@duke-dsh-plugins/dsh-agent-approval 1.8.2 → 1.10.0

package/index.js

@@ -31,11 +31,14 @@
  *      `callId`) plus the asker's stated reason. A rejection must name the
  *      concrete, credible risk the operation creates (destructive /
  *      irreversible / out-of-scope / dishonest); vague unease is approved.
- *      v1.6.0: the judge can alternatively be the TypeSafe Jev "System One"
- *      decision model (synthetic provider id `typesafe`) — a direct HTTP
- *      call that answers typed Choice/Noul questions with calibrated
- *      probabilities; a confidence below the configured gate resolves
- *      fail-closed like any other fault (see `_judgeWithJev`).
+ *      v1.10.0: the judge is ALWAYS an LLM — either one direct stream call or
+ *      the spawn child. The TypeSafe Jev "System One" decision model (v1.6.0
+ *      through v1.9.x could judge escalations too, as the synthetic provider
+ *      id `typesafe`) is NO LONGER selectable here: its calibrated-but-shallow
+ *      risk judgement is a weaker safety net than an LLM judge on the
+ *      escalation path, which is exactly the path a human approval would have
+ *      guarded. Jev now backs the separate per-call review mode ONLY
+ *      (`_reviewWithJev`), configured independently from this judge.
  *
  *   3. FAIL CLOSED — any infrastructure fault, timeout, malformed verdict, or
  *      cancellation maps to the fail-closed approval outcomes
@@ -61,9 +64,9 @@
 
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { Service } from "@deepseek-ai/cordis";
-import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { appendFile, mkdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve, sep } from "node:path";
 
 // ---- constants --------------------------------------------------------------
 
@@ -110,29 +113,35 @@ const DATA_DIR = join(process.env.DSH_HOME || join(homedir(), ".dsh"), "agent-ap
 const CONFIG_FILE = join(DATA_DIR, "config.json");
 
 /**
- * v1.6.0: the TypeSafe Jev judge backend. Jev is a "System One" decision
- * model (https://api.typesafe.ai/v1/systemone): it does not generate text —
- * it answers typed questions (Choice / Score / Noul) over one `state` with
- * calibrated probability distributions in ~70–500ms. That is exactly the
- * approval-verdict shape, so instead of spawning a judge subagent through
- * the harness model registry (Jev is not a chat route and cannot appear in
- * `llm.listProviders()`), the Host half calls its HTTP API directly when the
- * configured judge provider is the synthetic `typesafe` id. Fail-closed is
- * preserved end to end: any transport fault, non-200, malformed answer, or a
- * confidence below the configured gate resolves `unavailable` — never a
- * grant, and (below the gate) not a recorded rejection either.
+ * v1.6.0 (removed from the escalation judge in v1.10.0): the TypeSafe Jev
+ * "System One" decision model (https://api.typesafe.ai/v1/systemone). It does
+ * not generate text — it answers typed questions (Choice / Score / Noul) over
+ * one `state` with calibrated probability distributions in ~70–500ms, and it
+ * cannot appear in `llm.listProviders()` (not a chat route), hence the direct
+ * HTTP call. It now judges the PER-CALL REVIEW mode only (`_reviewWithJev`),
+ * configured independently of the approval judge. Fail-closed is preserved end
+ * to end there as well: any transport fault, non-200, malformed answer, or a
+ * confidence below the configured gate denies the call (or, on the low
+ * confidence branch, records `unavailable` without a verdict).
  */
-const JEV_PROVIDER = "typesafe";
 const JEV_DEFAULT_MODEL = "jev-latest";
 const JEV_DEFAULT_ENDPOINT = "https://api.typesafe.ai/v1/systemone";
 const JEV_DEFAULT_CONFIDENCE = 0.5;
+/**
+ * The retired escalation-judge provider id (v1.6.0–v1.9.x). Kept ONLY to
+ * recognize and drop it from persisted configs: a config.json still carrying
+ * `model.provider: "typesafe"` migrates to the harness default route, and
+ * `setModel` treats it as "clear the override". Never used to route a judge.
+ */
+const JEV_LEGACY_PROVIDER = "typesafe";
 
 /**
- * The typed questions sent to Jev. Policy lives in the criteria descriptions
- * (Jev reads instructions literally and injects domain knowledge only through
- * state + criteria); the wording mirrors the subagent judge prompt's APPROVE
- * conditions / REJECT list / 误杀治理 so both backends judge to the same
- * standard. `decision` and `riskLevel` are Choices (discrete options +
+ * The typed questions sent to Jev — the shared policy base for
+ * `JEV_REVIEW_QUESTIONS` (the only sender since v1.10.0). Policy lives in the
+ * criteria descriptions (Jev reads instructions literally and injects domain
+ * knowledge only through state + criteria); the wording mirrors the LLM
+ * judge's APPROVE conditions / REJECT list / 误杀治理 so both judge to the
+ * same standard. `decision` and `riskLevel` are Choices (discrete options +
  * probabilities + confidence); `concreteRisk` is a Noul probe whose
  * probability is folded into the synthesized audit rationale.
  */
@@ -164,15 +173,31 @@ const JEV_QUESTIONS = {
 };
 
