@duke-dsh-plugins/dsh-agent-approval 1.4.1 → 1.5.0

package/README.md

@@ -26,7 +26,7 @@
 | ⛔ 风险即拒绝 | 破坏性 / 不可逆 / 越界（含修改操作系统或其他应用数据）/ 理由与实际命令不符 → 直接 `reject`；仅"安全、可逆、与任务相符、理由诚实"才 `approve`——项目自身的安装/部署脚本写其文档指定路径属任务所需 |
 | 🔒 Fail-closed | 审批 Agent 启动失败、超时（可配 30s–600s）、结果不合法 → 一律按拒绝处理，绝不静默放行 |
 | ⚙️ 审批模型可配置 | 设置页选择 Provider + Model，不选则固定用 **Harness 默认模型**（不跟随请求会话，口径稳定）；选择与超时**持久保存**，重启不丢 |
-| 📋 审计记录 | 设置页查看最近审批：结论 / 风险等级 / 模型 / 耗时 / 理由；悬停看完整理由与**精确工具参数**；审批 Agent 的会话 id 可回溯完整推理；记录**本地持久化**（重启保留最近 200 条） |
+| 📋 审计记录（随会话） | 会话窗口顶部的**「审批」标签页**（轨迹旁）查看本会话全部审批：结论 / 风险等级 / 模型 / 耗时 / 理由；悬停看完整理由与**精确工具参数**；审批 Agent 的会话 id 可回溯完整推理；已批准行可一键**「加白」**存为放行规则。记录存在**会话存储目录内的独立文件**——随会话恢复，删除会话即随之删除 |
 | 🔁 可逆开关 | 权限菜单「Agent 审批」预设、`/agent-approval on\|off` 命令两条等价路径；关闭时**恢复开启前的权限旋钮** |
 
 ## 工作原理
@@ -42,7 +42,7 @@
                     ├─ approve → allowed-once（该次放行）
                     ├─ reject  → rejected（风险操作，最终拒绝）
                     └─ 超时/故障/取消 → fail-closed（按拒绝处理）
-              └─ 记入审计（设置页可见）
+              └─ 记入审计（写入会话日志，「审批」标签页可见）
 ```
 
 - 审批 Agent 只能看到：workspace 路径、**最近的用户消息**（任务上下文）、工具名、提权理由、**精确的工具参数 JSON**（按 `callId` 从会话日志回查）。裁决看"操作 vs 用户任务"的客观对齐，不依赖理由措辞。
@@ -60,7 +60,7 @@
 dsh plugin --profile web add /path/to/dsh-agent-approval
 
 # 正式发布：从 GitHub Release tarball 安装
-dsh plugin --profile web add https://github.com/MoonlitDropOfBlood/dsh-agent-approval/releases/download/v1.2.0/dsh-agent-approval-1.2.0.tgz
+dsh plugin --profile web add https://github.com/MoonlitDropOfBlood/dsh-agent-approval/releases/download/v1.5.0/dsh-agent-approval-1.5.0.tgz
 ```
 
 重启 DSH 后：设置面板出现 **Agent 审批** 页；`/permission` 菜单出现第四项 **Agent 审批**。
@@ -76,8 +76,8 @@ dsh plugin --profile web add https://github.com/MoonlitDropOfBlood/dsh-agent-app
 
 1. **开启**：在 `/permission` 菜单选 **Agent 审批**，或输入 `/agent-approval on`。
 2. **自动裁决**：之后该会话里的提权请求（例如命令被沙箱拒绝后带 `sandbox_permissions` 的重试）不再弹窗，由审批 Agent 在后台裁决并放行/拒绝。
-3. **审计**：设置 → **Agent 审批** → 审批记录；悬停"审批理由"看完整理由与工具参数。
-4. **配置**：同页设置审批模型（不选则用 Harness 默认模型）与审批超时。
+3. **审计**：会话窗口顶部的**「审批」标签页**（轨迹旁）查看本会话的审批记录；悬停"审批理由"看完整理由与工具参数；已批准行可「加白」存为放行规则。记录存在会话存储目录内的独立文件，删除会话即随之删除；v1.4 的旧全局记录用 `node scripts/migrate-records.mjs` 一次性迁移（`--dry-run` 预览）。
+4. **配置**：设置 → **Agent 审批** 设置审批模型（不选则用 Harness 默认模型）、审批超时与放行/拒绝规则。
 5. **关闭**：菜单切回其他预设，或 `/agent-approval off`，恢复开启前的沙箱模式与审批策略。
 
 ## 目录结构

package/client.js

@@ -3,13 +3,19 @@
  *
  * Rendered by the DSH web shell via `window.__ModuleLoader__.load`. Adds:
  *
- *   1. A "Agent 审批" page in the Settings panel (`settings.section`):
- *      - approval model picker (provider + model, or the harness default),
- *      - judge timeout setting (fail-closed),
- *      - the list of sessions with the mode enabled (session-list title +
- *        workspace, so each chip is recognizable),
- *      - the latest approval audit records (verdict, risk, model, duration,
- *        rationale; hover for the full rationale + tool arguments).
+ *   1. An「审批」tab in the conversation window's view ring
+ *      (`conversation.view`, right next to 轨迹): the per-session approval
+ *      audit trail. The Host folds the records out of a sidecar file inside
+ *      the session's OWN persistence directory
+ *      (`<sessionDir>/agent-approval.jsonl`), so the audit follows the
+ *      session — restored with it after a restart, gone when the session is
+ *      deleted. Rows offer the one-click「加白」rule shortcut.
+ *
+ *   2. A "Agent 审批" page in the Settings panel (`settings.section`):
+ *      approval model picker (provider + model, or the harness default),
+ *      judge timeout setting (fail-closed), the list of sessions with the
+ *      mode enabled (session-list title + workspace), and the allow/deny
+ *      rule table.
  *
  * Session-level on/off lives in the /permission menu (the "Agent 审批"
  * preset, registered by the package's cordis.patch.yml bundle patch) and the
@@ -57,6 +63,16 @@ window.__ModuleLoader__.load({
 .aapr-whitelist{color:var(--dsw-alias-label-secondary)}
 .aapr-whitelist:hover{color:var(--dsw-alias-label-primary)}
 
