feat(hermes): add unauthorized dm policy form

tests/hermes-config-page-ui.test.js

@@ -58,6 +58,15 @@ test('Hermes 配置页会暴露快捷命令结构化配置字段', () => {
   }
 })
 
+test('Hermes 配置页会暴露未授权 DM 全局策略字段', () => {
+  for (const id of [
+    'hm-unauthorized-dm-save',
+    'hm-unauthorized-dm-behavior',
+  ]) {
+    assert.match(source, new RegExp(`id="${id}"`), `缺少 ${id}`)
+  }
+})
+
 test('Hermes 配置页会暴露网关流式结构化配置字段', () => {
   for (const id of [
     'hm-streaming-save',
@@ -118,6 +127,7 @@ test('Hermes 配置页新增结构化配置不会暴露翻译 key', () => {
     key.includes('MemoryConfig') ||
     key.includes('SkillsConfig') ||
     key.includes('QuickCommandsConfig') ||
+    key.includes('UnauthorizedDmConfig') ||
     key.includes('StreamingConfig') ||
     key.includes('ExecutionLimits') ||
     key.includes('TerminalConfig')

tests/hermes-unauthorized-dm-config.test.js

@@ -0,0 +1,45 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+
+import {
+  buildHermesUnauthorizedDmConfigValues,
+  mergeHermesUnauthorizedDmConfig,
+} from '../scripts/dev-api.js'
+
+test('Hermes 未授权 DM 配置读取会提供默认配对策略', () => {
+  const values = buildHermesUnauthorizedDmConfigValues({})
+
+  assert.deepEqual(values, {
+    unauthorizedDmBehavior: 'pair',
+  })
+})
+
+test('Hermes 未授权 DM 配置读取会规范化已有策略', () => {
+  assert.equal(buildHermesUnauthorizedDmConfigValues({ unauthorized_dm_behavior: 'IGNORE' }).unauthorizedDmBehavior, 'ignore')
+  assert.equal(buildHermesUnauthorizedDmConfigValues({ unauthorized_dm_behavior: 'bad' }).unauthorizedDmBehavior, 'pair')
+})
+
+test('Hermes 未授权 DM 配置保存会保留无关 YAML 并写入顶层策略', () => {
+  const next = mergeHermesUnauthorizedDmConfig({
+    model: { provider: 'anthropic' },
+    unauthorized_dm_behavior: 'pair',
+    platforms: {
+      telegram: { enabled: true, custom_flag: 'keep-platform' },
+    },
+    memory: { memory_enabled: true },
+  }, {
+    unauthorizedDmBehavior: 'ignore',
+  })
+
+  assert.deepEqual(next.model, { provider: 'anthropic' })
+  assert.deepEqual(next.memory, { memory_enabled: true })
+  assert.deepEqual(next.platforms.telegram, { enabled: true, custom_flag: 'keep-platform' })
+  assert.equal(next.unauthorized_dm_behavior, 'ignore')
+})
+
+test('Hermes 未授权 DM 配置保存会拒绝非法策略', () => {
+  assert.throws(
+    () => mergeHermesUnauthorizedDmConfig({}, { unauthorizedDmBehavior: 'silent' }),
+    /unauthorized_dm_behavior/,
+  )
+})