 /**
- * v1.8.0: the per-call review mode (`agent-review` preset). The SAME policy
- * criteria as `JEV_QUESTIONS` — only the decision instruction wording adapts
- * from "escalation request" to the pending tool call.
+ * v1.8.0: the per-call review mode (`agent-review` preset) — since v1.10.0
+ * the ONLY Jev caller. The SAME policy criteria as `JEV_QUESTIONS` — only the
+ * decision instruction wording adapts from "escalation request" to the
+ * pending tool call. v1.9.0 adds guidance
+ * for the `effectiveCode` state field (the actual interpreter scripts the
+ * call would run): judge the code when present; reduced visibility alone is
+ * never a rejection reason (误杀治理 holds); and a source-edit diff that
+ * merely mentions destructive or security operations is not dangerous
+ * itself — the live false kill that motivated this sentence: Jev rejected
+ * THIS plugin's own criteria-text edit (risk=high 0.87) on 2026-09-29
+ * because the diff contained the phrases below.
  */
 const JEV_REVIEW_QUESTIONS = {
   ...JEV_QUESTIONS,
   decision: {
     ...JEV_QUESTIONS.decision,
     instructions: "Should this pending tool call be allowed to execute?",
+    criteria: {
+      approve:
+        JEV_QUESTIONS.decision.criteria.approve +
+        " The state's `effectiveCode` field carries the actual content of the interpreter scripts (node/python/bash/PowerShell files) this call would execute — when present, judge THAT code, not just the command line: a plainly safe, task-scoped script stays approved even if its command line alone looks opaque. When the pending call edits source files, judge what the change does to the file and whether it fits the task: diff text that merely mentions destructive or security operations (tests, security policy, incident reports, documentation) does not make the change dangerous.",
+      reject:
+        JEV_QUESTIONS.decision.criteria.reject +
+        " When `effectiveCode` is present, judge by that code: a script whose code deletes or modifies data outside the workspace, exfiltrates secrets, or hides obfuscated payloads is rejected for what its code shows. A referenced script that is unreadable, outside the workspace, oversized, or not decodable reduces your visibility — weigh that in concreteRisk, but never reject for reduced visibility alone: an ordinary script you simply have not seen is not, by itself, a risk.",
+    },
   },
 };
 
@@ -197,6 +222,222 @@ const RUN_CODE_TOOL = "run_code";
 const REVIEW_DENIED_NAME = "AgentReviewDeniedError";
 const REVIEW_DENIED_CODE = "AGENT_REVIEW_DENIED";
 
