@duke-dsh-plugins/dsh-agent-approval 1.9.0 → 1.10.0

package/README.md

@@ -23,11 +23,11 @@
 | 🛡 **权限菜单第四项** | `/permission` 菜单新增 **自动审批** 预设；选中即开启，切到其他预设自动关闭，跨重启保持 |
 | 🤖 新权限模式 | 开启后：沙箱基线固定 `workspace-write`，审批策略切到 `ask`（内部接管），**不再弹人工审批** |
 | 🤖 自动裁决（默认 LLM 直连） | 每次提权请求由**一次 LLM 直连调用**裁决（v1.8.0 起默认）：与子代理同一套审批人格 / 提示词 / 结构化裁决 `{decision, riskLevel, rationale}`，但**不创建审批子会话**（零上下文污染）；设置页可切回「隔离子代理」（一次性 `spawn` 子代理：独立会话、零工具、只读材料） |
-| 🕵️ 自动审查（逐调用，实验） | 可选预设（需先在设置页启用 Jev）：**Full access 基线**，每个工具调用（含 PTC 内层）执行前经 Jev 判定一次，风险调用**直接拒绝、body 不执行、不转人工**（fail-closed）；规则表与会话内信任先行短路降噪；`/agent-review on\|off` 或菜单「自动审查」开启。v1.9.0 起**有效代码展开**：命令引用的解释器脚本（node / python / bash / ps1）内容会被读出并放进裁决 state，agent 临时写的脚本按**实际代码**受审而不是只看命令行（仅读 workspace 内文件，越界只标注、永不读取） |
+| 🕵️ 自动审查（逐调用，实验） | 与自动审批**完全独立**的第二种模式（需先在设置页配置 Jev，配置即启用）：**Full access 基线**，每个工具调用（含 PTC 内层）执行前经 Jev 判定一次，风险调用**直接拒绝、body 不执行、不转人工**（fail-closed）；规则表与会话内信任先行短路降噪；`/agent-review on\|off` 或菜单「自动审查」开启。v1.9.0 起**有效代码展开**：命令引用的解释器脚本（node / python / bash / ps1）内容会被读出并放进裁决 state，agent 临时写的脚本按**实际代码**受审而不是只看命令行（仅读 workspace 内文件，越界只标注、永不读取） |
 | ⛔ 风险即拒绝 | 破坏性 / 不可逆 / 越界（含修改操作系统或其他应用数据）/ 理由与实际命令不符 → 直接 `reject`；仅"安全、可逆、与任务相符、理由诚实"才 `approve`——项目自身的安装/部署脚本写其文档指定路径属任务所需 |
 | 🔒 Fail-closed | 审批 Agent 启动失败、超时（可配 30s–600s）、结果不合法 → 一律按拒绝处理，绝不静默放行 |
-| ⚙️ 审批模型可配置 | 设置页选择 Provider + Model，不选则固定用 **Harness 默认模型**（不跟随请求会话，口径稳定）；选择与超时**持久保存**，重启不丢 |
-| ⚡ TypeSafe Jev 决策模型后端 | 审批模型可选 **TypeSafe Jev**（System One 结构化决策模型）：审批时直连其 API，用类型化问题（Choice/Noul）毫秒级返回带校准概率的裁决；置信度低于阈值按 fail-closed 处理，审计理由由概率合成（需在设置页填 API Key，或设 `TYPESAFE_API_KEY`） |
+| ⚙️ 审批模型可配置 | 设置页选择 Provider + Model（**只能是 LLM 路由**），不选则固定用 **Harness 默认模型**（不跟随请求会话，口径稳定）；选择与超时**持久保存**，重启不丢 |
+| ⚡ TypeSafe Jev 决策模型（仅自动审查） | Jev（System One 结构化决策模型）是**自动审查模式专属**的判定后端：设置页「自动审查」卡片独立配置（API Key / Endpoint / 模型 / 置信度阈值），直连其 API 用类型化问题（Choice/Noul）毫秒级返回带校准概率的裁决；置信度低于阈值按 fail-closed 处理，审计理由由概率合成（也可设 `TYPESAFE_API_KEY`）。**v1.10.0 起不再是自动审批的判定选项**——Jev 的风险判断弱于 LLM，而提权正是人工审批原本要守住的路径 |
 | 📋 审计记录（随会话） | 会话窗口顶部的**「审批」标签页**（轨迹旁）查看本会话全部审批：结论 / 风险等级 / 模型 / 耗时 / 理由；悬停看完整理由与**精确工具参数**；审批 Agent 的会话 id 可回溯完整推理；已批准行可一键**「加白」**存为放行规则。记录存在**会话存储目录内的独立文件**——随会话恢复，删除会话即随之删除 |
 | 🔁 可逆开关 | 权限菜单「自动审批」预设、`/agent-approval on\|off` 命令两条等价路径；关闭时**恢复开启前的权限旋钮** |
 
