@duke-dsh-plugins/dsh-agent-approval 1.4.2 → 1.6.0

package/README.md

@@ -26,7 +26,8 @@
 | ⛔ 风险即拒绝 | 破坏性 / 不可逆 / 越界（含修改操作系统或其他应用数据）/ 理由与实际命令不符 → 直接 `reject`；仅"安全、可逆、与任务相符、理由诚实"才 `approve`——项目自身的安装/部署脚本写其文档指定路径属任务所需 |
 | 🔒 Fail-closed | 审批 Agent 启动失败、超时（可配 30s–600s）、结果不合法 → 一律按拒绝处理，绝不静默放行 |
 | ⚙️ 审批模型可配置 | 设置页选择 Provider + Model，不选则固定用 **Harness 默认模型**（不跟随请求会话，口径稳定）；选择与超时**持久保存**，重启不丢 |
-| 📋 审计记录 | 设置页查看最近审批：结论 / 风险等级 / 模型 / 耗时 / 理由；悬停看完整理由与**精确工具参数**；审批 Agent 的会话 id 可回溯完整推理；记录**本地持久化**（重启保留最近 200 条） |
+| ⚡ TypeSafe Jev 决策模型后端 | 审批模型可选 **TypeSafe Jev**（System One 结构化决策模型）：审批时直连其 API，用类型化问题（Choice/Noul）毫秒级返回带校准概率的裁决；置信度低于阈值按 fail-closed 处理，审计理由由概率合成（需在设置页填 API Key，或设 `TYPESAFE_API_KEY`） |
+| 📋 审计记录（随会话） | 会话窗口顶部的**「审批」标签页**（轨迹旁）查看本会话全部审批：结论 / 风险等级 / 模型 / 耗时 / 理由；悬停看完整理由与**精确工具参数**；审批 Agent 的会话 id 可回溯完整推理；已批准行可一键**「加白」**存为放行规则。记录存在**会话存储目录内的独立文件**——随会话恢复，删除会话即随之删除 |
 | 🔁 可逆开关 | 权限菜单「Agent 审批」预设、`/agent-approval on\|off` 命令两条等价路径；关闭时**恢复开启前的权限旋钮** |
 
 ## 工作原理
@@ -38,11 +39,12 @@
 工具请求提权（sandbox_permissions / 人工 ask）
   └─ ctx.approval.request() → approval/request 瀑布
         └─ 本插件 prepend 抢占（先于人工弹窗 answerer）
-              └─ spawn 审批 Agent（独立会话 · 零工具 · 结构化裁决 · 不会递归审批）
+              ├─ （默认）spawn 审批 Agent（独立会话 · 零工具 · 结构化裁决 · 不会递归审批）
+              └─ （或）直连 TypeSafe Jev 决策模型（state + 类型化问题 → 概率化裁决 · 亚秒级）
                     ├─ approve → allowed-once（该次放行）
                     ├─ reject  → rejected（风险操作，最终拒绝）
-                    └─ 超时/故障/取消 → fail-closed（按拒绝处理）
-              └─ 记入审计（设置页可见）
+                    └─ 超时/故障/低置信/取消 → fail-closed（按拒绝处理）
+              └─ 记入审计（会话目录内的独立文件，「审批」标签页可见）
 ```
 
 - 审批 Agent 只能看到：workspace 路径、**最近的用户消息**（任务上下文）、工具名、提权理由、**精确的工具参数 JSON**（按 `callId` 从会话日志回查）。裁决看"操作 vs 用户任务"的客观对齐，不依赖理由措辞。
@@ -60,7 +62,7 @@
 dsh plugin --profile web add /path/to/dsh-agent-approval
 
 # 正式发布：从 GitHub Release tarball 安装
-dsh plugin --profile web add https://github.com/MoonlitDropOfBlood/dsh-agent-approval/releases/download/v1.2.0/dsh-agent-approval-1.2.0.tgz
+dsh plugin --profile web add https://github.com/MoonlitDropOfBlood/dsh-agent-approval/releases/download/v1.6.0/dsh-agent-approval-1.6.0.tgz
 ```
 
 重启 DSH 后：设置面板出现 **Agent 审批** 页；`/permission` 菜单出现第四项 **Agent 审批**。
@@ -76,8 +78,8 @@ dsh plugin --profile web add https://github.com/MoonlitDropOfBlood/dsh-agent-app
 
