Skip to content

v0.1.0

Choose a tag to compare

View all tags
@lifeopsgo lifeopsgo released this 22 Aug 06:07
· 26 commits to main since this release
v0.1.0
8f1b290

v0.1.0 — first release

Turn individual agent capabilities on and off from the DSH WebUI composer — and have it actually enforced.

Install

dsh plugin --profile web add github:lifeopsgo/dsh-capability-toggle-plugin#v0.1.0
dsh --profile web web

Refresh the page — the control appears in the composer row, next to the ➕ button. Click it while the agent is idle.

The tag ships prebuilt lib/, so installation runs no prepare script: you will not hit pnpm's build-approval prompt (allowBuilds) that git-hosted plugins otherwise require. dsh plugin also reconciles dsh.profile.bundles for you — no manual package.json editing.

What you get

A composer-row popup listing every capability the agent can currently reach, each with a three-level switch — session, project, global.

  • Five tabs, six capability families — Skills · MCP · Tools · Prompt · Security (the last folds the approval gate and the guard presets together).
  • Three levels per row, each on, off, or unset. Precedence is session › project › global › default (enabled); an unset level defers to the next one down. The badge at the row's end shows the resolved result.
  • Real enforcement, not hiding. A disabled capability leaves the model's tool schema set and skill catalog on the agent's next step, and a forced call is hard-refused.
  • Per-round adjustability — changes take effect on the agent's next step, no session restart.
  • Locked while running — switches are read-only while the agent works; toggles apply when it is idle.
  • Survives popup close and turn boundaries — the Host caches the last-known inventory, so reopening between turns still shows disabled state correctly.
  • 5 opt-in safety guards — read-only mode, protect secrets, confirm dangerous shell, confirm destructive git, confirm outbound network. Block guards refuse outright; Confirm guards raise one approval prompt.
  • Approval gate — off means every approval request from this agent is auto-rejected, independent of the system /permission setting.
  • Bilingual — ships zh-CN and en dictionaries, follows the WebUI language.

How enforcement works

Every seam acts on the agent's own scope, filtering the surface it inherits. Nothing global is mutated; everything is restored when the agent is released.

Family Mechanism
tool / mcp ctx.tools.restrict({ deny }) on the agent's scope
skill A same-named modelInvocable:false runtime skill shadows the real one
prompt A same-named empty-text section/context shadow, or suppressRuntimeContext()
approval A scoped approval/request listener resolving 'rejected'
guard A tools/pre-execute listener matching the preset's predicate

Notes

  • Requires Node ≥ 22.6 and a DSH profile running the Web GUI.
  • Trust boundary. The plugin's two same-origin routes inherit DSH's local-GUI trust model: no separate auth, no CSRF token, relying on only this machine reaching the GUI port on 127.0.0.1. /set mutates persisted settings, so any local process able to reach that port can call it. Add authentication in front if you expose the GUI beyond localhost.
  • Prompt gating is a curated allowlist, probed for real presence. Entries that would break the model or the render (harness:identity, tools:code-only/tools:sdk, and the strict variables provider/model/cwd) are deliberately excluded.
  • 87 tests over the pure resolution logic; MIT licensed.

Docs: English · 简体中文

v0.1.0 — 首个版本

在 DSH WebUI 输入栏逐项开关 agent 的能力 —— 而且是真的强制生效。

安装

dsh plugin --profile web add github:lifeopsgo/dsh-capability-toggle-plugin#v0.1.0
dsh --profile web web

刷新页面，输入栏 ➕ 旁边会出现开关按钮，agent 空闲时点开即可。

tag 内自带预构建的 lib/，安装不会触发 prepare 脚本，所以不会遇到 pnpm 对 git 插件的构建授权提示（allowBuilds）。dsh plugin 还会自动把插件写进 dsh.profile.bundles，不用手改 package.json。

有什么

一个输入栏弹窗，列出 agent 当前能触达的每一项能力，每项带三级开关：会话、项目、全局。

  • 五个 tab，六个能力族 —— 技能 · MCP · 工具 · 提示词 · 安全（安全 tab 收纳审批闸门与守卫预设）。
  • 每行三级，每级可取 开、关 或未设。优先级 会话 › 项目 › 全局 › 默认（启用）；某级未设则向下跟随。行尾徽标显示综合三级后的真实结果。
  • 真强制，不是隐藏。 被停用的能力会在模型下一步就从工具 schema 和技能目录里消失，强行调用被硬拦截。
  • 逐轮可调 —— 改动在 agent 下一步即生效，无需重启会话。
  • 运行中锁定 —— agent 工作时开关只读，切换只在空闲时落地。
  • 关弹窗、跨轮次都不丢 —— Host 缓存最后一次已知的能力清单，轮次之间重开弹窗仍正确显示已停用状态。
  • 5 个可选安全守卫 —— 只读模式、保护密钥、危险 shell 需确认、破坏性 git 需确认、外网出站需确认。拦截类直接拒绝，确认类弹一次审批。
  • 审批闸门 —— 关掉后本 agent 的所有审批请求一律自动拒绝，与系统 /permission 设置互不干扰。
  • 中英双语 —— 内置中英词典，跟随 WebUI 语言。

强制是怎么实现的

每条路径都作用在 agent 自己的层上，过滤它继承来的能力面；不改全局注册，agent 释放时全部还原。

能力族 机制
tool / mcp 在 agent scope 上 ctx.tools.restrict({ deny })
skill 用同名、modelInvocable:false 的运行时技能影子掉真技能
prompt 同名空文本 section/context 影子，或 suppressRuntimeContext()
approval scoped approval/request 监听器直接 resolve 'rejected'
guard tools/pre-execute 监听器按预设断言匹配

说明

  • 环境要求：Node ≥ 22.6，以及一个跑 Web GUI 的 DSH profile。
  • 信任边界：插件的两条同源路由沿用 DSH 本地 GUI 的信任模型 —— 无独立鉴权、无 CSRF token，依赖「只有本机能访问 127.0.0.1 上的 GUI 端口」。/set 会写持久化 settings，任何能访问该端口的本地进程都能调用。若把 GUI 暴露到非本机地址，需自行在前置代理加鉴权。
  • 提示词开关是精选白名单，且会探测实际存在性。会让模型或渲染崩坏的项（harness:identity、tools:code-only/tools:sdk，以及严格插值变量 provider/model/cwd）被刻意排除。
  • 87 条纯逻辑测试；MIT 许可。

文档：English · 简体中文

Assets 2
Loading