@@ -42,10 +42,9 @@
         └─ 本插件 prepend 抢占（先于人工弹窗 answerer）
               ├─ （默认）LLM 直连裁决（一次 stream 调用 · 同套人格/提示词/裁决格式 · 零子会话）
               ├─ （可选）spawn 审批 Agent（独立会话 · 零工具 · 结构化裁决 · 不会递归审批）
-              └─ （或）直连 TypeSafe Jev 决策模型（state + 类型化问题 → 概率化裁决 · 亚秒级）
-                    ├─ approve → allowed-once（该次放行）
-                    ├─ reject  → rejected（风险操作，最终拒绝）
-                    └─ 超时/故障/低置信/取消 → fail-closed（按拒绝处理）
+              │     ├─ approve → allowed-once（该次放行）
+              │     ├─ reject  → rejected（风险操作，最终拒绝）
+              │     └─ 超时/故障/低置信/取消 → fail-closed（按拒绝处理）
               └─ 记入审计（会话目录内的独立文件，「审批」标签页可见）
 ```
 
@@ -81,15 +80,15 @@ dsh plugin --profile web add https://github.com/MoonlitDropOfBlood/dsh-agent-app
 1. **开启**：在 `/permission` 菜单选 **自动审批**，或输入 `/agent-approval on`。
 2. **自动裁决**：之后该会话里的提权请求（例如命令被沙箱拒绝后带 `sandbox_permissions` 的重试）不再弹窗，由审批 Agent 在后台裁决并放行/拒绝。
 3. **审计**：会话窗口顶部的**「审批」标签页**（轨迹旁）查看本会话的审批记录；悬停"审批理由"看完整理由与工具参数；已批准行可「加白」存为放行规则。记录存在会话存储目录内的独立文件，删除会话即随之删除；v1.4 的旧全局记录用 `node scripts/migrate-records.mjs` 一次性迁移（`--dry-run` 预览）。
-4. **配置**：设置 → **自动审批** 设置审批模型（Harness 默认模型、指定 Provider/Model，或 **TypeSafe Jev**——选 Jev 后在下方卡片填 API Key 并按需调整 Endpoint / 模型版本 / 置信度阈值）、**裁决方式**（LLM 直连 / 隔离子代理）、审批超时与放行/拒绝规则。
-5. **自动审查（可选）**：设置页启用 Jev 后，`/permission` 菜单出现 **自动审查**（或执行 `/agent-review on`）——该会话切到 Full access 基线，**每个工具调用**执行前经 Jev 判定，风险调用直接拒绝（不转人工）；关闭恢复原旋钮。
+4. **配置自动审批**：设置 → **自动审批** 设置审批模型（Harness 默认模型或指定 Provider/Model——**只能是 LLM 路由**）、**裁决方式**（LLM 直连 / 隔离子代理）、审批超时与放行/拒绝规则。
+5. **配置自动审查（独立）**：设置页「自动审查」卡片填 Jev 的 API Key（可调 Endpoint / 模型版本 / 置信度阈值）——**保存即启用**逐调用审查（新开会话自动进入，菜单出现 **自动审查** 预设，或执行 `/agent-review on`）：该会话切到 Full access 基线，**每个工具调用**执行前经 Jev 判定，风险调用直接拒绝（不转人工）；关闭恢复原旋钮。
 6. **关闭**：菜单切回其他预设，或 `/agent-approval off`，恢复开启前的沙箱模式与审批策略。
 
 ## 目录结构
 
 ```
 dsh-agent-approval/
-├── index.js            # Host 半：AgentApprovalService（审批瀑布抢占 + LLM 直连/子代理/Jev 裁决 + 逐调用审查 + 审计）
+├── index.js            # Host 半：AgentApprovalService（审批瀑布抢占 + LLM 直连/子代理裁决 + Jev 逐调用审查 + 审计）
 ├── client.js           # Client 半：设置页「自动审批」+ 会话「审批」审计标签页 bundle
 ├── typert.host.js      # Typert Host manifest（agentApproval 10 个 Remote 方法的描述）
 ├── cordis.patch.yml      # dsh bundle patch（挂载行 + permission 预设表覆盖）

package/client.js

@@ -11,12 +11,16 @@
  *      session — restored with it after a restart, gone when the session is
  *      deleted. Rows offer the one-click「加白」rule shortcut.
  *
- *   2. A "自动审批" page in the Settings panel (`settings.section`):
- *      approval model picker (provider + model, the harness default, or the
- *      TypeSafe Jev direct HTTP backend with its API key / endpoint /
- *      confidence-gate settings), judge timeout setting (fail-closed), the
- *      list of sessions with the mode enabled (session-list title +
- *      workspace), and the allow/deny rule table.
+ *   2. A "自动审批" page in the Settings panel (`settings.section`). It
+ *      presents the two modes as SEPARATE blocks since v1.10.0:
+ *        - 自动审批: approval model picker (harness provider + model, or the
+ *          harness default), judge invocation mode (direct LLM vs isolated
+ *          subagent — an LLM either way, Jev is not selectable here), the
+ *          fail-closed timeout, enabled sessions and the allow/deny rules.
+ *        - 自动审查: the per-call review mode's own TypeSafe Jev settings
+ *          (API key / model / endpoint / confidence gate) plus the global
+ *          "new sessions enter 自动审查" switch. Configuring Jev here is what
+ *          enables the mode; the approval judge is untouched by it.
  *
  * Session-level on/off lives in the /permission menu (the "自动审批"
  * preset, registered by the package's cordis.patch.yml bundle patch) and the
@@ -551,8 +555,9 @@ window.__ModuleLoader__.load({
         const setReviewDefault = reviewDefaultSlot[1];
         const timeoutSlot = React.useState("");
         const setTimeoutDraft = timeoutSlot[1];
-        // Jev backend drafts (edited in the Jev card shown when the judge
-        // provider is the synthetic "typesafe" entry).
+        // Jev backend drafts — the 自动审查 card's own configuration, shown
+        // unconditionally since v1.10.0 (it no longer hangs off a judge
+        // provider selection).
         const jevKeySlot = React.useState("");
         const setJevKey = jevKeySlot[1];
         const jevEndpointSlot = React.useState("");
@@ -667,9 +672,19 @@ window.__ModuleLoader__.load({
           }
           remote
             .setJevConfig({ apiKey: jevKey, endpoint: jevEndpoint, model: jevModel, confidence: conf })
-            .then(() => {
+            .then((res) => {
+              const v = pick(res) || {};
+              setReviewGate(v.reviewAvailable === true);
+              setReviewDefault(v.reviewDefault === true);
               refresh();
-              setNote("Jev 配置已保存");
+              // Configuring Jev opens the review gate; the Host turns the
+              // per-call review default on at that exact moment (v1.10.0).
+              setNote(
+                v.reviewAvailable === true
+                  ? "Jev 配置已保存：自动审查已就绪" +
+                    (v.reviewDefault === true ? "，新开会话自动进入逐调用审查" : "")
+                  : "Jev 配置已保存，但 API Key 仍为空：自动审查保持关闭",
+              );
             })
             .catch((e) => setNote("保存失败：" + (e && e.message ? e.message : String(e))));
         };
@@ -735,30 +750,22 @@ window.__ModuleLoader__.load({
             .catch(() => {});
         };
 
