dsh-sidebar-row-menu 1.9.2 → 1.10.0

package/lib/host/permission-defaults.js

@@ -0,0 +1,190 @@
+/**
+ * 按工作区记住「新会话的默认权限」。
+ *
+ * DSH 原生只有一份全局默认（设置里的 permission.defaultPreset），没有
+ * 「这个工作区新建会话用完全访问、那个工作区用只读」的概念。这里把
+ * workspaceId → preset 存成插件自己的小 JSON，再在 agent/created 时把
+ * 它写成该会话的 permission/preset 事件：
+ *
+ *   - 事件是宿主自己的格式，会话内 `/permission` 看到的状态完全一致；
+ *   - 不碰全局设置，也不影响已有会话；
+ *   - 原生 `pinInitialPermission` 只在会话还没有 preset 时写入全局默认，
+ *     我们已经写过时会保留我们的值（顺序反过来也会被后写的覆盖成同一结果）。
+ *
+ * 文件位置：$DSH_HOME/storages/dsh-sidebar-row-menu/permission-defaults.json
+ */
+
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+const STORAGE_VERSION = 1;
+const STORAGE_DIR = 'storages';
+const STORAGE_OWNER = 'dsh-sidebar-row-menu';
+const STORAGE_FILE = 'permission-defaults.json';
+
+/** 解析 DSH 数据目录；桌面端会设置 DSH_HOME，命令行 fallback 到 ~/.dsh。 */
+export function resolveDshHome(env = process.env, home = homedir()) {
+  const configured = typeof env?.DSH_HOME === 'string' ? env.DSH_HOME.trim() : '';
+  return configured === '' ? join(home, '.dsh') : configured;
+}
+
+/** 权限默认值文件的绝对路径。 */
+export function permissionDefaultsPath(env = process.env, home = homedir()) {
+  return join(resolveDshHome(env, home), STORAGE_DIR, STORAGE_OWNER, STORAGE_FILE);
+}
+
+function emptyDefaults() {
+  return {};
+}
+
+/** 只接受「非空字符串 → 非空 preset 名」，坏数据直接丢弃。 */
+function sanitizeDefaults(value) {
+  const result = emptyDefaults();
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return result;
+  for (const [workspaceId, preset] of Object.entries(value)) {
+    if (typeof workspaceId !== 'string' || workspaceId === '') continue;
+    if (typeof preset !== 'string' || preset.trim() === '') continue;
+    result[workspaceId] = preset;
+  }
+  return result;
+}
+
+/** 读文件；不存在/损坏都当作空表（下一次写入会重建）。 */
+export function readPermissionDefaults(filePath = permissionDefaultsPath()) {
+  try {
+    const text = readFileSync(filePath, 'utf8');
+    const parsed = JSON.parse(text);
+    return sanitizeDefaults(parsed?.defaults);
+  } catch {
+    return emptyDefaults();
+  }
+}
+
+/**
+ * 文件存储。读失败静默回退空表，写失败抛给调用方决定是否提示。
+ * 写入用 tmp + rename，避免中途崩溃留下半截 JSON。
+ */
+export function createPermissionDefaultsStore(filePath = permissionDefaultsPath()) {
+  return {
+    filePath,
+    read() {
+      return readPermissionDefaults(filePath);
+    },
+    /** 传 null 表示删除该工作区的覆盖，恢复跟随全局默认。 */
+    set(workspaceId, preset) {
+      if (typeof workspaceId !== 'string' || workspaceId === '') {
+        throw new TypeError('workspaceId must be a non-empty string');
+      }
+      const defaults = readPermissionDefaults(filePath);
+      if (preset === null || preset === undefined) {
+        delete defaults[workspaceId];
+      } else {
+        if (typeof preset !== 'string' || preset.trim() === '') {
+          throw new TypeError('preset must be a non-empty string or null');
+        }
+        defaults[workspaceId] = preset;
+      }
+      mkdirSync(dirname(filePath), { recursive: true });
+      const temporary = `${filePath}.tmp`;
+      writeFileSync(temporary, `${JSON.stringify({ version: STORAGE_VERSION, defaults }, null, 2)}\n`, 'utf8');
+      renameSync(temporary, filePath);
+      return defaults;
