dsh-why-reject-me 0.0.0-stage → 0.3.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jorgen233
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,257 @@
-# Temporary Holding Version
+# dsh-why-reject-me
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+简体中文 | [English](README_en.md)
+
+给 DSH 的权限审批弹窗加一个可选的「拒绝原因」。拒绝时，原因会附在被拒绝工具的 **tool result** 里交给模型；留空则完全保持原生行为。
+
+> 本项目的代码、测试与文档完全由 DeepSeek 搭建和维护。
+
+状态：`v0.3.2`，已在 DSH Desktop `0.2.1-rc.5` 上完成真实审批验证，并验证了让 Agent 从 GitHub 直接安装。
+
+## 目录
+
+- [它解决什么问题](#它解决什么问题)
+- [效果](#效果)
+- [安装](#安装)
+- [使用](#使用)
+- [快捷键](#快捷键)
+- [工作原理](#工作原理)
+- [兼容性](#兼容性)
+- [已知限制](#已知限制)
+- [卸载与回滚](#卸载与回滚)
+- [故障排查](#故障排查)
+- [开发与测试](#开发与测试)
+- [许可证](#许可证)
+- [关于本项目](#关于本项目)
+
+## 它解决什么问题
+
+DSH 原生审批只有「允许一次 / 拒绝」两个动作。模型只知道请求被拒绝了，不知道为什么：是路径不对、命令太危险，还是这次只是在做测试。
+
+常见的场景：
+
+- 不想给某个操作权限，但希望模型换一种做法；
+- 在测试权限流程，需要明确告诉模型「这次拒绝是故意的」；
+- 先让模型解释计划、给出 diff，再决定是否放行；
+- 拒绝原因本身是下一步的输入，而不是一句无关的备注。
+
+这个插件在审批面板上加一个可选输入框，把原因送到模型能读到的地方，同时不新增用户消息、不额外起一轮对话。
+
+## 效果
+
+输入原因后点「拒绝」，模型收到的 tool result 末尾会多出一段：
+
+```text
+【审批请求已拒绝】原因：先不要动系统目录，把 diff 发给我看。
+```
+
+| 操作 | 结果 |
+| --- | --- |
+| 输入原因 → 拒绝 | 原因附在该工具的 tool result 里，模型在同一轮读到 |
+| 不输入 → 拒绝 | 与原生拒绝完全一致，不发送任何额外内容 |
+| 允许一次 | 与原生一致，输入框内容不会被发送 |
+
+前缀随界面语言变化：中文为 `【审批请求已拒绝】原因：`，英文为 `[Approval request rejected] Reason: `。
+
+## 安装
+
+从 GitHub 安装，或克隆到本地开发和调试。
+
+### 前置条件
+
+- **DSH Desktop**。插件在 DSH Desktop 内嵌的审批界面中运行，本项目也只在 Desktop 中验证；`dsh-TUI` 不使用这个面板。
+- 在 DSH Desktop `0.2.1-rc.5` 上验证通过；其他版本见[兼容性](#兼容性)。
+- 从 GitHub 安装需要本机有 **Git**，并且能访问 GitHub。
+- 安装会修改当前 profile，**影响该 profile 下的所有会话**。
+- 插件以 Host 插件身份在 DSH 进程内运行；请只从本仓库或你信任的副本安装。
+
+### 方式一：从 GitHub 安装（推荐）
+
+**在 DSH Desktop 中：**
+
+1. 打开 DSH Desktop，进入左侧 **Plugins（插件）** 页面。
+2. 点 **Add plugin（添加插件）** → **Install a third-party plugin（安装第三方插件）**。
+3. 填入仓库地址：
+
+   ```text
+   git+https://github.com/Jorgen233/dsh-why-reject-me.git
+   ```
+
+4. 点 **Install（安装）**。
+5. 安装完成后如果出现 **Enable now（立即启用）**，点它；如果关闭了对话框，在 **Installed plugins** 中确认 `dsh-why-reject-me` 已打开。
+6. 按界面提示重启 DSH Desktop。Host 半在启动时加载，只刷新 Desktop 页面可能不够。
+
+**让 Agent 安装：**
+
+在启用了 `plugin_manager` 工具的会话（默认是 Creator 模式）中，直接发：
+
+```text
+请在我的 DSH profile 中安装这个插件：
+plugin_manager action=install_bundle target=git+https://github.com/Jorgen233/dsh-why-reject-me.git
+
+安装完成后确认 bundle 已启用，并告诉我是否需要重启 DSH Desktop。
+```
+
+如果当前会话没有 `plugin_manager`，改用 DSH Desktop 的 Plugins 页面。
+
+### 方式二：本地克隆 / 开发
+
+适合需要改代码或调试插件，并且已经能取得仓库副本的情况。
+
+```bash
+git clone https://github.com/Jorgen233/dsh-why-reject-me.git
+```
+
+然后在 **Plugins → Add plugin** 中填入克隆目录的**绝对路径**，例如：
+
+```text
+G:\Dev\dsh-why-reject-me
+```
+
+本地路径会以 `link:` 方式装入 profile，修改 `client.js` 后刷新 Desktop 页面即可生效；修改 `index.js` 后需要重启 Desktop。
+
+> 本地安装要先有仓库副本。如果 GitHub 无法直接访问，需要先通过代理、镜像或其他方式取得副本，再填本地路径；直接 `git clone` 仓库地址仍然需要能访问 GitHub。
+
+### 更新
+
+GitHub 安装：
+
+```text
+plugin_manager action=remove_bundle target=dsh-why-reject-me
+plugin_manager action=install_bundle target=git+https://github.com/Jorgen233/dsh-why-reject-me.git
+```
+
+在 DSH Desktop 中等价于：在 **Plugins** 里卸载后重新 **Add plugin**。本地路径安装同理，把 target 换回对应的路径即可。更新 Host 半后需要重启 DSH Desktop。
+
+### 确认安装
+
+- **Plugins** 列表中能看到 `dsh-why-reject-me`，且开关为开启状态；
+- 把会话权限切到 `danger-full-access`，让 Agent 运行一条只读命令，或触发任意会弹出审批的操作；
+- 审批面板中应出现「拒绝原因（可选）」输入框；
+- 输入原因并拒绝后，展开对应的工具结果卡片，应能看到原因文本。
+
+## 使用
+
+1. Agent 请求越权执行，审批面板出现；
+2. 在「拒绝原因（可选）」中填写原因，可以留空；
+3. 点「拒绝」，或按 `Ctrl/⌘ + Enter`；
+4. 原因会先提交给 Host，随后审批才以 `rejected` 结束；
+5. 模型在同一个 tool result 中读到原因，并据此继续。
+
+原因只在**拒绝**时发送。点「允许一次」不会发送输入框里的内容。
+
+如果原因提交失败，审批不会自动结束，面板会显示错误并允许重试；此时可以重试，或清空原因后直接拒绝。
+
+## 快捷键
+
+| 按键 | 行为 |
+| --- | --- |