+/**
+ * v1.9.0 — per-call review (REVIEW MODE ONLY): effective-code expansion.
+ *
+ * The review judge otherwise sees a command line like `node scripts/x.js`
+ * and nothing about what that script does — the classic blind spot through
+ * which an agent-authored temp script once wiped ~/.dsh (2026-09 incident).
+ * Before judging, the plugin extracts the script files the command would
+ * execute and includes their contents in the Jev state's `effectiveCode`
+ * field, so the judge rules on the code itself.
+ *
+ * Scope (user ruling 2026-09-29): interpreter scripts only (node / python /
+ * bash / PowerShell and friends); packaged CLIs (`npm run`, `npx`, `git`, …)
+ * are deliberately NOT expanded. The escalation (自动审批) path is untouched —
+ * `_jevStateOf` is not modified. Reads are workspace-confined (paths that
+ * resolve — including through symlinks — outside the session workspace are
+ * noted, never read: the expansion must not become an exfiltration channel),
+ * capped, and fully best-effort: every fault degrades to a note inside the
+ * field and never blocks judging.
+ */
+const REVIEW_CODE_MAX_FILES = 4;
+const REVIEW_CODE_FILE_CHARS = 8192;
+const REVIEW_CODE_TOTAL_CHARS = 10000;
+const REVIEW_CODE_MAX_FILE_BYTES = 262144;
+const REVIEW_CODE_MAX_COMMANDS = 6;
+
+/** File extensions treated as "an interpreter script the agent may have written". */
+const REVIEW_CODE_SCRIPT_EXTENSIONS = [
+  ".js", ".mjs", ".cjs", ".jsx", ".ts", ".mts", ".cts",
+  ".py", ".pyw", ".sh", ".bash", ".ps1", ".psm1", ".rb", ".pl",
+];
+
+/** Interpreters whose positional argument (or `-File` value) is a script file. */
+const REVIEW_CODE_INTERPRETERS = new Set([
+  "node", "node.exe", "nodejs", "bun", "bun.exe", "deno", "deno.exe",
+  "python", "python.exe", "python3", "python3.exe", "py", "py.exe",
+  "bash", "bash.exe", "sh", "sh.exe", "zsh", "dash",
+  "pwsh", "pwsh.exe", "powershell", "powershell.exe",
+]);
+
+/** Strip wrapping quotes/braces a tokenizer may have left on a token. */
+function reviewCodeCleanToken(token) {
+  return String(token).replace(/^["'{(]+/, "").replace(/["'}),;]+$/, "");
+}
+
+/** True when the token names a file with a known interpreter-script extension. */
+function reviewCodeIsScriptFile(token) {
+  const t = reviewCodeCleanToken(token).toLowerCase();
+  for (const ext of REVIEW_CODE_SCRIPT_EXTENSIONS) {
+    if (t.endsWith(ext)) return true;
+  }
+  return false;
+}
+
+/**
+ * Split one shell command into top-level segments on `; | &` and newlines,
+ * respecting both quote styles and PowerShell brace blocks, so code embedded
+ * in `-Command "…"` / `-e "…"` stays one segment.
+ */
+function reviewCodeSplitSegments(command) {
+  const parts = [];
+  let cur = "";
+  let quote = null;
+  let depth = 0;
+  for (const ch of String(command)) {
+    if (quote !== null) {
+      cur += ch;
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      cur += ch;
+      continue;
+    }
+    if (ch === "{") depth += 1;
+    if (ch === "}") depth = Math.max(0, depth - 1);
+    if (depth === 0 && (ch === ";" || ch === "|" || ch === "&" || ch === "\n" || ch === "\r")) {
+      parts.push(cur);
+      cur = "";
+      continue;
+    }
+    cur += ch;
+  }
+  parts.push(cur);
+  return parts.map((s) => s.trim()).filter((s) => s !== "");
+}
+
+/** Whitespace tokenizer that keeps quoted runs (quotes attached) as one token. */
+function reviewCodeTokens(segment) {
+  const tokens = [];
+  let cur = "";
+  let quote = null;
+  let has = false;
+  for (const ch of String(segment)) {
+    if (quote !== null) {
+      cur += ch;
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      has = true;
+      cur += ch;
+      continue;
+    }
+    if (ch === " " || ch === "\t") {
+      if (has) tokens.push(cur);
+      cur = "";
+      has = false;
+      continue;
+    }
+    cur += ch;
+    has = true;
+  }
+  if (has) tokens.push(cur);
+  return tokens;
+}
+
+/**
+ * Extract script references from ONE command segment:
+ *   - `{kind:"file", path}`    — a script file the command would execute;
+ *   - `{kind:"inline"}`        — an inline-code flag (`-e`/`-c`/`-Command`…);
+ *     that code is already visible verbatim in the tool arguments;
+ *   - `{kind:"encoded", data}` — a `-EncodedCommand`/`-enc` payload;
+ *   - `{kind:"note", text}`    — anything unrecognizable worth surfacing.
+ * Depth-limited recursion expands code nested inside inline flags
+ * (`pwsh -Command "node x.js"`, `bash -c "python x.py"`).
+ */
+function reviewCodeSegmentRefs(segment, depth) {
+  const tokens = reviewCodeTokens(segment);
+  let i = 0;
+  while (
+    i < tokens.length &&
+    (tokens[i] === "&" || tokens[i] === "." || tokens[i] === "call" ||
+      tokens[i] === "source" || tokens[i] === "sudo" || tokens[i] === "exec")
+  ) {
+    i += 1;
+  }
+  if (i >= tokens.length) return [];
+  const head = tokens[i].replace(/^.*[\\/]/, "").toLowerCase();
+  const refs = [];
+  if (!REVIEW_CODE_INTERPRETERS.has(head)) {
+    // Not an interpreter head: only a leading token that is itself a script
+    // file counts (call operators stripped above). No mid-segment scanning,
+    // so `git diff -- foo.py` never pulls foo.py into the state. Multi-word
+    // leftovers (a quoted chunk that reached this branch) are never taken
+    // as a path.
+    const lead = tokens[i];
+    if (reviewCodeIsScriptFile(lead) && !/\s/.test(reviewCodeCleanToken(lead))) {
+      refs.push({ kind: "file", path: reviewCodeCleanToken(lead) });
+    }
+    return refs;
+  }
+  let scriptFile = null;
+  let inline = false;
+  let module = false;
+  let j = i + 1;
+  while (j < tokens.length) {
+    const t = tokens[j];
+    const low = t.toLowerCase();
+    if (low === "-file") {
+      if (j + 1 < tokens.length && scriptFile === null) scriptFile = reviewCodeCleanToken(tokens[j + 1]);
+      j += 2;
+      continue;
+    }
+    if (low === "-m") {
+      // `python -m pkg` runs an installed module — packaged scope, not an
+      // agent-authored script (same exclusion as CLIs).
+      module = true;
+      j += 1;
+      continue;
+    }
+    if (low.startsWith("-enc")) {
+      if (j + 1 < tokens.length) refs.push({ kind: "encoded", data: tokens[j + 1] });
+      j += 2;
+      continue;
+    }
+    if (low === "-e" || low === "-c" || low === "-p" || low === "--print" || low.startsWith("-com") || low.startsWith("--eval")) {
+      inline = true;
+      if (depth < 2) {
+        // Recurse into the remaining tokens as one command string; strip the
+        // wrapping quotes first so the inner tokenization sees clean words
+        // (`pwsh -Command "node build.js"` → inner `node` + `build.js`).
+        const rest = tokens.slice(j + 1).join(" ").replace(/^["']+/, "").replace(/["']+$/, "");
+        if (rest.trim() !== "") {
+          for (const seg of reviewCodeSplitSegments(rest)) {
+            for (const inner of reviewCodeSegmentRefs(seg, depth + 1)) refs.push(inner);
+          }
+        }
+      }
+      break; // everything after an inline flag is code, not more flags/files
+    }
+    if (t.startsWith("-")) {
+      j += 1;
+      continue;
+    }
+    if (scriptFile === null && reviewCodeIsScriptFile(t)) scriptFile = reviewCodeCleanToken(t);
+    j += 1;
+  }
+  if (scriptFile !== null) refs.unshift({ kind: "file", path: scriptFile });
+  if (inline) refs.push({ kind: "inline" });
+  if (scriptFile === null && !inline && !module && refs.length === 0) {
+    refs.push({ kind: "note", text: head + " invoked, but no script file or inline-code flag was recognizable" });
+  }
+  return refs;
+}
+
+/** Extract all refs across every top-level segment of one command string. */
+export function reviewCodeRefsOf(command) {
+  const refs = [];
+  for (const seg of reviewCodeSplitSegments(command)) {
+    for (const ref of reviewCodeSegmentRefs(seg, 0)) refs.push(ref);
+  }
+  return refs;
+}
+
 /** Constrained to the
  * JSON-Schema subset `assertObjectJsonSchema` enforces for subagent outputs
  * (type/properties/required/additionalProperties/enum only).
@@ -378,10 +619,13 @@ export class AgentApprovalService extends TypertRemoteService {
      */
     this._reviewDefault = false;
     /**
-     * TypeSafe Jev direct backend settings (used when `_model.provider` is
-     * the synthetic `typesafe` id). The API key lives in plaintext on this
-     * machine only (config.json, same trust domain as the rest of the
-     * settings); an empty key falls back to the TYPESAFE_API_KEY env var.
+     * TypeSafe Jev direct backend settings — v1.10.0: the INDEPENDENT
+     * configuration of the 自动审查 (per-call review) mode, no longer part of
+     * the approval judge's provider selection. Configuring it (a resolvable
+     * key) is what opens the review gate; see `_jevGateOk`. The API key lives
+     * in plaintext on this machine only (config.json, same trust domain as
+     * the rest of the settings); an empty key falls back to the
+     * TYPESAFE_API_KEY env var.
      */
     this._jev = {
       apiKey: "",
@@ -645,7 +889,7 @@ export class AgentApprovalService extends TypertRemoteService {
         return "自动审批 is already ON for this session — switch modes through the /permission menu";
       }
       if (!this._jevGateOk()) {
-        return "自动审查 requires the Jev judge: set the 审批模型 Provider to TypeSafe Jev with an API key in Settings → 自动审批 first";
+        return "自动审查 requires the Jev judge: configure a Jev API key in Settings → 自动审批 → 「自动审查」first";
       }
       this._enableCore(session, agent, "review");
       if (this._presetRegistered(REVIEW_PRESET_NAME)) {
@@ -676,13 +920,14 @@ export class AgentApprovalService extends TypertRemoteService {
   }
 