-        // The synthetic "typesafe" provider routes judging through the
-        // TypeSafe Jev HTTP API — it is not part of the harness directory.
+        // v1.10.0: the harness model directory is the WHOLE list — Jev is no
+        // longer a judge provider (it judges the per-call review mode only),
+        // so there is no synthetic "typesafe" entry to prepend.
         const providerOptions = [{ id: "", name: "默认（Harness 默认模型）" }].concat(
-          [{ id: "typesafe", name: "TypeSafe Jev（决策模型·直连 API）" }],
           dir ? dir.providers : [],
         );
-        const modelOptions =
-          provider === "typesafe"
-            ? [
-                { provider: "typesafe", id: "jev-latest", name: "jev-latest（跟随最新版本）" },
-                { provider: "typesafe", id: "jev-1.13.0", name: "jev-1.13.0（锁定版本）" },
-              ]
-            : [{ provider: "", id: "", name: "默认（Harness 默认模型）" }].concat(
-                dir && dir.models ? dir.models.filter((m) => m.provider === provider) : [],
-              );
+        const modelOptions = [{ provider: "", id: "", name: "默认（Harness 默认模型）" }].concat(
+          dir && dir.models ? dir.models.filter((m) => m.provider === provider) : [],
+        );
         const defaultHint =
-          provider === "typesafe"
-            ? "当前审批判定直连 TypeSafe Jev API，不经过 Harness 模型路由；下方 Jev 配置在该模式下生效。"
-            : dir && dir.defaultSelection
-              ? "未配置时使用 Harness 默认模型；当前默认路由：" +
-                dir.defaultSelection.provider +
-                " / " +
-                dir.defaultSelection.model
-              : "未配置时使用 Harness 默认模型路由";
+          dir && dir.defaultSelection
+            ? "未配置时使用 Harness 默认模型；当前默认路由：" +
+              dir.defaultSelection.provider +
+              " / " +
+              dir.defaultSelection.model
+            : "未配置时使用 Harness 默认模型路由";
 