+/* Conversation-window「审批」tab: fills the view area below the tab strip
+   with the same token family as the Settings cards, so the audit ledger
+   reads native beside 轨迹. */
+.aapr-view{height:100%;overflow:auto;padding:12px 16px 16px;color:var(--dsw-alias-label-primary);font-size:13px}
+.aapr-view-inner{display:flex;flex-direction:column;gap:10px;max-width:980px;margin:0 auto}
+.aapr-view-head{display:flex;align-items:center;gap:10px;flex-wrap:wrap}
+.aapr-view-title{font-size:13px;font-weight:600;margin:0}
+.aapr-state-on{color:var(--dsw-alias-state-success-primary)}
+.aapr-state-off{color:var(--dsw-alias-label-secondary)}
+
 /* Settings nav icon: DSH 0.1.x settings.section only projects id/order/
    label, and the settings shell paints a generic gear for every external
    section (client-ui-settings-general's navIcon()). registerSettingsNavIcon
@@ -277,13 +293,13 @@ window.__ModuleLoader__.load({
           result: result("dsh-agent-approval#AgentApprovalRulesResult"),
         },
         {
-          id: "dsh-agent-approval#agentApproval/clearRecords",
+          id: "dsh-agent-approval#agentApproval/sessionRecords",
           service: "agentApproval",
           namespace: "agentApproval",
-          method: "clearRecords",
+          method: "sessionRecords",
           invocation: { kind: "direct" },
-          parameters: [],
-          result: result("dsh-agent-approval#AgentApprovalClearRecordsResult"),
+          parameters: param("dsh-agent-approval#AgentApprovalSessionRecordsRequest"),
+          result: result("dsh-agent-approval#AgentApprovalSessionRecordsResult"),
         },
         {
           id: "dsh-agent-approval#agentApproval/directory",
@@ -463,12 +479,6 @@ window.__ModuleLoader__.load({
             .then(refresh)
             .catch(() => {});
         };
-        const clearRecords = () => {
-          remote
-            .clearRecords()
-            .then(refresh)
-            .catch(() => {});
-        };
 
         const ruleEffect = ruleEffectSlot[0];
         const ruleTool = ruleToolSlot[0];
@@ -509,18 +519,6 @@ window.__ModuleLoader__.load({
             })
             .catch(() => {});
         };
-        // One-click whitelist from an audit row: the recorded args are a
-        // PREFIX of the real arguments JSON (the Host truncates at 2000
-        // chars), so stripping the truncation marker keeps a valid substring.
-        const whitelistRecord = (r) => {
-          const args = String(r.args || "").replace(/…\[truncated\]$/, "");
-          addRule({
-            effect: "allow",
-            tool: String(r.toolName),
-            match: args,
-            note: "来自审计 " + fmtTime(r.at),
-          });
-        };
 