   /**
-   * v1.8.0 gate for the per-call review mode: the user must have switched the
-   * judge to TypeSafe Jev with a resolvable API key ("设置了使用 Jev").
-   * Everything about the mode is built around the Jev judge — enabling it
-   * without one would leave Full access with nobody judging.
+   * v1.8.0, re-based in v1.10.0: the gate for the per-call review mode. The
+   * Jev backend is the review mode's own, independent configuration — the
+   * gate is simply "a Jev API key resolves" (config.json or
+   * TYPESAFE_API_KEY). It no longer requires switching the APPROVAL judge to
+   * Jev (that option is gone as of v1.10.0), and it never reads `_model`.
    */
   _jevGateOk() {
-    return this._model.provider === JEV_PROVIDER && this._jevEffective().key !== "";
+    return this._jevEffective().key !== "";
   }
 
   /**
@@ -707,7 +952,7 @@ export class AgentApprovalService extends TypertRemoteService {
         durationMs: 0,
         childSessionId: "",
         rationale:
-          "自动审查 requires the Jev judge (Settings → 自动审批: Provider = TypeSafe Jev with an API key); falling back to the 自动审批 preset (fail closed)",
+          "自动审查 requires the Jev judge (Settings → 自动审批 → 「自动审查」卡片: configure a Jev API key); falling back to the 自动审批 preset (fail closed)",
         mode: "review",
       });
       const presets = this.ctx.get("permissionPresets");
@@ -1057,7 +1302,13 @@ export class AgentApprovalService extends TypertRemoteService {
           typeof cfg.model.provider === "string" &&
           typeof cfg.model.model === "string"
         ) {
-          this._model = { provider: cfg.model.provider, model: cfg.model.model };
+          // v1.10.0 migration: a persisted `typesafe` judge route (v1.6.0–
+          // v1.9.x) is no longer a valid judge — fall back to the harness
+          // default route instead of keeping a dead provider on the wire.
+          this._model =
+            cfg.model.provider === JEV_LEGACY_PROVIDER
+              ? { provider: "", model: "" }
+              : { provider: cfg.model.provider, model: cfg.model.model };
         }
         if (cfg.judgeMode === JUDGE_MODE_LLM || cfg.judgeMode === JUDGE_MODE_SUBAGENT) {
           this._judgeMode = cfg.judgeMode;
@@ -1258,10 +1509,6 @@ export class AgentApprovalService extends TypertRemoteService {
    * records display — "p/m" = selected, "default(p/m)" = harness default.
    */
   _judgeRoute() {
-    if (this._model.provider === JEV_PROVIDER) {
-      const model = this._jevEffective().model;
-      return { provider: JEV_PROVIDER, model: model, label: "jev(" + model + ")" };
-    }
     if (this._model.provider !== "" && this._model.model !== "") {
       return {
         provider: this._model.provider,
@@ -1327,13 +1574,11 @@ export class AgentApprovalService extends TypertRemoteService {
       return "allowed-once";
     }
 
