npm - @dnalec/dsh-auto-approve - Versions diffs - 0.1.2 → 0.2.0 - Mend

@dnalec/dsh-auto-approve 0.1.2 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/CHANGELOG.md ADDED Viewed

@@ -0,0 +1,21 @@
+# Changelog
+## 0.2.0
+### Breaking
+- Human review is **Web-only**. QQ / WeChat / Feishu / Telegram channels are removed.
+- Plugin config lives in `~/.dsh/auto-approve/config.json`. A readable 0.1.x `~/.dsh/approval-bridge/config.json` is migrated once (judge / preset / language only). QQ credentials are unused.
+### Pipeline
+- Keyword reject/human hay includes `session.header.cwd` (not `session.cwd`) and joins relative `file_path`/`path` onto cwd/workdir. Allow keywords still do not match the tool name or the session directory.
+- Empty write/edit bodies are kept and shown on the judge card as `(empty)` / `(空)`. Missing payload still goes to a human.
+- Connection RPC failures always include `{ code, message, details }` (`rpcFail`), matching the host `ConnectionRpcFailure` contract.
+- Settings criteria label/description remount when the snapshot changes, so restore-defaults is not undone on blur.
+### 中文
+- **破坏性**：人工只走网页；去掉 QQ / 微信 / 飞书 / Telegram。插件配置改到 `~/.dsh/auto-approve/config.json`（可读的 0.1.x `approval-bridge/config.json` 会迁一次判定字段）。
+- 关键词拒绝/人工干草含 `session.header.cwd`，相对路径会拼到 cwd/workdir；允许桶不含工具名和会话目录名。
+- 空写入/替换仍进审核卡片（`(空)` / `(empty)`）。RPC 失败带 `message`。审核表恢复默认后输入框会随 snapshot 重挂。

package/README.md CHANGED Viewed

@@ -2,130 +2,84 @@
 English | [中文](README.zh.md)
-A [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) Cordis plugin: judge-model auto-approval, QQ official Bot human approval, and a settings page — on one `approval/request` waterfall. The settings UI calls the model the **judge model** (审核模型).
-What needs approval is decided by the Auto-approve preset sandbox (in-workspace writes skip approval, or they also enter the judge pipeline). Keyword and criteria-table actions are configurable; out-of-workspace `danger-full-access` **does not short-circuit on the mode name**. Requests that need a human appear on both the Web UI and a configured QQ chat; **the first answer wins**.
-Scope is approval only. The QQ bot is a notify-and-reply channel, not an agent chat.
+A [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) plugin that auto-approves or rejects tool calls with **keywords** and a **judge-model criteria table**. Uncertainty goes to the original Web approval dialog.
 ## Install
-Pin a release tag (recommended). `main` is for published commits; in-progress work lives on other branches.
 ```sh
-dsh plugin --profile web add github:DNAlec/dsh-auto-approve#v0.1.2
+dsh plugin --profile web add github:DNAlec/dsh-auto-approve#v0.2.0
 ```
-From npm, after a tagged release:
+Or from npm, after a tagged release:
 ```sh
 dsh plugin --profile web add @dnalec/dsh-auto-approve
 ```
-A local checkout is fine while developing:
-```sh
-dsh plugin --profile web add /path/to/this-repo
-```
-Restart `dsh web`. The first start writes the `auto-approve` permission preset into the profile patch (the preset table cannot be extended at runtime).
+Restart `dsh web`. The first start adds the **Auto-approve** permission preset.
 ## Setup
-In Settings → **Auto-approve**:
-1. Click **Scan to create bot**, then scan with mobile QQ (official Open Platform flow). Or paste AppID / AppSecret and save.
-2. Friend the bot and send it any message. Pick the chat under **Recent incoming** (private chat recommended). Group chats must @ the bot and set `userId`. Scanning may prefill the scanner’s openid as `chatId` if none is set. This plugin is for a **private bot**: if no `chatId` is bound yet, any C2C reply of `是` / `确认` / `用作审批` / `yes` / `ok` binds that chat as the approval target. Do not add the bot where strangers can DM it.
