v0.4.1 — 安全兜底修复 / Fail-safe fixes

中文

v0.4.1 是 v0.4.0 的安全性补丁版本。它保留“借鉴 Claude Code auto mode 的用户意图覆盖与混淆熔断”、/auto-report 和离线日志调优，并修复发布后审查发现的 fail-safe 边界问题：

• 保证一次审批最多调用一次下游 next()；下游应答者异常不会导致 waterfall 被重复消费。
• 最新真人消息超过 2000 字符时不再静默截断，而是以 latest-user-message-too-long 明确转人工。
• force-push 前置危险清单补齐 +refspec、--mirror、git -C … push --force 等标准写法。
• 分类超时会先恢复人工审批；流迭代器清理由插件生命周期继续持有，卸载仍会等待合规 adapter 完成清理。
• 离线调优脚本接受合法的第三方扩展事件原始值数据，正确合并同一 session 的 append-only 多份导出，并把空样本明确标为“证据不足”而非“死正则”。

所有失败路径仍只会转人工，插件永不替用户拒绝。Node 26 本机测试 88/88；GitHub Actions 的 Node 22.x 与 24.x 均通过。

English

v0.4.1 is a safety patch for v0.4.0. It keeps the Claude Code auto mode-inspired user-intent override and confusion circuit breaker, /auto-report, and offline log tuning while closing fail-safe gaps found during post-release review:

• Each approval delegates through next() at most once; a downstream responder failure can no longer consume the waterfall twice.
• Genuine user messages longer than 2,000 characters are no longer silently truncated; they fall back to human review with latest-user-message-too-long.
• The pre-classification force-push guard now covers standard forms such as +refspec, --mirror, and git -C … push --force.
• Classification timeouts return to human review promptly, while iterator cleanup remains owned by the plugin lifecycle and is still drained on unload for conforming adapters.
• The offline tuner accepts valid primitive data on third-party extension events, deduplicates append-only exports of the same session, and reports empty samples as insufficient evidence instead of a dead regex.

Every failure path still delegates to a human, and the plugin never rejects on the user's behalf. Local Node 26 tests pass 88/88; GitHub Actions passes on Node 22.x and 24.x.

v0.4.0 — 日志调优与信任边界 / Log tuning and trust boundary

中文

v0.4.0 把内置危险词汇抽成共享模块，新增离线日志调优脚本与 /auto-report 内存台账，并收紧分类提示的信任边界。

• 危险词汇共享模块：内置清单移入依赖无关的 danger-patterns.js，运行时插件与离线调优脚本共用同一份规则，不再有第二处拷贝。
• 离线日志调优：新增 scripts/tune-from-logs.mjs（npm run tune）。只用 Node.js 标准库读取 Session log 解压出的 session.jsonl，输出审批统计、内置危险清单命中、批准后回滚信号与自定义规则评议；--extra-danger-pattern 可重复传入，重复去重、无效正则报错退出。所有建议仅为待人工复核的候选。
• latestUserMessage 信任边界：分类证据中仅最新一条真人用户消息被作为可信上下文；命令示例或引用仍不等于执行授权。
• 普通 push 分支语义：推送到用户自己的 fork 或工作分支为例行候选；main、master、release、production 等共享/生产类分支转人工；force push 分类前即命中危险清单。
• /auto-report 内存台账：当前 dsh 进程内、按 session 隔离的三组裁决明细（自动批准 / 危险清单拦截 / 分类器转人工）。
• 测试 56 → 82：覆盖调优脚本的解析、统计、去重与失败路径。
• 元数据：简介改为中文在前、英文在后，说明 auto 档介于 Workspace Write 与 Full access 之间；关键词扩充；包名已发布到 npm。

English

v0.4.0 extracts the built-in danger vocabulary into a shared module, adds an offline log-tuning script and the /auto-report in-memory ledger, and tightens the classifier trust boundary.

• Shared danger vocabulary: the built-in list moves into the dependency-free danger-patterns.js, shared by the runtime plugin and the offline tuning script.
• Offline log tuning: new scripts/tune-from-logs.mjs (npm run tune). Node.js stdlib only; reads plaintext session.jsonl files, reports approval statistics, built-in danger-list hits, post-approval rollback signals, and a custom-rule critique. --extra-danger-pattern is repeatable, duplicates are removed, and invalid regexes fail with a non-zero exit. Every suggestion is a candidate for human review only.
• latestUserMessage trust boundary: only the newest genuine user message is trusted context in the classifier evidence; command examples or quotations are not execution authorization.
• Ordinary-push branch semantics: pushes to the user's own fork or working branch are routine candidates; main, master, release, production, and similar shared branches go to a human; force-pushes hit the danger list before classification.
• /auto-report ledger: an in-memory, session-isolated view of three decision groups (auto-approved / danger-list handoff / classifier-to-human) for the current dsh process.
• Tests 56 → 82: tuning-script parsing, statistics, dedup, and failure paths.
• Metadata: description is now Chinese-first with English after, stating the auto preset sits between Workspace Write and Full access; keywords expanded; package published to npm.