+    },
+  };
+}
+
+/** 路径比较用的规范化：统一分隔符、去掉尾部分隔符。 */
+function normalizePath(value) {
+  if (typeof value !== 'string') return '';
+  let result = value.trim().replace(/[\\/]+/g, '/');
+  while (result.length > 1 && result.endsWith('/')) result = result.slice(0, -1);
+  return result;
+}
+
+/**
+ * 会话 cwd → 工作区 id。会话头里的 cwd 和工作区登记的 path 都是规范化
+ * 绝对路径；Windows 上再加一层大小写不敏感兜底。
+ */
+export function workspaceIdForCwd(registry, cwd) {
+  const target = normalizePath(cwd);
+  if (target === '' || registry === null || registry === undefined) return '';
+  let workspaces;
+  try {
+    workspaces = typeof registry.list === 'function' ? registry.list() : [];
+  } catch {
+    return '';
+  }
+  if (!Array.isArray(workspaces)) return '';
+  const entries = workspaces.filter((entry) => entry !== null && typeof entry === 'object');
+  const exact = entries.find((entry) => normalizePath(entry.path) === target);
+  if (exact !== undefined && typeof exact.id === 'string') return exact.id;
+  if (process.platform !== 'win32') return '';
+  const folded = entries.find((entry) => normalizePath(entry.path).toLowerCase() === target.toLowerCase());
+  return folded !== undefined && typeof folded.id === 'string' ? folded.id : '';
+}
+
+function presetNamesOf(service) {
+  try {
+    const names = service?.names;
+    return Array.isArray(names) ? names : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * 在 agent/created 上把工作区默认写进新会话。
+ * 只在真正新建的交互会话上动手：
+ *   - source 必须是 startup（resume / clear / compact 不碰）；
+ *   - 子代理和 seeded 会话（fork、压缩等）不碰；
+ *   - 找不到工作区或 preset 已被删除时静默跳过。
+ */
+export function applyWorkspacePermission(ctx, payload, store) {
+  if (payload?.source !== 'startup') return false;
+  const session = payload?.agent?.session;
+  if (session === null || session === undefined) return false;
+  const header = session.header;
+  if (header === null || header === undefined) return false;
+  if (header.origin === 'subagent' || header.isSeeded === true) return false;
+
+  let registry;
+  try {
+    registry = ctx.get?.('workspaceRegistry');
+  } catch {
+    return false;
+  }
+  const workspaceId = workspaceIdForCwd(registry, header.cwd);
+  if (workspaceId === '') return false;
+
+  const defaults = store.read();
+  const preset = defaults[workspaceId];
+  if (typeof preset !== 'string' || preset === '') return false;
+
+  let service;
+  try {
+    service = ctx.get?.('permissionPresets');
+  } catch {
+    return false;
+  }
+  if (service === null || service === undefined || typeof service.set !== 'function') return false;
+  const names = presetNamesOf(service);
+  if (names !== null && !names.includes(preset)) return false;
+  service.set(session, preset);
+  return true;
+}
+
+/**
+ * 注册监听。prepend 让本监听排在原生 `pinInitialPermission` 之前，
+ * 这样新会话的日志里只有一条 preset 事件；即便顺序反过来，后写的
+ * `set()` 也会把状态纠正成工作区默认，结果一致。
+ */
+export function registerWorkspacePermissionDefaults(ctx, store) {
+  return ctx.on('agent/created', (payload) => {
+    try {
+      applyWorkspacePermission(ctx, payload, store);
+    } catch (error) {
+      ctx.logger?.warn?.('[dsh-sidebar-row-menu] workspace permission default failed:', error);
+    }
+  }, { prepend: true });
+}