-3. Under **Auto-approve mode**, choose in-workspace writes without approval (preset sandbox `workspace-write`, recommended) or send them through the judge (`read-only`). After saving, restart `dsh web` and re-select **Auto-approve** or start a new session.
-4. Set the session permission preset to **Auto-approve**. If it is missing after the first start, restart once more so the live patch reload can pick it up.
-Credentials are stored only in `~/.dsh/approval-bridge/qqbot.json` (`0600`). Do not commit them.
+Settings → **Auto-approve**:
-Uninstall (`dsh plugin --profile web remove @dnalec/dsh-auto-approve`) drops this plugin from the bundle stack after a restart. The `auto-approve` preset may remain in the profile patch: without the plugin it is ordinary `workspace-write` or `read-only` + `ask`. Rules, audit logs, and QQ credentials under `~/.dsh/auto-approve/` and `~/.dsh/approval-bridge/` are not deleted.
+1. **Mode** — in-workspace writes skip approval (`workspace-write`, recommended), or send them through the judge (`read-only`). Save, restart `dsh web`, then re-select **Auto-approve** or start a new session.
+2. **Keywords** and **criteria table** as needed. Restore default criteria loads the shipped pack for the selected judge-prompt language.
+3. **Judge model** — empty follows the deployment default.
+4. Set the session permission to **Auto-approve**.
-## Behavior
-| Situation | Result |
-|---|---|
-| Preset sandbox `workspace-write`, in-workspace write | No approval (sandbox already allows it) |
-| Keyword or criteria action is reject | Immediate `rejected`; no dialog, no QQ |
-| Keyword or criteria action is allow | No dialog, no QQ; green strip + `ALLOW` audit |
-| Keyword/criteria human, or judge failure | QQ gets `#N`; reply `批准 N` to continue |
-| `danger-full-access` (outside workspace) | Same judge pipeline; does not short-circuit on the mode name |
-| Web UI and QQ both prompt | First outcome wins; QQ answering first dismisses the Web dialog (forked signal, not `req.signal`) |
-| QQ wait timeout (default 120s) | Web dialog stays open; QQ says continue in the browser |
-| No credentials / not connected | Auto-approval still runs; humans only on the Web UI (`PUSH_SKIP`) |
-| Judge model misconfigured / judge fails | Escalate to human (`FAILED`); do not fall back to the session model |
-| Tool args missing (no command/path/content/code, …) | Human (`missing-payload`); never auto-allow |
-| Captured field truncated | Keyword reject still applies; never auto-allow (`truncated-payload`) |
-| Preset is not `auto-approve` | Do not answer, do not push (unless `onlyAutoApprovePreset` is off) |
-QQ approval pushes include Allow / Reject buttons (custom keyboard in C2C and group chats). Text still works: `批准 17` / `#17 批准` / `yes 17` allow; `拒绝 17` rejects once. A bare `批准` / `拒绝` is allowed only when exactly one ticket is pending.
+## How it works
-Do not abort `req.signal` to dismiss the Web dialog: that cancels the whole request.
+Runs only when the session preset is Auto-approve. With `workspace-write`, in-workspace writes never reach approval. `danger-full-access` uses the same pipeline. Missing or truncated tool args go to a human and are never auto-allowed.
-## Pipeline
+1. **Keywords** (reject > human > allow). Match tool name, command, path, and working directory. Allow words do not match the tool name or the session directory. Shipped reject words cover disaster commands (`rm -rf`, `git push -f`, `drop table`, `dd of=`), approval-config paths, and credential paths such as `.env` / `id_rsa`.
+2. **Criteria table**. The judge model sees the same fields as the Web tool card and outputs a category; the plugin runs that row’s action. Parse failure or timeout goes to a human.