 1. **开启**：在 `/permission` 菜单选 **Agent 审批**，或输入 `/agent-approval on`。
 2. **自动裁决**：之后该会话里的提权请求（例如命令被沙箱拒绝后带 `sandbox_permissions` 的重试）不再弹窗，由审批 Agent 在后台裁决并放行/拒绝。
-3. **审计**：设置 → **Agent 审批** → 审批记录；悬停"审批理由"看完整理由与工具参数。
-4. **配置**：同页设置审批模型（不选则用 Harness 默认模型）与审批超时。
+3. **审计**：会话窗口顶部的**「审批」标签页**（轨迹旁）查看本会话的审批记录；悬停"审批理由"看完整理由与工具参数；已批准行可「加白」存为放行规则。记录存在会话存储目录内的独立文件，删除会话即随之删除；v1.4 的旧全局记录用 `node scripts/migrate-records.mjs` 一次性迁移（`--dry-run` 预览）。
+4. **配置**：设置 → **Agent 审批** 设置审批模型（Harness 默认模型、指定 Provider/Model，或 **TypeSafe Jev**——选 Jev 后在下方卡片填 API Key 并按需调整 Endpoint / 模型版本 / 置信度阈值）、审批超时与放行/拒绝规则。
 5. **关闭**：菜单切回其他预设，或 `/agent-approval off`，恢复开启前的沙箱模式与审批策略。
 
 ## 目录结构

package/client.js

@@ -3,13 +3,20 @@
  *
  * Rendered by the DSH web shell via `window.__ModuleLoader__.load`. Adds:
  *
- *   1. A "Agent 审批" page in the Settings panel (`settings.section`):
- *      - approval model picker (provider + model, or the harness default),
- *      - judge timeout setting (fail-closed),
- *      - the list of sessions with the mode enabled (session-list title +
- *        workspace, so each chip is recognizable),
- *      - the latest approval audit records (verdict, risk, model, duration,
- *        rationale; hover for the full rationale + tool arguments).
+ *   1. An「审批」tab in the conversation window's view ring
+ *      (`conversation.view`, right next to 轨迹): the per-session approval
+ *      audit trail. The Host folds the records out of a sidecar file inside
+ *      the session's OWN persistence directory
+ *      (`<sessionDir>/agent-approval.jsonl`), so the audit follows the
+ *      session — restored with it after a restart, gone when the session is
+ *      deleted. Rows offer the one-click「加白」rule shortcut.
+ *
+ *   2. A "Agent 审批" page in the Settings panel (`settings.section`):
+ *      approval model picker (provider + model, the harness default, or the
+ *      TypeSafe Jev direct HTTP backend with its API key / endpoint /
+ *      confidence-gate settings), judge timeout setting (fail-closed), the
+ *      list of sessions with the mode enabled (session-list title +
+ *      workspace), and the allow/deny rule table.
  *
  * Session-level on/off lives in the /permission menu (the "Agent 审批"
  * preset, registered by the package's cordis.patch.yml bundle patch) and the
@@ -57,6 +64,16 @@ window.__ModuleLoader__.load({
 .aapr-whitelist{color:var(--dsw-alias-label-secondary)}
 .aapr-whitelist:hover{color:var(--dsw-alias-label-primary)}
 