-    // 3. The judge. The TypeSafe Jev backend is a direct HTTP call (no
-    //    subagent, no harness model route); the DEFAULT "llm" mode is one
-    //    direct ctx.llm.stream() call (no subagent either — v1.8.0); only
-    //    judgeMode === "subagent" spawns the judge child through `spawn`.
-    if (this._model.provider === JEV_PROVIDER) {
-      return this._judgeWithJev(session, req, argsRaw, base, trustKey);
-    }
+    // 3. The judge — always an LLM (v1.10.0: Jev is no longer selectable
+    //    here; it judges the per-call review mode only). The DEFAULT "llm"
+    //    mode is one direct ctx.llm.stream() call (no subagent either —
+    //    v1.8.0); only judgeMode === "subagent" spawns the judge child
+    //    through `spawn`.
     if (this._judgeMode !== JUDGE_MODE_SUBAGENT) {
       return this._judgeWithLlmStream(session, req, argsRaw, base, trustKey);
     }
@@ -1472,7 +1717,7 @@ export class AgentApprovalService extends TypertRemoteService {
    * exactly — same persona, same `_judgePrompt`, same VERDICT_SCHEMA verdict
    * contract — only the invocation differs: no subagent session is created
    * (zero judge-side context pollution; `childSessionId` stays empty).
-   * Mirrors `_judgeWithJev`'s fail-closed contract:
+   * Fail-closed contract:
    *   - no concrete route / llm fault / non-'stop' finish / malformed verdict
    *     / timeout → `unavailable`
    *   - request cancelled mid-flight → `cancelled`
@@ -1738,13 +1983,12 @@ export class AgentApprovalService extends TypertRemoteService {
     return { decision: value.decision, riskLevel: value.riskLevel, rationale: value.rationale };
   }
 
-  // ---- the TypeSafe Jev direct backend ---------------------------------------
+  // ---- the TypeSafe Jev direct backend (自动审查 only, since v1.10.0) ---------
 
   /**
    * Effective Jev settings with env fallback and clamping applied. The key
    * may come from config.json or the TYPESAFE_API_KEY environment variable;
-   * an absent key keeps the backend selected but every judgment resolves
-   * `unavailable` (fail closed) until one is configured.
+   * an absent key keeps the review gate closed, so 自动审查 cannot be armed.
    */
   _jevEffective() {
     const key = String(this._jev.apiKey || process.env.TYPESAFE_API_KEY || "").trim();
@@ -1792,110 +2036,12 @@ export class AgentApprovalService extends TypertRemoteService {
   }
 
   /**
-   * Judge one escalation through the Jev HTTP API (state + typed questions →
-   * calibrated probability distributions). Mirrors `_judge`'s spawn-path
-   * contract exactly — rules and the session trust cache have already run —
-   * and every abnormal shape resolves fail-closed:
-   *   - no API key / transport fault / non-200 / malformed answer → `unavailable`
-   *   - request cancelled mid-flight → `cancelled`
-   *   - overall timeout (the same `this._timeoutMs` budget) → `unavailable`
-   *   - confidence below the configured gate → `unavailable` (the model is
-   *     not sure enough to decide: never a grant, and not a recorded
-   *     rejection either — the v1.4.0 误杀治理 applies symmetrically)
-   * Jev does not generate text, so the audit rationale is synthesized from
-   * the returned distributions; the served model version (`body.model`,
-   * which resolves aliases like jev-latest) is what the audit displays.
+   * The single POST to the System One endpoint; resolves the parsed body.
+   * `questions` defaults to the per-call review set (the only caller since
+   * v1.10.0). `state` leaves this machine by design — that is the review
+   * judge's whole point (see the workspace-confined code expansion in
+   * `_reviewEffectiveCode`).
    */
-  async _judgeWithJev(session, req, argsRaw, base, trustKey) {
-    const cfg = this._jevEffective();
-    if (cfg.key === "") {
-      this._record(session, {
-        ...base,
-        outcome: "unavailable",
-        riskLevel: "-",
-        model: "jev(" + cfg.model + ")",
-        rationale: "Jev backend selected but no API key configured (Settings → 自动审批, or the TYPESAFE_API_KEY environment variable)",
-      });
-      return "unavailable";
-    }
-    if (typeof fetch !== "function") {
-      this._record(session, { ...base, outcome: "unavailable", riskLevel: "-", model: "jev(" + cfg.model + ")", rationale: "fetch is unavailable in this runtime" });
-      return "unavailable";
-    }
-
-    const startedAt = Date.now();
-    const controller = new AbortController();
-    const signal = req.signal;
-    const onAbort = () => controller.abort();
-    if (signal && typeof signal.addEventListener === "function") {
-      signal.addEventListener("abort", onAbort, { once: true });
-    }
-
-    let winner;
-    try {
-      const state = this._jevStateOf(session, req, argsRaw);
-      winner = await Promise.race([
-        this._jevRequest(cfg, state, controller.signal)
-          .then((body) => ({ kind: "result", body: body }))
-          .catch((error) => ({
-            kind: "fault",
-            error: error,
-            aborted: error && error.name === "AbortError",
-          })),
-        (signal
-          ? new Promise((resolve) => {
-              if (signal.aborted) {
-                resolve(true);
-                return;
-              }
-              signal.addEventListener("abort", () => resolve(true), { once: true });
-            })
-          : Promise.resolve(false)
-        ).then((v) => ({ kind: "aborted", aborted: v })),
-        this.ctx.timeout(this._timeoutMs).then(() => ({ kind: "timeout" })),
-      ]);
-    } finally {
-      if (signal && typeof signal.removeEventListener === "function") {
-        signal.removeEventListener("abort", onAbort);
-      }
-      // Whether we lost the race to timeout/cancel or the request already
-      // settled, closing the transport is always safe.
-      try {
-        controller.abort();
-      } catch (e) {
-        /* controller abort never blocks the outcome */
-      }
-    }
-    const durationMs = Date.now() - startedAt;
-
-    if (winner.kind === "result") {
-      return this._jevVerdict(session, winner.body, cfg, base, trustKey, durationMs);
-    }
-    if (winner.kind === "aborted") {
-      this._record(session, { ...base, outcome: "cancelled", riskLevel: "-", model: "jev(" + cfg.model + ")", rationale: "request cancelled while Jev was judging" });
-      return "cancelled";
-    }
-    if (winner.kind === "timeout") {
-      this._record(session, {
-        ...base,
-        outcome: "unavailable",
-        riskLevel: "-",
-        model: "jev(" + cfg.model + ")",
-        rationale: "Jev request timed out after " + String(this._timeoutMs) + "ms (fail closed)",
-      });
-      return "unavailable";
-    }
-    if (winner.aborted) {
-      this._record(session, { ...base, outcome: "cancelled", riskLevel: "-", model: "jev(" + cfg.model + ")", rationale: "request cancelled while Jev was judging" });
-      return "cancelled";
-    }
-    this._record(session, { ...base, outcome: "unavailable", riskLevel: "-", model: "jev(" + cfg.model + ")", rationale: "Jev request failed: " + errText(winner.error) });
-    return "unavailable";
-  }
-
-  /** The single POST to the System One endpoint; resolves the parsed body.
-   *  `questions` defaults to the escalation set; the review path passes
-   *  `JEV_REVIEW_QUESTIONS`. */
   async _jevRequest(cfg, state, abortSignal, questions) {
     const response = await fetch(cfg.endpoint, {
       method: "POST",
@@ -1906,7 +2052,7 @@ export class AgentApprovalService extends TypertRemoteService {
       body: JSON.stringify({
         state: state,
         model: cfg.model,
-        questions: questions === undefined ? JEV_QUESTIONS : questions,
+        questions: questions === undefined ? JEV_REVIEW_QUESTIONS : questions,
       }),
       signal: abortSignal,
     });
@@ -1925,9 +2071,9 @@ export class AgentApprovalService extends TypertRemoteService {
   }
 