-Only when `permissionPresets.current(session) === 'auto-approve'` (unless that restriction is disabled). The preset sandbox is a gate, not a pipeline step: with `workspace-write`, in-workspace writes never reach approval.
-1. Keywords (reject > human > allow). Reject/human match **tool name + command + path + workdir**; allow keywords do not match the tool name. They do not match the model justification, `description`, or file bodies. Shipped phrases default to reject: catastrophic command shapes, auto-approve config paths, and credential paths (`.env`, `id_rsa`, …). Anything missed goes to the next step. If a captured field is truncated, keyword reject still applies; keyword allow and judge-safe do not — that request goes to a human.
-2. Criteria table: the judge model sees the same fields as the Web tool card (command, path, old/new text, write content, code/url/sql, …) and emits only a category id + reason; the program applies allow / reject / human. Parse failure or timeout → human and does **not** run `other.action`. Risk rows default to reject; `safe` defaults to allow; `other` defaults to human.
-Default criteria (actions are editable; `other` cannot be deleted):
+Default criteria (actions are editable; **Other** cannot be deleted):
 | id | Label | Default |
 |---|---|---|
-| deletion | Destructive delete/overwrite | reject |
-| credential | Credentials / secrets / auth | reject |
-| remote | Remote / production / database | reject |
-| system | System paths / config | reject |
-| bulk | Bulk irreversible ops | reject |
-| approval-config | Auto-approve config | reject |
-| safe | Safe / routine reversible | allow |
-| other | Uncertain / none of the above | human |
-Risk rows default to reject. Auto-allow only when the model can confirm `safe`. Uncertainty goes to `other` (human). Mis-filing a dangerous op as `safe` is still auto-allowed.
+| deletion | Delete/overwrite irreplaceable data | reject |
+| credential | Credentials/keys/auth changes | reject |
+| remote | Remote/production/database | reject |
+| system | System paths/config | reject |
+| bulk | Bulk irreversible operations | reject |
+| approval-config | Auto-approve configuration | reject |
+| safe | Safe/routine reversible | allow |
+| other | Other (unsure) | human |
-Settings can set **judge prompt language** to Chinese or English (default Chinese). That switches only the prompt framework and card labels; it does **not** rewrite the current criteria table. Restore default criteria loads the shipped pack for the selected language. The reason line uses the same language as the framework.
+Judge prompt language (Chinese or English) only changes the framework sent to the model, not the current table.
-Host APIs use authenticated `connection.rpc` (`/api/dsh-auto-approve`), not unauthenticated HTTP.
+## Data
 ## Data
-Under `$DSH_HOME` (default `~/.dsh/`). None of this belongs in git.
+Under `$DSH_HOME` (default `~/.dsh/`), never committed:
 | Path | Purpose |
 |---|---|
-| `auto-approve/allowlist.json` | Keyword buckets / criteria / judge timeout (`0600`) |
-| `auto-approve/audit.log` | `ALLOW` / `REJECT` / `HUMAN` / `FAILED` / `PUSH` / `PUSH_SKIP` / `PUSH_FAIL` / `OUTCOME` (`0600`) |
-| `auto-approve/events.jsonl` | UI events (`ticket`, `sessionId`; trimmed to last 2000 lines after ~2MB, `0600`) |
-| `approval-bridge/qqbot.json` | AppID / AppSecret, `0600` |
-| `approval-bridge/config.json` | Judge model, notify target, and other plugin config (`0600`) |
+| `auto-approve/allowlist.json` | Keywords, criteria, judge timeout |
+| `auto-approve/config.json` | Judge model and plugin settings |
+| `auto-approve/audit.log` | `ALLOW` / `REJECT` / `HUMAN` / `FAILED` / `OUTCOME` |
+| `auto-approve/events.jsonl` | Approval tab events |
-No audit line means this plugin did not handle that request.
+Corrupt files are not overwritten. Uninstalling the plugin does not delete this directory.