+/* Conversation-window「审批」tab: fills the view area below the tab strip
+   with the same token family as the Settings cards, so the audit ledger
+   reads native beside 轨迹. */
+.aapr-view{height:100%;overflow:auto;padding:12px 16px 16px;color:var(--dsw-alias-label-primary);font-size:13px}
+.aapr-view-inner{display:flex;flex-direction:column;gap:10px;max-width:980px;margin:0 auto}
+.aapr-view-head{display:flex;align-items:center;gap:10px;flex-wrap:wrap}
+.aapr-view-title{font-size:13px;font-weight:600;margin:0}
+.aapr-state-on{color:var(--dsw-alias-state-success-primary)}
+.aapr-state-off{color:var(--dsw-alias-label-secondary)}
+
 /* Settings nav icon: DSH 0.1.x settings.section only projects id/order/
    label, and the settings shell paints a generic gear for every external
    section (client-ui-settings-general's navIcon()). registerSettingsNavIcon
@@ -240,6 +257,15 @@ window.__ModuleLoader__.load({
           parameters: param("dsh-agent-approval#AgentApprovalSetModelRequest"),
           result: result("dsh-agent-approval#AgentApprovalSetModelResult"),
         },
+        {
+          id: "dsh-agent-approval#agentApproval/setJevConfig",
+          service: "agentApproval",
+          namespace: "agentApproval",
+          method: "setJevConfig",
+          invocation: { kind: "direct" },
+          parameters: param("dsh-agent-approval#AgentApprovalSetJevRequest"),
+          result: result("dsh-agent-approval#AgentApprovalSetJevResult"),
+        },
         {
           id: "dsh-agent-approval#agentApproval/setApprovalTimeout",
           service: "agentApproval",
@@ -277,13 +303,13 @@ window.__ModuleLoader__.load({
           result: result("dsh-agent-approval#AgentApprovalRulesResult"),
         },
         {
-          id: "dsh-agent-approval#agentApproval/clearRecords",
+          id: "dsh-agent-approval#agentApproval/sessionRecords",
           service: "agentApproval",
           namespace: "agentApproval",
-          method: "clearRecords",
+          method: "sessionRecords",
           invocation: { kind: "direct" },
-          parameters: [],
-          result: result("dsh-agent-approval#AgentApprovalClearRecordsResult"),
+          parameters: param("dsh-agent-approval#AgentApprovalSessionRecordsRequest"),
+          result: result("dsh-agent-approval#AgentApprovalSessionRecordsResult"),
         },
         {
           id: "dsh-agent-approval#agentApproval/directory",
@@ -397,6 +423,16 @@ window.__ModuleLoader__.load({
         const setModel = modelSlot[1];
         const timeoutSlot = React.useState("");
         const setTimeoutDraft = timeoutSlot[1];
+        // Jev backend drafts (edited in the Jev card shown when the judge
+        // provider is the synthetic "typesafe" entry).
+        const jevKeySlot = React.useState("");
+        const setJevKey = jevKeySlot[1];
+        const jevEndpointSlot = React.useState("");
+        const setJevEndpoint = jevEndpointSlot[1];
+        const jevModelSlot = React.useState("");
+        const setJevModel = jevModelSlot[1];
+        const jevConfSlot = React.useState("0.5");
+        const setJevConf = jevConfSlot[1];
         const noteSlot = React.useState("");
         const note = noteSlot[0];
         const setNote = noteSlot[1];
@@ -415,6 +451,11 @@ window.__ModuleLoader__.load({
               setProvider(s.model.provider);
               setModel(s.model.model);
               setTimeoutDraft(String(s.timeoutMs));
+              // A not-yet-restarted old host sends no `jev` field — keep drafts.
+              setJevKey(s.jev && typeof s.jev.apiKey === "string" ? s.jev.apiKey : "");
+              setJevEndpoint(s.jev && typeof s.jev.endpoint === "string" ? s.jev.endpoint : "");
+              setJevModel(s.jev && typeof s.jev.model === "string" ? s.jev.model : "");
+              setJevConf(s.jev && typeof s.jev.confidence === "number" ? String(s.jev.confidence) : "0.5");
             })
             .catch((e) => setNote("无法读取状态：" + (e && e.message ? e.message : String(e))));
         };
@@ -442,6 +483,28 @@ window.__ModuleLoader__.load({
             })
             .catch((e) => setNote("保存失败：" + (e && e.message ? e.message : String(e))));
         };
+        const jevKey = jevKeySlot[0];
+        const jevEndpoint = jevEndpointSlot[0];
+        const jevModel = jevModelSlot[0];
+        const jevConf = jevConfSlot[0];
+        const saveJev = () => {
+          if (typeof remote.setJevConfig !== "function") {
+            setNote("Host 半未更新（缺少 setJevConfig）：请重装本插件并重启 DSH。");
+            return;
+          }
+          const conf = Number(jevConf);
+          if (!Number.isFinite(conf) || conf <= 0 || conf >= 1) {
+            setNote("置信度阈值必须是 0–1 之间的小数（如 0.5）");
+            return;
+          }
+          remote
+            .setJevConfig({ apiKey: jevKey, endpoint: jevEndpoint, model: jevModel, confidence: conf })
+            .then(() => {
+              refresh();
+              setNote("Jev 配置已保存");
+            })
+            .catch((e) => setNote("保存失败：" + (e && e.message ? e.message : String(e))));
+        };
         const saveTimeout = () => {
           const parsed = Number(timeoutDraft);
           if (!Number.isFinite(parsed)) {
@@ -463,12 +526,6 @@ window.__ModuleLoader__.load({
             .then(refresh)
             .catch(() => {});
         };
-        const clearRecords = () => {
-          remote
-            .clearRecords()
-            .then(refresh)
-            .catch(() => {});
-        };
 