+| `Enter`（焦点不在输入框或按钮上） | 允许一次 |
+| `Ctrl/⌘ + Enter` | 拒绝并附上原因 |
+| `Esc`（焦点在输入框且有内容） | 让输入框失焦，避免误触拒绝 |
+| `Esc`（输入框为空） | 直接拒绝 |
+
+输入法组合输入期间按 `Enter` 不会触发审批动作。
+
+## 工作原理
+
+1. 客户端接管 `conversation.composer` 上的审批面板，只在「待处理交互是审批」且「不是子代理会话」时生效；
+2. 点拒绝且原因非空时，客户端把 `{ sessionId, callId, reason, prefix }` POST 到 Host 的 `/api/dsh-why-reject-me/reason`；
+3. Host 在内存中按 `Session + Tool call` 暂存原因，5 分钟内未匹配到拒绝结果就丢弃；
+4. 客户端调用原审批对象的 `answer('rejected')`；
+5. 拒绝结果产生后，Host 的 `tools/post-execute` 监听器把原因追加到这条 tool result 的 content；
+6. 模型像读 `ask_user_question` 的答案一样读到它——它是普通工具结果，不是一条 `user/message`，也不会单独起一轮。
+
+插件不修改任何 DSH 自带包，Host 半只注册一个同源路由和一个 `tools/post-execute` 监听器。
+
+## 兼容性
+
+- 验证环境：DSH Desktop `0.2.1-rc.2` 和 `0.2.1-rc.5`；两个版本都做过真实审批验证，其他运行方式未验证；
+- 依赖以下公开面：
+  - `conversation.composer` 链式插槽与 `priority`；
+  - `PendingApproval.kind / answer / callId / key`；
+  - `ctx.connection.fetch.register`；
+  - `tools/post-execute` waterfall；
+  - `SessionSnapshot.subagent`。
+- DSH 大版本升级后，如果这些公开面发生变化，插件可能需要同步适配。升级 DSH 后若审批面板异常，先禁用本插件，确认是否为兼容性问题。
+
+## 已知限制
+
+- 原因会作为 tool result 的一部分进入会话记录（`tool/result`），并随上下文发送给模型提供商。这是「模型可见」的必要代价，无法既让模型读到、又完全不落盘；
+- 展开被拒绝工具的结果卡片时，可以看到这段原因；
+- **子代理会话不适用**：运行时会在子代理上下文中自动拒绝提权，插件不会接管这类审批，因此没有原因输入框，拒绝文案仍是运行时原文（`the user rejected ...`，与人工拒绝同文）。这是 DSH 核心策略，不是本插件能改的；
+- 原因上限 2000 字；Host 暂存 5 分钟未匹配到拒绝结果就丢弃；
+- 未发送的草稿按 `Session + Tool call` 保留 30 分钟：切到其他会话再回来不会丢字，但刷新 Desktop 页面会丢（只存在页面内存里）；
+- 只处理权限审批，不处理 `ask_user_question` 或其他确认框；
+- 原因只是附加文本，模型会读到，但不保证一定照做；
+- 插件通过 `priority: 0` 接管审批面板。如果同时安装了其他抢占 `conversation.composer` 的审批插件，可能只有其中一个生效。
+
+## 卸载与回滚
+
+在 **Plugins** 页面把 `dsh-why-reject-me` 关闭或卸载，然后重启 DSH Desktop。
+
+也可以用 Agent 工具：
+
+```text
+plugin_manager action=set_bundle target=dsh-why-reject-me enabled=false
+# 或
+plugin_manager action=remove_bundle target=dsh-why-reject-me
+```
+
+卸载后审批面板恢复为 DSH 自带样式，已经写入会话记录的原因不会被删除。
+
+## 故障排查
+
+| 现象 | 处理 |
+| --- | --- |
+| 安装后审批面板没有变化 | 确认 bundle 已启用；重启 DSH Desktop，而不是只刷新 Desktop 页面 |
+| 有输入框，但模型没看到原因 | 确认点的是「拒绝」且原因非空；原因提交失败时面板会报错并停在审批上；展开工具结果卡片查看原文 |
+| 点拒绝后一直停在「正在提交原因…」 | Host 路由没有响应；重启 Desktop，并检查是否有代理或安全软件拦截同源 POST |
+| 子代理会话没有输入框 | 预期行为，见[已知限制](#已知限制) |
+| 刷新 Desktop 页面后草稿丢了 | 预期行为，草稿只存在页面内存中 |
+| GitHub 安装失败或超时 | 确认本机有 Git、能访问 GitHub；或先取得仓库副本后填本地路径 |
+| 插件列表显示的不是英文名 | 升级到 `0.3.2` 或更新版本，并重启 Desktop 清除旧元数据缓存 |
+| 和其他审批插件冲突 | 只保留一个接管 `conversation.composer` 的审批插件 |
+
+## 开发与测试
+
+插件是纯 ESM JavaScript，不需要构建，也没有运行时依赖。测试需要 Node.js 20 或更新版本，只使用 Node 内置模块，克隆后无需先安装依赖。
+
+```bash
+git clone https://github.com/Jorgen233/dsh-why-reject-me.git
+cd dsh-why-reject-me
+npm test
+```
+
+`npm test` 依次运行三个冒烟测试：
+
+```text
+node test/smoke-client.mjs
+node test/smoke-panel.mjs
+node test/smoke-host.mjs
+```
+
+| 文件 | 作用 |
+| --- | --- |
+| `index.js` | Host 半：原因暂存路由、`tools/post-execute` 追加逻辑 |
+| `client.js` | 客户端半（Desktop 内嵌页面）：审批面板、草稿、POST、快捷键 |
+| `cordis.patch.yml` | 向 profile 插入插件行 |
+| `locale/` | 插件列表的显示元数据 |
+| `test/` | 不依赖 DSH 运行时的冒烟测试 |
+
+三个测试分别覆盖：插槽注册与 POST 形状、面板交互与草稿生命周期、Host 路由校验与 tool result 追加。真实 Desktop 行为仍需安装后手测：
+
+1. 触发一次需要审批的操作；
+2. 输入原因并拒绝，确认 tool result 末尾出现原因；
+3. 再次触发审批，留空拒绝，确认与原生一致；
+4. 输入原因后切到其他会话再回来，确认草稿还在。
+
+## 许可证
+
+[MIT](LICENSE)，Copyright (c) 2026 Jorgen233。
+
+## 关于本项目
+
+本项目完全由 DeepSeek 搭建和维护。
+
+它是第三方社区插件，不是 DSH 官方组件。欢迎通过 GitHub Issues 反馈问题；涉及 DSH 公开面的兼容性调整，会随 DSH 版本变化更新。

package/client.js

@@ -0,0 +1,475 @@
+window.__ModuleLoader__.load({
+  id: 'dsh-why-reject-me',
+  factory(require) {
+    const React = require('react')
+    const h = React.createElement
+
+    /** Locale namespace owned by this plugin. */
+    const NS = 'why-reject-me'
+    /** Hard cap for one rejection reason; the textarea enforces the same value. */
