@duke-dsh-plugins/dsh-agent-approval 1.5.0 → 1.6.0

package/README.md

@@ -26,6 +26,7 @@
 | ⛔ 风险即拒绝 | 破坏性 / 不可逆 / 越界（含修改操作系统或其他应用数据）/ 理由与实际命令不符 → 直接 `reject`；仅"安全、可逆、与任务相符、理由诚实"才 `approve`——项目自身的安装/部署脚本写其文档指定路径属任务所需 |
 | 🔒 Fail-closed | 审批 Agent 启动失败、超时（可配 30s–600s）、结果不合法 → 一律按拒绝处理，绝不静默放行 |
 | ⚙️ 审批模型可配置 | 设置页选择 Provider + Model，不选则固定用 **Harness 默认模型**（不跟随请求会话，口径稳定）；选择与超时**持久保存**，重启不丢 |
+| ⚡ TypeSafe Jev 决策模型后端 | 审批模型可选 **TypeSafe Jev**（System One 结构化决策模型）：审批时直连其 API，用类型化问题（Choice/Noul）毫秒级返回带校准概率的裁决；置信度低于阈值按 fail-closed 处理，审计理由由概率合成（需在设置页填 API Key，或设 `TYPESAFE_API_KEY`） |
 | 📋 审计记录（随会话） | 会话窗口顶部的**「审批」标签页**（轨迹旁）查看本会话全部审批：结论 / 风险等级 / 模型 / 耗时 / 理由；悬停看完整理由与**精确工具参数**；审批 Agent 的会话 id 可回溯完整推理；已批准行可一键**「加白」**存为放行规则。记录存在**会话存储目录内的独立文件**——随会话恢复，删除会话即随之删除 |
 | 🔁 可逆开关 | 权限菜单「Agent 审批」预设、`/agent-approval on\|off` 命令两条等价路径；关闭时**恢复开启前的权限旋钮** |
 
@@ -38,11 +39,12 @@
 工具请求提权（sandbox_permissions / 人工 ask）
   └─ ctx.approval.request() → approval/request 瀑布
         └─ 本插件 prepend 抢占（先于人工弹窗 answerer）
-              └─ spawn 审批 Agent（独立会话 · 零工具 · 结构化裁决 · 不会递归审批）
+              ├─ （默认）spawn 审批 Agent（独立会话 · 零工具 · 结构化裁决 · 不会递归审批）
+              └─ （或）直连 TypeSafe Jev 决策模型（state + 类型化问题 → 概率化裁决 · 亚秒级）
                     ├─ approve → allowed-once（该次放行）
                     ├─ reject  → rejected（风险操作，最终拒绝）
-                    └─ 超时/故障/取消 → fail-closed（按拒绝处理）
-              └─ 记入审计（写入会话日志，「审批」标签页可见）
+                    └─ 超时/故障/低置信/取消 → fail-closed（按拒绝处理）
+              └─ 记入审计（会话目录内的独立文件，「审批」标签页可见）
 ```
 
 - 审批 Agent 只能看到：workspace 路径、**最近的用户消息**（任务上下文）、工具名、提权理由、**精确的工具参数 JSON**（按 `callId` 从会话日志回查）。裁决看"操作 vs 用户任务"的客观对齐，不依赖理由措辞。
@@ -60,7 +62,7 @@
 dsh plugin --profile web add /path/to/dsh-agent-approval
 
 # 正式发布：从 GitHub Release tarball 安装
-dsh plugin --profile web add https://github.com/MoonlitDropOfBlood/dsh-agent-approval/releases/download/v1.5.0/dsh-agent-approval-1.5.0.tgz
+dsh plugin --profile web add https://github.com/MoonlitDropOfBlood/dsh-agent-approval/releases/download/v1.6.0/dsh-agent-approval-1.6.0.tgz
 ```
 
 重启 DSH 后：设置面板出现 **Agent 审批** 页；`/permission` 菜单出现第四项 **Agent 审批**。
@@ -77,7 +79,7 @@ dsh plugin --profile web add https://github.com/MoonlitDropOfBlood/dsh-agent-app
 1. **开启**：在 `/permission` 菜单选 **Agent 审批**，或输入 `/agent-approval on`。
 2. **自动裁决**：之后该会话里的提权请求（例如命令被沙箱拒绝后带 `sandbox_permissions` 的重试）不再弹窗，由审批 Agent 在后台裁决并放行/拒绝。
 3. **审计**：会话窗口顶部的**「审批」标签页**（轨迹旁）查看本会话的审批记录；悬停"审批理由"看完整理由与工具参数；已批准行可「加白」存为放行规则。记录存在会话存储目录内的独立文件，删除会话即随之删除；v1.4 的旧全局记录用 `node scripts/migrate-records.mjs` 一次性迁移（`--dry-run` 预览）。
-4. **配置**：设置 → **Agent 审批** 设置审批模型（不选则用 Harness 默认模型）、审批超时与放行/拒绝规则。
+4. **配置**：设置 → **Agent 审批** 设置审批模型（Harness 默认模型、指定 Provider/Model，或 **TypeSafe Jev**——选 Jev 后在下方卡片填 API Key 并按需调整 Endpoint / 模型版本 / 置信度阈值）、审批超时与放行/拒绝规则。
 5. **关闭**：菜单切回其他预设，或 `/agent-approval off`，恢复开启前的沙箱模式与审批策略。
 