         const ruleEffect = ruleEffectSlot[0];
         const ruleTool = ruleToolSlot[0];
@@ -509,32 +566,31 @@ window.__ModuleLoader__.load({
             })
             .catch(() => {});
         };
-        // One-click whitelist from an audit row: the recorded args are a
-        // PREFIX of the real arguments JSON (the Host truncates at 2000
-        // chars), so stripping the truncation marker keeps a valid substring.
-        const whitelistRecord = (r) => {
-          const args = String(r.args || "").replace(/…\[truncated\]$/, "");
-          addRule({
-            effect: "allow",
-            tool: String(r.toolName),
-            match: args,
-            note: "来自审计 " + fmtTime(r.at),
-          });
-        };
 
+        // The synthetic "typesafe" provider routes judging through the
+        // TypeSafe Jev HTTP API — it is not part of the harness directory.
         const providerOptions = [{ id: "", name: "默认（Harness 默认模型）" }].concat(
+          [{ id: "typesafe", name: "TypeSafe Jev（决策模型·直连 API）" }],
           dir ? dir.providers : [],
         );
-        const modelOptions = [{ provider: "", id: "", name: "默认（Harness 默认模型）" }].concat(
-          dir && dir.models ? dir.models.filter((m) => m.provider === provider) : [],
-        );
+        const modelOptions =
+          provider === "typesafe"
+            ? [
+                { provider: "typesafe", id: "jev-latest", name: "jev-latest（跟随最新版本）" },
+                { provider: "typesafe", id: "jev-1.13.0", name: "jev-1.13.0（锁定版本）" },
+              ]
+            : [{ provider: "", id: "", name: "默认（Harness 默认模型）" }].concat(
+                dir && dir.models ? dir.models.filter((m) => m.provider === provider) : [],
+              );
         const defaultHint =
-          dir && dir.defaultSelection
-            ? "未配置时使用 Harness 默认模型；当前默认路由：" +
-              dir.defaultSelection.provider +
-              " / " +
-              dir.defaultSelection.model
-            : "未配置时使用 Harness 默认模型路由";
+          provider === "typesafe"
+            ? "当前审批判定直连 TypeSafe Jev API，不经过 Harness 模型路由；下方 Jev 配置在该模式下生效。"
+            : dir && dir.defaultSelection
+              ? "未配置时使用 Harness 默认模型；当前默认路由：" +
+                dir.defaultSelection.provider +
+                " / " +
+                dir.defaultSelection.model
+              : "未配置时使用 Harness 默认模型路由";
 