+    const MAX_REASON_LENGTH = 2000
+    /** Keep an unsent draft while the user switches Sessions and comes back. */
+    const DRAFT_TTL_MS = 30 * 60 * 1000
+    /** Unique style tag id so HMR reloads can find (and update) the sheet. */
+    const STYLE_ID = 'dsh-why-reject-me/panel.css'
+
+    /** @type {Map<string, { text: string, expiresAt: number }>} */
+    const drafts = new Map()
+
+    /** One draft identity: Session + Tool call, with the pending key as fallback. */
+    function draftKey(pending) {
+      if (pending === null || typeof pending !== 'object') return undefined
+      const sessionId = typeof pending.sessionId === 'string' && pending.sessionId.length > 0
+        ? pending.sessionId
+        : undefined
+      if (sessionId === undefined) return undefined
+      if (typeof pending.callId === 'string' && pending.callId.length > 0) {
+        return `${sessionId}\u0000${pending.callId}`
+      }
+      if (typeof pending.key === 'string' && pending.key.length > 0) {
+        return `${sessionId}\u0000${pending.key}`
+      }
+      return undefined
+    }
+
+    /** Read one draft, dropping it once its approval is long gone. */
+    function readDraft(key) {
+      if (key === undefined) return ''
+      const entry = drafts.get(key)
+      if (entry === undefined) return ''
+      if (entry.expiresAt <= Date.now()) {
+        drafts.delete(key)
+        return ''
+      }
+      return entry.text
+    }
+
+    /** Store one draft; an emptied field removes the entry. */
+    function writeDraft(key, text) {
+      if (key === undefined) return
+      if (text.length === 0) {
+        drafts.delete(key)
+        return
+      }
+      const now = Date.now()
+      for (const [keyOfEntry, entry] of drafts) {
+        if (entry.expiresAt <= now) drafts.delete(keyOfEntry)
+      }
+      drafts.set(key, { text, expiresAt: now + DRAFT_TTL_MS })
+    }
+
+    /** Drop one draft once its approval is answered. */
+    function clearDraft(key) {
+      if (key !== undefined) drafts.delete(key)
+    }
+
+    /** Simplified Chinese copy. */
+    const zh = {
+      waiting: '等待审批',
+      sending: '正在提交原因…',
+      detailAria: '审批详情',
+      escalation: '工具 {toolName} 请求越权执行',
+      reject: '拒绝',
+      allowOnce: '允许一次',
+      reasonLabel: '拒绝原因（可选）',
+      reasonPrefix: '【审批请求已拒绝】原因：',
+      reasonPlaceholder: '写下拒绝的理由，会附在拒绝结果里交给模型；留空则只发送拒绝。',
+      reasonHint: 'Ctrl/⌘ + Enter 拒绝并附上原因',
+      sendFailed: '原因提交失败：{message}',
+      rejectFailed: '拒绝没有送达：{message}',
+      rejecting: '正在拒绝…',
+      allowing: '正在允许…',
+    }
+
+    /** English copy, checked against the Chinese key set. */
+    const en = {
+      waiting: 'Waiting for approval',
+      sending: 'Submitting rejection reason…',
+      detailAria: 'Approval details',
+      escalation: 'Tool {toolName} requests privileged execution',
+      reject: 'Reject',
+      allowOnce: 'Allow once',
+      reasonLabel: 'Rejection reason (optional)',
+      reasonPrefix: '[Approval request rejected] Reason: ',
+      reasonPlaceholder: 'Explain why you reject this request. It is attached to the rejection result for the model; leave empty to reject without a reason.',
+      reasonHint: 'Ctrl/⌘ + Enter rejects and attaches the reason',
+      sendFailed: 'Could not submit the reason: {message}',
+      rejectFailed: 'The rejection was not delivered: {message}',
+      rejecting: 'Rejecting…',
+      allowing: 'Allowing…',
+    }
+
+    /**
+     * Panel stylesheet, adapted from the shipped approval panel and primitives