-## Configuration
+## Config
 ```yaml
 - id: dsh-auto-approve
   config:
     onlyAutoApprovePreset: true
-    presetSandbox: workspace-write   # or read-only: workspace writes also go through the judge
+    presetSandbox: workspace-write   # or read-only
     judge:
       provider: ''
       model: ''
       reasoningEffort: ''
       timeoutMs: 20000
-    notify:
-      enabled: true
-      chatId: ''
-      userId: ''
-      timeoutSecs: 120
 ```
-Empty judge fields follow the deployment default model. If there is no default and nothing is configured, or the route is invalid, that request goes to a human. There is no hardcoded fallback model. The settings **Judge timeout** writes `judgeTimeoutMs` in `allowlist.json` (that is what runtime uses); yaml `judge.timeoutMs` is only a default when allowlist does not exist yet.
-If a JSON file cannot be parsed, this process uses in-memory defaults and **does not overwrite the file**. Settings will not write a corrupt allowlist except Restore defaults; a corrupt plugin config needs an explicit overwrite; corrupt QQ credentials need a re-save or QR scan.
+Empty judge fields follow the deployment default. With no usable route, that request goes to a human. Settings “judge timeout” writes `allowlist.json` and wins at runtime.
 ## Development
@@ -134,19 +88,8 @@ node --test tests/*.test.mjs
 npm run check
 ```
-Layout: `src/index.mjs` (host), `src/rules.mjs`, `src/tickets.mjs`, `src/qqbot.mjs`, `src/provisioning.mjs` (official QR), `src/preset-patch.mjs`, `src/util.mjs`, `client.js` (Web UI; React via `createElement`, no JSX), `locales.mjs` (zh/en Client copy). The Web UI follows the DSH language setting; QQ push text and audit logs stay Chinese. QR login uses `@tencent-connect/qqbot-connector` (optional) and generates the image locally with `qrcode`.
-For agents working in this repository, follow [AGENTS.md](AGENTS.md).
-## Releasing
-1. Set `package.json` `version` (for example `0.1.2`) and merge to `main`.
-2. On npmjs.com, add a Trusted Publisher for this GitHub repo, workflow file `publish.yml` (once).
-3. Tag and push: `git tag v0.1.2 && git push origin v0.1.2`.
-The tag must match `package.json` version. The workflow runs tests, then `npm publish`. The first publish of the package name may need a local `npm login` and `npm publish --access public` once; later tags are enough.