 ## 目录结构

package/client.js

@@ -12,10 +12,11 @@
  *      deleted. Rows offer the one-click「加白」rule shortcut.
  *
  *   2. A "Agent 审批" page in the Settings panel (`settings.section`):
- *      approval model picker (provider + model, or the harness default),
- *      judge timeout setting (fail-closed), the list of sessions with the
- *      mode enabled (session-list title + workspace), and the allow/deny
- *      rule table.
+ *      approval model picker (provider + model, the harness default, or the
+ *      TypeSafe Jev direct HTTP backend with its API key / endpoint /
+ *      confidence-gate settings), judge timeout setting (fail-closed), the
+ *      list of sessions with the mode enabled (session-list title +
+ *      workspace), and the allow/deny rule table.
  *
  * Session-level on/off lives in the /permission menu (the "Agent 审批"
  * preset, registered by the package's cordis.patch.yml bundle patch) and the
@@ -256,6 +257,15 @@ window.__ModuleLoader__.load({
           parameters: param("dsh-agent-approval#AgentApprovalSetModelRequest"),
           result: result("dsh-agent-approval#AgentApprovalSetModelResult"),
         },
+        {
+          id: "dsh-agent-approval#agentApproval/setJevConfig",
+          service: "agentApproval",
+          namespace: "agentApproval",
+          method: "setJevConfig",
+          invocation: { kind: "direct" },
+          parameters: param("dsh-agent-approval#AgentApprovalSetJevRequest"),
+          result: result("dsh-agent-approval#AgentApprovalSetJevResult"),
+        },
         {
           id: "dsh-agent-approval#agentApproval/setApprovalTimeout",
           service: "agentApproval",
@@ -413,6 +423,16 @@ window.__ModuleLoader__.load({
         const setModel = modelSlot[1];
         const timeoutSlot = React.useState("");
         const setTimeoutDraft = timeoutSlot[1];
+        // Jev backend drafts (edited in the Jev card shown when the judge
+        // provider is the synthetic "typesafe" entry).
+        const jevKeySlot = React.useState("");
+        const setJevKey = jevKeySlot[1];
+        const jevEndpointSlot = React.useState("");
+        const setJevEndpoint = jevEndpointSlot[1];
+        const jevModelSlot = React.useState("");
+        const setJevModel = jevModelSlot[1];
+        const jevConfSlot = React.useState("0.5");
+        const setJevConf = jevConfSlot[1];
         const noteSlot = React.useState("");
         const note = noteSlot[0];
         const setNote = noteSlot[1];
@@ -431,6 +451,11 @@ window.__ModuleLoader__.load({
               setProvider(s.model.provider);
               setModel(s.model.model);
               setTimeoutDraft(String(s.timeoutMs));
+              // A not-yet-restarted old host sends no `jev` field — keep drafts.
+              setJevKey(s.jev && typeof s.jev.apiKey === "string" ? s.jev.apiKey : "");
+              setJevEndpoint(s.jev && typeof s.jev.endpoint === "string" ? s.jev.endpoint : "");
+              setJevModel(s.jev && typeof s.jev.model === "string" ? s.jev.model : "");
+              setJevConf(s.jev && typeof s.jev.confidence === "number" ? String(s.jev.confidence) : "0.5");
             })
             .catch((e) => setNote("无法读取状态：" + (e && e.message ? e.message : String(e))));
         };
@@ -458,6 +483,28 @@ window.__ModuleLoader__.load({
             })
             .catch((e) => setNote("保存失败：" + (e && e.message ? e.message : String(e))));
         };
+        const jevKey = jevKeySlot[0];
+        const jevEndpoint = jevEndpointSlot[0];
+        const jevModel = jevModelSlot[0];
+        const jevConf = jevConfSlot[0];
+        const saveJev = () => {
+          if (typeof remote.setJevConfig !== "function") {
+            setNote("Host 半未更新（缺少 setJevConfig）：请重装本插件并重启 DSH。");
+            return;
+          }
+          const conf = Number(jevConf);
+          if (!Number.isFinite(conf) || conf <= 0 || conf >= 1) {
+            setNote("置信度阈值必须是 0–1 之间的小数（如 0.5）");
+            return;
+          }
+          remote
+            .setJevConfig({ apiKey: jevKey, endpoint: jevEndpoint, model: jevModel, confidence: conf })
+            .then(() => {
+              refresh();
+              setNote("Jev 配置已保存");
+            })
+            .catch((e) => setNote("保存失败：" + (e && e.message ? e.message : String(e))));
+        };
         const saveTimeout = () => {
           const parsed = Number(timeoutDraft);
           if (!Number.isFinite(parsed)) {
@@ -520,19 +567,30 @@ window.__ModuleLoader__.load({
             .catch(() => {});
         };
 
+        // The synthetic "typesafe" provider routes judging through the
+        // TypeSafe Jev HTTP API — it is not part of the harness directory.
         const providerOptions = [{ id: "", name: "默认（Harness 默认模型）" }].concat(
+          [{ id: "typesafe", name: "TypeSafe Jev（决策模型·直连 API）" }],
           dir ? dir.providers : [],
         );
-        const modelOptions = [{ provider: "", id: "", name: "默认（Harness 默认模型）" }].concat(
-          dir && dir.models ? dir.models.filter((m) => m.provider === provider) : [],
-        );
+        const modelOptions =
+          provider === "typesafe"
+            ? [
+                { provider: "typesafe", id: "jev-latest", name: "jev-latest（跟随最新版本）" },
+                { provider: "typesafe", id: "jev-1.13.0", name: "jev-1.13.0（锁定版本）" },
+              ]
+            : [{ provider: "", id: "", name: "默认（Harness 默认模型）" }].concat(
+                dir && dir.models ? dir.models.filter((m) => m.provider === provider) : [],
+              );
         const defaultHint =
-          dir && dir.defaultSelection
-            ? "未配置时使用 Harness 默认模型；当前默认路由：" +
-              dir.defaultSelection.provider +
-              " / " +
-              dir.defaultSelection.model
-            : "未配置时使用 Harness 默认模型路由";
+          provider === "typesafe"
+            ? "当前审批判定直连 TypeSafe Jev API，不经过 Harness 模型路由；下方 Jev 配置在该模式下生效。"
+            : dir && dir.defaultSelection
+              ? "未配置时使用 Harness 默认模型；当前默认路由：" +
+                dir.defaultSelection.provider +
+                " / " +
+                dir.defaultSelection.model
+              : "未配置时使用 Harness 默认模型路由";
 