+     * Button so the takeover looks like the host surface. Class names are
+     * prefixed with `dwrm_` to avoid colliding with any shipped stylesheet.
+     */
+    const css = {
+      root: 'dwrm_root',
+      card: 'dwrm_card',
+      strip: 'dwrm_strip',
+      dot: 'dwrm_dot',
+      body: 'dwrm_body',
+      headline: 'dwrm_headline',
+      command: 'dwrm_command',
+      reasonLabel: 'dwrm_reasonLabel',
+      reason: 'dwrm_reason',
+      hint: 'dwrm_hint',
+      error: 'dwrm_error',
+      actionRow: 'dwrm_actionRow',
+      button: 'dwrm_btn',
+      medium: 'dwrm_md',
+      outline: 'dwrm_outline',
+      primary: 'dwrm_primary',
+      reject: 'dwrm_reject',
+    }
+
+    const STYLE_TEXT = `
+.dwrm_root{padding:8px calc(var(--dsh-composer-side-clearance) + 16px) 12px;flex-direction:column;align-items:center;display:flex}
+.dwrm_card{width:100%;max-width:var(--dsh-chat-content-width);border:1px solid var(--dsw-alias-state-warn-secondary);border-radius:var(--dsw-radius-xl);background:var(--dsw-specific-input-major);box-shadow:var(--dsw-shadow-lv2);--dsh-scrollbar-thumb:var(--dsw-alias-scrollbar-bg-l2);--dsh-scrollbar-thumb-hover:var(--dsw-alias-scrollbar-hover-l2);overflow:hidden}
+.dwrm_strip{background:var(--dsw-alias-state-warn-tertiary);color:var(--dsw-alias-state-warn-primary);align-items:center;gap:8px;padding:10px 16px;font-size:13px;line-height:18px;display:flex}
+.dwrm_dot{width:8px;height:8px;border-radius:999px;corner-shape:round;background:currentColor;flex:none}
+.dwrm_dot[data-state=sending]{animation:dwrm_pulse 1s ease-in-out infinite}
+@keyframes dwrm_pulse{0%,100%{opacity:.35}50%{opacity:1}}
+.dwrm_body{box-sizing:border-box;max-height:var(--dsh-composer-text-max-height);flex-direction:column;gap:6px;padding:12px 16px 0;display:flex;overflow-y:auto}
+.dwrm_headline{color:var(--dsw-alias-label-primary);font-size:15px;font-weight:500;line-height:24px}
+.dwrm_command{color:var(--dsw-alias-label-tertiary);font-family:var(--ds-font-family-code);word-break:break-all;font-size:13px;line-height:20px}
+.dwrm_reasonLabel{margin-top:6px;color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px}
+.dwrm_reason{box-sizing:border-box;width:100%;min-height:56px;max-height:160px;padding:8px 10px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-base);color:var(--dsw-alias-label-primary);font:inherit;font-size:13px;line-height:19px;resize:vertical}
+.dwrm_reason::placeholder{color:var(--dsw-alias-label-secondary)}
+.dwrm_reason:focus{outline:none;border-color:var(--dsw-alias-brand-primary)}
+.dwrm_reason:disabled{opacity:.6;cursor:not-allowed}
+.dwrm_hint{color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px}
+.dwrm_error{color:var(--dsw-alias-state-error-primary);font-size:12px;line-height:18px;word-break:break-word}
+.dwrm_actionRow{justify-content:flex-end;gap:8px;padding:14px 16px;display:flex}
+.dwrm_btn{box-sizing:border-box;display:inline-flex;align-items:center;justify-content:center;gap:4px;border:none;border-radius:var(--dsw-radius-md);cursor:pointer;font-size:14px;line-height:22px;color:var(--dsw-alias-label-primary);background:transparent;padding:0 14px}
+.dwrm_btn:disabled{cursor:not-allowed;opacity:.4}
+.dwrm_md{height:36px}
+.dwrm_outline{border:.5px solid var(--dsw-alias-border-l3);background:transparent}
+.dwrm_outline:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}
+.dwrm_reject:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-danger);color:var(--dsw-alias-state-error-primary);border-color:transparent}
+.dwrm_primary{background:var(--dsw-alias-button-primary-fill);color:var(--dsw-alias-label-primary-foreground)}
