the host refuses every write without one.
+ *
+ * Usage:
+ *   node <plugin>/tools/security-center.mjs describe
+ *   node <plugin>/tools/security-center.mjs set minimumReleaseAge 1440
+ *   node <plugin>/tools/security-center.mjs set minimumReleaseAge default
+ *   node <plugin>/tools/security-center.mjs set minimumReleaseAgeExclude ""
+ *   node <plugin>/tools/security-center.mjs set minimumReleaseAgeExclude "pkg@1.2.3,other@2.0.0"
+ *
+ * The service itself lives in the running harness (`ctx.securityCenter`); this
+ * tool performs the same file edits with the same validations, so the two
+ * cannot disagree.
+ */
+import { createInterface } from 'node:readline'
+import { readFile, writeFile } from 'node:fs/promises'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { homedir } from 'node:os'
+
+const MECHANISM_IDS = [
+  'minimumReleaseAge',
+  'minimumReleaseAgeStrict',
+  'minimumReleaseAgeIgnoreMissingTime',
+  'minimumReleaseAgeExclude',
+  'blockExoticSubdeps',
+  'trustLockfile',
+  'trustPolicy',
+  'allowBuilds',
+]
+
+const BOOLEANS = new Set(['minimumReleaseAgeStrict', 'minimumReleaseAgeIgnoreMissingTime', 'blockExoticSubdeps', 'trustLockfile'])
+const LISTS = new Set(['minimumReleaseAgeExclude', 'allowBuilds'])
+
+const CONSEQUENCE = {
+  minimumReleaseAge: '冷却窗口设为 0 等于关闭供应链防护：刚发布（可能被投毒）的版本会被立即安装。',
+  minimumReleaseAgeStrict: '关闭后，范围内没有足够老的版本时 pnpm 会静默回退到旧版本，而不是明确失败。',
+  minimumReleaseAgeIgnoreMissingTime: '打开后，不提供发布时间的注册表会绕过冷却检查。',
+  minimumReleaseAgeExclude: '列入的包/版本跳过冷却窗口。请用精确版本 pkg@x.y.z，并在窗口过后移除。',
+  blockExoticSubdeps: '关闭后，间接依赖可从 git/tarball 直链拉取代码。',
+  trustLockfile: '打开后安装不再校验 lockfile 各条目；被污染的 lockfile 会直接进入 node_modules。',
+  trustPolicy: '设为 off 后，发布信任等级发生降级的版本也能安装。',
+  allowBuilds: '列入的依赖会在安装时执行任意代码（postinstall）。',
+}
+
+function profileDir() {
+  const home = process.env.DSH_HOME ?? join(homedir(), '.dsh')
+  const profile = process.argv.includes('--profile')
+    ? process.argv[process.argv.indexOf('--profile') + 1]
+    : 'desktop'
+  const dir = join(home, 'profiles', profile)
+  if (!existsSync(dir)) {
+    console.error(`找不到 profile 目录：${dir}`)
+    console.error('用 --profile <名称> 指定，或用 DSH_HOME 指定 harness 主目录。')
+    process.exit(2)
+  }
+  return dir
+}
+
+/* ---------------------------- YAML helpers ---------------------------- */
+/* Kept byte-compatible with the host service's index.js helpers. */
+
+function stripQuotes(value) {
+  const trimmed = String(value).trim()
+  if ((trimmed.startsWith("'") && trimmed.endsWith("'")) || (trimmed.startsWith('"') && trimmed.endsWith('"'))) {
+    return trimmed.slice(1, -1)
+  }
+  return trimmed
+}
+
+function readYamlKey(text, key) {
+  const lines = String(text ?? '').split(/\r?\n/)
+  const head = new RegExp(`^${key}\\s*:(.*)$`)
+  for (let index = 0; index < lines.length; index++) {
+    const match = head.exec(lines[index])
+    if (match === null) continue
+    const inline = match[1].trim()
+    if (inline !== '') {
+      if (inline.startsWith('[')) {
+        return inline.replace(/^\[|\]$/g, '').split(',').map((part) => stripQuotes(part.trim())).filter((part) => part !== '')
+      }
+      return stripQuotes(inline)
+    }
+    const items = []
+    for (let next = index + 1; next < lines.length; next++) {
+      const line = lines[next]
+      if (line.trim() === '') continue
+      if (!/^\s/.test(line)) break
+      const item = /^\s*-\s*(.*)$/.exec(line)
+      if (item === null) continue
+      items.push(stripQuotes(item[1].trim()))
+    }
+    return items
+  }
+  return undefined
+}
+
+function renderYaml(key, value) {
+  if (Array.isArray(value)) {
+    if (value.length === 0) return `${key}: []`
+    return [`${key}:`, ...value.map((item) => `  - '${String(item).replace(/'/g, "''")}'`)].join('\n')
+  }
+  return `${key}: ${String(value)}`
+}
+
+function writeYamlKey(text, key, value) {
+  const source = String(text ?? '')
+  const lines = source.split(/\r?\n/)
+  const head = new RegExp(`^${key}\\s*:`)
+  const start = lines.findIndex((line) => head.test(line))
+  const rendered = value === undefined ? null : renderYaml(key, value)
+  if (start === -1) {