         return h(
           "div",
@@ -766,13 +773,17 @@ window.__ModuleLoader__.load({
           h(
             "div",
             { className: "aapr-card" },
-            h("h3", null, "自动审批权限"),
+            h("h3", null, "自动审批与自动审查"),
             h(
               "div",
               { className: "aapr-muted" },
-              "一种新的权限模式：以 workspace-write 为基线沙箱；当工具请求提权（更宽的沙箱）时，由一个独立的审批 Agent 评估风险——安全、可逆、与任务相符的操作自动批准，破坏性、不可逆、越界或理由不符的操作直接拒绝。",
+              "两种互相独立的权限模式。",
+              h("br", null),
+              "① 自动审批：workspace-write 基线；工具请求提权时由 LLM 审批 Agent 自动裁决（v1.10.0 起判定模型只能是 LLM）。在输入框 /permission 菜单选择「自动审批」预设，或执行 /agent-approval on|off 为会话开启。",
               h("br", null),
-              "在输入框 /permission 菜单选择「自动审批」预设，或执行命令 /agent-approval on|off 为会话开启；每个会话的审批审计记录在该会话窗口顶部的「审批」标签页（轨迹旁），随会话保存。",
+              "② 自动审查：danger-full-access 基线；每个工具调用执行前经 TypeSafe Jev 判定一次（见下方独立卡片）。在 /permission 菜单选择「自动审查」预设，或执行 /agent-review on|off。",
+              h("br", null),
+              "每个会话的审批审计记录在该会话窗口顶部的「审批」标签页（轨迹旁），随会话保存。",
             ),
             note !== "" ? h("div", { className: "aapr-muted" }, note) : null,
           ),
@@ -794,7 +805,7 @@ window.__ModuleLoader__.load({
                     value: provider,
                     onChange: (e) => {
                       setProvider(e.target.value);
-                      setModel(e.target.value === "typesafe" ? "jev-latest" : "");
+                      setModel("");
                     },
                   },
                   providerOptions.map((p) =>
@@ -812,7 +823,7 @@ window.__ModuleLoader__.load({
                     className: "aapr-select",
                     value: model,
                     onChange: (e) => setModel(e.target.value),
-                    disabled: dir === null && provider !== "typesafe",
+                    disabled: dir === null,
                   },
                   modelOptions.map((m) =>
                     h("option", { key: m.provider + "/" + m.id, value: m.id }, m.id === "" ? m.name : m.name + "（" + m.id + "）"),
@@ -822,144 +833,33 @@ window.__ModuleLoader__.load({
               h(ui.Button, { variant: "primary", size: "sm", onClick: saveModel }, "保存"),
             ),
             h("div", { className: "aapr-muted" }, defaultHint),
-            provider !== "typesafe"
-              ? h(
-                  "div",
-                  { className: "aapr-row" },
-                  h(
-                    "label",
-                    null,
-                    "裁决方式：",
-                    h(
-                      "select",
-                      {
-                        className: "aapr-select",
-                        value: judgeMode,
-                        onChange: (e) => saveJudgeMode(e.target.value),
-                      },
-                      h("option", { value: "llm" }, "LLM 直连（默认，不创建子会话）"),
-                      h("option", { value: "subagent" }, "隔离子代理（legacy，创建审批子会话）"),
-                    ),
-                  ),
-                )
-              : null,
-            provider !== "typesafe"
-              ? h(
-                  "div",
-                  { className: "aapr-muted" },
-                  "LLM 直连与隔离子代理是同一套审批人格、提示词与裁决格式（{decision, riskLevel, rationale}），仅调用方式不同：前者一次直连模型调用完成裁决、不启动审批子代理（零上下文污染）；后者每次裁决创建一个独立子会话（v1.8.0 前的唯一行为）。TypeSafe Jev 后端不受此设置影响。",
-                )
-              : null,
-          ),
-          provider === "typesafe"
-            ? h(
-                "div",
-                { className: "aapr-card" },
-                h("h3", null, "TypeSafe Jev 配置"),
-                h(
-                  "div",
-                  { className: "aapr-muted" },
-                  "Jev 是结构化决策模型（System One）：审批时直连 TypeSafe API，不创建审批子会话，毫秒级返回带校准概率的裁决。审计「理由」由概率分布合成（Jev 本身不生成文字）；置信度低于阈值时按 fail-closed 处理（记 unavailable，不批准也不记拒绝）。对中文任务上下文的准确率略低于英语。API Key 明文保存在本机 config.json；留空时使用环境变量 TYPESAFE_API_KEY。",
-                ),
-                h(
-                  "div",
-                  { className: "aapr-row" },
-                  h(
-                    "label",
-                    null,
-                    "API Key：",
-                    h("input", {
-                      className: "aapr-input",
-                      type: "password",
-                      placeholder: "TYPESAFE_API_KEY",
-                      value: jevKey,
-                      onChange: (e) => setJevKey(e.target.value),
-                    }),
-                  ),
-                  h(
-                    "label",
-                    null,
-                    "模型：",
-                    h("input", {
-                      className: "aapr-input",
-                      placeholder: "jev-latest",
-                      value: jevModel,
-                      onChange: (e) => setJevModel(e.target.value),
-                    }),
-                  ),
-                ),
-                h(
-                  "div",
-                  { className: "aapr-row" },
-                  h(
-                    "label",
-                    null,
-                    "Endpoint：",
-                    h("input", {
-                      className: "aapr-input aapr-input-wide",
-                      placeholder: "https://api.typesafe.ai/v1/systemone",
-                      value: jevEndpoint,
-                      onChange: (e) => setJevEndpoint(e.target.value),
-                    }),
-                  ),
-                  h(
-                    "label",
-                    null,
-                    "置信度阈值：",
-                    h("input", {
-                      className: "aapr-input",
-                      type: "number",
-                      step: "0.05",
-                      min: "0.01",
-                      max: "0.99",
-                      value: jevConf,
-                      onChange: (e) => setJevConf(e.target.value),
-                    }),
-                  ),
-                  h(ui.Button, { variant: "primary", size: "sm", onClick: saveJev }, "保存"),
-                ),
-              )
-            : null,
-          provider === "typesafe"
-            ? h(
-                "div",
-                { className: "aapr-card" },
-                h("h3", null, "自动审查（逐调用审查）"),
-                h(
-                  "div",
-                  { className: "aapr-row" },
-                  h(
-                    "label",
-                    null,
-                    "逐调用审查：",
-                    h(
-                      "select",
-                      {
-                        className: "aapr-select",