+See [AGENTS.md](AGENTS.md) and [CHANGELOG.md](CHANGELOG.md).
 ## License
 [MIT](LICENSE)

package/README.zh.md CHANGED Viewed

@@ -2,18 +2,12 @@
 [English](README.md) | 中文
-[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 的 Cordis 插件：把审核模型自动审批、QQ 官方 Bot 人工审批和设置页做在同一条 `approval/request` 瀑布上。
-需要审批的行为（由「自动审批」预设沙箱决定：工作区内不审批，或工作区也走判定）进入同一条判定管道。关键词和审核表的动作都可配置；越出工作区的 `danger-full-access` **不因模式名短路**。必须人工的请求同时出现在网页和配置的 QQ 聊天，**谁先答谁赢**。
-范围仅限审批。QQ 机器人是通知和批复通道，不是 agent 聊天。
+[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 插件：用**关键词**和**审核模型审核表**自动允许或拒绝工具调用。拿不准就交给原来的网页审批框。
 ## 安装
-请钉死发行 tag（推荐）。`main` 只放已发布的提交，开发走其他分支。
 ```sh
-dsh plugin --profile web add github:DNAlec/dsh-auto-approve#v0.1.2
+dsh plugin --profile web add github:DNAlec/dsh-auto-approve#v0.2.0
 ```
 打 tag 发布后也可从 npm 安装：
@@ -22,58 +16,27 @@ dsh plugin --profile web add github:DNAlec/dsh-auto-approve#v0.1.2
 dsh plugin --profile web add @dnalec/dsh-auto-approve
 ```
-自己开发可以用本地路径：
-```sh
-dsh plugin --profile web add /path/to/this-repo
-```
-重启 `dsh web`。首次启动会把 `auto-approve` 权限预设写入 profile patch（预设表冻结，不能运行时扩展）。
+重启 `dsh web`。首次启动会写入「自动审批」权限预设。
 ## 设置
 设置页 → **自动审批**：
-1. 点「扫码接入机器人」，用手机 QQ 扫码（腾讯官方开放平台流程）；也可以手动填 AppID / AppSecret 后保存连接。
-2. 加好友后给机器人发任意一句，在「最近来信」点选审批聊天（推荐私聊）。群必须 @机器人，并另配 `userId`。若尚未选定聊天，扫码者的 openid 会预填为 `chatId`。本插件按**私人 bot** 设计：未绑定 `chatId` 时，任意私聊回复「是」「确认」「用作审批」「yes」「ok」会把该聊天设为审批目标。不要把 bot 加到别人也能私聊的环境。
-3. 在「自动审批模式」里选择：工作区内不审批（预设沙箱 `workspace-write`，推荐），或工作区也走判定（`read-only`）。保存后重启 `dsh web`，并重新选择「自动审批」或开新会话。
-4. 会话权限选「自动审批」。若首次启动后下拉里还没有，再重启一次让 live patch 生效。
-凭据只存在 `~/.dsh/approval-bridge/qqbot.json`（`0600`），不要提交。
-卸载（`dsh plugin --profile web remove @dnalec/dsh-auto-approve`）后重启，插件随 bundle 层消失。`auto-approve` 预设可能仍留在 profile patch 里：没有本插件时它只是普通的 `workspace-write` 或 `read-only` + `ask`。`~/.dsh/auto-approve/` 与 `~/.dsh/approval-bridge/` 里的规则、审计和 QQ 凭据不会删除。
-## 行为
-| 情况 | 结果 |
-|---|---|
-| 预设沙箱 `workspace-write`，工作区内写入 | 不进审批（沙箱已允许） |
-| 关键词命中拒绝 / 审核表动作为拒绝 | 直接 `rejected`，无框、无 QQ |
-| 关键词命中允许 / 审核表动作为允许 | 无框、无 QQ；绿条 + `ALLOW` 审计 |
-| 关键词命中人工、审核表人工、判定失败 | QQ 收到 `#N`；回复 `批准 N` 后工具继续 |
-| `danger-full-access`（越出工作区） | 进入同一条判定管道，不因模式名短路 |
