@duke-dsh-plugins/dsh-agent-approval 1.8.1 → 1.9.0

package/README.md

@@ -23,7 +23,7 @@
 | 🛡 **权限菜单第四项** | `/permission` 菜单新增 **自动审批** 预设；选中即开启，切到其他预设自动关闭，跨重启保持 |
 | 🤖 新权限模式 | 开启后：沙箱基线固定 `workspace-write`，审批策略切到 `ask`（内部接管），**不再弹人工审批** |
 | 🤖 自动裁决（默认 LLM 直连） | 每次提权请求由**一次 LLM 直连调用**裁决（v1.8.0 起默认）：与子代理同一套审批人格 / 提示词 / 结构化裁决 `{decision, riskLevel, rationale}`，但**不创建审批子会话**（零上下文污染）；设置页可切回「隔离子代理」（一次性 `spawn` 子代理：独立会话、零工具、只读材料） |
-| 🕵️ 自动审查（逐调用，实验） | 可选预设（需先在设置页启用 Jev）：**Full access 基线**，每个工具调用（含 PTC 内层）执行前经 Jev 判定一次，风险调用**直接拒绝、body 不执行、不转人工**（fail-closed）；规则表与会话内信任先行短路降噪；`/agent-review on\|off` 或菜单「自动审查」开启 |
+| 🕵️ 自动审查（逐调用，实验） | 可选预设（需先在设置页启用 Jev）：**Full access 基线**，每个工具调用（含 PTC 内层）执行前经 Jev 判定一次，风险调用**直接拒绝、body 不执行、不转人工**（fail-closed）；规则表与会话内信任先行短路降噪；`/agent-review on\|off` 或菜单「自动审查」开启。v1.9.0 起**有效代码展开**：命令引用的解释器脚本（node / python / bash / ps1）内容会被读出并放进裁决 state，agent 临时写的脚本按**实际代码**受审而不是只看命令行（仅读 workspace 内文件，越界只标注、永不读取） |
 | ⛔ 风险即拒绝 | 破坏性 / 不可逆 / 越界（含修改操作系统或其他应用数据）/ 理由与实际命令不符 → 直接 `reject`；仅"安全、可逆、与任务相符、理由诚实"才 `approve`——项目自身的安装/部署脚本写其文档指定路径属任务所需 |
 | 🔒 Fail-closed | 审批 Agent 启动失败、超时（可配 30s–600s）、结果不合法 → 一律按拒绝处理，绝不静默放行 |
 | ⚙️ 审批模型可配置 | 设置页选择 Provider + Model，不选则固定用 **Harness 默认模型**（不跟随请求会话，口径稳定）；选择与超时**持久保存**，重启不丢 |

package/client.js

@@ -106,7 +106,7 @@ window.__ModuleLoader__.load({
    would bounce the selection back anyway. */
 [data-dsh-agent-approval-review-gate="off"] [data-dsh-agent-approval-review-item]{display:none}
 [data-dsh-agent-approval-review-item]::before{content:'';flex:none;width:16px;height:16px;background:currentColor;-webkit-mask:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16' fill='none'%3E%3Cpath d='M8.20554 0.899994L14.7901 3.36857V7.01026C14.7901 12 11.0466 14.2103 8.20554 15.3C5.36446 14.2103 1.62012 12 1.62012 7.01026V3.36857L8.20554 0.899994Z' stroke='black' stroke-width='1.31831' stroke-linejoin='round'/%3E%3Cpath d='M8 3.2L9.1 5.9L11.8 7L9.1 8.1L8 10.8L6.9 8.1L4.2 7L6.9 5.9Z' fill='black'/%3E%3C/svg%3E") center/contain no-repeat;mask:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16' fill='none'%3E%3Cpath d='M8.20554 0.899994L14.7901 3.36857V7.01026C14.7901 12 11.0466 14.2103 8.20554 15.3C5.36446 14.2103 1.62012 12 1.62012 7.01026V3.36857L8.20554 0.899994Z' stroke='black' stroke-width='1.31831' stroke-linejoin='round'/%3E%3Cpath d='M8 3.2L9.1 5.9L11.8 7L9.1 8.1L8 10.8L6.9 8.1L4.2 7L6.9 5.9Z' fill='black'/%3E%3C/svg%3E") center/contain no-repeat}
-.aapr-mode-review{margin-left:6px;font-size:10px;border:1px solid var(--dsw-alias-border-l2);border-radius:4px;padding:0 4px;color:var(--dsw-alias-label-secondary);white-space:nowrap}
+.aapr-mode-review{display:inline-block;margin:2px 0 2px 6px;padding:1px 6px;font-size:10px;line-height:1.5;border:1px solid var(--dsw-alias-border-l2);border-radius:4px;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-secondary);white-space:nowrap;vertical-align:1px}
 `;
 