         const providerOptions = [{ id: "", name: "默认（Harness 默认模型）" }].concat(
           dir ? dir.providers : [],
@@ -548,8 +546,9 @@ window.__ModuleLoader__.load({
               { className: "aapr-muted" },
               "一种新的权限模式：以 workspace-write 为基线沙箱；当工具请求提权（更宽的沙箱）时，由一个独立的审批 Agent 评估风险——安全、可逆、与任务相符的操作自动批准，破坏性、不可逆、越界或理由不符的操作直接拒绝。",
               h("br", null),
-              "在输入框 /permission 菜单选择「Agent 审批」预设，或执行命令 /agent-approval on|off 为会话开启；审批记录见下方审计。",
+              "在输入框 /permission 菜单选择「Agent 审批」预设，或执行命令 /agent-approval on|off 为会话开启；每个会话的审批审计记录在该会话窗口顶部的「审批」标签页（轨迹旁），随会话保存。",
             ),
+            note !== "" ? h("div", { className: "aapr-muted" }, note) : null,
           ),
           h(
             "div",
@@ -703,84 +702,164 @@ window.__ModuleLoader__.load({
               h(ui.Button, { variant: "primary", size: "sm", onClick: submitRule }, "添加"),
             ),
           ),
+        );
+      }
+
+      /**
+       * The conversation-window「审批」tab (`conversation.view`, next to
+       * 轨迹): this session's audit trail, folded by the Host out of the
+       * session's own sidecar storage. Rendered only while the tab is
+       * active, so the 10s poll costs nothing otherwise. Session-scoped
+       * slot: the runtime hands us the standard `useSession` hook; the
+       * snapshot's `sessionId` leaf is the only field we read.
+       */
+      function ApprovalAuditView(props) {
+        const useSession = props.useSession;
+        const session = useSession(function (s) { return s; });
+        const sessionId = session && session.sessionId ? String(session.sessionId) : "";
+
+        const stateSlot = React.useState(null); // { records, enabled } | null
+        const state = stateSlot[0];
+        const setState = stateSlot[1];
+        const noteSlot = React.useState("");
+        const note = noteSlot[0];
+        const setNote = noteSlot[1];
+        const tickSlot = React.useState(0); // manual-refresh counter
+        const tick = tickSlot[0];
+        const setTick = tickSlot[1];
+
+        React.useEffect(() => {
+          if (sessionId === "") return undefined;
+          let alive = true;
+          const load = () => {
+            if (typeof remote.sessionRecords !== "function") {
+              if (alive) setNote("Host 半未更新（缺少 sessionRecords）：请重装本插件并重启 DSH。");
+              return;
+            }
+            remote
+              .sessionRecords({ sessionId: sessionId })
+              .then((res) => {
+                if (alive) setState(pick(res));
+              })
+              .catch((e) => {
+                if (alive) setNote("无法读取审批记录：" + (e && e.message ? e.message : String(e)));
+              });
+          };
+          load();
+          const timer = setInterval(load, 10000);
+          return () => {
+            alive = false;
+            clearInterval(timer);
+          };
+        }, [sessionId, tick]);
+
+        // One-click whitelist from an audit row: the recorded args are a
+        // PREFIX of the real arguments JSON (the Host truncates at 2000
+        // chars), so stripping the truncation marker keeps a valid substring.
+        const whitelistRecord = (r) => {
+          const args = String(r.args || "").replace(/…\[truncated\]$/, "");
+          remote
+            .addRule({
+              effect: "allow",
+              tool: String(r.toolName),
+              match: args,
+              note: "来自审批审计 " + fmtTime(r.at),
+            })
+            .then(() => setNote("已加白：今后该操作直接放行，不再经过审批模型。"))
+            .catch((e) => setNote("加白失败：" + (e && e.message ? e.message : String(e))));
+        };
+
+        const records = state !== null && Array.isArray(state.records) ? state.records : [];
+        // 倒序展示（最新在最上）；Host 仍按时间正序返回，顺序属于视图层。
+        const ordered = records.slice().reverse();
+        const enabled = state !== null ? !!state.enabled : null;
+
+        return h(
+          "div",
+          { className: "aapr-view" },
           h(
             "div",
-            { className: "aapr-card" },
-            h("h3", null, "审批记录（最近 50 条，本地持久化保留 200 条，重启不丢）"),
+            { className: "aapr-view-inner" },
             h(
               "div",
-              { className: "aapr-row" },
-              h(ui.Button, { variant: "ghost", size: "sm", onClick: refresh }, "刷新"),
-              h(ui.Button, { variant: "ghost", size: "sm", onClick: clearRecords }, "清空记录"),
+              { className: "aapr-view-head" },
+              h("h3", { className: "aapr-view-title" }, "审批审计（本会话）"),
+              enabled === true
+                ? h("span", { className: "aapr-state-on" }, "● Agent 审批已开启")
+                : enabled === false
+                  ? h("span", { className: "aapr-state-off" }, "○ Agent 审批未开启")
+                  : null,
+              h(ui.Button, { variant: "ghost", size: "sm", onClick: () => setTick(tick + 1) }, "刷新"),
               note !== "" ? h("span", { className: "aapr-muted" }, note) : null,
             ),
             h(
               "div",
-              { className: "aapr-wrap" },
-              h(
-                "table",
-                { className: "aapr-table" },
-                h(
-                  "thead",
-                  null,
-                  h(
-                    "tr",
-                    null,
-                    ["时间", "会话", "工具", "结果", "风险", "模型", "耗时", "审批理由", "规则"].map((t) => h("th", { key: t }, t)),
-                  ),
-                ),
-                h(
-                  "tbody",
-                  null,
-                  state !== null && state.records
-                    ? state.records.map((r, i) =>
+              { className: "aapr-muted" },
+              "审批结论随会话保存（会话目录内的独立记录文件）：随会话恢复，删除会话即随之删除，最新记录在最上。悬停「审批理由」可查看完整理由与工具参数；「审批会话」前缀可在会话列表中找到审批 Agent 的完整会话记录。",
+            ),
+            sessionId === ""
+              ? h("div", { className: "aapr-muted" }, "当前没有活动会话。")
+              : records.length === 0
+                ? h("div", { className: "aapr-muted" }, "本会话暂无审批记录。")
+                : h(
+                    "div",
+                    { className: "aapr-wrap" },
+                    h(
+                      "table",
+                      { className: "aapr-table" },
+                      h(
+                        "thead",
+                        null,
                         h(
                           "tr",
-                          { key: String(i) + "-" + String(r.at) },
-                          h("td", null, fmtTime(r.at)),
-                          h("td", null, String(r.sessionId)),
-                          h("td", null, String(r.toolName)),
-                          h("td", { className: r.outcome === "allowed-once" ? "aapr-ok" : "aapr-no" }, OUTCOME_LABEL[r.outcome] || String(r.outcome)),
-                          h("td", null, RISK_LABEL[r.riskLevel] || String(r.riskLevel || "-")),
-                          h("td", null, String(r.model)),
-                          h("td", null, String(r.durationMs) + "ms"),
-                          h(
-                            "td",
-                            {
-                              className: "aapr-cell",
-                              title:
-                                (r.rationale || "") +
-                                (r.args ? "\n\n工具参数：" + r.args : "") +
-                                (r.childSessionId ? "\n\n审批会话：" + r.childSessionId : ""),
-                            },
-                            truncText(r.rationale, 110),
-                          ),
+                          null,
+                          ["时间", "工具", "结果", "风险", "模型", "耗时", "审批理由", "规则"].map((t) => h("th", { key: t }, t)),
+                        ),
+                      ),
+                      h(
+                        "tbody",
+                        null,
+                        ordered.map((r, i) =>
                           h(
-                            "td",
-                            null,
-                            r.outcome === "allowed-once" && r.args && r.model !== "rule"
-                              ? h(
-                                  "button",
-                                  {
-                                    className: "aapr-whitelist",
-                                    onClick: () => whitelistRecord(r),
-                                    title: "把该操作存为放行规则（工具 + 参数子串）：今后直接放行，不再经过审批模型",
-                                  },
-                                  "加白",
-                                )
-                              : null,
+                            "tr",
+                            { key: String(r.at) + "-" + String(i) },
+                            h("td", null, fmtTime(r.at)),
+                            h("td", null, String(r.toolName)),
+                            h("td", { className: r.outcome === "allowed-once" ? "aapr-ok" : "aapr-no" }, OUTCOME_LABEL[r.outcome] || String(r.outcome)),
+                            h("td", null, RISK_LABEL[r.riskLevel] || String(r.riskLevel || "-")),
+                            h("td", null, String(r.model)),
+                            h("td", null, String(r.durationMs) + "ms"),
+                            h(
+                              "td",
+                              {
+                                className: "aapr-cell",
+                                title:
+                                  (r.rationale || "") +
+                                  (r.args ? "\n\n工具参数：" + r.args : "") +
+                                  (r.childSessionId ? "\n\n审批会话：" + r.childSessionId : ""),
+                              },
+                              truncText(r.rationale, 110),
+                            ),
+                            h(
+                              "td",
+                              null,
+                              r.outcome === "allowed-once" && r.args && r.model !== "rule"
+                                ? h(
+                                    "button",
+                                    {
+                                      className: "aapr-whitelist",
+                                      onClick: () => whitelistRecord(r),
+                                      title: "把该操作存为放行规则（工具 + 参数子串）：今后直接放行，不再经过审批模型",
+                                    },
+                                    "加白",
+                                  )
+                                : null,
+                            ),
                           ),
                         ),
-                      )
-                    : h("tr", null, h("td", { colSpan: 9 }, h("span", { className: "aapr-muted" }, "暂无记录"))),
-                ),
-              ),
-            ),
-            h(
-              "div",
-              { className: "aapr-muted" },
-              "悬停“审批理由”可查看完整理由与工具参数；“审批会话”前缀可在会话列表中找到审批 Agent 的完整会话记录。「加白」把一条已批准的操作存为放行规则（模型列显示 rule/trust 的行分别来自规则命中与会话内信任缓存）。",
-            ),
+                      ),
+                    ),
+                  ),
           ),
         );
       }
@@ -792,6 +871,18 @@ window.__ModuleLoader__.load({
           AgentApprovalSection,
         ),
       );
+
+      // Conversation entry: the「审批」audit tab in the view ring, right
+      // beside 轨迹 (chat order 0, trajectory order 10, audit order 11).
+      // Session-scoped: renders per conversation with the session's own
+      // records; registration rides the slot ledger so plugin unload
+      // removes the tab.
+      ctx.slots.inject("conversation.view", () =>
+        ctx.slots.register(
+          { name: "conversation.view", id: "agent-approval-audit", order: 11, label: () => "审批" },
+          ApprovalAuditView,
+        ),
+      );
     }
 