-                        value: reviewDefault ? "on" : "off",
-                        disabled: state !== null && state.reviewAvailable !== true,
-                        onChange: (e) => saveReviewDefault(e.target.value === "on"),
-                      },
-                      h("option", { value: "on" }, "开（新会话自动审查每个工具调用）"),
-                      h("option", { value: "off" }, "关（新会话按默认预设）"),
-                    ),
-                  ),
-                ),
+            h(
+              "div",
+              { className: "aapr-row" },
+              h(
+                "label",
+                null,
+                "裁决方式：",
                 h(
-                  "div",
-                  { className: "aapr-muted" },
-                  "开启后，新开会话自动进入自动审查：以 danger-full-access 为基线，每个工具调用（含 PTC 内层调用，外层 run_code 传输除外）执行前经 Jev 判定一次——风险调用直接拒绝、body 不执行、不转人工（fail-closed，拒绝即最终结论）。规则表与会话内信任缓存先行短路降噪；命中拒绝规则、Jev 判拒、低置信、超时、网络故障一律拒绝该调用（工具卡片显示 AGENT_REVIEW_DENIED 详情与风险理由）。",
-                  h("br", null),
-                  "已存在的会话不受此开关影响，可用 /permission 菜单「自动审查」或 /agent-review on|off 单独切换。审计逐调用记录在「审批」标签页（工具列标注「逐调用」）。",
-                  h("br", null),
-                  state === null
-                    ? "状态加载中…"
-                    : state.reviewAvailable === true
-                      ? "当前状态：Jev 判定可用。"
-                      : "当前状态：Jev 判定不可用（缺 API Key），开关已禁用，新会话不会自动审查。",
+                  "select",
+                  {
+                    className: "aapr-select",
+                    value: judgeMode,
+                    onChange: (e) => saveJudgeMode(e.target.value),
+                  },
+                  h("option", { value: "llm" }, "LLM 直连（默认，不创建子会话）"),
+                  h("option", { value: "subagent" }, "隔离子代理（legacy，创建审批子会话）"),
                 ),
-              )
-            : null,
+              ),
+            ),
+            h(
+              "div",
+              { className: "aapr-muted" },
+              "LLM 直连与隔离子代理是同一套审批人格、提示词与裁决格式（{decision, riskLevel, rationale}），仅调用方式不同：前者一次直连模型调用完成裁决、不启动审批子代理（零上下文污染）；后者每次裁决创建一个独立子会话（v1.8.0 前的唯一行为）。",
+              h("br", null),
+              "自动审批的判定模型只能是 LLM：TypeSafe Jev 的结构化决策在此处不可选（它的风险判断比 LLM 弱，而这里正是人工审批原本要守住的路径）。Jev 只用于下方的「自动审查」模式，两者互不影响。",
+            ),
+          ),
           h(
             "div",
             { className: "aapr-card" },
@@ -977,6 +877,110 @@ window.__ModuleLoader__.load({
               h(ui.Button, { variant: "primary", size: "sm", onClick: saveTimeout }, "保存"),
             ),
           ),
+          h(
+            "div",
+            { className: "aapr-card" },
+            h("h3", null, "自动审查（逐调用审查）"),
+            h(
+              "div",
+              { className: "aapr-muted" },
+              "自动审查是独立的第二种权限模式，与上面的自动审批互不相关：它不看提权，而是以 danger-full-access 为基线，对每个工具调用（含 PTC 内层调用，外层 run_code 传输除外）在执行前用 TypeSafe Jev 判定一次——风险调用直接拒绝、body 不执行、不转人工（fail-closed，拒绝即最终结论）。",
+              h("br", null),
+              "Jev 是结构化决策模型（System One）：直连 TypeSafe API，不创建审批子会话，毫秒级返回带校准概率的裁决。审计「理由」由概率分布合成（Jev 本身不生成文字）；置信度低于阈值时按 fail-closed 处理（记 unavailable，不放行也不记拒绝）。对中文任务上下文的准确率略低于英语。API Key 明文保存在本机 config.json；留空时使用环境变量 TYPESAFE_API_KEY。",
+              h("br", null),
+              "保存一个可用的 API Key 即完成配置，自动审查随之启用（新开会话自动进入）；下面同一张卡片可以随时关掉它。",
+            ),
+            h(
+              "div",
+              { className: "aapr-row" },
+              h(
+                "label",
+                null,
+                "逐调用审查：",
+                h(
+                  "select",
+                  {
+                    className: "aapr-select",
+                    value: reviewDefault ? "on" : "off",
+                    disabled: state !== null && state.reviewAvailable !== true,
+                    onChange: (e) => saveReviewDefault(e.target.value === "on"),
+                  },
+                  h("option", { value: "on" }, "开（新会话自动审查每个工具调用）"),
+                  h("option", { value: "off" }, "关（新会话按默认预设）"),
+                ),
+              ),
+            ),
+            h(
+              "div",
+              { className: "aapr-row" },
+              h(
+                "label",
+                null,
+                "API Key：",
+                h("input", {
+                  className: "aapr-input",
+                  type: "password",
+                  placeholder: "TYPESAFE_API_KEY",
+                  value: jevKey,
+                  onChange: (e) => setJevKey(e.target.value),
+                }),
+              ),
+              h(
+                "label",
+                null,
+                "模型：",
+                h("input", {
+                  className: "aapr-input",
+                  placeholder: "jev-latest",
+                  value: jevModel,
+                  onChange: (e) => setJevModel(e.target.value),
+                }),
+              ),
+            ),
+            h(
+              "div",
+              { className: "aapr-row" },
+              h(
+                "label",
+                null,
+                "Endpoint：",
+                h("input", {
+                  className: "aapr-input aapr-input-wide",
+                  placeholder: "https://api.typesafe.ai/v1/systemone",
+                  value: jevEndpoint,
+                  onChange: (e) => setJevEndpoint(e.target.value),
+                }),
+              ),
+              h(
+                "label",
+                null,
+                "置信度阈值：",
+                h("input", {
+                  className: "aapr-input",
+                  type: "number",
+                  step: "0.05",
+                  min: "0.01",
+                  max: "0.99",
+                  value: jevConf,
+                  onChange: (e) => setJevConf(e.target.value),
+                }),
+              ),
+              h(ui.Button, { variant: "primary", size: "sm", onClick: saveJev }, "保存"),
+            ),
+            h(
+              "div",
+              { className: "aapr-muted" },
+              "规则表与会话内信任缓存先行短路降噪；命中拒绝规则、Jev 判拒、低置信、超时、网络故障一律拒绝该调用（工具卡片显示 AGENT_REVIEW_DENIED 详情与风险理由）。",
+              h("br", null),
+              "已存在的会话不受此开关影响，可用 /permission 菜单「自动审查」或 /agent-review on|off 单独切换。审计逐调用记录在「审批」标签页（工具列标注「逐调用」）。",
+              h("br", null),
+              state === null
+                ? "状态加载中…"
+                : state.reviewAvailable === true
+                  ? "当前状态：Jev 判定可用，自动审查已就绪。"
+                  : "当前状态：Jev 判定不可用（缺 API Key），开关已禁用，新会话不会自动审查。",
+            ),
+          ),
           h(
             "div",
             { className: "aapr-card" },