     // ---- Settings nav icon --------------------------------------------------
@@ -200,6 +200,12 @@ window.__ModuleLoader__.load({
         //    with no glyph the icon span is absent, leaving label + chevron.
         //    Skip menu rows (handled above) and the settings dialog (its nav
         //    row carries the same label but is owned by the settings-nav icon).
+        //    The trigger renders whichever preset is CURRENTLY selected, so it
+        //    must accept BOTH of our preset names (v1.8.2): 自动审批 and 自动审查
+        //    are equally ours, and neither is in the host's permissionGlyphs —
+        //    registerReviewMenuItem only marks menu rows, so without this the
+        //    trigger showed 自动审查 with no icon at all.
+        const triggerLabels = [currentLabel, String(REVIEW_LABEL).trim()];
         const buttons = document.querySelectorAll("button");
         for (let i = 0; i < buttons.length; i++) {
           const button = buttons[i];
@@ -212,7 +218,7 @@ window.__ModuleLoader__.load({
             const s = spans[j].textContent ? spans[j].textContent.trim() : "";
             if (s.length > 0) { labelText = s; break; }
           }
-          const matches = labelText === currentLabel && button.querySelector("svg") !== null;
+          const matches = triggerLabels.indexOf(labelText) !== -1 && button.querySelector("svg") !== null;
           if (matches) button.setAttribute(PERM_TRIGGER_MARKER, "");
           else button.removeAttribute(PERM_TRIGGER_MARKER);
         }

package/index.js

@@ -61,9 +61,9 @@
 
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { Service } from "@deepseek-ai/cordis";
-import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { appendFile, mkdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve, sep } from "node:path";
 
 // ---- constants --------------------------------------------------------------
 
@@ -166,13 +166,28 @@ const JEV_QUESTIONS = {
 /**
  * v1.8.0: the per-call review mode (`agent-review` preset). The SAME policy
  * criteria as `JEV_QUESTIONS` — only the decision instruction wording adapts
- * from "escalation request" to the pending tool call.
+ * from "escalation request" to the pending tool call. v1.9.0 adds guidance
+ * for the `effectiveCode` state field (the actual interpreter scripts the
+ * call would run): judge the code when present; reduced visibility alone is
+ * never a rejection reason (误杀治理 holds); and a source-edit diff that
+ * merely mentions destructive or security operations is not dangerous
+ * itself — the live false kill that motivated this sentence: Jev rejected
+ * THIS plugin's own criteria-text edit (risk=high 0.87) on 2026-09-29
+ * because the diff contained the phrases below.
  */
 const JEV_REVIEW_QUESTIONS = {
   ...JEV_QUESTIONS,
   decision: {
     ...JEV_QUESTIONS.decision,
     instructions: "Should this pending tool call be allowed to execute?",
+    criteria: {
+      approve:
+        JEV_QUESTIONS.decision.criteria.approve +
+        " The state's `effectiveCode` field carries the actual content of the interpreter scripts (node/python/bash/PowerShell files) this call would execute — when present, judge THAT code, not just the command line: a plainly safe, task-scoped script stays approved even if its command line alone looks opaque. When the pending call edits source files, judge what the change does to the file and whether it fits the task: diff text that merely mentions destructive or security operations (tests, security policy, incident reports, documentation) does not make the change dangerous.",
+      reject:
+        JEV_QUESTIONS.decision.criteria.reject +
+        " When `effectiveCode` is present, judge by that code: a script whose code deletes or modifies data outside the workspace, exfiltrates secrets, or hides obfuscated payloads is rejected for what its code shows. A referenced script that is unreadable, outside the workspace, oversized, or not decodable reduces your visibility — weigh that in concreteRisk, but never reject for reduced visibility alone: an ordinary script you simply have not seen is not, by itself, a risk.",
+    },
   },
 };
 
@@ -197,6 +212,222 @@ const RUN_CODE_TOOL = "run_code";
 const REVIEW_DENIED_NAME = "AgentReviewDeniedError";
 const REVIEW_DENIED_CODE = "AGENT_REVIEW_DENIED";
 