     exports.apply = apply;

package/index.js

@@ -36,10 +36,18 @@
  *      cancellation maps to the fail-closed approval outcomes
  *      (`unavailable` / `cancelled`), never to a grant.
  *
- *   4. AUDIT      — every decision is recorded (memory ring + JSONL under
- *      DSH_HOME) and shown in the Settings page; the judge's own child
- *      session id is kept so the full reasoning trail can be inspected in
- *      the session list.
+ *   4. AUDIT      — every decision is appended to a SIDECAR file inside the
+ *      requesting session's OWN persistence directory
+ *      (`<sessionDir>/agent-approval.jsonl`, resolved via
+ *      `sessionPersistence.locate`), so the audit trail follows the session
+ *      exactly: it survives restarts with the session, disappears when the
+ *      session is deleted, and NEVER touches the durable event log — no
+ *      custom events written, none read (the log's strict event-type
+ *      vocabulary makes plugin-defined types unsafe, and per project ruling
+ *      session.jsonl.zstd carries zero plugin data). The conversation
+ *      window's「审批」tab (next to 轨迹) folds those records per session;
+ *      the judge's own child session id is kept so the full reasoning trail
+ *      can be inspected in the session list.
  *
  * Mount on the HOST plane (profile `cordis.patch.yml` insert row): the
  * approval waterfall listener must be unscoped to see every live agent, and
@@ -50,7 +58,7 @@ import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { Service } from "@deepseek-ai/cordis";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
 // ---- constants --------------------------------------------------------------
 
@@ -66,16 +74,34 @@ const PRESET_NAME = "agent-approval";
 const DEFAULT_TIMEOUT_MS = 120000;
 const MIN_TIMEOUT_MS = 30000;
 const MAX_TIMEOUT_MS = 600000;
-/** In-memory audit ring size (the Settings page shows the latest 50). */
-const MAX_RECORDS = 200;
 /**
- * On-disk persistence: one JSON object per line in records.jsonl plus the
- * judge settings in config.json. Lives under DSH_HOME (same resolution as
- * the plugin's own README documents), outside any profile's node_modules so
- * reinstalls and upgrades never touch it.
+ * v1.5.1, tightened in v1.5.2: audit records live in a SIDECAR FILE inside
+ * the session's OWN persistence directory (`<sessionDir>/agent-approval.jsonl`,
+ * resolved via `sessionPersistence.locate(header)`), so they still follow the
+ * session exactly — restored/kept with it, gone when the session directory is
+ * deleted. The durable event log (session.jsonl.zstd) is NEVER read for
+ * records and NEVER written by this plugin: writing custom event types into
+ * the log (v1.5.0's approach) is NOT viable — the persistence read path
+ * refuses a whole log containing an event type outside
+ * `KNOWN_SESSION_EVENT_TYPES` unless the envelope carries `ignorable: true`,
+ * and the live-session writer `session.append()` cannot set that marker —
+ * the first judged escalation made the session unresumable (2026-09-06, two
+ * poisoned log events repaired in place). Per the final ruling: the log
+ * carries ZERO plugin-defined data, and the audit tab reads the sidecar
+ * only. A handful of ignorable-marked v1.5.0-era record events remain in one
+ * historical log as inert, load-verified history; physically deleting them
+ * would require whole-log seq renumbering and is not worth the corruption
+ * risk.
+ */
+/** The sidecar file name inside a session's persistence directory. */
+const RECORDS_SIDECAR = "agent-approval.jsonl";
+/**
+ * On-disk persistence for the judge settings (model override + timeout +
+ * rules). Lives under DSH_HOME (same resolution as the plugin's own README
+ * documents), outside any profile's node_modules so reinstalls and upgrades
+ * never touch it.
  */
 const DATA_DIR = join(process.env.DSH_HOME || join(homedir(), ".dsh"), "agent-approval");
-const RECORDS_FILE = join(DATA_DIR, "records.jsonl");
 const CONFIG_FILE = join(DATA_DIR, "config.json");
 
