v0.4.0 — 日志调优与信任边界 / Log tuning and trust boundary

中文

v0.4.0 把内置危险词汇抽成共享模块，新增离线日志调优脚本与 /auto-report 内存台账，并收紧分类提示的信任边界。

• 危险词汇共享模块：内置清单移入依赖无关的 danger-patterns.js，运行时插件与离线调优脚本共用同一份规则，不再有第二处拷贝。
• 离线日志调优：新增 scripts/tune-from-logs.mjs（npm run tune）。只用 Node.js 标准库读取 Session log 解压出的 session.jsonl，输出审批统计、内置危险清单命中、批准后回滚信号与自定义规则评议；--extra-danger-pattern 可重复传入，重复去重、无效正则报错退出。所有建议仅为待人工复核的候选。
• latestUserMessage 信任边界：分类证据中仅最新一条真人用户消息被作为可信上下文；命令示例或引用仍不等于执行授权。
• 普通 push 分支语义：推送到用户自己的 fork 或工作分支为例行候选；main、master、release、production 等共享/生产类分支转人工；force push 分类前即命中危险清单。
• /auto-report 内存台账：当前 dsh 进程内、按 session 隔离的三组裁决明细（自动批准 / 危险清单拦截 / 分类器转人工）。
• 测试 56 → 82：覆盖调优脚本的解析、统计、去重与失败路径。
• 元数据：简介改为中文在前、英文在后，说明 auto 档介于 Workspace Write 与 Full access 之间；关键词扩充；包名已发布到 npm。

English

v0.4.0 extracts the built-in danger vocabulary into a shared module, adds an offline log-tuning script and the /auto-report in-memory ledger, and tightens the classifier trust boundary.

• Shared danger vocabulary: the built-in list moves into the dependency-free danger-patterns.js, shared by the runtime plugin and the offline tuning script.
• Offline log tuning: new scripts/tune-from-logs.mjs (npm run tune). Node.js stdlib only; reads plaintext session.jsonl files, reports approval statistics, built-in danger-list hits, post-approval rollback signals, and a custom-rule critique. --extra-danger-pattern is repeatable, duplicates are removed, and invalid regexes fail with a non-zero exit. Every suggestion is a candidate for human review only.
• latestUserMessage trust boundary: only the newest genuine user message is trusted context in the classifier evidence; command examples or quotations are not execution authorization.
• Ordinary-push branch semantics: pushes to the user's own fork or working branch are routine candidates; main, master, release, production, and similar shared branches go to a human; force-pushes hit the danger list before classification.
• /auto-report ledger: an in-memory, session-isolated view of three decision groups (auto-approved / danger-list handoff / classifier-to-human) for the current dsh process.
• Tests 56 → 82: tuning-script parsing, statistics, dedup, and failure paths.
• Metadata: description is now Chinese-first with English after, stating the auto preset sits between Workspace Write and Full access; keywords expanded; package published to npm.