+/**
+ * v1.9.0 — per-call review (REVIEW MODE ONLY): effective-code expansion.
+ *
+ * The review judge otherwise sees a command line like `node scripts/x.js`
+ * and nothing about what that script does — the classic blind spot through
+ * which an agent-authored temp script once wiped ~/.dsh (2026-09 incident).
+ * Before judging, the plugin extracts the script files the command would
+ * execute and includes their contents in the Jev state's `effectiveCode`
+ * field, so the judge rules on the code itself.
+ *
+ * Scope (user ruling 2026-09-29): interpreter scripts only (node / python /
+ * bash / PowerShell and friends); packaged CLIs (`npm run`, `npx`, `git`, …)
+ * are deliberately NOT expanded. The escalation (自动审批) path is untouched —
+ * `_jevStateOf` is not modified. Reads are workspace-confined (paths that
+ * resolve — including through symlinks — outside the session workspace are
+ * noted, never read: the expansion must not become an exfiltration channel),
+ * capped, and fully best-effort: every fault degrades to a note inside the
+ * field and never blocks judging.
+ */
+const REVIEW_CODE_MAX_FILES = 4;
+const REVIEW_CODE_FILE_CHARS = 8192;
+const REVIEW_CODE_TOTAL_CHARS = 10000;
+const REVIEW_CODE_MAX_FILE_BYTES = 262144;
+const REVIEW_CODE_MAX_COMMANDS = 6;
+
+/** File extensions treated as "an interpreter script the agent may have written". */
+const REVIEW_CODE_SCRIPT_EXTENSIONS = [
+  ".js", ".mjs", ".cjs", ".jsx", ".ts", ".mts", ".cts",
+  ".py", ".pyw", ".sh", ".bash", ".ps1", ".psm1", ".rb", ".pl",
+];
+
+/** Interpreters whose positional argument (or `-File` value) is a script file. */
+const REVIEW_CODE_INTERPRETERS = new Set([
+  "node", "node.exe", "nodejs", "bun", "bun.exe", "deno", "deno.exe",
+  "python", "python.exe", "python3", "python3.exe", "py", "py.exe",
+  "bash", "bash.exe", "sh", "sh.exe", "zsh", "dash",
+  "pwsh", "pwsh.exe", "powershell", "powershell.exe",
+]);
+
+/** Strip wrapping quotes/braces a tokenizer may have left on a token. */
+function reviewCodeCleanToken(token) {
+  return String(token).replace(/^["'{(]+/, "").replace(/["'}),;]+$/, "");
+}
+
+/** True when the token names a file with a known interpreter-script extension. */
+function reviewCodeIsScriptFile(token) {
+  const t = reviewCodeCleanToken(token).toLowerCase();
+  for (const ext of REVIEW_CODE_SCRIPT_EXTENSIONS) {
+    if (t.endsWith(ext)) return true;
+  }
+  return false;
+}
+
+/**
+ * Split one shell command into top-level segments on `; | &` and newlines,
+ * respecting both quote styles and PowerShell brace blocks, so code embedded
+ * in `-Command "…"` / `-e "…"` stays one segment.
+ */
+function reviewCodeSplitSegments(command) {
+  const parts = [];
+  let cur = "";
+  let quote = null;
+  let depth = 0;
+  for (const ch of String(command)) {
+    if (quote !== null) {
+      cur += ch;
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      cur += ch;
+      continue;
+    }
+    if (ch === "{") depth += 1;
+    if (ch === "}") depth = Math.max(0, depth - 1);
+    if (depth === 0 && (ch === ";" || ch === "|" || ch === "&" || ch === "\n" || ch === "\r")) {
+      parts.push(cur);
+      cur = "";
+      continue;
+    }
+    cur += ch;
+  }
+  parts.push(cur);
+  return parts.map((s) => s.trim()).filter((s) => s !== "");
+}
+
+/** Whitespace tokenizer that keeps quoted runs (quotes attached) as one token. */
+function reviewCodeTokens(segment) {
+  const tokens = [];
+  let cur = "";
+  let quote = null;
+  let has = false;
+  for (const ch of String(segment)) {
+    if (quote !== null) {
+      cur += ch;
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      has = true;
+      cur += ch;
+      continue;
+    }
+    if (ch === " " || ch === "\t") {
+      if (has) tokens.push(cur);
+      cur = "";
+      has = false;
+      continue;
+    }
+    cur += ch;
+    has = true;
+  }
+  if (has) tokens.push(cur);
+  return tokens;
+}
+
+/**
+ * Extract script references from ONE command segment:
+ *   - `{kind:"file", path}`    — a script file the command would execute;