 /**
@@ -203,7 +229,7 @@ export class AgentApprovalService extends TypertRemoteService {
     markRemoteMethod(this, "toggle", "toggle");
     markRemoteMethod(this, "addRule", "addRule");
     markRemoteMethod(this, "removeRule", "removeRule");
-    markRemoteMethod(this, "clearRecords", "clearRecords");
+    markRemoteMethod(this, "sessionRecords", "sessionRecords");
     markRemoteMethod(this, "directory", "directory");
 
     /** Judge model override; empty strings = use the harness default route. */
@@ -212,8 +238,6 @@ export class AgentApprovalService extends TypertRemoteService {
     this._timeoutMs = DEFAULT_TIMEOUT_MS;
     /** sessionId -> { prevSandbox?: string, prevApproval?: string } */
     this._enabled = new Map();
-    /** Audit records, oldest first, capped at MAX_RECORDS. */
-    this._records = [];
     /**
      * Deterministic rules judged BEFORE the model (persisted in config.json):
      * [{ id, effect: "allow"|"deny", tool, match, note, createdAt }]. A hit
@@ -338,9 +362,26 @@ export class AgentApprovalService extends TypertRemoteService {
 
   // ---- knob plumbing --------------------------------------------------------
 
+  /**
+   * The session's durable events as a plain readonly array. DSH 0.1.2-rc.1
+   * removed the public `session.events` snapshot array in favor of
+   * `snapshotEvents(from?, to?)` / `eventAt(seq)` / `seq` — reading the old
+   * field yields undefined and every fold below threw TypeError, which the
+   * listeners' try/catch swallowed, so no session could ever enter `_enabled`
+   * (every escalation fell through to the human answerer). Prefer the new
+   * accessor; fall back to the legacy array on 0.1.1.
+   */
+  _eventsOf(session) {
+    if (session && typeof session.snapshotEvents === "function") {
+      return session.snapshotEvents();
+    }
+    const legacy = session ? session.events : undefined;
+    return Array.isArray(legacy) ? legacy : [];
+  }
+
   /** Last `sandbox/mode` / `approval/policy` value in the session log fold. */
   _lastKnob(session, type, field) {
-    const events = session.events;
+    const events = this._eventsOf(session);
     for (let i = events.length - 1; i >= 0; i--) {
       const e = events[i];
       if (e.type === type) return e.data[field];
@@ -554,11 +595,16 @@ export class AgentApprovalService extends TypertRemoteService {
 
   // ---- audit ----------------------------------------------------------------
 
-  /** Coerce one entry to the strict wire shape (typert result schema). */
-  _recordShape(entry) {
+  /**
+   * Coerce one entry to the strict wire shape (typert result schema). The
+   * session column is filled by the reader — the sidecar lives inside the
+   * session's own directory, so the id is implied but still stamped into
+   * every line to keep the file self-describing.
+   */
+  _recordShape(sessionId, entry) {
     return {
       at: String(entry.at),
-      sessionId: String(entry.sessionId),
+      sessionId: String(sessionId),
       toolName: String(entry.toolName),
       reason: String(entry.reason),
       args: String(entry.args),
@@ -571,29 +617,76 @@ export class AgentApprovalService extends TypertRemoteService {
     };
   }
 
-  /** Append one audit record (coerced), cap the ring, persist as JSONL. */
-  _record(entry) {
-    const shape = this._recordShape(entry);
-    this._records.push(shape);
-    if (this._records.length > MAX_RECORDS) {
-      this._records.splice(0, this._records.length - MAX_RECORDS);
+  /**
+   * Resolve the audit sidecar for one session: `agent-approval.jsonl` inside
+   * the session's persistence directory (same directory as the session's own
+   * durable log, via `sessionPersistence.locate(header)` — a pure path
+   * resolution that also works for live sessions). Falls back to a
+   * plugin-owned per-session file under DSH_HOME when the seam or the
+   * location is unavailable; the fallback keeps restart-safety at the cost
+   * of not being cleaned up when the session is deleted.
+   */
+  async _recordsFileOf(session) {
+    const persistence = this.ctx.get("sessionPersistence");
+    if (persistence !== undefined && typeof persistence.locate === "function") {
+      try {
+        const loc = persistence.locate(session.header);
+        if (loc && typeof loc.path === "string" && loc.path !== "") {
+          return join(dirname(loc.path), RECORDS_SIDECAR);
+        }
+      } catch (e) {
+        /* fall through to the plugin-owned fallback */
+      }
     }
-    mkdir(DATA_DIR, { recursive: true })
-      .then(() => appendFile(RECORDS_FILE, JSON.stringify(shape) + "\n", "utf8"))
-      .catch(() => {
-        /* persistence is best-effort; the in-memory ring still works */
-      });
+    return join(DATA_DIR, "records", `${String(session.id)}.jsonl`);
   }
 