v0.3.0 — Auto 图标与卸载安全 / Auto icon and unload safety

中文

v0.3.0 为 Auto 权限档补上与 dsh 统一的盾牌闪电图标，并收紧插件卸载时的分类生命周期。

• Auto 图标兼容层：为权限触发器和菜单项补上单色盾牌闪电图标；浏览器脚本随仓库直接提交，继续保持零构建、Git 安装免构建授权。
• best-effort、只影响视觉：DeepSeek Harness rc.6 尚无自定义预设图标 API，因此兼容层依赖当前 DOM 与无障碍文案。未来 dsh 变化导致识别失败时只会静默不显示图标，不会影响权限切换、危险清单、自动审批或人工兜底。
• 修复卸载清理：修复插件卸载时进行中的分类不中止的问题。HMR、disabled 或 remove 会先摘除 responder，再中止分类并等待流迭代器和 timer 清理完成；该次审批记录 unloaded 并转人工。
• 提示词可配置：新增非空 classifierPrompt，默认仍是原保守提示；自定义值会完整替换 system prompt。
• 跨 Node 防御：无效 approval abort signal 现在始终安全转人工，避免 Node 22/26 对 AbortSignal.any() 校验差异影响失败语义。
• 新增可重复的 docs/ACCEPTANCE.md，固化升级后的四档、审计、危险转人工、Workspace Write 和图标自禁用复验；本地 56 项测试通过，GitHub Actions Node 22/24 全绿。

English

v0.3.0 adds a dsh-aligned shield-and-bolt icon to the Auto permission preset and tightens classifier lifecycle cleanup during plugin unload.

• Auto icon compatibility layer: adds a monochrome shield-and-bolt glyph to the permission trigger and menu item. The browser script is committed as a runtime file, preserving the zero-build, no-build-authorization Git install.
• Best effort and visual only: DeepSeek Harness rc.6 does not expose a custom preset-icon API, so the layer depends on the current DOM and accessible copy. If a future dsh change prevents recognition, it silently leaves the icon absent; permission switching, danger rules, automatic approvals, and the human fallback remain unaffected.
• Unload cleanup fix: fixes in-flight classification continuing after plugin unload. HMR, disable, or removal now detaches the responder, aborts classification, and waits for stream-iterator and timer cleanup; that approval logs unloaded and returns to human review.
• Configurable prompt: adds a non-empty classifierPrompt; the original conservative prompt remains the default, while a custom value replaces the complete system prompt.
• Cross-Node defense: invalid approval abort signals now always fall back to human review, insulating failure semantics from Node 22/26 differences in AbortSignal.any() validation.
• A repeatable docs/ACCEPTANCE.md now covers four-preset composition, audit pairing, dangerous-command fallback, Workspace Write parity, and icon self-disable checks after dsh upgrades. All 56 local tests pass, and the GitHub Actions Node 22/24 matrix is green.

v0.2.0 — 零配置支持任意 API / Zero-config for any API

中文

分类模型现在默认跟随 DeepSeek Harness Settings → Models 中的默认模型。

• 零配置支持任意 API：无论使用 DeepSeek、自定义 OpenAI 兼容端点还是其他 provider，Auto 档都能直接复用部署默认模型。
• provider 与 model 默认均为 null，并在每次分类调用时动态读取；用户修改默认模型后无需重启插件。
• 两个字段可独立覆盖：只指定 model 可在同一 API 下使用更便宜的分类模型；同时指定两者则保持 0.1.0 的显式路由行为。
• 默认模型不可用时安全转人工，日志明确记录 no-default-model；所有异常仍保持 next() 兜底。
• 原有 39 项测试全部保留，新增 6 项动态路由与失败语义覆盖，共 45 项。

English

The classifier now follows the default model configured under DeepSeek Harness Settings → Models.

• Zero-config support for any API: Auto works with DeepSeek, custom OpenAI-compatible endpoints, and other providers by reusing the deployment's default model.
• Both provider and model now default to null and are resolved for every classification call, so changes to the default model are picked up without restarting the plugin.
• The fields can be overridden independently: set only model to use a cheaper classifier on the same API, or set both fields to preserve the explicit routing behavior from 0.1.0.
• If no default model is available, the plugin safely falls back to human review and logs no-default-model; every exception path still falls through via next().
• All 39 existing tests remain, with 6 new routing and failure-semantics cases, for 45 tests total.

v0.1.0

首个公开版本 · First public release

• 新增 Auto 权限档：例行沙箱升级自动批准，危险动作转人工 / adds the Auto preset: routine sandbox escalations auto-approved, dangerous actions fall back to the human dialog
• 确定性危险清单优先于 LLM 分类，全部失败路径转人工 / deterministic danger list runs before the LLM classifier; every failure path falls back to manual review
• 保留 dsh 原生 read-only / workspace-write / danger-full-access 三档 / keeps all three stock dsh presets
• 纯 ESM JavaScript、零构建、39 项单元测试 / pure ESM JavaScript, no build step, 39 unit tests