+ *   - `{kind:"inline"}`        — an inline-code flag (`-e`/`-c`/`-Command`…);
+ *     that code is already visible verbatim in the tool arguments;
+ *   - `{kind:"encoded", data}` — a `-EncodedCommand`/`-enc` payload;
+ *   - `{kind:"note", text}`    — anything unrecognizable worth surfacing.
+ * Depth-limited recursion expands code nested inside inline flags
+ * (`pwsh -Command "node x.js"`, `bash -c "python x.py"`).
+ */
+function reviewCodeSegmentRefs(segment, depth) {
+  const tokens = reviewCodeTokens(segment);
+  let i = 0;
+  while (
+    i < tokens.length &&
+    (tokens[i] === "&" || tokens[i] === "." || tokens[i] === "call" ||
+      tokens[i] === "source" || tokens[i] === "sudo" || tokens[i] === "exec")
+  ) {
+    i += 1;
+  }
+  if (i >= tokens.length) return [];
+  const head = tokens[i].replace(/^.*[\\/]/, "").toLowerCase();
+  const refs = [];
+  if (!REVIEW_CODE_INTERPRETERS.has(head)) {
+    // Not an interpreter head: only a leading token that is itself a script
+    // file counts (call operators stripped above). No mid-segment scanning,
+    // so `git diff -- foo.py` never pulls foo.py into the state. Multi-word
+    // leftovers (a quoted chunk that reached this branch) are never taken
+    // as a path.
+    const lead = tokens[i];
+    if (reviewCodeIsScriptFile(lead) && !/\s/.test(reviewCodeCleanToken(lead))) {
+      refs.push({ kind: "file", path: reviewCodeCleanToken(lead) });
+    }
+    return refs;
+  }
+  let scriptFile = null;
+  let inline = false;
+  let module = false;
+  let j = i + 1;
+  while (j < tokens.length) {
+    const t = tokens[j];
+    const low = t.toLowerCase();
+    if (low === "-file") {
+      if (j + 1 < tokens.length && scriptFile === null) scriptFile = reviewCodeCleanToken(tokens[j + 1]);
+      j += 2;
+      continue;
+    }
+    if (low === "-m") {
+      // `python -m pkg` runs an installed module — packaged scope, not an
+      // agent-authored script (same exclusion as CLIs).
+      module = true;
+      j += 1;
+      continue;
+    }
+    if (low.startsWith("-enc")) {
+      if (j + 1 < tokens.length) refs.push({ kind: "encoded", data: tokens[j + 1] });
+      j += 2;
+      continue;
+    }
+    if (low === "-e" || low === "-c" || low === "-p" || low === "--print" || low.startsWith("-com") || low.startsWith("--eval")) {
+      inline = true;
+      if (depth < 2) {
+        // Recurse into the remaining tokens as one command string; strip the
+        // wrapping quotes first so the inner tokenization sees clean words
+        // (`pwsh -Command "node build.js"` → inner `node` + `build.js`).
+        const rest = tokens.slice(j + 1).join(" ").replace(/^["']+/, "").replace(/["']+$/, "");
+        if (rest.trim() !== "") {
+          for (const seg of reviewCodeSplitSegments(rest)) {
+            for (const inner of reviewCodeSegmentRefs(seg, depth + 1)) refs.push(inner);
+          }
+        }
+      }
+      break; // everything after an inline flag is code, not more flags/files
+    }
+    if (t.startsWith("-")) {
+      j += 1;
+      continue;
+    }
+    if (scriptFile === null && reviewCodeIsScriptFile(t)) scriptFile = reviewCodeCleanToken(t);
+    j += 1;
+  }
+  if (scriptFile !== null) refs.unshift({ kind: "file", path: scriptFile });
+  if (inline) refs.push({ kind: "inline" });
+  if (scriptFile === null && !inline && !module && refs.length === 0) {
+    refs.push({ kind: "note", text: head + " invoked, but no script file or inline-code flag was recognizable" });
+  }
+  return refs;
+}
+
+/** Extract all refs across every top-level segment of one command string. */
+export function reviewCodeRefsOf(command) {
+  const refs = [];
+  for (const seg of reviewCodeSplitSegments(command)) {
+    for (const ref of reviewCodeSegmentRefs(seg, 0)) refs.push(ref);
+  }
+  return refs;
+}
+
 /** Constrained to the
  * JSON-Schema subset `assertObjectJsonSchema` enforces for subagent outputs
  * (type/properties/required/additionalProperties/enum only).
@@ -2211,6 +2442,136 @@ export class AgentApprovalService extends TypertRemoteService {
     };
   }
 
