# dsh-automode bundle patch (v0.5.0)
#
# Inserts the plugin row + the auto-mode permission preset.
# The preset appears in the permission picker next to read-only /
# workspace-write / danger-full-access.

- insert:
    - id: auto-mode
      name: '@log.li/dsh-automode'
      config:
        deny:
          - exfiltrat
          - 'curl\s+[^|]*\|\s*(?:ba)?sh'
          - 'wget\s+[^|]*\|\s*(?:ba)?sh'
          - authorized_keys
          - 'AWS_SECRET|PRIVATE KEY|-----BEGIN'
          - \.aws/credentials
          - '(?:^|[\s;&|("''])(?:trash|mv)\s+/(?:etc|usr|bin|sbin|var|System|Library|private/etc)(?:/|\s|$)'
          - 'docker\s+(volume\s+rm|system\s+prune|container\s+prune)'
          - '(?<![a-zA-Z0-9?.])\.ssh/'
          - '(?<![a-zA-Z0-9?.])\.zshrc'
          - '(?<![a-zA-Z0-9?.])\.bashrc'
          - '(?<![a-zA-Z0-9?.])\.bash_profile'
          - '(?<![a-zA-Z0-9?.])\.profile\b'
          - '(?<![a-zA-Z0-9?.])\.claude/settings'
          - 'id_rsa|id_ed25519'
          - '(?<![a-zA-Z0-9?.])\.pem\b'
          - '(?<![a-zA-Z0-9?.])\.env\b'
          - '(?<![a-zA-Z0-9])credentials\b'
        allow:
          - 'trash *'
          - 'echo *'
          - git status
          - 'git status *'
          - 'git log*'
          - 'git diff*'
          - 'git show*'
          - 'wc *'
          - 'head *'
          - 'tail *'
          - 'sort *'
          - 'uniq *'
          - 'date*'
          - 'which *'
          - 'ps *'
          - 'df *'
          - 'du *'
          - 'mkdir *'
          - 'ls*'
          - 'pip show *'
          - 'pip list *'
          - 'npm view *'
          - 'tasklist *'
          - 'brew list *'
          - 'brew info *'
          - brew --prefix
          - 'unzip -l *'
          - 'tar xzf *'
          - 'code *'
        readOnlyTools:
          - read
          - glob
          - grep
          - list
          - search
        allowPaths:
          - '/tmp/'
        allowInsideWorkingDirectory: true
        failClosed: true
        preExecuteGate: true
        timeoutMs: 45000
        classifyContextChars: 6000
        maxArgsChars: 4000
        breakerConsecutive: 3
        breakerTotal: 20
        classifier:
          provider: ''
          model: ''
          maxTranscriptMessages: 40
          maxTokens: 2048
          temperature: 0
          # 2026-08-25：默认改为 off（显式关闭分类器 reasoning）。
          # 实测 opencode-go 路由不支持 low/medium/high（以 error-finish 拒绝）；
          # off 与不传 effort 均 ~1-1.7s 返回、无 reasoning 块、不超时。
          # 代码侧已加 error-finish 无 effort 回退，其他路由仍可用 low/high。
          # 2026-08-26：分类器两态化（allow/reject），askFallback 配置已移除。
          reasoningLevel: off
        rules:
          deny: ['$defaults']
          allow: ['$defaults']
          environment: ['$defaults']

# Permission row restatement: the built-in presets plus auto-mode.
- id: permission
  config:
    presets:
      read-only:
        sandbox: read-only
        approval: ask
        name: 只读
        description: 只能读，任何写入都需要审批。
      workspace-write:
        sandbox: workspace-write
        approval: ask
        name: 请求批准
        description: 工作区内可写；工作区外的操作请求人工审批。
      danger-full-access:
        sandbox: danger-full-access
        approval: never
        name: 完全放开
        description: 全放行，不弹审批。
      auto-mode:
        sandbox: workspace-write
        approval: ask
        name: Auto mode
        description: 确定性规则 + 两阶段分类器自动决定；危险或故障时 fail-closed。
        # Inner glyph path (drawn inside the shared shield outline by the DSH
        # permission picker); requires the dsh-permission-preset-icon patch.
        icon: 'M9.15 3.4L5.85 8.55H7.95L7.05 12.6L10.45 7.25H8.25L9.15 3.4Z'