         return h(
           "div",
@@ -568,7 +626,7 @@ window.__ModuleLoader__.load({
                     value: provider,
                     onChange: (e) => {
                       setProvider(e.target.value);
-                      setModel("");
+                      setModel(e.target.value === "typesafe" ? "jev-latest" : "");
                     },
                   },
                   providerOptions.map((p) =>
@@ -586,7 +644,7 @@ window.__ModuleLoader__.load({
                     className: "aapr-select",
                     value: model,
                     onChange: (e) => setModel(e.target.value),
-                    disabled: dir === null,
+                    disabled: dir === null && provider !== "typesafe",
                   },
                   modelOptions.map((m) =>
                     h("option", { key: m.provider + "/" + m.id, value: m.id }, m.id === "" ? m.name : m.name + "（" + m.id + "）"),
@@ -597,6 +655,75 @@ window.__ModuleLoader__.load({
             ),
             h("div", { className: "aapr-muted" }, defaultHint),
           ),
+          provider === "typesafe"
+            ? h(
+                "div",
+                { className: "aapr-card" },
+                h("h3", null, "TypeSafe Jev 配置"),
+                h(
+                  "div",
+                  { className: "aapr-muted" },
+                  "Jev 是结构化决策模型（System One）：审批时直连 TypeSafe API，不创建审批子会话，毫秒级返回带校准概率的裁决。审计「理由」由概率分布合成（Jev 本身不生成文字）；置信度低于阈值时按 fail-closed 处理（记 unavailable，不批准也不记拒绝）。对中文任务上下文的准确率略低于英语。API Key 明文保存在本机 config.json；留空时使用环境变量 TYPESAFE_API_KEY。",
+                ),
+                h(
+                  "div",
+                  { className: "aapr-row" },
+                  h(
+                    "label",
+                    null,
+                    "API Key：",
+                    h("input", {
+                      className: "aapr-input",
+                      type: "password",
+                      placeholder: "TYPESAFE_API_KEY",
+                      value: jevKey,
+                      onChange: (e) => setJevKey(e.target.value),
+                    }),
+                  ),
+                  h(
+                    "label",
+                    null,
+                    "模型：",
+                    h("input", {
+                      className: "aapr-input",
+                      placeholder: "jev-latest",
+                      value: jevModel,
+                      onChange: (e) => setJevModel(e.target.value),
+                    }),
+                  ),
+                ),
+                h(
+                  "div",
+                  { className: "aapr-row" },
+                  h(
+                    "label",
+                    null,
+                    "Endpoint：",
+                    h("input", {
+                      className: "aapr-input aapr-input-wide",
+                      placeholder: "https://api.typesafe.ai/v1/systemone",
+                      value: jevEndpoint,
+                      onChange: (e) => setJevEndpoint(e.target.value),
+                    }),
+                  ),
+                  h(
+                    "label",
+                    null,
+                    "置信度阈值：",
+                    h("input", {
+                      className: "aapr-input",
+                      type: "number",
+                      step: "0.05",
+                      min: "0.01",
+                      max: "0.99",
+                      value: jevConf,
+                      onChange: (e) => setJevConf(e.target.value),
+                    }),
+                  ),
+                  h(ui.Button, { variant: "primary", size: "sm", onClick: saveJev }, "保存"),
+                ),
+              )
+            : null,
           h(
             "div",
             { className: "aapr-card" },

package/index.js

@@ -31,6 +31,11 @@
  *      `callId`) plus the asker's stated reason. A rejection must name the
  *      concrete, credible risk the operation creates (destructive /
  *      irreversible / out-of-scope / dishonest); vague unease is approved.
+ *      v1.6.0: the judge can alternatively be the TypeSafe Jev "System One"
+ *      decision model (synthetic provider id `typesafe`) — a direct HTTP
+ *      call that answers typed Choice/Noul questions with calibrated
+ *      probabilities; a confidence below the configured gate resolves
+ *      fail-closed like any other fault (see `_judgeWithJev`).
  *
  *   3. FAIL CLOSED — any infrastructure fault, timeout, malformed verdict, or
  *      cancellation maps to the fail-closed approval outcomes
@@ -104,6 +109,60 @@ const RECORDS_SIDECAR = "agent-approval.jsonl";
 const DATA_DIR = join(process.env.DSH_HOME || join(homedir(), ".dsh"), "agent-approval");
 const CONFIG_FILE = join(DATA_DIR, "config.json");
 