         return h(
           "div",
@@ -548,8 +604,9 @@ window.__ModuleLoader__.load({
               { className: "aapr-muted" },
               "一种新的权限模式：以 workspace-write 为基线沙箱；当工具请求提权（更宽的沙箱）时，由一个独立的审批 Agent 评估风险——安全、可逆、与任务相符的操作自动批准，破坏性、不可逆、越界或理由不符的操作直接拒绝。",
               h("br", null),
-              "在输入框 /permission 菜单选择「Agent 审批」预设，或执行命令 /agent-approval on|off 为会话开启；审批记录见下方审计。",
+              "在输入框 /permission 菜单选择「Agent 审批」预设，或执行命令 /agent-approval on|off 为会话开启；每个会话的审批审计记录在该会话窗口顶部的「审批」标签页（轨迹旁），随会话保存。",
             ),
+            note !== "" ? h("div", { className: "aapr-muted" }, note) : null,
           ),
           h(
             "div",
@@ -569,7 +626,7 @@ window.__ModuleLoader__.load({
                     value: provider,
                     onChange: (e) => {
                       setProvider(e.target.value);
-                      setModel("");
+                      setModel(e.target.value === "typesafe" ? "jev-latest" : "");
                     },
                   },
                   providerOptions.map((p) =>
@@ -587,7 +644,7 @@ window.__ModuleLoader__.load({
                     className: "aapr-select",
                     value: model,
                     onChange: (e) => setModel(e.target.value),
-                    disabled: dir === null,
+                    disabled: dir === null && provider !== "typesafe",
                   },
                   modelOptions.map((m) =>
                     h("option", { key: m.provider + "/" + m.id, value: m.id }, m.id === "" ? m.name : m.name + "（" + m.id + "）"),
@@ -598,6 +655,75 @@ window.__ModuleLoader__.load({
             ),
             h("div", { className: "aapr-muted" }, defaultHint),
           ),
+          provider === "typesafe"
+            ? h(
+                "div",
+                { className: "aapr-card" },
+                h("h3", null, "TypeSafe Jev 配置"),
+                h(
+                  "div",
+                  { className: "aapr-muted" },
+                  "Jev 是结构化决策模型（System One）：审批时直连 TypeSafe API，不创建审批子会话，毫秒级返回带校准概率的裁决。审计「理由」由概率分布合成（Jev 本身不生成文字）；置信度低于阈值时按 fail-closed 处理（记 unavailable，不批准也不记拒绝）。对中文任务上下文的准确率略低于英语。API Key 明文保存在本机 config.json；留空时使用环境变量 TYPESAFE_API_KEY。",
+                ),
+                h(
+                  "div",
+                  { className: "aapr-row" },
+                  h(
+                    "label",
+                    null,
+                    "API Key：",
+                    h("input", {
+                      className: "aapr-input",
+                      type: "password",
+                      placeholder: "TYPESAFE_API_KEY",
+                      value: jevKey,
+                      onChange: (e) => setJevKey(e.target.value),
+                    }),
+                  ),
+                  h(
+                    "label",
+                    null,
+                    "模型：",
+                    h("input", {
+                      className: "aapr-input",
+                      placeholder: "jev-latest",
+                      value: jevModel,
+                      onChange: (e) => setJevModel(e.target.value),
+                    }),
+                  ),
+                ),
+                h(
+                  "div",
+                  { className: "aapr-row" },
+                  h(
+                    "label",
+                    null,
+                    "Endpoint：",
+                    h("input", {
+                      className: "aapr-input aapr-input-wide",
+                      placeholder: "https://api.typesafe.ai/v1/systemone",
+                      value: jevEndpoint,
+                      onChange: (e) => setJevEndpoint(e.target.value),
+                    }),
+                  ),
+                  h(
+                    "label",
+                    null,
+                    "置信度阈值：",
+                    h("input", {
+                      className: "aapr-input",
+                      type: "number",
+                      step: "0.05",
+                      min: "0.01",
+                      max: "0.99",
+                      value: jevConf,
+                      onChange: (e) => setJevConf(e.target.value),
+                    }),
+                  ),
+                  h(ui.Button, { variant: "primary", size: "sm", onClick: saveJev }, "保存"),
+                ),
+              )
+            : null,
           h(
             "div",
             { className: "aapr-card" },
@@ -703,84 +829,164 @@ window.__ModuleLoader__.load({
               h(ui.Button, { variant: "primary", size: "sm", onClick: submitRule }, "添加"),
             ),
           ),
+        );
+      }
+
+      /**
+       * The conversation-window「审批」tab (`conversation.view`, next to
+       * 轨迹): this session's audit trail, folded by the Host out of the
+       * session's own sidecar storage. Rendered only while the tab is
+       * active, so the 10s poll costs nothing otherwise. Session-scoped
+       * slot: the runtime hands us the standard `useSession` hook; the
+       * snapshot's `sessionId` leaf is the only field we read.
+       */
+      function ApprovalAuditView(props) {