+  /**
+   * v1.9.0: build the `effectiveCode` review-state field — the actual
+   * contents of the interpreter scripts one pending call would execute —
+   * plus a one-line visibility note for the audit rationale. The judge
+   * state stays workspace-scoped: file contents are only ever included for
+   * paths that resolve (symlinks followed and re-checked) inside the
+   * session workspace, so the expansion never ships beyond-boundary file
+   * contents anywhere. Capped, and fully best-effort: every fault degrades
+   * to a note inside the field and never blocks judging.
+   */
+  async _reviewEffectiveCode(session, argsRaw) {
+    let args;
+    try {
+      args = typeof argsRaw === "string" ? JSON.parse(argsRaw) : undefined;
+    } catch (e) {
+      args = undefined;
+    }
+    let cwd = "";
+    try {
+      if (session.header && typeof session.header.cwd === "string") cwd = session.header.cwd;
+    } catch (e) {
+      /* header access is best-effort */
+    }
+    let baseDir = cwd;
+    if (
+      args && typeof args === "object" && !Array.isArray(args) &&
+      typeof args.workdir === "string" && args.workdir.trim() !== ""
+    ) {
+      baseDir = args.workdir;
+    }
+    const commands = [];
+    const pushCommand = (v) => {
+      if (typeof v === "string" && v.trim() !== "" && commands.length < REVIEW_CODE_MAX_COMMANDS) commands.push(v);
+    };
+    if (typeof args === "string") pushCommand(args);
+    else if (args && typeof args === "object") {
+      for (const v of Object.values(args)) pushCommand(v);
+    }
+
+    const files = [];
+    let inlineCount = 0;
+    let encodedCount = 0;
+    const notes = [];
+    for (const command of commands) {
+      for (const ref of reviewCodeRefsOf(command)) {
+        if (ref.kind === "file") {
+          const dup = files.some((f) => f.toLowerCase() === ref.path.toLowerCase());
+          if (!dup && files.length < REVIEW_CODE_MAX_FILES) files.push(ref.path);
+        } else if (ref.kind === "inline") inlineCount += 1;
+        else if (ref.kind === "encoded") encodedCount += 1;
+        else if (ref.kind === "note") notes.push(ref.text);
+      }
+    }
+
+    const lines = [];
+    let filesRead = 0;
+    let filesSkipped = 0;
+    let filesMissing = 0;
+    let charsIncluded = 0;
+    const baseAbs = baseDir.trim() !== "" ? resolve(baseDir) : "";
+    const insideOf = (p) =>
+      baseAbs !== "" &&
+      (p.toLowerCase() === baseAbs.toLowerCase() || p.toLowerCase().startsWith(baseAbs.toLowerCase() + sep));
+    for (const raw of files) {
+      let resolved;
+      try {
+        resolved = resolve(baseAbs !== "" ? baseAbs : ".", raw);
+      } catch (e) {
+        filesMissing += 1;
+        continue;
+      }
+      if (!insideOf(resolved)) {
+        filesSkipped += 1;
+        lines.push("[script] " + raw + " — path resolves beyond the workspace boundary; skipped, contents never included");
+        continue;
+      }
+      let real = resolved;
+      try {
+        real = await realpath(resolved);
+        if (!insideOf(real)) {
+          filesSkipped += 1;
+          lines.push("[script] " + raw + " — symlink target lies beyond the workspace boundary; skipped, contents never included");
+          continue;
+        }
+      } catch (e) {
+        filesMissing += 1;
+        lines.push("[script] " + raw + " — not found on disk at review time");
+        continue;
+      }
+      try {
+        const st = await stat(real);
+        if (!st.isFile() || st.size > REVIEW_CODE_MAX_FILE_BYTES) {
+          filesSkipped += 1;
+          lines.push(
+            "[script] " + raw + " — " +
+              (st.isFile() ? "too large to review (" + st.size + " bytes)" : "not a regular file"),
+          );
+          continue;
+        }
+        let text = await readFile(real, "utf8");
+        const total = text.length;
+        if (total > REVIEW_CODE_FILE_CHARS) {
+          text = text.slice(0, REVIEW_CODE_FILE_CHARS) + "\n…[truncated, " + (total - REVIEW_CODE_FILE_CHARS) + " more chars]";
+        }
+        filesRead += 1;
+        charsIncluded += Math.min(total, REVIEW_CODE_FILE_CHARS);
+        lines.push("[script " + filesRead + "] " + raw + " → " + real + " (" + st.size + " bytes)\n" + text);
+      } catch (e) {
+        filesMissing += 1;
+        lines.push("[script] " + raw + " — not readable at review time: " + errText(e));
+      }
+    }
+    if (encodedCount > 0) {
+      lines.push("[-EncodedCommand] " + encodedCount + " base64-encoded invocation(s) present — the payload is not verifiable as readable code");
+    }
+    if (inlineCount > 0) {
+      lines.push("[inline] " + inlineCount + " inline-code invocation(s) — that code is embedded verbatim in the command text / toolArguments");
+    }
+    if (notes.length > 0) lines.push("[note] " + notes.join("; "));
+    if (lines.length === 0) {
+      return { text: "(no interpreter script file is referenced by this call)", note: "no script files referenced" };
+    }
+    const note =
+      "code: " + filesRead + " script file(s)" +
+      (charsIncluded > 0 ? ", ~" + Math.round(charsIncluded / 1024) + " KB included" : "") +
+      (filesSkipped > 0 ? ", " + filesSkipped + " skipped (beyond workspace / oversized)" : "") +
+      (filesMissing > 0 ? ", " + filesMissing + " missing/unreadable" : "");
+    return { text: trunc(lines.join("\n\n"), REVIEW_CODE_TOTAL_CHARS), note: note };
+  }
+
   /**
    * Judge one pending call through the Jev HTTP API (the review-mode judge).
    * Mirrors `_judgeWithJev`'s fail-closed contract exactly — same `_jevParse`
@@ -2242,8 +2603,14 @@ export class AgentApprovalService extends TypertRemoteService {
     }
 