-  /** Rewrite the whole records file from the in-memory ring (clear/compact). */
-  async _rewriteRecordsFile() {
+  /**
+   * Append one audit record to the session's SIDECAR file (see
+   * `_recordsFileOf`). Appending must never break the approval flow it
+   * audits: fire-and-forget with every failure swallowed.
+   */
+  _record(session, entry) {
+    const shape = this._recordShape(session.id, entry);
+    void (async () => {
+      try {
+        const file = await this._recordsFileOf(session);
+        await mkdir(dirname(file), { recursive: true });
+        await appendFile(file, JSON.stringify(shape) + "\n", "utf8");
+      } catch (e) {
+        /* audit is best-effort; the approval outcome still stands */
+      }
+    })();
+  }
+
+  /**
+   * Fold one session's audit records (chronological by `at`). The sidecar
+   * file is the ONLY source — the durable event log is never consulted
+   * (v1.5.2: zero custom data read from or written to session.jsonl.zstd).
+   * Never throws.
+   */
+  async _recordsOf(session) {
+    const out = [];
     try {
-      await mkdir(DATA_DIR, { recursive: true });
-      const body = this._records.map((r) => JSON.stringify(r)).join("\n");
-      await writeFile(RECORDS_FILE, body === "" ? "" : body + "\n", "utf8");
+      const file = await this._recordsFileOf(session);
+      const text = await readFile(file, "utf8");
+      for (const raw of text.split("\n")) {
+        const line = raw.trim();
+        if (line === "") continue;
+        try {
+          const parsed = JSON.parse(line);
+          if (parsed && typeof parsed === "object" && typeof parsed.at === "string") {
+            out.push(this._recordShape(session.id, parsed));
+          }
+        } catch (e) {
+          /* skip the corrupt line */
+        }
+      }
     } catch (e) {
-      /* best-effort */
+      /* no sidecar yet */
     }
+    out.sort((a, b) => (a.at < b.at ? -1 : a.at > b.at ? 1 : 0));
+    return out;
   }
 
   /** Persist the judge settings (model override + timeout + rules) to config.json. */
@@ -611,9 +704,9 @@ export class AgentApprovalService extends TypertRemoteService {
   }
 
   /**
-   * Load persisted settings + records at startup. Corrupt files/lines are
-   * skipped individually; the records file is compacted back down to the ring
-   * size so it cannot grow without bound. Never throws.
+   * Load persisted judge settings at startup (audit records need no loading —
+   * they live in the session logs and are folded per session on demand).
+   * Corrupt config is skipped; never throws.
    */
   async _loadPersisted() {
     try {
@@ -654,28 +747,6 @@ export class AgentApprovalService extends TypertRemoteService {
     } catch (e) {
       /* first run or unreadable config — keep the defaults */
     }
-    try {
-      const text = await readFile(RECORDS_FILE, "utf8");
-      const lines = text.split("\n");
-      const kept = [];
-      for (let i = lines.length - 1; i >= 0 && kept.length < MAX_RECORDS; i--) {
-        const line = lines[i].trim();
-        if (line === "") continue;
-        try {
-          const parsed = JSON.parse(line);
-          if (parsed && typeof parsed === "object" && typeof parsed.at === "string") {
-            kept.push(this._recordShape(parsed));
-          }
-        } catch (e) {
-          /* skip the corrupt line */
-        }
-      }
-      kept.reverse();
-      this._records = kept;
-      if (lines.length > kept.length) await this._rewriteRecordsFile();
-    } catch (e) {
-      /* no records file yet */
-    }
   }
 
   // ---- the claimer ----------------------------------------------------------
@@ -683,7 +754,7 @@ export class AgentApprovalService extends TypertRemoteService {
   /** Read the exact tool-call arguments JSON from the session log by callId. */
   _callArgsOf(session, callId) {
     if (callId === undefined) return undefined;
-    const events = session.events;
+    const events = this._eventsOf(session);
     for (let i = events.length - 1; i >= 0; i--) {
       const e = events[i];
       if (e.type === "tool/call" && e.data.callId === callId) return e.data.arguments;
@@ -701,7 +772,7 @@ export class AgentApprovalService extends TypertRemoteService {
    * the requesting agent phrased its justification.
    */
   _recentUserContext(session) {
-    const events = session.events;
+    const events = this._eventsOf(session);
     let first = "";
     const last = []; // chronological, capped at 3
     for (let i = 0; i < events.length; i++) {
@@ -794,9 +865,8 @@ export class AgentApprovalService extends TypertRemoteService {
       // A listener throw would make the whole waterfall fail closed with
       // 'unavailable' anyway; record what we can and resolve the same way.
       try {
-        this._record({
+        this._record(session, {
           at: new Date().toISOString(),
-          sessionId: shortId(session.id),
           toolName: String(req.toolName),
           reason: trunc(req.reason, 300),
           args: "",
@@ -853,7 +923,6 @@ export class AgentApprovalService extends TypertRemoteService {
     const toolName = String(req.toolName);
     const base = {
       at: startedAt,
-      sessionId: shortId(session.id),
       toolName: toolName,
       reason: trunc(req.reason, 300),
       args: trunc(argsRaw, 2000),
@@ -871,10 +940,10 @@ export class AgentApprovalService extends TypertRemoteService {
         (rule.note !== "" ? " — " + rule.note : "");
       base.durationMs = Date.now() - t0;
       if (rule.effect === "deny") {
-        this._record({ ...base, outcome: "rejected", riskLevel: "-", model: "rule", rationale: trunc(text, 600) });
+        this._record(session, { ...base, outcome: "rejected", riskLevel: "-", model: "rule", rationale: trunc(text, 600) });
         return "rejected";
       }
-      this._record({ ...base, outcome: "allowed-once", riskLevel: "-", model: "rule", rationale: trunc(text, 600) });
+      this._record(session, { ...base, outcome: "allowed-once", riskLevel: "-", model: "rule", rationale: trunc(text, 600) });
       return "allowed-once";
     }
 
@@ -884,7 +953,7 @@ export class AgentApprovalService extends TypertRemoteService {
     const trusted = this._trusted.get(session.id);
     if (trustKey !== undefined && trusted !== undefined && trusted.has(trustKey)) {
       base.durationMs = Date.now() - t0;
-      this._record({ ...base, outcome: "allowed-once", riskLevel: "-", model: "trust", rationale: "trusted: an identical operation was already approved in this session" });
+      this._record(session, { ...base, outcome: "allowed-once", riskLevel: "-", model: "trust", rationale: "trusted: an identical operation was already approved in this session" });
       return "allowed-once";
     }
 