+/**
+ * v1.6.0: the TypeSafe Jev judge backend. Jev is a "System One" decision
+ * model (https://api.typesafe.ai/v1/systemone): it does not generate text —
+ * it answers typed questions (Choice / Score / Noul) over one `state` with
+ * calibrated probability distributions in ~70–500ms. That is exactly the
+ * approval-verdict shape, so instead of spawning a judge subagent through
+ * the harness model registry (Jev is not a chat route and cannot appear in
+ * `llm.listProviders()`), the Host half calls its HTTP API directly when the
+ * configured judge provider is the synthetic `typesafe` id. Fail-closed is
+ * preserved end to end: any transport fault, non-200, malformed answer, or a
+ * confidence below the configured gate resolves `unavailable` — never a
+ * grant, and (below the gate) not a recorded rejection either.
+ */
+const JEV_PROVIDER = "typesafe";
+const JEV_DEFAULT_MODEL = "jev-latest";
+const JEV_DEFAULT_ENDPOINT = "https://api.typesafe.ai/v1/systemone";
+const JEV_DEFAULT_CONFIDENCE = 0.5;
+
+/**
+ * The typed questions sent to Jev. Policy lives in the criteria descriptions
+ * (Jev reads instructions literally and injects domain knowledge only through
+ * state + criteria); the wording mirrors the subagent judge prompt's APPROVE
+ * conditions / REJECT list / 误杀治理 so both backends judge to the same
+ * standard. `decision` and `riskLevel` are Choices (discrete options +
+ * probabilities + confidence); `concreteRisk` is a Noul probe whose
+ * probability is folded into the synthesized audit rationale.
+ */
+const JEV_QUESTIONS = {
+  decision: {
+    type: "choice",
+    instructions: "Should this one-time sandbox-escalation request be approved?",
+    criteria: {
+      approve:
+        "Yes, approve once. The operation is plausibly safe, non-destructive and reversible; it is clearly required by or consistent with the user's task; the stated reason honestly matches the actual arguments; and granting it once cannot leak secrets or cause irreversible system-wide changes. The project's own documented install/build/deploy steps that place the project's own files into the tool's own documented directories, and reading tool-owned config or logs needed for the task, count as task-scoped.",
+      reject:
+        "No, reject. The operation is destructive or irreversible (mass deletion, disk formatting, registry/service/system-wide changes), exfiltrates credentials or secrets, touches resources unrelated to the task, modifies the operating system or other applications' data, hides intent behind encoded or obfuscated content, the stated reason does not match the actual arguments, or there is a concrete, credible risk — something it would destroy, leak, or change beyond the user's task.",
+    },
+  },
+  riskLevel: {
+    type: "choice",
+    instructions: "How risky is the requested operation?",
+    criteria: {
+      low: "Routine and easily reversible: reading files, or writing within the project workspace that can be regenerated or undone.",
+      medium: "Awkward to undo or touches more than the immediate task outputs, but not destructive and not security-sensitive.",
+      high: "Destructive, irreversible, system-wide, or touching credentials, secrets, or other applications' data.",
+    },
+  },
+  concreteRisk: {
+    type: "noul",
+    instructions:
+      "Does this specific operation create a concrete, credible risk — destroying data, leaking secrets or credentials, or changing the operating system, other applications, or resources beyond the user's task? Answer false when the operation is task-scoped and reversible; vague unease or an unfamiliar command is NOT a risk.",
+  },
+};
+
 /**
  * The structured verdict the judge subagent MUST produce. Constrained to the
  * JSON-Schema subset `assertObjectJsonSchema` enforces for subagent outputs
@@ -225,6 +284,7 @@ export class AgentApprovalService extends TypertRemoteService {
   async [Service.init]() {
     markRemoteMethod(this, "getState", "getState");
     markRemoteMethod(this, "setModel", "setModel");
+    markRemoteMethod(this, "setJevConfig", "setJevConfig");
     markRemoteMethod(this, "setApprovalTimeout", "setApprovalTimeout");
     markRemoteMethod(this, "toggle", "toggle");
     markRemoteMethod(this, "addRule", "addRule");
@@ -234,6 +294,18 @@ export class AgentApprovalService extends TypertRemoteService {
 
     /** Judge model override; empty strings = use the harness default route. */
     this._model = { provider: "", model: "" };
+    /**
+     * TypeSafe Jev direct backend settings (used when `_model.provider` is
+     * the synthetic `typesafe` id). The API key lives in plaintext on this
+     * machine only (config.json, same trust domain as the rest of the
+     * settings); an empty key falls back to the TYPESAFE_API_KEY env var.
+     */
+    this._jev = {
+      apiKey: "",
+      endpoint: JEV_DEFAULT_ENDPOINT,
+      model: JEV_DEFAULT_MODEL,
+      confidence: JEV_DEFAULT_CONFIDENCE,
+    };
     /** Judge timeout in ms (clamped); a timeout resolves fail-closed. */
     this._timeoutMs = DEFAULT_TIMEOUT_MS;
     /** sessionId -> { prevSandbox?: string, prevApproval?: string } */
@@ -693,6 +765,7 @@ export class AgentApprovalService extends TypertRemoteService {
   _persistConfig() {
     const body = JSON.stringify({
       model: { provider: this._model.provider, model: this._model.model },
+      jev: this._jevShape(),
       timeoutMs: this._timeoutMs,
       rules: this._rules,
     });
@@ -719,6 +792,18 @@ export class AgentApprovalService extends TypertRemoteService {
         ) {
           this._model = { provider: cfg.model.provider, model: cfg.model.model };
         }
+        if (cfg.jev && typeof cfg.jev === "object") {
+          if (typeof cfg.jev.apiKey === "string") this._jev.apiKey = cfg.jev.apiKey;
+          if (typeof cfg.jev.endpoint === "string" && cfg.jev.endpoint !== "") {
+            this._jev.endpoint = cfg.jev.endpoint;
+          }
+          if (typeof cfg.jev.model === "string" && cfg.jev.model !== "") {
+            this._jev.model = cfg.jev.model;
+          }
+          if (typeof cfg.jev.confidence === "number" && Number.isFinite(cfg.jev.confidence)) {
+            this._jev.confidence = Math.min(0.99, Math.max(0.01, cfg.jev.confidence));
+          }
+        }
         if (typeof cfg.timeoutMs === "number" && Number.isFinite(cfg.timeoutMs)) {
           this._timeoutMs = Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.floor(cfg.timeoutMs)));
         }
@@ -892,6 +977,10 @@ export class AgentApprovalService extends TypertRemoteService {
    * records display — "p/m" = selected, "default(p/m)" = harness default.
    */
   _judgeRoute() {
+    if (this._model.provider === JEV_PROVIDER) {
+      const model = this._jevEffective().model;
+      return { provider: JEV_PROVIDER, model: model, label: "jev(" + model + ")" };
+    }
     if (this._model.provider !== "" && this._model.model !== "") {
       return {
         provider: this._model.provider,
@@ -957,7 +1046,13 @@ export class AgentApprovalService extends TypertRemoteService {
       return "allowed-once";
     }
 