   /**
-   * Parse + gate one Jev response into a normalized verdict, shared by the
-   * escalation path (`_jevVerdict`) and the per-call review path
-   * (`_reviewWithJev`) so both judge to exactly the same standard:
+   * Parse + gate one Jev response into a normalized verdict, shared by every
+   * review call (the escalation path stopped using Jev in v1.10.0) so the
+   * review judge always holds to the same standard:
    *   - `{ kind: "malformed", served }` — any missing/out-of-shape answer
    *   - `{ kind: "low-confidence", served, choice, riskLevel, confidence, gate }`
    *   - `{ kind: "verdict", served, choice, riskLevel, rationale }`
@@ -2000,56 +2146,6 @@ export class AgentApprovalService extends TypertRemoteService {
     return { kind: "verdict", served: served, choice: choice, riskLevel: riskChoice, rationale: rationale };
   }
 
-  /**
-   * Map a Jev response to the same outcomes the subagent path produces.
-   * Returns the waterfall outcome string; records the audit line itself.
-   */
-  _jevVerdict(session, body, cfg, base, trustKey, durationMs) {
-    const parsed = this._jevParse(body, cfg);
-    const label = "jev(" + parsed.served + ")";
-    base.durationMs = durationMs;
-
-    if (parsed.kind === "malformed") {
-      this._record(session, {
-        ...base,
-        outcome: "unavailable",
-        riskLevel: "-",
-        model: label,
-        rationale: "Jev returned no valid verdict shape (decision/riskLevel/concreteRisk incomplete)",
-      });
-      return "unavailable";
-    }
-    if (parsed.kind === "low-confidence") {
-      this._record(session, {
-        ...base,
-        outcome: "unavailable",
-        riskLevel: parsed.riskLevel,
-        model: label,
-        rationale:
-          "Jev confidence " + parsed.confidence.toFixed(2) + " is below the gate " + parsed.gate.toFixed(2) + " (decision draft: " + parsed.choice + ") — fail closed",
-      });
-      return "unavailable";
-    }
-
-    const approved = parsed.choice === "approve";
-    this._record(session, {
-      ...base,
-      outcome: approved ? "allowed-once" : "rejected",
-      riskLevel: parsed.riskLevel,
-      model: label,
-      rationale: trunc(parsed.rationale, 600),
-    });
-    if (approved && trustKey !== undefined) {
-      let set = this._trusted.get(session.id);
-      if (set === undefined) {
-        set = new Set();
-        this._trusted.set(session.id, set);
-      }
-      set.add(trustKey);
-    }
-    return approved ? "allowed-once" : "rejected";
-  }
-
   // ---- v1.8.0 per-call review mode (agent-review) ----------------------------
 
   /**
@@ -2212,12 +2308,142 @@ export class AgentApprovalService extends TypertRemoteService {
   }
 