package/lib/host/route.js

@@ -10,6 +10,7 @@
 import { inspectOpenPath } from './paths.js';
 import { isLoopbackRequest } from './security.js';
 import { openInVscode, revealDirectory } from './launch.js';
+import { createPermissionDefaultsStore } from './permission-defaults.js';
 import { DELETE_BATCH_LIMIT, removeSessions } from './session-delete.js';
 import { removeWorkspaceWithSessions } from './workspace-delete.js';
 
@@ -18,9 +19,26 @@ export const ROUTE_PREFIX = '/dsh-sidebar-row-menu';
 export const ROUTE_OPEN = `${ROUTE_PREFIX}/open`;
 export const ROUTE_DELETE = `${ROUTE_PREFIX}/session/delete`;
 export const ROUTE_WORKSPACE_DELETE = `${ROUTE_PREFIX}/workspace/delete`;
+export const ROUTE_PERMISSION_DEFAULTS = `${ROUTE_PREFIX}/permission-defaults`;
 /** 请求体上限（只传路径或会话 id 列表，64KB 足够）。 */
 const MAX_BODY_BYTES = 64 * 1024;
 
+/** 读原生权限目录；旧宿主没有该服务时返回 null。 */
+function readPermissionCatalog(ctx) {
+  try {
+    const service = ctx?.get?.('permissionPresets');
+    if (service === null || service === undefined || typeof service.catalog !== 'function') return null;
+    const catalog = service.catalog();
+    if (catalog === null || typeof catalog !== 'object' || catalog.then !== undefined) return null;
+    return {
+      options: Array.isArray(catalog.options) ? catalog.options : [],
+      defaultPreset: typeof catalog.defaultPreset === 'string' ? catalog.defaultPreset : '',
+    };
+  } catch {
+    return null;
+  }
+}
+
 /** 写一个 JSON 响应；handler 自己拥有响应生命周期。 */
 function writeJson(res, status, body) {
   const text = JSON.stringify(body);
@@ -232,7 +250,91 @@ export async function handleWorkspaceDeleteRequest(request, response, ctx) {
   }
 }
 
-/** 构造 webServer 路由对象（kind=prefix）。 */export function createOpenRoute(ctx) {
+/**
+ * 读写「工作区 → 新会话默认权限」映射。
+ *   GET  /dsh-sidebar-row-menu/permission-defaults → { ok, defaults }
+ *   POST /dsh-sidebar-row-menu/permission-defaults { workspaceId, preset }
+ *        preset=null 表示删除覆盖、恢复跟随全局默认。
+ * 写之前用宿主 permissionPresets.names 校验，避免存进一个不存在的预设。
+ */
+export async function handlePermissionDefaultsRequest(request, response, ctx, store) {
+  if (!isLoopbackRequest(request)) {
+    writeJson(response, 403, { ok: false, error: 'forbidden' });
+    return;
+  }
+  if (pathnameOf(request) !== ROUTE_PERMISSION_DEFAULTS) {
+    writeJson(response, 404, { ok: false, error: 'not-found' });
+    return;
+  }
+  if (store === null || store === undefined || typeof store.read !== 'function') {
+    writeJson(response, 503, { ok: false, error: 'service-unavailable' });
+    return;
+  }
+  if (request.method === 'GET') {
+    writeJson(response, 200, {
+      ok: true,
+      defaults: store.read(),
+      catalog: readPermissionCatalog(ctx),
+    });
+    return;
+  }
+  if (request.method !== 'POST') {
+    writeJson(response, 405, { ok: false, error: 'method-not-allowed' });
+    return;
+  }
+
+  let payload;
+  try {
+    payload = await readJsonBody(request);
+  } catch {
+    writeJson(response, 400, { ok: false, error: 'bad-request' });
+    return;
+  }
+  const workspaceId = payload?.workspaceId;
+  if (typeof workspaceId !== 'string' || workspaceId.trim() === '') {
+    writeJson(response, 400, { ok: false, error: 'bad-request' });
+    return;
+  }
+  const preset = payload?.preset;
+  if (preset !== null && (typeof preset !== 'string' || preset.trim() === '')) {
+    writeJson(response, 400, { ok: false, error: 'bad-request' });
+    return;
+  }
+  if (preset !== null) {
+    let service;
+    try {
+      service = ctx?.get?.('permissionPresets');
+    } catch {
+      service = undefined;
+    }
+    let names = null;
+    try {
+      names = Array.isArray(service?.names) ? service.names : null;
+    } catch {
+      names = null;
+    }
+    if (names === null) {
+      writeJson(response, 503, { ok: false, error: 'service-unavailable' });
+      return;
+    }
+    if (!names.includes(preset)) {
+      writeJson(response, 400, { ok: false, error: 'bad-preset' });
+      return;
+    }
+  }
+
+  try {
+    const defaults = store.set(workspaceId, preset);
+    writeJson(response, 200, { ok: true, defaults });
+  } catch (error) {
+    ctx?.logger?.warn?.('[dsh-sidebar-row-menu] permission defaults write failed:', error);
+    writeJson(response, 500, { ok: false, error: 'write-failed' });
+  }
+}
+
+/** 构造 webServer 路由对象（kind=prefix）。 */
+export function createOpenRoute(ctx, options = {}) {
+  const permissionStore = options.permissionStore ?? createPermissionDefaultsStore();
   return {
     kind: 'prefix',
     path: ROUTE_PREFIX,
@@ -241,6 +343,9 @@ export async function handleWorkspaceDeleteRequest(request, response, ctx) {
       if (pathname === ROUTE_OPEN) return handleOpenRequest(request, response);
       if (pathname === ROUTE_DELETE) return handleSessionDeleteRequest(request, response, ctx);
       if (pathname === ROUTE_WORKSPACE_DELETE) return handleWorkspaceDeleteRequest(request, response, ctx);
+      if (pathname === ROUTE_PERMISSION_DEFAULTS) {
+        return handlePermissionDefaultsRequest(request, response, ctx, permissionStore);
+      }
       if (!isLoopbackRequest(request)) {
         writeJson(response, 403, { ok: false, error: 'forbidden' });
         return undefined;