package/index.js

@@ -31,11 +31,14 @@
  *      `callId`) plus the asker's stated reason. A rejection must name the
  *      concrete, credible risk the operation creates (destructive /
  *      irreversible / out-of-scope / dishonest); vague unease is approved.
- *      v1.6.0: the judge can alternatively be the TypeSafe Jev "System One"
- *      decision model (synthetic provider id `typesafe`) — a direct HTTP
- *      call that answers typed Choice/Noul questions with calibrated
- *      probabilities; a confidence below the configured gate resolves
- *      fail-closed like any other fault (see `_judgeWithJev`).
+ *      v1.10.0: the judge is ALWAYS an LLM — either one direct stream call or
+ *      the spawn child. The TypeSafe Jev "System One" decision model (v1.6.0
+ *      through v1.9.x could judge escalations too, as the synthetic provider
+ *      id `typesafe`) is NO LONGER selectable here: its calibrated-but-shallow
+ *      risk judgement is a weaker safety net than an LLM judge on the
+ *      escalation path, which is exactly the path a human approval would have
+ *      guarded. Jev now backs the separate per-call review mode ONLY
+ *      (`_reviewWithJev`), configured independently from this judge.
  *
  *   3. FAIL CLOSED — any infrastructure fault, timeout, malformed verdict, or
  *      cancellation maps to the fail-closed approval outcomes
@@ -110,29 +113,35 @@ const DATA_DIR = join(process.env.DSH_HOME || join(homedir(), ".dsh"), "agent-ap
 const CONFIG_FILE = join(DATA_DIR, "config.json");
 
 /**
- * v1.6.0: the TypeSafe Jev judge backend. Jev is a "System One" decision
- * model (https://api.typesafe.ai/v1/systemone): it does not generate text —
- * it answers typed questions (Choice / Score / Noul) over one `state` with
- * calibrated probability distributions in ~70–500ms. That is exactly the
- * approval-verdict shape, so instead of spawning a judge subagent through
- * the harness model registry (Jev is not a chat route and cannot appear in
- * `llm.listProviders()`), the Host half calls its HTTP API directly when the
- * configured judge provider is the synthetic `typesafe` id. Fail-closed is
- * preserved end to end: any transport fault, non-200, malformed answer, or a
- * confidence below the configured gate resolves `unavailable` — never a
- * grant, and (below the gate) not a recorded rejection either.
+ * v1.6.0 (removed from the escalation judge in v1.10.0): the TypeSafe Jev
+ * "System One" decision model (https://api.typesafe.ai/v1/systemone). It does
+ * not generate text — it answers typed questions (Choice / Score / Noul) over
+ * one `state` with calibrated probability distributions in ~70–500ms, and it
+ * cannot appear in `llm.listProviders()` (not a chat route), hence the direct
+ * HTTP call. It now judges the PER-CALL REVIEW mode only (`_reviewWithJev`),
+ * configured independently of the approval judge. Fail-closed is preserved end
+ * to end there as well: any transport fault, non-200, malformed answer, or a
+ * confidence below the configured gate denies the call (or, on the low
+ * confidence branch, records `unavailable` without a verdict).
  */
-const JEV_PROVIDER = "typesafe";
 const JEV_DEFAULT_MODEL = "jev-latest";
 const JEV_DEFAULT_ENDPOINT = "https://api.typesafe.ai/v1/systemone";
 const JEV_DEFAULT_CONFIDENCE = 0.5;
+/**
+ * The retired escalation-judge provider id (v1.6.0–v1.9.x). Kept ONLY to
+ * recognize and drop it from persisted configs: a config.json still carrying
+ * `model.provider: "typesafe"` migrates to the harness default route, and
+ * `setModel` treats it as "clear the override". Never used to route a judge.
+ */
+const JEV_LEGACY_PROVIDER = "typesafe";
 
 /**
- * The typed questions sent to Jev. Policy lives in the criteria descriptions
- * (Jev reads instructions literally and injects domain knowledge only through
- * state + criteria); the wording mirrors the subagent judge prompt's APPROVE
- * conditions / REJECT list / 误杀治理 so both backends judge to the same
- * standard. `decision` and `riskLevel` are Choices (discrete options +
+ * The typed questions sent to Jev — the shared policy base for
+ * `JEV_REVIEW_QUESTIONS` (the only sender since v1.10.0). Policy lives in the
+ * criteria descriptions (Jev reads instructions literally and injects domain
+ * knowledge only through state + criteria); the wording mirrors the LLM
+ * judge's APPROVE conditions / REJECT list / 误杀治理 so both judge to the
+ * same standard. `decision` and `riskLevel` are Choices (discrete options +
  * probabilities + confidence); `concreteRisk` is a Noul probe whose
  * probability is folded into the synthesized audit rationale.
  */
@@ -164,9 +173,10 @@ const JEV_QUESTIONS = {
 };
 