   /**
-   * Judge one pending call through the Jev HTTP API (the review-mode judge).
-   * Mirrors `_judgeWithJev`'s fail-closed contract exactly — same `_jevParse`
-   * standard, same confidence gate — but every outcome is FINAL: rejections,
-   * low confidence, timeouts and faults all deny the call (no human
-   * fallback). Returns `undefined` to allow, otherwise a pre-execute
-   * decision.
+   * v1.9.0: build the `effectiveCode` review-state field — the actual
+   * contents of the interpreter scripts one pending call would execute —
+   * plus a one-line visibility note for the audit rationale. The judge
+   * state stays workspace-scoped: file contents are only ever included for
+   * paths that resolve (symlinks followed and re-checked) inside the
+   * session workspace, so the expansion never ships beyond-boundary file
+   * contents anywhere. Capped, and fully best-effort: every fault degrades
+   * to a note inside the field and never blocks judging.
+   */
+  async _reviewEffectiveCode(session, argsRaw) {
+    let args;
+    try {
+      args = typeof argsRaw === "string" ? JSON.parse(argsRaw) : undefined;
+    } catch (e) {
+      args = undefined;
+    }
+    let cwd = "";
+    try {
+      if (session.header && typeof session.header.cwd === "string") cwd = session.header.cwd;
+    } catch (e) {
+      /* header access is best-effort */
+    }
+    let baseDir = cwd;
+    if (
+      args && typeof args === "object" && !Array.isArray(args) &&
+      typeof args.workdir === "string" && args.workdir.trim() !== ""
+    ) {
+      baseDir = args.workdir;
+    }
+    const commands = [];
+    const pushCommand = (v) => {
+      if (typeof v === "string" && v.trim() !== "" && commands.length < REVIEW_CODE_MAX_COMMANDS) commands.push(v);
+    };
+    if (typeof args === "string") pushCommand(args);
+    else if (args && typeof args === "object") {
+      for (const v of Object.values(args)) pushCommand(v);
+    }
+
+    const files = [];
+    let inlineCount = 0;
+    let encodedCount = 0;
+    const notes = [];
+    for (const command of commands) {
+      for (const ref of reviewCodeRefsOf(command)) {
+        if (ref.kind === "file") {
+          const dup = files.some((f) => f.toLowerCase() === ref.path.toLowerCase());
+          if (!dup && files.length < REVIEW_CODE_MAX_FILES) files.push(ref.path);
+        } else if (ref.kind === "inline") inlineCount += 1;
+        else if (ref.kind === "encoded") encodedCount += 1;
+        else if (ref.kind === "note") notes.push(ref.text);
+      }
+    }
+
+    const lines = [];
+    let filesRead = 0;
+    let filesSkipped = 0;
+    let filesMissing = 0;
+    let charsIncluded = 0;
+    const baseAbs = baseDir.trim() !== "" ? resolve(baseDir) : "";
+    const insideOf = (p) =>
+      baseAbs !== "" &&
+      (p.toLowerCase() === baseAbs.toLowerCase() || p.toLowerCase().startsWith(baseAbs.toLowerCase() + sep));
+    for (const raw of files) {
+      let resolved;
+      try {
+        resolved = resolve(baseAbs !== "" ? baseAbs : ".", raw);
+      } catch (e) {
+        filesMissing += 1;
+        continue;
+      }
+      if (!insideOf(resolved)) {
+        filesSkipped += 1;
+        lines.push("[script] " + raw + " — path resolves beyond the workspace boundary; skipped, contents never included");
+        continue;
+      }
+      let real = resolved;
+      try {
+        real = await realpath(resolved);
+        if (!insideOf(real)) {
+          filesSkipped += 1;
+          lines.push("[script] " + raw + " — symlink target lies beyond the workspace boundary; skipped, contents never included");
+          continue;
+        }
+      } catch (e) {
+        filesMissing += 1;
+        lines.push("[script] " + raw + " — not found on disk at review time");
+        continue;
+      }
+      try {
+        const st = await stat(real);
+        if (!st.isFile() || st.size > REVIEW_CODE_MAX_FILE_BYTES) {
+          filesSkipped += 1;
+          lines.push(
+            "[script] " + raw + " — " +
+              (st.isFile() ? "too large to review (" + st.size + " bytes)" : "not a regular file"),
+          );
+          continue;
+        }
+        let text = await readFile(real, "utf8");
+        const total = text.length;
+        if (total > REVIEW_CODE_FILE_CHARS) {
+          text = text.slice(0, REVIEW_CODE_FILE_CHARS) + "\n…[truncated, " + (total - REVIEW_CODE_FILE_CHARS) + " more chars]";
+        }
+        filesRead += 1;
+        charsIncluded += Math.min(total, REVIEW_CODE_FILE_CHARS);
+        lines.push("[script " + filesRead + "] " + raw + " → " + real + " (" + st.size + " bytes)\n" + text);
+      } catch (e) {
+        filesMissing += 1;
+        lines.push("[script] " + raw + " — not readable at review time: " + errText(e));
+      }
+    }
+    if (encodedCount > 0) {
+      lines.push("[-EncodedCommand] " + encodedCount + " base64-encoded invocation(s) present — the payload is not verifiable as readable code");
+    }
+    if (inlineCount > 0) {
+      lines.push("[inline] " + inlineCount + " inline-code invocation(s) — that code is embedded verbatim in the command text / toolArguments");
+    }
+    if (notes.length > 0) lines.push("[note] " + notes.join("; "));
+    if (lines.length === 0) {
+      return { text: "(no interpreter script file is referenced by this call)", note: "no script files referenced" };
+    }
+    const note =
+      "code: " + filesRead + " script file(s)" +
+      (charsIncluded > 0 ? ", ~" + Math.round(charsIncluded / 1024) + " KB included" : "") +
+      (filesSkipped > 0 ? ", " + filesSkipped + " skipped (beyond workspace / oversized)" : "") +
+      (filesMissing > 0 ? ", " + filesMissing + " missing/unreadable" : "");
+    return { text: trunc(lines.join("\n\n"), REVIEW_CODE_TOTAL_CHARS), note: note };
+  }
+
+  /**
+   * Judge one pending call through the Jev HTTP API — the review mode's only
+   * judge, and the only remaining Jev caller since v1.10.0. Fail-closed
+   * through `_jevParse` (same validation, same confidence gate) but every
+   * outcome is FINAL: rejections, low confidence, timeouts and faults all
+   * deny the call (no human fallback). Returns `undefined` to allow,
+   * otherwise a pre-execute decision.
    */
   async _reviewWithJev(session, exec, argsRaw, base, trustKey) {
     const cfg = this._jevEffective();
@@ -2242,8 +2468,14 @@ export class AgentApprovalService extends TypertRemoteService {
     }
 