package/lib/index.js

@@ -24,6 +24,10 @@
  */
 
 import { createOpenRoute } from './host/route.js';
+import {
+  createPermissionDefaultsStore,
+  registerWorkspacePermissionDefaults,
+} from './host/permission-defaults.js';
 
 export const name = 'sidebar-row-menu';
 /** cordis 依赖：网页服务器 + 删除会话时需要读写的宿主服务。 */
@@ -32,16 +36,37 @@ export const inject = ['webServer', 'sessions', 'sessionPersistence', 'sessionQu
 export { isLoopbackRequest } from './host/security.js';
 export { inspectOpenPath, toVscodeFileUrl } from './host/paths.js';
 export { resolveVscodeLauncher } from './host/launch.js';
-export { createOpenRoute, handleSessionDeleteRequest, handleWorkspaceDeleteRequest } from './host/route.js';
+export {
+  createOpenRoute,
+  handlePermissionDefaultsRequest,
+  handleSessionDeleteRequest,
+  handleWorkspaceDeleteRequest,
+} from './host/route.js';
+export {
+  applyWorkspacePermission,
+  createPermissionDefaultsStore,
+  permissionDefaultsPath,
+  readPermissionDefaults,
+  registerWorkspacePermissionDefaults,
+  resolveDshHome,
+  workspaceIdForCwd,
+} from './host/permission-defaults.js';
 export { DELETE_BATCH_LIMIT, removeSession, removeSessions } from './host/session-delete.js';
 export { removeWorkspaceWithSessions } from './host/workspace-delete.js';
 
 /**
- * 注册路由。
+ * 注册路由与新会话默认权限。
  * @param ctx - 宿主插件上下文（带 webServer 与会话服务）。
  */
 export function apply(ctx) {
-  const route = createOpenRoute(ctx);
+  const permissionStore = createPermissionDefaultsStore();
+  const route = createOpenRoute(ctx, { permissionStore });
+  try {
+    registerWorkspacePermissionDefaults(ctx, permissionStore);
+  } catch (error) {
+    // 老宿主没有 agent/created 事件时只是没有按工作区的默认权限，不能拖垮插件。
+    ctx.logger?.warn?.('[dsh-sidebar-row-menu] permission listener registration failed:', error);
+  }
   try {
     ctx.effect(() => ctx.webServer.register(route), 'dsh-sidebar-row-menu: routes');
   } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-sidebar-row-menu",
-  "version": "1.9.2",
+  "version": "1.10.0",
   "type": "module",
   "description": "Adds open-with and cleanup entries to the DSH sidebar context menus (interleaved on 0.2.2+, self-drawn workspace menu on 0.2.1), plus a conversation-body right-click menu that mirrors the session header toolbar with in-menu open-with and more-actions submenus.",
   "keywords": [
@@ -61,7 +61,7 @@
   "scripts": {
     "test": "node --test test/host.test.mjs test/manifest.test.mjs test/client.test.mjs",
     "test:local": "node --test --test-isolation=none test/host.test.mjs test/manifest.test.mjs test/client.test.mjs",
-    "check": "node --check lib/index.js && node --check lib/client.js && node --check lib/host/paths.js && node --check lib/host/security.js && node --check lib/host/launch.js && node --check lib/host/route.js && node --check lib/host/session-delete.js && node --check lib/host/workspace-delete.js",
+    "check": "node --check lib/index.js && node --check lib/client.js && node --check lib/host/paths.js && node --check lib/host/security.js && node --check lib/host/launch.js && node --check lib/host/route.js && node --check lib/host/permission-defaults.js && node --check lib/host/session-delete.js && node --check lib/host/workspace-delete.js",
     "build": "npm pack",
     "marketplace:check": "node scripts/marketplace-preflight.mjs",
     "prepack": "npm run check",