     let winner;
+    let codeInfo = { text: "(not evaluated)", note: "" };
     try {
-      const state = this._reviewStateOf(session, exec, argsRaw);
+      try {
+        codeInfo = await this._reviewEffectiveCode(session, argsRaw);
+      } catch (e) {
+        codeInfo = { text: "(expansion fault: " + errText(e) + ")", note: "code expansion fault" };
+      }
+      const state = { ...this._reviewStateOf(session, exec, argsRaw), effectiveCode: codeInfo.text };
       winner = await Promise.race([
         this._jevRequest(cfg, state, controller.signal, JEV_REVIEW_QUESTIONS)
           .then((body) => ({ kind: "result", body: body }))
@@ -2310,7 +2677,7 @@ export class AgentApprovalService extends TypertRemoteService {
         outcome: approved ? "allowed-once" : "rejected",
         riskLevel: parsed.riskLevel,
         model: label,
-        rationale: trunc(parsed.rationale, 600),
+        rationale: trunc(parsed.rationale + (codeInfo.note !== "" ? " [" + codeInfo.note + "]" : ""), 600),
       });
       if (approved) {
         if (trustKey !== undefined) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@duke-dsh-plugins/dsh-agent-approval",
-  "version": "1.8.1",
-  "description": "Agent-decided approvals for DeepSeek Harness: an 自动审批 permission mode where every sandbox escalation is judged automatically (default judge: one direct LLM call with no subagent session; optional isolated judge subagent or the TypeSafe Jev decision model), plus an opt-in 自动审查 per-call review mode (Full access base; every tool call reviewed by the Jev judge before execution, risky calls rejected with no human fallback), with a configurable judge model and a per-session audit trail in the conversation window's 审批 tab.",
+  "version": "1.9.0",
+  "description": "Agent-decided approvals for DeepSeek Harness: an 自动审批 permission mode where every sandbox escalation is judged automatically (default judge: one direct LLM call with no subagent session; optional isolated judge subagent or the TypeSafe Jev decision model), plus an opt-in 自动审查 per-call review mode (Full access base; every tool call reviewed by the Jev judge before execution, with interpreter scripts the command references expanded into the judge state so temp scripts are judged by their actual code; risky calls rejected with no human fallback), with a configurable judge model and a per-session audit trail in the conversation window's 审批 tab.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/MoonlitDropOfBlood/dsh-agent-approval.git"