     let winner;
+    let codeInfo = { text: "(not evaluated)", note: "" };
     try {
-      const state = this._reviewStateOf(session, exec, argsRaw);
+      try {
+        codeInfo = await this._reviewEffectiveCode(session, argsRaw);
+      } catch (e) {
+        codeInfo = { text: "(expansion fault: " + errText(e) + ")", note: "code expansion fault" };
+      }
+      const state = { ...this._reviewStateOf(session, exec, argsRaw), effectiveCode: codeInfo.text };
       winner = await Promise.race([
         this._jevRequest(cfg, state, controller.signal, JEV_REVIEW_QUESTIONS)
           .then((body) => ({ kind: "result", body: body }))
@@ -2310,7 +2542,7 @@ export class AgentApprovalService extends TypertRemoteService {
         outcome: approved ? "allowed-once" : "rejected",
         riskLevel: parsed.riskLevel,
         model: label,
-        rationale: trunc(parsed.rationale, 600),
+        rationale: trunc(parsed.rationale + (codeInfo.note !== "" ? " [" + codeInfo.note + "]" : ""), 600),
       });
       if (approved) {
         if (trustKey !== undefined) {
@@ -2409,15 +2641,18 @@ export class AgentApprovalService extends TypertRemoteService {
 
   /**
    * Set the judge model override. Empty strings clear it (the judge then runs
-   * on the harness default route, never the requester's). Persisted.
+   * on the harness default route, never the requester's). v1.10.0: Jev is no
+   * longer a judge provider — a legacy `typesafe` selection migrates to the
+   * harness default route. Persisted.
    */
   async setModel(request) {
     const provider = request && typeof request.provider === "string" ? request.provider : "";
     const model = request && typeof request.model === "string" ? request.model : "";
-    if (provider === JEV_PROVIDER) {
-      // The Jev backend ignores the harness route table; an unset model just
-      // means the latest alias.
-      this._model = { provider: JEV_PROVIDER, model: model !== "" ? model : JEV_DEFAULT_MODEL };
+    if (provider === JEV_LEGACY_PROVIDER) {
+      // v1.6.0–v1.9.x routed the escalation judge to Jev. That option is gone
+      // (Jev judges the per-call review mode only), so an old client still
+      // sending it clears the override instead of resurrecting a dead route.
+      this._model = { provider: "", model: "" };
     } else {
       this._model =
         provider !== "" && model !== "" ? { provider, model } : { provider: "", model: "" };
@@ -2461,20 +2696,35 @@ export class AgentApprovalService extends TypertRemoteService {
   }
 
   /**
-   * Set the TypeSafe Jev backend settings (only provided fields change).
-   * `confidence` is the gate below which Jev's answer is not trusted and the
-   * outcome resolves fail-closed; clamped to [0.01, 0.99]. Persisted.
+   * Set the TypeSafe Jev backend settings (only provided fields change) — the
+   * 自动审查 mode's own, independent configuration (v1.10.0: Jev is not a
+   * judge provider, so nothing here touches the approval route). Saving a
+   * resolvable key OPENS the review gate, and opening the gate for the first
+   * time turns 自动审查 on for new sessions (`_reviewDefault`) — "配置了 Jev
+   * 就启用自动审查". The same card switches it back off. `confidence` is the
+   * gate below which Jev's answer is not trusted and the call is denied;
+   * clamped to [0.01, 0.99]. Persisted.
    */
   async setJevConfig(request) {
     const r = request && typeof request === "object" ? request : {};
+    const gateBefore = this._jevGateOk();
     if (typeof r.apiKey === "string") this._jev.apiKey = r.apiKey.trim();
     if (typeof r.endpoint === "string") this._jev.endpoint = r.endpoint.trim();
     if (typeof r.model === "string") this._jev.model = r.model.trim();
     if (typeof r.confidence === "number" && Number.isFinite(r.confidence)) {
       this._jev.confidence = Math.min(0.99, Math.max(0.01, r.confidence));
     }
+    const gateAfter = this._jevGateOk();
+    if (gateAfter && !gateBefore) this._reviewDefault = true;
     this._persistConfig();
-    return { ok: true, value: { jev: this._jevShape() } };
+    return {
+      ok: true,
+      value: {
+        jev: this._jevShape(),
+        reviewAvailable: gateAfter,
+        reviewDefault: this._reviewDefault,
+      },
+    };
   }
 
   /** Set the judge timeout (clamped to [MIN, MAX] milliseconds). Persisted. */