@@ -906,7 +975,7 @@ export class AgentApprovalService extends TypertRemoteService {
         persona: APPROVER_PERSONA,
       });
     } catch (error) {
-      this._record({ ...base, outcome: "unavailable", riskLevel: "-", model: route.label, rationale: "approval agent failed to start: " + errText(error) });
+      this._record(session, { ...base, outcome: "unavailable", riskLevel: "-", model: route.label, rationale: "approval agent failed to start: " + errText(error) });
       return "unavailable";
     }
     base.childSessionId = shortId(run.id);
@@ -943,7 +1012,7 @@ export class AgentApprovalService extends TypertRemoteService {
         (verdict.decision === "approve" || verdict.decision === "reject")
       ) {
         const approved = verdict.decision === "approve";
-        this._record({
+        this._record(session, {
           ...base,
           outcome: approved ? "allowed-once" : "rejected",
           riskLevel: String(verdict.riskLevel || "-"),
@@ -962,7 +1031,7 @@ export class AgentApprovalService extends TypertRemoteService {
         }
         return approved ? "allowed-once" : "rejected";
       }
-      this._record({
+      this._record(session, {
         ...base,
         outcome: "unavailable",
         riskLevel: "-",
@@ -973,11 +1042,11 @@ export class AgentApprovalService extends TypertRemoteService {
       return "unavailable";
     }
     if (winner.kind === "aborted") {
-      this._record({ ...base, outcome: "cancelled", riskLevel: "-", model: route.label, rationale: "request cancelled while the approval agent was judging" });
+      this._record(session, { ...base, outcome: "cancelled", riskLevel: "-", model: route.label, rationale: "request cancelled while the approval agent was judging" });
       return "cancelled";
     }
     if (winner.kind === "timeout") {
-      this._record({
+      this._record(session, {
         ...base,
         outcome: "unavailable",
         riskLevel: "-",
@@ -986,7 +1055,7 @@ export class AgentApprovalService extends TypertRemoteService {
       });
       return "unavailable";
     }
-    this._record({ ...base, outcome: "unavailable", riskLevel: "-", model: route.label, rationale: "approval agent infrastructure fault: " + errText(winner.error) });
+    this._record(session, { ...base, outcome: "unavailable", riskLevel: "-", model: route.label, rationale: "approval agent infrastructure fault: " + errText(winner.error) });
     return "unavailable";
   }
 
@@ -1034,7 +1103,6 @@ export class AgentApprovalService extends TypertRemoteService {
         timeoutMs: this._timeoutMs,
         enabledSessions: this._sessionInfos(),
         rules: this._rulesSnapshot(),
-        records: this._records.slice(-50).reverse(),
       },
     };
   }
@@ -1119,11 +1187,34 @@ export class AgentApprovalService extends TypertRemoteService {
     return { ok: true, value: { rules: this._rulesSnapshot() } };
   }
 
-  /** Clear the audit records (memory + persisted file). */
-  async clearRecords() {
-    this._records = [];
-    await this._rewriteRecordsFile();
-    return { ok: true, value: { cleared: true } };
+  /**
+   * Fold ONE session's audit records out of its sidecar storage (see
+   * `_recordsFileOf` / `_recordsOf`). Powers the conversation window's「审批」
+   * tab — the records are requested per session and rendered next to the
+   * 轨迹 tab, exactly where they were produced. The session must be live (it
+   * always is when its conversation window is open). Also reports whether
+   * the mode is currently enabled for the session so the tab can show the
+   * state.
+   */
+  async sessionRecords(request) {
+    const sessionId = request && typeof request.sessionId === "string" ? request.sessionId : "";
+    if (sessionId === "") {
+      return { ok: false, error: { code: "invalid-session", message: "sessionId is required" } };
+    }
+    const agent = this.ctx.agents.get(sessionId);
+    if (agent === undefined) {
+      return {
+        ok: false,
+        error: { code: "session-not-live", message: "that session is not live right now" },
+      };
+    }
+    return {
+      ok: true,
+      value: {
+        records: await this._recordsOf(agent.session),
+        enabled: this._enabled.has(sessionId),
+      },
+    };
   }
 
   /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@duke-dsh-plugins/dsh-agent-approval",
-  "version": "1.4.1",
-  "description": "Agent-decided approvals for DeepSeek Harness: a workspace-write base permission mode where an independent approval subagent judges every sandbox escalation (risky operations are rejected), with a configurable approval model and an audit log in Settings.",
+  "version": "1.5.0",
+  "description": "Agent-decided approvals for DeepSeek Harness: a workspace-write base permission mode where an independent approval subagent judges every sandbox escalation (risky operations are rejected), with a configurable approval model and a per-session audit trail in the conversation window's 审批 tab.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/MoonlitDropOfBlood/dsh-agent-approval.git"

package/typert.host.js

@@ -66,7 +66,6 @@ const stateValueSchema = z
     timeoutMs: z.number(),
     enabledSessions: z.array(enabledSessionSchema).readonly(),
     rules: z.array(ruleSchema).readonly(),
-    records: z.array(recordSchema).readonly(),
   })
   .readonly();
 
@@ -94,9 +93,10 @@ const rulesValueSchema = z
   })
   .readonly();
 
-const clearRecordsValueSchema = z
+const sessionRecordsValueSchema = z
   .object({
-    cleared: z.boolean(),
+    records: z.array(recordSchema).readonly(),
+    enabled: z.boolean(),
   })
   .readonly();
 
