@duke-dsh-plugins/dsh-agent-approval 1.4.2 → 1.6.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@duke-dsh-plugins/dsh-agent-approval",
-  "version": "1.4.2",
-  "description": "Agent-decided approvals for DeepSeek Harness: a workspace-write base permission mode where an independent approval subagent judges every sandbox escalation (risky operations are rejected), with a configurable approval model and an audit log in Settings.",
+  "version": "1.6.0",
+  "description": "Agent-decided approvals for DeepSeek Harness: a workspace-write base permission mode where an independent approval judge (an isolated subagent, or the TypeSafe Jev decision model via direct API) evaluates every sandbox escalation (risky operations are rejected), with a configurable approval model and a per-session audit trail in the conversation window's 审批 tab.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/MoonlitDropOfBlood/dsh-agent-approval.git"

package/typert.host.js

@@ -41,6 +41,15 @@ const modelRouteSchema = z
   })
   .readonly();
 
+const jevConfigSchema = z
+  .object({
+    apiKey: z.string(),
+    endpoint: z.string(),
+    model: z.string(),
+    confidence: z.number(),
+  })
+  .readonly();
+
 const enabledSessionSchema = z
   .object({
     id: z.string(),
@@ -63,10 +72,10 @@ const ruleSchema = z
 const stateValueSchema = z
   .object({
     model: modelRouteSchema,
+    jev: jevConfigSchema,
     timeoutMs: z.number(),
     enabledSessions: z.array(enabledSessionSchema).readonly(),
     rules: z.array(ruleSchema).readonly(),
-    records: z.array(recordSchema).readonly(),
   })
   .readonly();
 
@@ -76,6 +85,12 @@ const setModelValueSchema = z
   })
   .readonly();
 
+const setJevValueSchema = z
+  .object({
+    jev: jevConfigSchema,
+  })
+  .readonly();
+
 const setTimeoutValueSchema = z
   .object({
     timeoutMs: z.number(),
@@ -94,9 +109,10 @@ const rulesValueSchema = z
   })
   .readonly();
 
-const clearRecordsValueSchema = z
+const sessionRecordsValueSchema = z
   .object({
-    cleared: z.boolean(),
+    records: z.array(recordSchema).readonly(),
+    enabled: z.boolean(),
   })
   .readonly();
 
@@ -152,11 +168,12 @@ function okResult(valueSchema) {
 
 const stateResultSchema = okResult(stateValueSchema);
 const setModelResultSchema = okResult(setModelValueSchema);
+const setJevResultSchema = okResult(setJevValueSchema);
 const setTimeoutResultSchema = okResult(setTimeoutValueSchema);
 const toggleResultSchema = okResult(toggleValueSchema);
 const addRuleResultSchema = okResult(rulesValueSchema);
 const removeRuleResultSchema = okResult(rulesValueSchema);
-const clearRecordsResultSchema = okResult(clearRecordsValueSchema);
+const sessionRecordsResultSchema = okResult(sessionRecordsValueSchema);
 const directoryResultSchema = okResult(directoryValueSchema);
 
 // ---- per-invocation parameter schemas ----------------------------------------
@@ -166,6 +183,13 @@ const _agentApproval_setModel_parameter_0$schema = z.object({
   model: z.string(),
 });
 
+const _agentApproval_setJevConfig_parameter_0$schema = z.object({
+  apiKey: z.string(),
+  endpoint: z.string(),
+  model: z.string(),
+  confidence: z.number(),
+});
+
 const _agentApproval_setApprovalTimeout_parameter_0$schema = z.object({
   timeoutMs: z.number(),
 });
@@ -186,6 +210,10 @@ const _agentApproval_removeRule_parameter_0$schema = z.object({
   id: z.string(),
 });
 