+        const useSession = props.useSession;
+        const session = useSession(function (s) { return s; });
+        const sessionId = session && session.sessionId ? String(session.sessionId) : "";
+
+        const stateSlot = React.useState(null); // { records, enabled } | null
+        const state = stateSlot[0];
+        const setState = stateSlot[1];
+        const noteSlot = React.useState("");
+        const note = noteSlot[0];
+        const setNote = noteSlot[1];
+        const tickSlot = React.useState(0); // manual-refresh counter
+        const tick = tickSlot[0];
+        const setTick = tickSlot[1];
+
+        React.useEffect(() => {
+          if (sessionId === "") return undefined;
+          let alive = true;
+          const load = () => {
+            if (typeof remote.sessionRecords !== "function") {
+              if (alive) setNote("Host 半未更新（缺少 sessionRecords）：请重装本插件并重启 DSH。");
+              return;
+            }
+            remote
+              .sessionRecords({ sessionId: sessionId })
+              .then((res) => {
+                if (alive) setState(pick(res));
+              })
+              .catch((e) => {
+                if (alive) setNote("无法读取审批记录：" + (e && e.message ? e.message : String(e)));
+              });
+          };
+          load();
+          const timer = setInterval(load, 10000);
+          return () => {
+            alive = false;
+            clearInterval(timer);
+          };
+        }, [sessionId, tick]);
+
+        // One-click whitelist from an audit row: the recorded args are a
+        // PREFIX of the real arguments JSON (the Host truncates at 2000
+        // chars), so stripping the truncation marker keeps a valid substring.
+        const whitelistRecord = (r) => {
+          const args = String(r.args || "").replace(/…\[truncated\]$/, "");
+          remote
+            .addRule({
+              effect: "allow",
+              tool: String(r.toolName),
+              match: args,
+              note: "来自审批审计 " + fmtTime(r.at),
+            })
+            .then(() => setNote("已加白：今后该操作直接放行，不再经过审批模型。"))
+            .catch((e) => setNote("加白失败：" + (e && e.message ? e.message : String(e))));
+        };
+
+        const records = state !== null && Array.isArray(state.records) ? state.records : [];
+        // 倒序展示（最新在最上）；Host 仍按时间正序返回，顺序属于视图层。
+        const ordered = records.slice().reverse();
+        const enabled = state !== null ? !!state.enabled : null;
+
+        return h(
+          "div",
+          { className: "aapr-view" },
           h(
             "div",
-            { className: "aapr-card" },
-            h("h3", null, "审批记录（最近 50 条，本地持久化保留 200 条，重启不丢）"),
+            { className: "aapr-view-inner" },
             h(
               "div",
-              { className: "aapr-row" },
-              h(ui.Button, { variant: "ghost", size: "sm", onClick: refresh }, "刷新"),
-              h(ui.Button, { variant: "ghost", size: "sm", onClick: clearRecords }, "清空记录"),
+              { className: "aapr-view-head" },
+              h("h3", { className: "aapr-view-title" }, "审批审计（本会话）"),
+              enabled === true
+                ? h("span", { className: "aapr-state-on" }, "● Agent 审批已开启")
+                : enabled === false
+                  ? h("span", { className: "aapr-state-off" }, "○ Agent 审批未开启")
+                  : null,
+              h(ui.Button, { variant: "ghost", size: "sm", onClick: () => setTick(tick + 1) }, "刷新"),
               note !== "" ? h("span", { className: "aapr-muted" }, note) : null,
             ),
             h(
               "div",
-              { className: "aapr-wrap" },
-              h(
-                "table",
-                { className: "aapr-table" },
-                h(
-                  "thead",
-                  null,
-                  h(
-                    "tr",
-                    null,
-                    ["时间", "会话", "工具", "结果", "风险", "模型", "耗时", "审批理由", "规则"].map((t) => h("th", { key: t }, t)),
-                  ),
-                ),
-                h(
-                  "tbody",
-                  null,
-                  state !== null && state.records
-                    ? state.records.map((r, i) =>
+              { className: "aapr-muted" },
+              "审批结论随会话保存（会话目录内的独立记录文件）：随会话恢复，删除会话即随之删除，最新记录在最上。悬停「审批理由」可查看完整理由与工具参数；「审批会话」前缀可在会话列表中找到审批 Agent 的完整会话记录。",
+            ),
+            sessionId === ""
+              ? h("div", { className: "aapr-muted" }, "当前没有活动会话。")
+              : records.length === 0
+                ? h("div", { className: "aapr-muted" }, "本会话暂无审批记录。")
+                : h(
+                    "div",
+                    { className: "aapr-wrap" },
+                    h(
+                      "table",
+                      { className: "aapr-table" },
+                      h(
+                        "thead",
+                        null,
                         h(
                           "tr",
-                          { key: String(i) + "-" + String(r.at) },
-                          h("td", null, fmtTime(r.at)),
-                          h("td", null, String(r.sessionId)),