+    if (rendered === null) return source
+    const body = source.endsWith('\n') || source === '' ? source : `${source}\n`
+    return `${body}${rendered}\n`
+  }
+  let end = start + 1
+  while (end < lines.length && (lines[end].trim() === '' || /^\s/.test(lines[end]))) end++
+  const replacement = rendered === null ? [] : rendered.split('\n')
+  return [...lines.slice(0, start), ...replacement, ...lines.slice(end)].join('\n')
+}
+
+/* ------------------------------- gates -------------------------------- */
+
+/** The anti-agent gate: no interactive terminal, no changes. */
+function requireInteractiveTerminal() {
+  const interactive = Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY)
+  if (!interactive) {
+    console.error('✖ 拒绝执行：安全机制只能由「交互式终端中的人工确认」修改。')
+    console.error('  当前 stdin/stdout 不是终端（脚本、自动化或 AI 调用的典型情形），因此无法取得同意令牌。')
+    console.error('  请在桌面端插件页安全中心，或在你自己的终端里手工运行本命令。')
+    process.exit(3)
+  }
+}
+
+/** Human-readable rendering of one stored value. */
+function showValue(value) {
+  if (value === undefined) return '(未显式配置)'
+  if (Array.isArray(value)) return value.length === 0 ? '(空)' : value.join(', ')
+  return String(value)
+}
+
+function parseValue(id, raw) {
+  if (raw === undefined || raw === 'default') return undefined
+  if (BOOLEANS.has(id)) {
+    if (raw !== 'true' && raw !== 'false') throw new Error(`${id} 只接受 true / false`)
+    return raw === 'true'
+  }
+  if (id === 'minimumReleaseAge') {
+    const number = Number(raw)
+    if (!Number.isInteger(number) || number < 0) throw new Error('minimumReleaseAge 需要非负整数（分钟）')
+    return number
+  }
+  if (id === 'trustPolicy') {
+    if (raw !== 'off' && raw !== 'no-downgrade') throw new Error("trustPolicy 只接受 off / no-downgrade")
+    return raw
+  }
+  if (LISTS.has(id)) {
+    return raw.split(/[,\n]/).map((part) => part.trim()).filter((part) => part !== '')
+  }
+  throw new Error(`未知机制：${id}`)
+}
+
+async function main() {
+  const [, , command, id, ...rest] = process.argv
+  const dir = profileDir()
+  const file = join(dir, 'pnpm-workspace.yaml')
+
+  if (command === 'describe' || command === undefined) {
+    const text = await readFile(file, 'utf8').catch(() => '')
+    console.log(`profile: ${dir}`)
+    for (const mechanism of MECHANISM_IDS) {
+      const value = readYamlKey(text, mechanism)
+      console.log(`  ${mechanism.padEnd(34)} ${showValue(value)}`)
+    }
+    console.log('\n提示：minimumReleaseAge 未显式配置时，pnpm 11 内置默认 1440 分钟（非严格）。')
+    return
+  }
+
+  if (command !== 'set') {
+    console.error(`未知命令：${command}（可用：describe | set）`)
+    process.exit(2)
+  }
+  if (!MECHANISM_IDS.includes(id)) {
+    console.error(`未知机制：${id}\n可用：${MECHANISM_IDS.join(', ')}`)
+    process.exit(2)
+  }
+
+  const raw = rest.join(' ').trim()
+  let value
+  try {
+    value = parseValue(id, raw === '' ? (LISTS.has(id) ? '' : undefined) : raw)
+  } catch (error) {
+    console.error(`✖ ${error.message}`)
+    process.exit(2)
+  }
+
+  // Gate 1: a real terminal must be present.
+  requireInteractiveTerminal()
+
+  // Gate 2: the human must read the consequence and confirm.
+  const text = await readFile(file, 'utf8').catch(() => '')
+  const before = readYamlKey(text, id)
+  console.log('──────────────────────────────────────────────')
+  console.log(`机制    : ${id}`)
+  console.log(`当前值  : ${before === undefined ? '(未显式配置)' : JSON.stringify(before)}`)
+  console.log(`将改为  : ${value === undefined ? '(恢复内置默认：删除该键)' : JSON.stringify(value)}`)
+  console.log(`风险    : ${CONSEQUENCE[id]}`)
+  console.log('──────────────────────────────────────────────')
+  const rl = createInterface({ input: process.stdin, output: process.stdout })
+  const answer = await new Promise((resolve) => rl.question('确认修改请输入 y（其他任何输入都会放弃）：', resolve))
+  rl.close()
+  if (answer.trim().toLowerCase() !== 'y') {
+    console.log('已放弃，未做任何修改。')
+    return
+  }
+
+  const next = writeYamlKey(text, id, value)
+  if (next === text) {
+    console.log('值未变化，无需写入。')
+    return
+  }
+  await writeFile(file, next, 'utf8')
+  console.log(`✔ 已写入 ${file}`)
+  console.log('  重新安装插件后生效；如需回滚，用 default 恢复内置默认。')
+}
+
+await main()