+const _agentApproval_sessionRecords_parameter_0$schema = z.object({
+  sessionId: z.string(),
+});
+
 export const TYPERT = {
   package: "@duke-dsh-plugins/dsh-agent-approval",
   face: "host",
@@ -230,6 +258,31 @@ export const TYPERT = {
       },
       sourceLocation: { file: "index.js", line: 1, column: 1 },
     },
+    {
+      id: "dsh-agent-approval#agentApproval/setJevConfig",
+      service: "agentApproval",
+      namespace: "agentApproval",
+      method: "setJevConfig",
+      invocation: { kind: "direct" },
+      parameters: [
+        {
+          name: "request",
+          wire: "request",
+          source: "json",
+          codec: {
+            mode: "strict",
+            typeSymbol: "dsh-agent-approval#AgentApprovalSetJevRequest",
+            schema: _agentApproval_setJevConfig_parameter_0$schema,
+          },
+        },
+      ],
+      result: {
+        mode: "strict",
+        typeSymbol: "dsh-agent-approval#AgentApprovalSetJevResult",
+        schema: setJevResultSchema,
+      },
+      sourceLocation: { file: "index.js", line: 1, column: 1 },
+    },
     {
       id: "dsh-agent-approval#agentApproval/setApprovalTimeout",
       service: "agentApproval",
@@ -331,16 +384,27 @@ export const TYPERT = {
       sourceLocation: { file: "index.js", line: 1, column: 1 },
     },
     {
-      id: "dsh-agent-approval#agentApproval/clearRecords",
+      id: "dsh-agent-approval#agentApproval/sessionRecords",
       service: "agentApproval",
       namespace: "agentApproval",
-      method: "clearRecords",
+      method: "sessionRecords",
       invocation: { kind: "direct" },
-      parameters: [],
+      parameters: [
+        {
+          name: "request",
+          wire: "request",
+          source: "json",
+          codec: {
+            mode: "strict",
+            typeSymbol: "dsh-agent-approval#AgentApprovalSessionRecordsRequest",
+            schema: _agentApproval_sessionRecords_parameter_0$schema,
+          },
+        },
+      ],
       result: {
         mode: "strict",
-        typeSymbol: "dsh-agent-approval#AgentApprovalClearRecordsResult",
-        schema: clearRecordsResultSchema,
+        typeSymbol: "dsh-agent-approval#AgentApprovalSessionRecordsResult",
+        schema: sessionRecordsResultSchema,
       },
       sourceLocation: { file: "index.js", line: 1, column: 1 },
     },
@@ -363,7 +427,7 @@ export const TYPERT = {
     services: [
       {
         description:
-          "Agent-approval permission mode service: pins enabled sessions to a workspace-write base, judges every sandbox escalation with an independent approval subagent (fail closed), and exposes model config plus an audit log to the DeepSeek Harness web UI.",
+          "Agent-approval permission mode service: pins enabled sessions to a workspace-write base, judges every sandbox escalation with an independent approval subagent (fail closed), appends the audit trail to each session's own log, and exposes model config to the DeepSeek Harness web UI.",
         summary: "Agent-approval permission mode service.",
         tags: [],
         jsDoc:
@@ -375,17 +439,25 @@ export const TYPERT = {
             kind: "method",
             name: "getState",
             signature: "@Remote('getState') async getState(): Promise<AgentApprovalStateResult>",
-            summary: "Snapshot for the Settings page and the composer toggle.",
+            summary: "Snapshot for the Settings page (model route, Jev backend, timeout, enabled sessions, rules).",
             jsDoc:
-              "/**\n * Return the judge model route, timeout, enabled sessions (id + session-list title + workspace cwd), and the latest audit records.\n * @returns success or a business failure.\n */",
+              "/**\n * Return the judge model route, the TypeSafe Jev backend settings, timeout, enabled sessions (id + session-list title + workspace cwd), and the rule table.\n * @returns success or a business failure.\n */",
           },
           {
             kind: "method",
             name: "setModel",
             signature: "@Remote('setModel') async setModel(request: AgentApprovalSetModelRequest): Promise<AgentApprovalSetModelResult>",
-            summary: "Set the judge model route (empty strings = inherit the requesting session's).",
+            summary: "Set the judge model route (empty strings = inherit the requesting session's; provider 'typesafe' selects the Jev backend).",
+            jsDoc:
+              "/**\n * Set provider/model used by the approval judge; empty strings clear the override. The synthetic provider 'typesafe' routes judging through the TypeSafe Jev HTTP API instead of a harness subagent.\n * @param request - { provider, model }.\n * @returns the stored route.\n */",