-                          h("td", null, String(r.toolName)),
-                          h("td", { className: r.outcome === "allowed-once" ? "aapr-ok" : "aapr-no" }, OUTCOME_LABEL[r.outcome] || String(r.outcome)),
-                          h("td", null, RISK_LABEL[r.riskLevel] || String(r.riskLevel || "-")),
-                          h("td", null, String(r.model)),
-                          h("td", null, String(r.durationMs) + "ms"),
-                          h(
-                            "td",
-                            {
-                              className: "aapr-cell",
-                              title:
-                                (r.rationale || "") +
-                                (r.args ? "\n\n工具参数：" + r.args : "") +
-                                (r.childSessionId ? "\n\n审批会话：" + r.childSessionId : ""),
-                            },
-                            truncText(r.rationale, 110),
-                          ),
+                          null,
+                          ["时间", "工具", "结果", "风险", "模型", "耗时", "审批理由", "规则"].map((t) => h("th", { key: t }, t)),
+                        ),
+                      ),
+                      h(
+                        "tbody",
+                        null,
+                        ordered.map((r, i) =>
                           h(
-                            "td",
-                            null,
-                            r.outcome === "allowed-once" && r.args && r.model !== "rule"
-                              ? h(
-                                  "button",
-                                  {
-                                    className: "aapr-whitelist",
-                                    onClick: () => whitelistRecord(r),
-                                    title: "把该操作存为放行规则（工具 + 参数子串）：今后直接放行，不再经过审批模型",
-                                  },
-                                  "加白",
-                                )
-                              : null,
+                            "tr",
+                            { key: String(r.at) + "-" + String(i) },
+                            h("td", null, fmtTime(r.at)),
+                            h("td", null, String(r.toolName)),
+                            h("td", { className: r.outcome === "allowed-once" ? "aapr-ok" : "aapr-no" }, OUTCOME_LABEL[r.outcome] || String(r.outcome)),
+                            h("td", null, RISK_LABEL[r.riskLevel] || String(r.riskLevel || "-")),
+                            h("td", null, String(r.model)),
+                            h("td", null, String(r.durationMs) + "ms"),
+                            h(
+                              "td",
+                              {
+                                className: "aapr-cell",
+                                title:
+                                  (r.rationale || "") +
+                                  (r.args ? "\n\n工具参数：" + r.args : "") +
+                                  (r.childSessionId ? "\n\n审批会话：" + r.childSessionId : ""),
+                              },
+                              truncText(r.rationale, 110),
+                            ),
+                            h(
+                              "td",
+                              null,
+                              r.outcome === "allowed-once" && r.args && r.model !== "rule"
+                                ? h(
+                                    "button",
+                                    {
+                                      className: "aapr-whitelist",
+                                      onClick: () => whitelistRecord(r),
+                                      title: "把该操作存为放行规则（工具 + 参数子串）：今后直接放行，不再经过审批模型",
+                                    },
+                                    "加白",
+                                  )
+                                : null,
+                            ),
                           ),
                         ),
-                      )
-                    : h("tr", null, h("td", { colSpan: 9 }, h("span", { className: "aapr-muted" }, "暂无记录"))),
-                ),
-              ),
-            ),
-            h(
-              "div",
-              { className: "aapr-muted" },
-              "悬停“审批理由”可查看完整理由与工具参数；“审批会话”前缀可在会话列表中找到审批 Agent 的完整会话记录。「加白」把一条已批准的操作存为放行规则（模型列显示 rule/trust 的行分别来自规则命中与会话内信任缓存）。",
-            ),
+                      ),
+                    ),
+                  ),
           ),
         );
       }
@@ -792,6 +998,18 @@ window.__ModuleLoader__.load({
           AgentApprovalSection,
         ),
       );
+
+      // Conversation entry: the「审批」audit tab in the view ring, right
+      // beside 轨迹 (chat order 0, trajectory order 10, audit order 11).
+      // Session-scoped: renders per conversation with the session's own
+      // records; registration rides the slot ledger so plugin unload
+      // removes the tab.
+      ctx.slots.inject("conversation.view", () =>
+        ctx.slots.register(
+          { name: "conversation.view", id: "agent-approval-audit", order: 11, label: () => "审批" },
+          ApprovalAuditView,
+        ),
+      );
     }
 
     exports.apply = apply;