 /**
- * v1.8.0: the per-call review mode (`agent-review` preset). The SAME policy
- * criteria as `JEV_QUESTIONS` — only the decision instruction wording adapts
- * from "escalation request" to the pending tool call. v1.9.0 adds guidance
+ * v1.8.0: the per-call review mode (`agent-review` preset) — since v1.10.0
+ * the ONLY Jev caller. The SAME policy criteria as `JEV_QUESTIONS` — only the
+ * decision instruction wording adapts from "escalation request" to the
+ * pending tool call. v1.9.0 adds guidance
  * for the `effectiveCode` state field (the actual interpreter scripts the
  * call would run): judge the code when present; reduced visibility alone is
  * never a rejection reason (误杀治理 holds); and a source-edit diff that
@@ -609,10 +619,13 @@ export class AgentApprovalService extends TypertRemoteService {
      */
     this._reviewDefault = false;
     /**
-     * TypeSafe Jev direct backend settings (used when `_model.provider` is
-     * the synthetic `typesafe` id). The API key lives in plaintext on this
-     * machine only (config.json, same trust domain as the rest of the
-     * settings); an empty key falls back to the TYPESAFE_API_KEY env var.
+     * TypeSafe Jev direct backend settings — v1.10.0: the INDEPENDENT
+     * configuration of the 自动审查 (per-call review) mode, no longer part of
+     * the approval judge's provider selection. Configuring it (a resolvable
+     * key) is what opens the review gate; see `_jevGateOk`. The API key lives
+     * in plaintext on this machine only (config.json, same trust domain as
+     * the rest of the settings); an empty key falls back to the
+     * TYPESAFE_API_KEY env var.
      */
     this._jev = {
       apiKey: "",
@@ -876,7 +889,7 @@ export class AgentApprovalService extends TypertRemoteService {
         return "自动审批 is already ON for this session — switch modes through the /permission menu";
       }
       if (!this._jevGateOk()) {
-        return "自动审查 requires the Jev judge: set the 审批模型 Provider to TypeSafe Jev with an API key in Settings → 自动审批 first";
+        return "自动审查 requires the Jev judge: configure a Jev API key in Settings → 自动审批 → 「自动审查」first";
       }
       this._enableCore(session, agent, "review");
       if (this._presetRegistered(REVIEW_PRESET_NAME)) {
@@ -907,13 +920,14 @@ export class AgentApprovalService extends TypertRemoteService {
   }
 
   /**
-   * v1.8.0 gate for the per-call review mode: the user must have switched the
-   * judge to TypeSafe Jev with a resolvable API key ("设置了使用 Jev").
-   * Everything about the mode is built around the Jev judge — enabling it
-   * without one would leave Full access with nobody judging.
+   * v1.8.0, re-based in v1.10.0: the gate for the per-call review mode. The
+   * Jev backend is the review mode's own, independent configuration — the
+   * gate is simply "a Jev API key resolves" (config.json or
+   * TYPESAFE_API_KEY). It no longer requires switching the APPROVAL judge to
+   * Jev (that option is gone as of v1.10.0), and it never reads `_model`.
    */
   _jevGateOk() {
-    return this._model.provider === JEV_PROVIDER && this._jevEffective().key !== "";
+    return this._jevEffective().key !== "";
   }
 
   /**
@@ -938,7 +952,7 @@ export class AgentApprovalService extends TypertRemoteService {
         durationMs: 0,
         childSessionId: "",
         rationale:
-          "自动审查 requires the Jev judge (Settings → 自动审批: Provider = TypeSafe Jev with an API key); falling back to the 自动审批 preset (fail closed)",
+          "自动审查 requires the Jev judge (Settings → 自动审批 → 「自动审查」卡片: configure a Jev API key); falling back to the 自动审批 preset (fail closed)",
         mode: "review",
       });
       const presets = this.ctx.get("permissionPresets");
@@ -1288,7 +1302,13 @@ export class AgentApprovalService extends TypertRemoteService {
           typeof cfg.model.provider === "string" &&
           typeof cfg.model.model === "string"
         ) {
-          this._model = { provider: cfg.model.provider, model: cfg.model.model };
+          // v1.10.0 migration: a persisted `typesafe` judge route (v1.6.0–
+          // v1.9.x) is no longer a valid judge — fall back to the harness
+          // default route instead of keeping a dead provider on the wire.
+          this._model =
+            cfg.model.provider === JEV_LEGACY_PROVIDER
+              ? { provider: "", model: "" }
+              : { provider: cfg.model.provider, model: cfg.model.model };
         }
         if (cfg.judgeMode === JUDGE_MODE_LLM || cfg.judgeMode === JUDGE_MODE_SUBAGENT) {
           this._judgeMode = cfg.judgeMode;
@@ -1489,10 +1509,6 @@ export class AgentApprovalService extends TypertRemoteService {
    * records display — "p/m" = selected, "default(p/m)" = harness default.
    */
   _judgeRoute() {
-    if (this._model.provider === JEV_PROVIDER) {
-      const model = this._jevEffective().model;
-      return { provider: JEV_PROVIDER, model: model, label: "jev(" + model + ")" };
-    }
     if (this._model.provider !== "" && this._model.model !== "") {
       return {
         provider: this._model.provider,
@@ -1558,13 +1574,11 @@ export class AgentApprovalService extends TypertRemoteService {
       return "allowed-once";
     }
 