@@ -156,7 +156,7 @@ const setTimeoutResultSchema = okResult(setTimeoutValueSchema);
 const toggleResultSchema = okResult(toggleValueSchema);
 const addRuleResultSchema = okResult(rulesValueSchema);
 const removeRuleResultSchema = okResult(rulesValueSchema);
-const clearRecordsResultSchema = okResult(clearRecordsValueSchema);
+const sessionRecordsResultSchema = okResult(sessionRecordsValueSchema);
 const directoryResultSchema = okResult(directoryValueSchema);
 
 // ---- per-invocation parameter schemas ----------------------------------------
@@ -186,6 +186,10 @@ const _agentApproval_removeRule_parameter_0$schema = z.object({
   id: z.string(),
 });
 
+const _agentApproval_sessionRecords_parameter_0$schema = z.object({
+  sessionId: z.string(),
+});
+
 export const TYPERT = {
   package: "@duke-dsh-plugins/dsh-agent-approval",
   face: "host",
@@ -331,16 +335,27 @@ export const TYPERT = {
       sourceLocation: { file: "index.js", line: 1, column: 1 },
     },
     {
-      id: "dsh-agent-approval#agentApproval/clearRecords",
+      id: "dsh-agent-approval#agentApproval/sessionRecords",
       service: "agentApproval",
       namespace: "agentApproval",
-      method: "clearRecords",
+      method: "sessionRecords",
       invocation: { kind: "direct" },
-      parameters: [],
+      parameters: [
+        {
+          name: "request",
+          wire: "request",
+          source: "json",
+          codec: {
+            mode: "strict",
+            typeSymbol: "dsh-agent-approval#AgentApprovalSessionRecordsRequest",
+            schema: _agentApproval_sessionRecords_parameter_0$schema,
+          },
+        },
+      ],
       result: {
         mode: "strict",
-        typeSymbol: "dsh-agent-approval#AgentApprovalClearRecordsResult",
-        schema: clearRecordsResultSchema,
+        typeSymbol: "dsh-agent-approval#AgentApprovalSessionRecordsResult",
+        schema: sessionRecordsResultSchema,
       },
       sourceLocation: { file: "index.js", line: 1, column: 1 },
     },
@@ -363,7 +378,7 @@ export const TYPERT = {
     services: [
       {
         description:
-          "Agent-approval permission mode service: pins enabled sessions to a workspace-write base, judges every sandbox escalation with an independent approval subagent (fail closed), and exposes model config plus an audit log to the DeepSeek Harness web UI.",
+          "Agent-approval permission mode service: pins enabled sessions to a workspace-write base, judges every sandbox escalation with an independent approval subagent (fail closed), appends the audit trail to each session's own log, and exposes model config to the DeepSeek Harness web UI.",
         summary: "Agent-approval permission mode service.",
         tags: [],
         jsDoc:
@@ -375,9 +390,9 @@ export const TYPERT = {
             kind: "method",
             name: "getState",
             signature: "@Remote('getState') async getState(): Promise<AgentApprovalStateResult>",
-            summary: "Snapshot for the Settings page and the composer toggle.",
+            summary: "Snapshot for the Settings page (model route, timeout, enabled sessions, rules).",
             jsDoc:
-              "/**\n * Return the judge model route, timeout, enabled sessions (id + session-list title + workspace cwd), and the latest audit records.\n * @returns success or a business failure.\n */",
+              "/**\n * Return the judge model route, timeout, enabled sessions (id + session-list title + workspace cwd), and the rule table.\n * @returns success or a business failure.\n */",
           },
           {
             kind: "method",
@@ -421,11 +436,11 @@ export const TYPERT = {
           },
           {
             kind: "method",
-            name: "clearRecords",
-            signature: "@Remote('clearRecords') async clearRecords(): Promise<AgentApprovalClearRecordsResult>",
-            summary: "Clear the in-memory audit records.",
+            name: "sessionRecords",
+            signature: "@Remote('sessionRecords') async sessionRecords(request: AgentApprovalSessionRecordsRequest): Promise<AgentApprovalSessionRecordsResult>",
+            summary: "Fold one live session's audit records out of its own durable log.",
             jsDoc:
-              "/**\n * Clear the in-memory audit records.\n * @returns { cleared: true }.\n */",
+              "/**\n * Fold the agent-approval/record events of one live session (chronological) plus the current enabled state. Records follow the session: persisted in its log, restored with it, gone when it is deleted.\n * @param request - { sessionId }.\n * @returns the session's records, or session-not-live.\n */",
           },
           {
             kind: "method",
@@ -465,7 +480,22 @@ export const TYPERT = {
           {
             name: "AgentApprovalStateValue",
             declaration:
-              "export interface AgentApprovalStateValue {\n    readonly model: AgentApprovalModelRoute;\n    readonly timeoutMs: number;\n    readonly enabledSessions: readonly AgentApprovalEnabledSession[];\n    readonly rules: readonly AgentApprovalRule[];\n    readonly records: readonly AgentApprovalRecord[];\n}",
+              "export interface AgentApprovalStateValue {\n    readonly model: AgentApprovalModelRoute;\n    readonly timeoutMs: number;\n    readonly enabledSessions: readonly AgentApprovalEnabledSession[];\n    readonly rules: readonly AgentApprovalRule[];\n}",
+          },
+          {
+            name: "AgentApprovalSessionRecordsRequest",
+            declaration:
+              "export interface AgentApprovalSessionRecordsRequest {\n    readonly sessionId: string;\n}",
+          },
+          {
+            name: "AgentApprovalSessionRecordsValue",
+            declaration:
+              "export interface AgentApprovalSessionRecordsValue {\n    readonly records: readonly AgentApprovalRecord[];\n    readonly enabled: boolean;\n}",
+          },
+          {
+            name: "AgentApprovalSessionRecordsResult",
+            declaration:
+              "export type AgentApprovalSessionRecordsResult = { ok: true; value: AgentApprovalSessionRecordsValue } | { ok: false; error: { code: string; message?: string } };",
           },
           {
             name: "AgentApprovalStateResult",