+.dwrm_primary:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover)}
+`
+
+    /** Install (or refresh) the plugin stylesheet exactly once per page. */
+    function installStyle(ctx) {
+      if (typeof document === 'undefined') return
+      const selector = 'style[data-plugin-css=' + JSON.stringify(STYLE_ID) + ']'
+      const existing = document.querySelector(selector)
+      if (existing !== null) {
+        existing.textContent = STYLE_TEXT
+        return
+      }
+      const tag = document.createElement('style')
+      tag.dataset.plugin = 'dsh-why-reject-me'
+      tag.dataset.pluginCss = STYLE_ID
+      tag.textContent = STYLE_TEXT
+      ctx.effect(() => {
+        if (!tag.isConnected) document.head.appendChild(tag)
+        return () => {
+          tag.remove()
+        }
+      }, 'dsh-why-reject-me: panel stylesheet')
+    }
+
+    /** Resolve one failure into a short, localizable message. */
+    function messageOf(cause) {
+      if (cause instanceof Error && cause.message.length > 0) return cause.message
+      const text = String(cause)
+      return text.length > 0 ? text : 'unknown error'
+    }
+
+    /**
+     * Hand one rejection reason to the Host half.
+     *
+     * The Host parks it in memory and appends it to the rejected Tool call's
+     * `tool/result`; the model reads it there, exactly like an
+     * `ask_user_question` answer. No user message is created.
+     */
+    async function sendReason(pending, text, prefix) {
+      const reason = String(text ?? '').trim().slice(0, MAX_REASON_LENGTH)
+      if (reason.length === 0) return
+      const sessionId = pending !== null && typeof pending === 'object' ? pending.sessionId : undefined
+      const callId = pending !== null && typeof pending === 'object' ? pending.callId : undefined
+      if (typeof sessionId !== 'string' || sessionId.length === 0) {
+        throw new Error('the pending approval has no Session identity')
+      }
+      if (typeof callId !== 'string' || callId.length === 0) {
+        throw new Error('the pending approval has no Tool call identity')
+      }
+      const marker = typeof prefix === 'string' ? prefix.slice(0, 120) : undefined
+      const response = await fetch('/api/dsh-why-reject-me/reason', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          sessionId,
+          callId,
+          reason,
+          ...(marker === undefined ? {} : { prefix: marker }),
+        }),
+      })
+      if (response.ok) return
+      let detail = ''
+      try {
+        const payload = await response.json()
+        if (payload !== null && typeof payload === 'object' && typeof payload.error === 'string') {
+          detail = payload.error
+        }
+      } catch {
+        // keep the status-only message
+      }
+      throw new Error(detail.length > 0 ? `HTTP ${response.status}: ${detail}` : `HTTP ${response.status}`)
+    }
+
+    /** Whether one Session pending interaction is the approval takeover we own. */
+    function isApproval(value) {
+      return value !== null
+        && typeof value === 'object'
+        && value.kind === 'approval'
+        && typeof value.answer === 'function'
+        && typeof value.sessionId === 'string'
+    }
+
+    /**
+     * Whether the addressed Session is a subagent conversation.
+     *
+     * Subagent sessions keep the shipped approval behavior: the Host disables
+     * approval prompts there and auto-rejects escalation, so this plugin must
+     * not claim their pending interactions (and never asks for a reason).
+     * @param session - current Session snapshot from the composer owner props.