-    // 3. The model judge.
+    // 3. The judge. The TypeSafe Jev backend is a direct HTTP call (no
+    //    subagent, no harness model route); anything else spawns the judge
+    //    child through the `spawn` provider as before.
+    if (this._model.provider === JEV_PROVIDER) {
+      return this._judgeWithJev(session, req, argsRaw, base, trustKey);
+    }
+
     const route = this._judgeRoute();
 
     let run;
@@ -1059,6 +1154,276 @@ export class AgentApprovalService extends TypertRemoteService {
     return "unavailable";
   }
 
+  // ---- the TypeSafe Jev direct backend ---------------------------------------
+
+  /**
+   * Effective Jev settings with env fallback and clamping applied. The key
+   * may come from config.json or the TYPESAFE_API_KEY environment variable;
+   * an absent key keeps the backend selected but every judgment resolves
+   * `unavailable` (fail closed) until one is configured.
+   */
+  _jevEffective() {
+    const key = String(this._jev.apiKey || process.env.TYPESAFE_API_KEY || "").trim();
+    const endpoint = String(this._jev.endpoint || "").trim() || JEV_DEFAULT_ENDPOINT;
+    const model = String(this._jev.model || "").trim() || JEV_DEFAULT_MODEL;
+    let confidence = Number(this._jev.confidence);
+    if (!Number.isFinite(confidence)) confidence = JEV_DEFAULT_CONFIDENCE;
+    confidence = Math.min(0.99, Math.max(0.01, confidence));
+    return { key: key, endpoint: endpoint, model: model, confidence: confidence };
+  }
+
+  /** Owned plain copy of the Jev settings for the wire and config.json. */
+  _jevShape() {
+    return {
+      apiKey: String(this._jev.apiKey || ""),
+      endpoint: String(this._jev.endpoint || JEV_DEFAULT_ENDPOINT),
+      model: String(this._jev.model || JEV_DEFAULT_MODEL),
+      confidence: Number(this._jev.confidence) || JEV_DEFAULT_CONFIDENCE,
+    };
+  }
+
+  /**
+   * The `state` sent to Jev: the same ground truth the subagent judge sees
+   * (workspace, exact arguments, stated reason, first + recent genuine user
+   * messages), as a named object — the shape TypeSafe recommends. All values
+   * are pre-truncated strings so the 32K state budget is respected.
+   */
+  _jevStateOf(session, req, argsRaw) {
+    let cwd = "";
+    try {
+      if (session.header && typeof session.header.cwd === "string") cwd = session.header.cwd;
+    } catch (e) {
+      /* header access is best-effort */
+    }
+    const task = this._recentUserContext(session);
+    return {
+      workspace: cwd || "(unknown)",
+      tool: String(req.toolName),
+      statedReason:
+        typeof req.reason === "string" && req.reason !== "" ? trunc(req.reason, 300) : "(none)",
+      toolArguments: argsRaw === undefined ? "(not available)" : trunc(argsRaw, 4000) || "(empty)",
+      firstUserMessage: task.first !== "" ? task.first : "(no user messages available)",
+      recentUserMessages: task.recent,
+    };
+  }
+
+  /**
+   * Judge one escalation through the Jev HTTP API (state + typed questions →
+   * calibrated probability distributions). Mirrors `_judge`'s spawn-path
+   * contract exactly — rules and the session trust cache have already run —
+   * and every abnormal shape resolves fail-closed:
+   *   - no API key / transport fault / non-200 / malformed answer → `unavailable`
+   *   - request cancelled mid-flight → `cancelled`
+   *   - overall timeout (the same `this._timeoutMs` budget) → `unavailable`
+   *   - confidence below the configured gate → `unavailable` (the model is
+   *     not sure enough to decide: never a grant, and not a recorded
+   *     rejection either — the v1.4.0 误杀治理 applies symmetrically)
+   * Jev does not generate text, so the audit rationale is synthesized from
+   * the returned distributions; the served model version (`body.model`,
+   * which resolves aliases like jev-latest) is what the audit displays.
+   */
+  async _judgeWithJev(session, req, argsRaw, base, trustKey) {
+    const cfg = this._jevEffective();
+    if (cfg.key === "") {
+      this._record(session, {
+        ...base,
+        outcome: "unavailable",
+        riskLevel: "-",
+        model: "jev(" + cfg.model + ")",
+        rationale: "Jev backend selected but no API key configured (Settings → Agent 审批, or the TYPESAFE_API_KEY environment variable)",
+      });
+      return "unavailable";
+    }
+    if (typeof fetch !== "function") {
+      this._record(session, { ...base, outcome: "unavailable", riskLevel: "-", model: "jev(" + cfg.model + ")", rationale: "fetch is unavailable in this runtime" });
+      return "unavailable";
+    }
+
+    const startedAt = Date.now();
+    const controller = new AbortController();
+    const signal = req.signal;
+    const onAbort = () => controller.abort();
+    if (signal && typeof signal.addEventListener === "function") {
+      signal.addEventListener("abort", onAbort, { once: true });
+    }
+
+    let winner;
+    try {
+      const state = this._jevStateOf(session, req, argsRaw);
+      winner = await Promise.race([
+        this._jevRequest(cfg, state, controller.signal)
+          .then((body) => ({ kind: "result", body: body }))
+          .catch((error) => ({
+            kind: "fault",
+            error: error,
+            aborted: error && error.name === "AbortError",
+          })),
+        (signal
+          ? new Promise((resolve) => {
+              if (signal.aborted) {
+                resolve(true);
+                return;
+              }
+              signal.addEventListener("abort", () => resolve(true), { once: true });
+            })
+          : Promise.resolve(false)
+        ).then((v) => ({ kind: "aborted", aborted: v })),
+        this.ctx.timeout(this._timeoutMs).then(() => ({ kind: "timeout" })),
+      ]);
+    } finally {
+      if (signal && typeof signal.removeEventListener === "function") {
+        signal.removeEventListener("abort", onAbort);
+      }
+      // Whether we lost the race to timeout/cancel or the request already