-| 网页与 QQ 同时亮 | 先到的 outcome 生效；QQ 先答会关掉网页框（只 abort 网页用的 fork signal，不碰 `req.signal`） |
-| QQ 等待超时（默认 120s） | 网页框仍在；QQ 提示到网页继续 |
-| 未配凭据 / 未连接 | 自动审批照常；人工只走网页（`PUSH_SKIP`） |
-| 审核模型配错 / 判定失败 | 当次转人工（`FAILED`）；不改用会话模型 |
-| 未捕获工具参数（无命令/路径/内容/code 等） | 转人工（`missing-payload`），禁止自动放行 |
-| 捕获字段被截断 | 仍可关键词拒绝；禁止自动放行（`truncated-payload`） |
-| 预设不是 `auto-approve` | 不抢答、不推送（除非关闭 `onlyAutoApprovePreset`） |
-QQ 审批推送带「批准 / 拒绝」按钮（单聊、群聊自定义按钮）。也可回复：`批准 17` / `#17 批准` / `yes 17` 放行；`拒绝 17` 只拒这一次。仅 1 条 pending 时允许裸 `批准` / `拒绝`。
-不要 abort `req.signal` 来关网页框：那会把整单变成 `cancelled`。
+1. **模式** — 工作区内不审批（`workspace-write`，推荐），或工作区也走判定（`read-only`）。保存后重启 `dsh web`，再重新选择「自动审批」或开新会话。
+2. 按需改**关键词**和**审核表**。恢复默认会按所选审核提示词语言加载出厂包。
+3. **审核模型** — 空则跟随部署默认。
+4. 会话权限选 **自动审批**。
-## 判定管道
+## 怎么判定
-仅当 `permissionPresets.current(session) === 'auto-approve'` 时介入（除非关闭「仅该预设」）。预设沙箱是底线、不是管道步骤：`workspace-write` 时工作区内写入根本进不了审批。
+仅当会话预设是「自动审批」时介入。`workspace-write` 下，工作区内写入不会进审批。`danger-full-access` 走同一条管道。缺参或字段被截断会转人工，禁止自动放行。
-1. 关键词（拒绝 > 人工 > 允许）。拒绝/人工匹配 **工具名 + command + 路径 + workdir**；允许词不匹配工具名。不匹配模型理由、`description`、文件正文。预置词默认拒绝，含灾难命令形态（`rm -rf`、`git push -f`、`drop table`、`dd of=` 等）、审批配置路径，以及 `.env` / `id_rsa` 等凭据路径。漏掉的交给下一步。捕获字段被截断时仍可关键词拒绝，禁止关键词允许或模型标 safe，转人工。
-2. 审核表：审核模型看到与网页工具卡片相同的字段（含命令、路径、原文/改成、写入内容、code/url/sql 等），只输出类别 id + 理由；程序按表执行允许 / 拒绝 / 人工。解析失败或超时转人工，**不**执行「其他」的动作。风险类默认拒绝；「安全」默认允许；「其他」默认人工。
+1. **关键词**（拒绝 > 人工 > 允许）。匹配工具名、命令、路径和工作目录。允许词不匹配工具名，也不匹配会话目录名。预置拒绝词覆盖灾难命令（`rm -rf`、`git push -f`、`drop table`、`dd of=`）、审批配置路径，以及 `.env` / `id_rsa` 等凭据路径。
+2. **审核表**。审核模型看到与网页工具卡片相同的字段，只输出类别；程序按该行动作执行。解析失败或超时转人工。
-默认审核表（动作均可改；「其他」不能删除）：
+默认审核表（动作可改；**其他**不能删除）：
-| id | 标签 | 默认动作 |
+| id | 标签 | 默认 |
 |---|---|---|
 | deletion | 删除/覆盖不可再生数据 | 拒绝 |
 | credential | 凭据/密钥/授权修改 | 拒绝 |
@@ -84,25 +47,20 @@ QQ 审批推送带「批准 / 拒绝」按钮（单聊、群聊自定义按钮
 | safe | 安全/常规可回补 | 允许 |
 | other | 其他（拿不准） | 人工 |
-风险类默认拒绝。只有模型能确认安全才走 `safe` 自动放行；拿不准走「其他」转人。模型若把危险操作归进 `safe`，会被自动放行。
-设置里可把**审核提示词语言**设为中文或 English（默认中文）。这只换发给模型的框架和卡片标签，**不会**改当前审核表。点「恢复默认审核表」才按所选语言加载出厂包。理由与框架同语言。
-Host API 走已鉴权的 `connection.rpc`（`/api/dsh-auto-approve`），不上无鉴权 HTTP。
+审核提示词语言（中文 / English）只换发给模型的框架，不改当前审核表。
 ## 数据
-位于 `$DSH_HOME`（默认 `~/.dsh/`），均不进 git。
+位于 `$DSH_HOME`（默认 `~/.dsh/`），不进 git：
 | 路径 | 用途 |
 |---|---|
-| `auto-approve/allowlist.json` | 关键词三桶 / 审核表 / 审核超时（`0600`） |