+     */
+    function isSubagentSession(session) {
+      return session !== undefined && session !== null && session.subagent != null
+    }
+
+    /**
+     * Render the command text of the Tool call correlated with an approval.
+     * Mirrors the shipped `ApprovalCommand`, using the standard `useChat` prop
+     * instead of the shipped detail slot so this entry declares no children.
+     */
+    function CommandDetail(props) {
+      const command = props.useChat((snapshot) => {
+        for (const node of snapshot.nodes.values()) {
+          const root = node.kind === 'tool-call' ? node.data.root : undefined
+          if (root !== undefined && root.callId === props.callId && !('kind' in root) && root.phase === 'start') {
+            try {
+              const args = JSON.parse(root.argsRaw)
+              return typeof args.command === 'string' ? args.command : null
+            } catch {
+              return null
+            }
+          }
+        }
+        return null
+      })
+      return command === null || command === undefined
+        ? null
+        : h('div', { className: css.command }, command)
+    }
+
+    /**
+     * One pending approval with an optional rejection reason.
+     *
+     * Remounted per `pending.key` by {@link WhyRejectPanel}, so a new approval
+     * never inherits the previous draft or error.
+     */
+    function ApprovalReasonPanel(props) {
+      const pending = props.matched
+      const t = props.t
+      const draftId = draftKey(pending)
+      const [reason, setReason] = React.useState(readDraft(draftId))
+      const [phase, setPhase] = React.useState(null)
+      const [error, setError] = React.useState(null)
+      const waiting = React.useRef(false)
+      const active = React.useRef(true)
+      const sentReason = React.useRef(null)
+      const busy = phase !== null
+
+      React.useEffect(() => {
+        active.current = true
+        return () => {
+          active.current = false
+        }
+      }, [])
+
+      React.useEffect(() => {
+        setReason(readDraft(draftId))
+      }, [draftId])
+
+      React.useEffect(() => {
+        if (pending.answerable === false) clearDraft(draftId)
+      }, [pending.answerable, draftId])
+
+      const settle = async (outcome) => {
+        if (waiting.current || pending.answerable === false) return
+        waiting.current = true
+        const text = reason.trim().slice(0, MAX_REASON_LENGTH)
+        const sendsReason = outcome === 'rejected' && text.length > 0 && sentReason.current !== text
+        setPhase(outcome === 'allowed-once' ? 'allowing' : sendsReason ? 'sending' : 'rejecting')
+        setError(null)
+        let stage = 'reason'
+        try {
+          if (sendsReason) {
+            await props.sendReason(pending, text)
+            sentReason.current = text
+            if (active.current) setPhase('rejecting')
+          }
+          stage = 'answer'
+          await pending.answer(outcome)
+          clearDraft(draftId)
+        } catch (cause) {
+          if (!active.current) return
+          waiting.current = false
+          setPhase(null)
+          setError(t(stage === 'reason' ? 'sendFailed' : 'rejectFailed', { message: messageOf(cause) }))
+        }
+      }
+
+      const keydown = (event) => {
+        if (event.defaultPrevented || waiting.current) return
+        const element = event.target
+        const field = element !== null && element.closest !== undefined
+          ? element.closest('input, textarea, select, [contenteditable="true"], [contenteditable=""]')
+          : null
+        const composing = (event.nativeEvent !== undefined && event.nativeEvent.isComposing === true) || event.keyCode === 229
+        if (event.key === 'Enter' && (event.ctrlKey || event.metaKey)) {
+          if (composing) return
+          event.preventDefault()
+          event.stopPropagation()
+          settle('rejected')
+          return
+        }
+        if (event.key === 'Escape') {
+          if (event.ctrlKey || event.metaKey || event.altKey || event.shiftKey) return
+          if (field !== null && reason.trim().length > 0) {
+            event.preventDefault()
+            field.blur()
+            return
+          }
+          event.preventDefault()
+          event.stopPropagation()
+          settle('rejected')
+          return
+        }
+        if (event.key !== 'Enter') return
+        if (event.ctrlKey || event.metaKey || event.altKey || event.shiftKey || composing) return
+        if (element !== null && element.closest !== undefined && element.closest('button, a[href], [role="button"]') !== null) return
+        if (field !== null) return
+        event.preventDefault()
+        event.stopPropagation()
+        settle('allowed-once')
+      }
+
+      const headline = pending.displayReason === undefined
+        ? (pending.reason === undefined ? t('escalation', { toolName: pending.toolName }) : pending.reason)
+        : props.resolveReason(pending.displayReason)
+      const detail = pending.callId !== undefined && typeof props.useChat === 'function'
+        ? h(CommandDetail, { useChat: props.useChat, callId: pending.callId })
+        : null
+      const disabled = busy || pending.answerable === false
+      const stripText = phase === 'sending'
+        ? t('sending')
+        : phase === 'allowing'
+          ? t('allowing')
+          : phase === 'rejecting'
+            ? t('rejecting')
+            : t('waiting')
+
+      return h('div', {
+        className: css.root,
+        'data-approval-key': pending.key,
+        'data-why-reject-me': 'approval',