+          },
+          {
+            kind: "method",
+            name: "setJevConfig",
+            signature: "@Remote('setJevConfig') async setJevConfig(request: AgentApprovalSetJevRequest): Promise<AgentApprovalSetJevResult>",
+            summary: "Set the TypeSafe Jev backend settings (API key, endpoint, model, confidence gate; persisted).",
             jsDoc:
-              "/**\n * Set provider/model used by the approval subagent; empty strings clear the override.\n * @param request - { provider, model }.\n * @returns the stored route.\n */",
+              "/**\n * Update the Jev backend settings used when the judge provider is 'typesafe'. Only provided fields change; confidence (the fail-closed gate) is clamped to [0.01, 0.99].\n * @param request - { apiKey, endpoint, model, confidence }.\n * @returns the stored Jev settings.\n */",
           },
           {
             kind: "method",
@@ -421,11 +493,11 @@ export const TYPERT = {
           },
           {
             kind: "method",
-            name: "clearRecords",
-            signature: "@Remote('clearRecords') async clearRecords(): Promise<AgentApprovalClearRecordsResult>",
-            summary: "Clear the in-memory audit records.",
+            name: "sessionRecords",
+            signature: "@Remote('sessionRecords') async sessionRecords(request: AgentApprovalSessionRecordsRequest): Promise<AgentApprovalSessionRecordsResult>",
+            summary: "Fold one live session's audit records out of its own durable log.",
             jsDoc:
-              "/**\n * Clear the in-memory audit records.\n * @returns { cleared: true }.\n */",
+              "/**\n * Fold the agent-approval/record events of one live session (chronological) plus the current enabled state. Records follow the session: persisted in its log, restored with it, gone when it is deleted.\n * @param request - { sessionId }.\n * @returns the session's records, or session-not-live.\n */",
           },
           {
             kind: "method",
@@ -447,6 +519,21 @@ export const TYPERT = {
             declaration:
               "export interface AgentApprovalModelRoute {\n    readonly provider: string;\n    readonly model: string;\n}",
           },
+          {
+            name: "AgentApprovalJevConfig",
+            declaration:
+              "export interface AgentApprovalJevConfig {\n    readonly apiKey: string;\n    readonly endpoint: string;\n    readonly model: string;\n    readonly confidence: number;\n}",
+          },
+          {
+            name: "AgentApprovalSetJevRequest",
+            declaration:
+              "export interface AgentApprovalSetJevRequest {\n    readonly apiKey: string;\n    readonly endpoint: string;\n    readonly model: string;\n    readonly confidence: number;\n}",
+          },
+          {
+            name: "AgentApprovalSetJevResult",
+            declaration:
+              "export type AgentApprovalSetJevResult = { ok: true; value: { readonly jev: AgentApprovalJevConfig } } | { ok: false; error: { code: string; message?: string } };",
+          },
           {
             name: "AgentApprovalEnabledSession",
             declaration:
@@ -465,7 +552,22 @@ export const TYPERT = {
           {
             name: "AgentApprovalStateValue",
             declaration:
-              "export interface AgentApprovalStateValue {\n    readonly model: AgentApprovalModelRoute;\n    readonly timeoutMs: number;\n    readonly enabledSessions: readonly AgentApprovalEnabledSession[];\n    readonly rules: readonly AgentApprovalRule[];\n    readonly records: readonly AgentApprovalRecord[];\n}",
+              "export interface AgentApprovalStateValue {\n    readonly model: AgentApprovalModelRoute;\n    readonly jev: AgentApprovalJevConfig;\n    readonly timeoutMs: number;\n    readonly enabledSessions: readonly AgentApprovalEnabledSession[];\n    readonly rules: readonly AgentApprovalRule[];\n}",
+          },
+          {
+            name: "AgentApprovalSessionRecordsRequest",
+            declaration:
+              "export interface AgentApprovalSessionRecordsRequest {\n    readonly sessionId: string;\n}",
+          },
+          {
+            name: "AgentApprovalSessionRecordsValue",
+            declaration:
+              "export interface AgentApprovalSessionRecordsValue {\n    readonly records: readonly AgentApprovalRecord[];\n    readonly enabled: boolean;\n}",
+          },
+          {
+            name: "AgentApprovalSessionRecordsResult",
+            declaration:
+              "export type AgentApprovalSessionRecordsResult = { ok: true; value: AgentApprovalSessionRecordsValue } | { ok: false; error: { code: string; message?: string } };",
           },
           {
             name: "AgentApprovalStateResult",