-| `auto-approve/audit.log` | `ALLOW` / `REJECT` / `HUMAN` / `FAILED` / `PUSH` / `PUSH_SKIP` / `PUSH_FAIL` / `OUTCOME`（`0600`） |
-| `auto-approve/events.jsonl` | UI 事件（含 `ticket`、`sessionId`；超约 2MB 只留最后 2000 条，`0600`） |
-| `approval-bridge/qqbot.json` | AppID / AppSecret，`0600` |
-| `approval-bridge/config.json` | 审核模型、推送目标等插件配置（`0600`） |
+| `auto-approve/allowlist.json` | 关键词、审核表、审核超时 |
+| `auto-approve/config.json` | 审核模型与插件配置 |
+| `auto-approve/audit.log` | `ALLOW` / `REJECT` / `HUMAN` / `FAILED` / `OUTCOME` |
+| `auto-approve/events.jsonl` | 审批 tab 事件 |
-没有 audit 行 = 本插件没有处理该请求。
+损坏文件不会被覆盖。卸载插件不会删除这个目录。
 ## 配置
@@ -110,22 +68,15 @@ Host API 走已鉴权的 `connection.rpc`（`/api/dsh-auto-approve`），不上
 - id: dsh-auto-approve
   config:
     onlyAutoApprovePreset: true
-    presetSandbox: workspace-write   # 或 read-only：工作区写入也走判定
+    presetSandbox: workspace-write   # 或 read-only
     judge:
       provider: ''
       model: ''
       reasoningEffort: ''
       timeoutMs: 20000
-    notify:
-      enabled: true
-      chatId: ''
-      userId: ''
-      timeoutSecs: 120
 ```
-审核模型字段为空则跟随部署默认模型。没有默认可跟随、也没手动配置，或路由配错，则当次转人工。不会再猜一个模型。设置页「审核超时」写入 `allowlist.json` 的 `judgeTimeoutMs`（运行时以此为准）；yaml 里的 `judge.timeoutMs` 只在尚未生成 allowlist 时作缺省。
-JSON 读失败（损坏）时本进程用内存默认，**不覆盖磁盘**。设置页除「恢复默认 / 覆盖损坏配置」外不会写坏 allowlist；插件配置损坏需明确覆盖；QQ 凭据损坏需重新保存或扫码。
+审核模型字段为空则跟随部署默认。没有可用路由时当次转人工。设置页「审核超时」写入 `allowlist.json`，运行时以此为准。
 ## 开发
@@ -134,19 +85,8 @@ node --test tests/*.test.mjs
 npm run check
 ```
-结构：`src/index.mjs`（宿主）、`src/rules.mjs`、`src/tickets.mjs`、`src/qqbot.mjs`、`src/provisioning.mjs`（官方扫码）、`src/preset-patch.mjs`、`src/util.mjs`、`client.js`（网页半；React 用 `createElement`，无 JSX）、`locales.mjs`（网页 zh/en 字典）。网页文案跟随 DSH 语言设置；QQ 推送和审计日志仍为中文。扫码依赖可选包 `@tencent-connect/qqbot-connector`，二维码由本机 `qrcode` 生成。
-在本仓库改代码的 agent 请遵循 [AGENTS.md](AGENTS.md)。
-## 发布
-1. 把 `package.json` 的 `version` 改成目标版本（例如 `0.1.2`），合进 `main`。
-2. 在 npmjs.com 给本仓库配置 Trusted Publisher，工作流文件填 `publish.yml`（只需一次）。
-3. 打 tag 并推送：`git tag v0.1.2 && git push origin v0.1.2`。
-tag 必须与 `package.json` 版本一致。工作流会先跑测试再 `npm publish`。这个包名第一次上架可能需要本机 `npm login` 后执行一次 `npm publish --access public`；之后推 tag 即可。
+见 [AGENTS.md](AGENTS.md) 与 [CHANGELOG.md](CHANGELOG.md)。
 ## 许可证
 [MIT](LICENSE)