+      // settled, closing the transport is always safe.
+      try {
+        controller.abort();
+      } catch (e) {
+        /* controller abort never blocks the outcome */
+      }
+    }
+    const durationMs = Date.now() - startedAt;
+
+    if (winner.kind === "result") {
+      return this._jevVerdict(session, winner.body, cfg, base, trustKey, durationMs);
+    }
+    if (winner.kind === "aborted") {
+      this._record(session, { ...base, outcome: "cancelled", riskLevel: "-", model: "jev(" + cfg.model + ")", rationale: "request cancelled while Jev was judging" });
+      return "cancelled";
+    }
+    if (winner.kind === "timeout") {
+      this._record(session, {
+        ...base,
+        outcome: "unavailable",
+        riskLevel: "-",
+        model: "jev(" + cfg.model + ")",
+        rationale: "Jev request timed out after " + String(this._timeoutMs) + "ms (fail closed)",
+      });
+      return "unavailable";
+    }
+    if (winner.aborted) {
+      this._record(session, { ...base, outcome: "cancelled", riskLevel: "-", model: "jev(" + cfg.model + ")", rationale: "request cancelled while Jev was judging" });
+      return "cancelled";
+    }
+    this._record(session, { ...base, outcome: "unavailable", riskLevel: "-", model: "jev(" + cfg.model + ")", rationale: "Jev request failed: " + errText(winner.error) });
+    return "unavailable";
+  }
+
+  /** The single POST to the System One endpoint; resolves the parsed body. */
+  async _jevRequest(cfg, state, abortSignal) {
+    const response = await fetch(cfg.endpoint, {
+      method: "POST",
+      headers: {
+        "Authorization": "Bearer " + cfg.key,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        state: state,
+        model: cfg.model,
+        questions: JEV_QUESTIONS,
+      }),
+      signal: abortSignal,
+    });
+    if (!response.ok) {
+      let detail = "";
+      try {
+        detail = trunc(String(await response.text()), 200);
+      } catch (e) {
+        /* body read is best-effort */
+      }
+      throw new Error("HTTP " + String(response.status) + (detail !== "" ? " " + detail : ""));
+    }
+    const body = await response.json();
+    if (!body || typeof body !== "object") throw new Error("response body is not an object");
+    return body;
+  }
+
+  /**
+   * Map a Jev response to the same outcomes the subagent path produces.
+   * Returns the waterfall outcome string; records the audit line itself.
+   */
+  _jevVerdict(session, body, cfg, base, trustKey, durationMs) {
+    const served = typeof body.model === "string" && body.model !== "" ? body.model : cfg.model;
+    const label = "jev(" + served + ")";
+    const answers = body.answers && typeof body.answers === "object" ? body.answers : {};
+    const decision = answers.decision && typeof answers.decision === "object" ? answers.decision : undefined;
+    const risk = answers.riskLevel && typeof answers.riskLevel === "object" ? answers.riskLevel : undefined;
+    const probe = answers.concreteRisk && typeof answers.concreteRisk === "object" ? answers.concreteRisk : undefined;
+
+    const choice = decision && (decision.choice === "approve" || decision.choice === "reject") ? decision.choice : undefined;
+    const confidence = decision ? Number(decision.confidence) : NaN;
+    const probabilities = decision && decision.probabilities && typeof decision.probabilities === "object" ? decision.probabilities : {};
+    const riskChoice =
+      risk && (risk.choice === "low" || risk.choice === "medium" || risk.choice === "high") ? risk.choice : undefined;
+    const probeNoul = probe ? Number(probe.noul) : NaN;
+
+    // Any missing or out-of-shape answer is fail-closed, not guessed.
+    if (
+      choice === undefined ||
+      !Number.isFinite(confidence) ||
+      confidence < 0 ||
+      confidence > 1 ||
+      riskChoice === undefined ||
+      !Number.isFinite(probeNoul)
+    ) {
+      this._record(session, {
+        ...base,
+        durationMs: durationMs,
+        outcome: "unavailable",
+        riskLevel: "-",
+        model: label,
+        rationale: "Jev returned no valid verdict shape (decision/riskLevel/concreteRisk incomplete)",
+      });
+      return "unavailable";
+    }
+
+    // Confidence gate: below the threshold the model is not sure enough to
+    // decide at all — never a grant, never a recorded rejection.
+    if (confidence < cfg.confidence) {
+      this._record(session, {
+        ...base,
+        durationMs: durationMs,
+        outcome: "unavailable",
+        riskLevel: riskChoice,
+        model: label,
+        rationale:
+          "Jev confidence " + confidence.toFixed(2) + " is below the gate " + cfg.confidence.toFixed(2) + " (decision draft: " + choice + ") — fail closed",
+      });
+      return "unavailable";
+    }
+
+    const pApprove = Number(probabilities.approve);
+    const pReject = Number(probabilities.reject);
+    const rationale =
+      "Jev 决策=" + choice +
+      "（置信度 " + confidence.toFixed(2) +
+      (Number.isFinite(pApprove) && Number.isFinite(pReject)
+        ? "，p approve/reject " + pApprove.toFixed(2) + "/" + pReject.toFixed(2)
+        : "") +
+      "）；风险=" + riskChoice +
+      "；具体风险概率=" + probeNoul.toFixed(2) +
+      "。Jev 为结构化决策模型，不生成文字，本理由由概率分布合成。";
+
+    base.durationMs = durationMs;
+    const approved = choice === "approve";
+    this._record(session, {
+      ...base,
+      outcome: approved ? "allowed-once" : "rejected",
+      riskLevel: riskChoice,
+      model: label,
+      rationale: trunc(rationale, 600),
+    });
+    if (approved && trustKey !== undefined) {
+      let set = this._trusted.get(session.id);
+      if (set === undefined) {
+        set = new Set();
+        this._trusted.set(session.id, set);
+      }
+      set.add(trustKey);
+    }
+    return approved ? "allowed-once" : "rejected";
+  }
+
   // ---- Remote API ------------------------------------------------------------
 
