新增: 审批超时可配置 + ScriptNode 命令白/黑名单

- 审批超时: Settings 下拉选择(不限时/5/15/30/60min),默认 15min
- getApprovalTimeoutMs() 从 KV 读取,startApprovalTimer 动态取值
- ScriptNode: 黑名单 > 白名单策略,从环境变量读取
- Settings 加命令执行安全面板(白/黑名单文本框)
- i18n 中英文案 + 搜索索引补全

src/components/settings/AllowedDirsPanel.vue

@@ -41,6 +41,38 @@
       </div>
     </div>
   </section>
+
+  <!-- ═══ 命令执行安全:ScriptNode 白/黑名单(前端仅 UI + 持久化,后端当前从环境变量读) ═══ -->
+  <section class="panel">
+    <div class="panel-header">
+      <h2>{{ $t('settings.panelScriptSafety') }}</h2>
+    </div>
+    <div class="script-safety">
+      <p class="script-safety-desc">{{ $t('settings.descScriptSafety') }}</p>
+
+      <SettingRow :label="$t('settings.labelScriptWhitelist')" :desc="$t('settings.descScriptWhitelist')">
+        <input
+          v-model="scriptWhitelist"
+          class="setting-select script-safety-input"
+          :placeholder="$t('settings.placeholderScriptWhitelist')"
+          @blur="onScriptWhitelistCommit"
+          @keyup.enter="onScriptWhitelistCommit"
+        />
+      </SettingRow>
+
+      <SettingRow :label="$t('settings.labelScriptBlacklist')" :desc="$t('settings.descScriptBlacklist')">
+        <input
+          v-model="scriptBlacklist"
+          class="setting-select script-safety-input"
+          :placeholder="$t('settings.placeholderScriptBlacklist')"
+          @blur="onScriptBlacklistCommit"
+          @keyup.enter="onScriptBlacklistCommit"
+        />
+      </SettingRow>
+
+      <p class="script-safety-note">{{ $t('settings.noteScriptSafety') }}</p>
+    </div>
+  </section>
 </template>
 
 <script setup lang="ts">
@@ -48,8 +80,11 @@ import { ref, onMounted } from 'vue'
 import { open } from '@tauri-apps/plugin-dialog'
 import { useI18n } from 'vue-i18n'
 import { aiApi } from '@/api'
+import { useAppSettingsStore } from '@/stores/appSettings'
+import SettingRow from './SettingRow.vue'
 
 const { t } = useI18n()
+const appSettings = useAppSettingsStore()
 // F-260620: 接共享 toast 通道(Settings.vue showToast),替代 console.error/warn 用户零反馈
 const emit = defineEmits<{ (e: 'toast', msg: string, type: 'error' | 'warning' | 'info'): void }>()
 
@@ -138,6 +173,27 @@ async function reload() {
   await load()
 }
 
+// ============================================================
+// ScriptNode 命令执行安全 — 白/黑名单 UI
+// ------------------------------------------------------------
+// 前端仅做 UI + 持久化到 appSettings(df-script-whitelist / df-script-blacklist)。
+// 后端 ScriptNode 当前从环境变量 DF_SCRIPT_WHITELIST / DF_SCRIPT_BLACKLIST 读取
+// (同一逗号分隔语义),前后端打通留后续:前端写入需经 IPC/启动期注入环境变量。
+// 输入语义:逗号分隔命令名(如 `git,npm,cargo`),空串=该项不限制。
+// ============================================================
+const scriptWhitelist = ref(appSettings.get<string>('df-script-whitelist', ''))
+const scriptBlacklist = ref(appSettings.get<string>('df-script-blacklist', ''))
+
+function onScriptWhitelistCommit() {
+  appSettings.set('df-script-whitelist', scriptWhitelist.value.trim())
+  emit('toast', t('settings.savedHint'), 'info')
+}
+
+function onScriptBlacklistCommit() {
+  appSettings.set('df-script-blacklist', scriptBlacklist.value.trim())
+  emit('toast', t('settings.savedHint'), 'info')
+}
+
 onMounted(load)
 </script>
 
@@ -165,4 +221,17 @@ onMounted(load)
 .add-row { display: flex; gap: 8px; margin-top: 4px; }
 .dir-input { flex: 1; min-width: 0; }
 .actions { display: flex; gap: 8px; margin-top: 8px; }
+
+/* ===== ScriptNode 命令执行安全面板 ===== */
+.script-safety { display: flex; flex-direction: column; gap: 4px; }
+.script-safety-desc {
+  font-size: 12px; color: var(--df-text-dim); margin: 0 0 4px; line-height: 1.5;
+}
+.script-safety-input {
+  min-width: 280px;
+  font-family: var(--df-font-mono, monospace);
+}
+.script-safety-note {
+  font-size: 11px; color: var(--df-text-dim); margin: 4px 0 0; line-height: 1.5;
+}
 </style>