+        'aria-busy': busy,
+        onKeyDown: keydown,
+      }, h('div', { className: css.card }, [
+        h('div', { className: css.strip }, [
+          h('span', { className: css.dot, 'data-state': phase === 'sending' ? 'sending' : 'waiting', 'aria-hidden': true }),
+          stripText,
+        ]),
+        h('div', {
+          className: css.body,
+          'data-approval-scroll': '',
+          tabIndex: 0,
+          role: 'group',
+          'aria-label': t('detailAria'),
+        }, [
+          h('div', { className: css.headline }, headline),
+          detail,
+          h('div', { className: css.reasonLabel }, t('reasonLabel')),
+          h('textarea', {
+            className: css.reason,
+            value: reason,
+            rows: 2,
+            maxLength: MAX_REASON_LENGTH,
+            placeholder: t('reasonPlaceholder'),
+            'aria-label': t('reasonLabel'),
+            disabled,
+            onChange: (event) => {
+              const next = event.target.value
+              setReason(next)
+              writeDraft(draftId, next)
+              if (error !== null) setError(null)
+            },
+          }),
+          h('div', { className: css.hint }, t('reasonHint')),
+          error === null ? null : h('div', { className: css.error, role: 'alert' }, error),
+        ]),
+        h('div', { className: css.actionRow }, [
+          h('button', {
+            type: 'button',
+            className: css.button + ' ' + css.medium + ' ' + css.outline + ' ' + css.reject,
+            disabled,
+            onClick: () => {
+              settle('rejected')
+            },
+          }, t('reject')),
+          h('button', {
+            type: 'button',
+            className: css.button + ' ' + css.medium + ' ' + css.primary,
+            disabled,
+            onClick: () => {
+              settle('allowed-once')
+            },
+          }, t('allowOnce')),
+        ]),
+      ]))
+    }
+
+    /** Remount the panel whenever the pending approval changes. */
+    function WhyRejectPanel(props) {
+      const approval = props.matched
+      return h(ApprovalReasonPanel, { ...props, key: approval.key })
+    }
+
+    /** Required Client services: slot registry and copy. */
+    const inject = ['slots', 'locale']
+
+    /**
+     * Install the approval takeover.
+     * @param ctx - Client root context.
+     */
+    function apply(ctx) {
+      installStyle(ctx)
+      ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-why-reject-me: dictionaries')
+      ctx.slots.inject('conversation.composer', () => ctx.slots.register({
+        name: 'conversation.composer',
+        // Lower number wins in a chain: the shipped approval takeover is 1,
+        // and the ordinary composer entries decline while an approval is pending.
+        // Subagent conversations are explicitly left to the shipped behavior.
+        priority: 0,
+        select: ({ pendingInteraction, session }) => {
+          if (isSubagentSession(session)) return null
+          return isApproval(pendingInteraction) ? pendingInteraction : null
+        },
+        locale: NS,
+        inject: () => ({
+          resolveReason: (reason) => ctx.locale.resolveText(reason),
+          sendReason: (pending, text) => sendReason(pending, text, ctx.locale.bind(NS)('reasonPrefix')),
+        }),
+      }, WhyRejectPanel))
+    }
+
+    return { inject, apply }
+  },
+})

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: dsh-why-reject-me
+      name: 'dsh-why-reject-me'

package/icon.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="Why you reject me">
+  <rect width="64" height="64" rx="14" fill="#2F6BFF"/>
+  <path d="M18 18h28a6 6 0 0 1 6 6v14a6 6 0 0 1-6 6H32l-9 7v-7h-5a6 6 0 0 1-6-6V24a6 6 0 0 1 6-6Z" fill="#FFFFFF"/>
+  <path d="M23 28h18M23 36h10" stroke="#2F6BFF" stroke-width="4" stroke-linecap="round"/>
+  <circle cx="46" cy="44" r="9" fill="#E5484D" stroke="#FFFFFF" stroke-width="3"/>
+  <path d="m42.6 40.6 6.8 6.8m0-6.8-6.8 6.8" stroke="#FFFFFF" stroke-width="3" stroke-linecap="round"/>
+</svg>

package/index.js

@@ -0,0 +1,125 @@
+/**
+ * Host half of `dsh-why-reject-me`.
+ *
+ * The Client half posts the rejection reason here before answering the
+ * approval. This half parks the text in memory, keyed by Session and Tool call,
+ * and appends it to that call's rejected `tool/result` through the
+ * `tools/post-execute` waterfall. The model therefore reads the reason as part
+ * of the tool result — the same channel `ask_user_question` uses — instead of a
+ * separate user message.
+ */
+
+/** Same-origin route the Client half posts one reason to. */
+const REASON_PATH = '/api/dsh-why-reject-me/reason'
+/** Keep in step with the Client textarea. */
+const MAX_REASON_LENGTH = 2000
+/** A pending reason that never met its Tool result is dropped after this. */
+const REASON_TTL_MS = 5 * 60 * 1000
+
+/** @type {Map<string, { text: string, prefix: string, expiresAt: number }>} */
+const reasons = new Map()
+
+/** One key per Session and Tool call; both are opaque strings. */
+function keyOf(sessionId, callId) {
+  return `${sessionId}\u0000${callId}`
+}
+
+/** Drop expired entries so an unanswered approval cannot leak text. */
+function prune(now) {
+  for (const [key, value] of reasons) {
+    if (value.expiresAt <= now) reasons.delete(key)
+  }
+}
+
+/** One JSON response with a stable content type. */
+function json(status, body) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'content-type': 'application/json; charset=utf-8' },
+  })
+}
+
+/**
+ * Receive one reason from the Client.