   /**
@@ -1100,6 +1465,7 @@ export class AgentApprovalService extends TypertRemoteService {
       ok: true,
       value: {
         model: { provider: this._model.provider, model: this._model.model },
+        jev: this._jevShape(),
         timeoutMs: this._timeoutMs,
         enabledSessions: this._sessionInfos(),
         rules: this._rulesSnapshot(),
@@ -1114,12 +1480,35 @@ export class AgentApprovalService extends TypertRemoteService {
   async setModel(request) {
     const provider = request && typeof request.provider === "string" ? request.provider : "";
     const model = request && typeof request.model === "string" ? request.model : "";
-    this._model =
-      provider !== "" && model !== "" ? { provider, model } : { provider: "", model: "" };
+    if (provider === JEV_PROVIDER) {
+      // The Jev backend ignores the harness route table; an unset model just
+      // means the latest alias.
+      this._model = { provider: JEV_PROVIDER, model: model !== "" ? model : JEV_DEFAULT_MODEL };
+    } else {
+      this._model =
+        provider !== "" && model !== "" ? { provider, model } : { provider: "", model: "" };
+    }
     this._persistConfig();
     return { ok: true, value: { model: { provider: this._model.provider, model: this._model.model } } };
   }
 
+  /**
+   * Set the TypeSafe Jev backend settings (only provided fields change).
+   * `confidence` is the gate below which Jev's answer is not trusted and the
+   * outcome resolves fail-closed; clamped to [0.01, 0.99]. Persisted.
+   */
+  async setJevConfig(request) {
+    const r = request && typeof request === "object" ? request : {};
+    if (typeof r.apiKey === "string") this._jev.apiKey = r.apiKey.trim();
+    if (typeof r.endpoint === "string") this._jev.endpoint = r.endpoint.trim();
+    if (typeof r.model === "string") this._jev.model = r.model.trim();
+    if (typeof r.confidence === "number" && Number.isFinite(r.confidence)) {
+      this._jev.confidence = Math.min(0.99, Math.max(0.01, r.confidence));
+    }
+    this._persistConfig();
+    return { ok: true, value: { jev: this._jevShape() } };
+  }
+
   /** Set the judge timeout (clamped to [MIN, MAX] milliseconds). Persisted. */
   async setApprovalTimeout(request) {
     const raw = request && typeof request.timeoutMs === "number" ? request.timeoutMs : 0;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@duke-dsh-plugins/dsh-agent-approval",
-  "version": "1.5.0",
-  "description": "Agent-decided approvals for DeepSeek Harness: a workspace-write base permission mode where an independent approval subagent judges every sandbox escalation (risky operations are rejected), with a configurable approval model and a per-session audit trail in the conversation window's 审批 tab.",
+  "version": "1.6.0",
+  "description": "Agent-decided approvals for DeepSeek Harness: a workspace-write base permission mode where an independent approval judge (an isolated subagent, or the TypeSafe Jev decision model via direct API) evaluates every sandbox escalation (risky operations are rejected), with a configurable approval model and a per-session audit trail in the conversation window's 审批 tab.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/MoonlitDropOfBlood/dsh-agent-approval.git"

package/typert.host.js

@@ -41,6 +41,15 @@ const modelRouteSchema = z
   })
   .readonly();
 
+const jevConfigSchema = z
+  .object({
+    apiKey: z.string(),
+    endpoint: z.string(),
+    model: z.string(),
+    confidence: z.number(),
+  })
+  .readonly();
+
 const enabledSessionSchema = z
   .object({
     id: z.string(),
@@ -63,6 +72,7 @@ const ruleSchema = z
 const stateValueSchema = z
   .object({
     model: modelRouteSchema,
+    jev: jevConfigSchema,
     timeoutMs: z.number(),
     enabledSessions: z.array(enabledSessionSchema).readonly(),
     rules: z.array(ruleSchema).readonly(),
@@ -75,6 +85,12 @@ const setModelValueSchema = z
   })
   .readonly();
 
+const setJevValueSchema = z
+  .object({
+    jev: jevConfigSchema,
+  })
+  .readonly();
+
 const setTimeoutValueSchema = z
   .object({
     timeoutMs: z.number(),
@@ -152,6 +168,7 @@ function okResult(valueSchema) {
 
 const stateResultSchema = okResult(stateValueSchema);
 const setModelResultSchema = okResult(setModelValueSchema);
+const setJevResultSchema = okResult(setJevValueSchema);
 const setTimeoutResultSchema = okResult(setTimeoutValueSchema);
 const toggleResultSchema = okResult(toggleValueSchema);
 const addRuleResultSchema = okResult(rulesValueSchema);
@@ -166,6 +183,13 @@ const _agentApproval_setModel_parameter_0$schema = z.object({
   model: z.string(),
 });
 