+ * @param {Request} request - buffered same-origin POST body.
+ * @returns {Promise<Response>} accepted or a validation failure.
+ */
+async function receiveReason(request) {
+  let body
+  try {
+    body = await request.json()
+  } catch {
+    return json(400, { ok: false, error: 'invalid JSON body' })
+  }
+  if (body === null || typeof body !== 'object') {
+    return json(400, { ok: false, error: 'invalid body' })
+  }
+  const { sessionId, callId, reason, prefix } = body
+  if (typeof sessionId !== 'string' || sessionId.length === 0) {
+    return json(400, { ok: false, error: 'sessionId is required' })
+  }
+  if (typeof callId !== 'string' || callId.length === 0) {
+    return json(400, { ok: false, error: 'callId is required' })
+  }
+  if (typeof reason !== 'string') {
+    return json(400, { ok: false, error: 'reason is required' })
+  }
+  const text = reason.trim().slice(0, MAX_REASON_LENGTH)
+  if (text.length === 0) {
+    return json(200, { ok: true, stored: false })
+  }
+  const marker = typeof prefix === 'string' && prefix.length > 0
+    ? prefix.slice(0, 120)
+    : '[approval rejected] reason: '
+  const now = Date.now()
+  prune(now)
+  reasons.set(keyOf(sessionId, callId), { text, prefix: marker, expiresAt: now + REASON_TTL_MS })
+  return json(200, { ok: true, stored: true })
+}
+
+/**
+ * Append the parked reason to the rejected Tool result.
+ *
+ * Registered with `prepend: true` so `next()` returns the decision every later
+ * listener produced; this listener only augments an accepted failed result.
+ * @param {object} exec - Tool execution carrying Session and call identity.
+ * @param {object} result - final Tool result before post-processing.
+ * @param {() => Promise<object>} next - downstream waterfall decision.
+ * @returns {Promise<object>} the accepted decision, with reason content added.
+ */
+async function appendReason(exec, result, next) {
+  const decision = await next()
+  if (decision.kind !== 'accept' || result.isError !== true) return decision
+  const sessionId = exec.agent?.id
+  if (typeof sessionId !== 'string' || typeof exec.callId !== 'string') return decision
+  const key = keyOf(sessionId, exec.callId)
+  const stored = reasons.get(key)
+  if (stored === undefined) return decision
+  if (stored.expiresAt <= Date.now()) {
+    reasons.delete(key)
+    return decision
+  }
+  reasons.delete(key)
+  const content = [...(decision.content ?? result.content), {
+    type: 'text',
+    text: `\n\n${stored.prefix}${stored.text}`,
+  }]
+  return { ...decision, content }
+}
+
+/** The route and the Tool pipeline are both Host-owned services. */
+export const inject = ['connection', 'tools']
+
+/**
+ * Install the reason route and the Tool-result augmentation.
+ * @param {object} ctx - Host plugin context.
+ */
+export function apply(ctx) {
+  ctx.connection.fetch.register({
+    path: REASON_PATH,
+    methods: ['POST'],
+    requestBody: 'buffered',
+    fetch: receiveReason,
+  })
+  ctx.on('tools/post-execute', appendReason, { prepend: true })
+}

package/locale/en.json

@@ -0,0 +1,5 @@
+{
+  "meta": {
+    "description": "Adds an optional rejection reason to permission approval prompts and attaches it to the rejected tool result for the model; leaving it empty keeps the original rejection behavior."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,5 @@
+{
+  "meta": {
+    "description": "在权限审批的「拒绝」旁增加原因输入框；拒绝时把原因附在被拒绝工具的 tool result 里交给模型，留空则保持原有拒绝行为。"
+  }
+}

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "dsh-why-reject-me",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.2",
+  "description": "Adds an optional rejection reason to DSH permission approval prompts and delivers it with the rejected tool result.",
+  "license": "MIT",
+  "author": "Jorgen233",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Jorgen233/dsh-why-reject-me.git"
+  },
+  "homepage": "https://github.com/Jorgen233/dsh-why-reject-me#readme",
+  "bugs": {
+    "url": "https://github.com/Jorgen233/dsh-why-reject-me/issues"
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "approval",
+    "permission",
+    "cordis"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "scripts": {
+    "test": "node test/smoke-client.mjs && node test/smoke-panel.mjs && node test/smoke-host.mjs"
+  },
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg"
+  },
+  "files": [
+    "index.js",
+    "client.js",
+    "cordis.patch.yml",
+    "locale/*.json",
+    "icon.svg",
+    "README.md"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-approval",
+        "@deepseek-ai/dsh-client-ui-conversation"
+      ]
+    }
+  }
+}