+const _agentApproval_setJevConfig_parameter_0$schema = z.object({
+  apiKey: z.string(),
+  endpoint: z.string(),
+  model: z.string(),
+  confidence: z.number(),
+});
+
 const _agentApproval_setApprovalTimeout_parameter_0$schema = z.object({
   timeoutMs: z.number(),
 });
@@ -234,6 +258,31 @@ export const TYPERT = {
       },
       sourceLocation: { file: "index.js", line: 1, column: 1 },
     },
+    {
+      id: "dsh-agent-approval#agentApproval/setJevConfig",
+      service: "agentApproval",
+      namespace: "agentApproval",
+      method: "setJevConfig",
+      invocation: { kind: "direct" },
+      parameters: [
+        {
+          name: "request",
+          wire: "request",
+          source: "json",
+          codec: {
+            mode: "strict",
+            typeSymbol: "dsh-agent-approval#AgentApprovalSetJevRequest",
+            schema: _agentApproval_setJevConfig_parameter_0$schema,
+          },
+        },
+      ],
+      result: {
+        mode: "strict",
+        typeSymbol: "dsh-agent-approval#AgentApprovalSetJevResult",
+        schema: setJevResultSchema,
+      },
+      sourceLocation: { file: "index.js", line: 1, column: 1 },
+    },
     {
       id: "dsh-agent-approval#agentApproval/setApprovalTimeout",
       service: "agentApproval",
@@ -390,17 +439,25 @@ export const TYPERT = {
             kind: "method",
             name: "getState",
             signature: "@Remote('getState') async getState(): Promise<AgentApprovalStateResult>",
-            summary: "Snapshot for the Settings page (model route, timeout, enabled sessions, rules).",
+            summary: "Snapshot for the Settings page (model route, Jev backend, timeout, enabled sessions, rules).",
             jsDoc:
-              "/**\n * Return the judge model route, timeout, enabled sessions (id + session-list title + workspace cwd), and the rule table.\n * @returns success or a business failure.\n */",
+              "/**\n * Return the judge model route, the TypeSafe Jev backend settings, timeout, enabled sessions (id + session-list title + workspace cwd), and the rule table.\n * @returns success or a business failure.\n */",
           },
           {
             kind: "method",
             name: "setModel",
             signature: "@Remote('setModel') async setModel(request: AgentApprovalSetModelRequest): Promise<AgentApprovalSetModelResult>",
-            summary: "Set the judge model route (empty strings = inherit the requesting session's).",
+            summary: "Set the judge model route (empty strings = inherit the requesting session's; provider 'typesafe' selects the Jev backend).",
+            jsDoc:
+              "/**\n * Set provider/model used by the approval judge; empty strings clear the override. The synthetic provider 'typesafe' routes judging through the TypeSafe Jev HTTP API instead of a harness subagent.\n * @param request - { provider, model }.\n * @returns the stored route.\n */",
+          },
+          {
+            kind: "method",
+            name: "setJevConfig",
+            signature: "@Remote('setJevConfig') async setJevConfig(request: AgentApprovalSetJevRequest): Promise<AgentApprovalSetJevResult>",
+            summary: "Set the TypeSafe Jev backend settings (API key, endpoint, model, confidence gate; persisted).",
             jsDoc:
-              "/**\n * Set provider/model used by the approval subagent; empty strings clear the override.\n * @param request - { provider, model }.\n * @returns the stored route.\n */",
+              "/**\n * Update the Jev backend settings used when the judge provider is 'typesafe'. Only provided fields change; confidence (the fail-closed gate) is clamped to [0.01, 0.99].\n * @param request - { apiKey, endpoint, model, confidence }.\n * @returns the stored Jev settings.\n */",
           },
           {
             kind: "method",
@@ -462,6 +519,21 @@ export const TYPERT = {
             declaration:
               "export interface AgentApprovalModelRoute {\n    readonly provider: string;\n    readonly model: string;\n}",
           },
+          {
+            name: "AgentApprovalJevConfig",
+            declaration:
+              "export interface AgentApprovalJevConfig {\n    readonly apiKey: string;\n    readonly endpoint: string;\n    readonly model: string;\n    readonly confidence: number;\n}",
+          },
+          {
+            name: "AgentApprovalSetJevRequest",
+            declaration:
+              "export interface AgentApprovalSetJevRequest {\n    readonly apiKey: string;\n    readonly endpoint: string;\n    readonly model: string;\n    readonly confidence: number;\n}",
+          },
+          {
+            name: "AgentApprovalSetJevResult",
+            declaration:
+              "export type AgentApprovalSetJevResult = { ok: true; value: { readonly jev: AgentApprovalJevConfig } } | { ok: false; error: { code: string; message?: string } };",
+          },
           {
             name: "AgentApprovalEnabledSession",
             declaration:
@@ -480,7 +552,7 @@ export const TYPERT = {
           {
             name: "AgentApprovalStateValue",
             declaration:
-              "export interface AgentApprovalStateValue {\n    readonly model: AgentApprovalModelRoute;\n    readonly timeoutMs: number;\n    readonly enabledSessions: readonly AgentApprovalEnabledSession[];\n    readonly rules: readonly AgentApprovalRule[];\n}",
+              "export interface AgentApprovalStateValue {\n    readonly model: AgentApprovalModelRoute;\n    readonly jev: AgentApprovalJevConfig;\n    readonly timeoutMs: number;\n    readonly enabledSessions: readonly AgentApprovalEnabledSession[];\n    readonly rules: readonly AgentApprovalRule[];\n}",
           },
           {
             name: "AgentApprovalSessionRecordsRequest",