-    // 3. The judge. The TypeSafe Jev backend is a direct HTTP call (no
-    //    subagent, no harness model route); the DEFAULT "llm" mode is one
-    //    direct ctx.llm.stream() call (no subagent either — v1.8.0); only
-    //    judgeMode === "subagent" spawns the judge child through `spawn`.
-    if (this._model.provider === JEV_PROVIDER) {
-      return this._judgeWithJev(session, req, argsRaw, base, trustKey);
-    }
+    // 3. The judge — always an LLM (v1.10.0: Jev is no longer selectable
+    //    here; it judges the per-call review mode only). The DEFAULT "llm"
+    //    mode is one direct ctx.llm.stream() call (no subagent either —
+    //    v1.8.0); only judgeMode === "subagent" spawns the judge child
+    //    through `spawn`.
     if (this._judgeMode !== JUDGE_MODE_SUBAGENT) {
       return this._judgeWithLlmStream(session, req, argsRaw, base, trustKey);
     }
@@ -1703,7 +1717,7 @@ export class AgentApprovalService extends TypertRemoteService {
    * exactly — same persona, same `_judgePrompt`, same VERDICT_SCHEMA verdict
    * contract — only the invocation differs: no subagent session is created
    * (zero judge-side context pollution; `childSessionId` stays empty).
-   * Mirrors `_judgeWithJev`'s fail-closed contract:
+   * Fail-closed contract:
    *   - no concrete route / llm fault / non-'stop' finish / malformed verdict
    *     / timeout → `unavailable`
    *   - request cancelled mid-flight → `cancelled`
@@ -1969,13 +1983,12 @@ export class AgentApprovalService extends TypertRemoteService {
     return { decision: value.decision, riskLevel: value.riskLevel, rationale: value.rationale };
   }
 
-  // ---- the TypeSafe Jev direct backend ---------------------------------------
+  // ---- the TypeSafe Jev direct backend (自动审查 only, since v1.10.0) ---------
 
   /**
    * Effective Jev settings with env fallback and clamping applied. The key
    * may come from config.json or the TYPESAFE_API_KEY environment variable;
-   * an absent key keeps the backend selected but every judgment resolves
-   * `unavailable` (fail closed) until one is configured.
+   * an absent key keeps the review gate closed, so 自动审查 cannot be armed.
    */
   _jevEffective() {
     const key = String(this._jev.apiKey || process.env.TYPESAFE_API_KEY || "").trim();
@@ -2023,110 +2036,12 @@ export class AgentApprovalService extends TypertRemoteService {
   }
 
   /**
-   * Judge one escalation through the Jev HTTP API (state + typed questions →
-   * calibrated probability distributions). Mirrors `_judge`'s spawn-path
-   * contract exactly — rules and the session trust cache have already run —
-   * and every abnormal shape resolves fail-closed:
-   *   - no API key / transport fault / non-200 / malformed answer → `unavailable`
-   *   - request cancelled mid-flight → `cancelled`
-   *   - overall timeout (the same `this._timeoutMs` budget) → `unavailable`
-   *   - confidence below the configured gate → `unavailable` (the model is
-   *     not sure enough to decide: never a grant, and not a recorded
-   *     rejection either — the v1.4.0 误杀治理 applies symmetrically)
-   * Jev does not generate text, so the audit rationale is synthesized from
-   * the returned distributions; the served model version (`body.model`,
-   * which resolves aliases like jev-latest) is what the audit displays.
+   * The single POST to the System One endpoint; resolves the parsed body.
+   * `questions` defaults to the per-call review set (the only caller since
+   * v1.10.0). `state` leaves this machine by design — that is the review
+   * judge's whole point (see the workspace-confined code expansion in
+   * `_reviewEffectiveCode`).
    */
-  async _judgeWithJev(session, req, argsRaw, base, trustKey) {
-    const cfg = this._jevEffective();
-    if (cfg.key === "") {
-      this._record(session, {
-        ...base,
-        outcome: "unavailable",
-        riskLevel: "-",
-        model: "jev(" + cfg.model + ")",
-        rationale: "Jev backend selected but no API key configured (Settings → 自动审批, or the TYPESAFE_API_KEY environment variable)",
-      });
-      return "unavailable";
-    }
-    if (typeof fetch !== "function") {
-      this._record(session, { ...base, outcome: "unavailable", riskLevel: "-", model: "jev(" + cfg.model + ")", rationale: "fetch is unavailable in this runtime" });
-      return "unavailable";
-    }
-
-    const startedAt = Date.now();
-    const controller = new AbortController();
-    const signal = req.signal;
-    const onAbort = () => controller.abort();
-    if (signal && typeof signal.addEventListener === "function") {
-      signal.addEventListener("abort", onAbort, { once: true });
-    }
-
-    let winner;
-    try {
-      const state = this._jevStateOf(session, req, argsRaw);
-      winner = await Promise.race([
-        this._jevRequest(cfg, state, controller.signal)
-          .then((body) => ({ kind: "result", body: body }))
-          .catch((error) => ({
-            kind: "fault",
-            error: error,
-            aborted: error && error.name === "AbortError",
-          })),
-        (signal
-          ? new Promise((resolve) => {
-              if (signal.aborted) {
-                resolve(true);
-                return;
-              }
-              signal.addEventListener("abort", () => resolve(true), { once: true });
-            })
-          : Promise.resolve(false)
-        ).then((v) => ({ kind: "aborted", aborted: v })),
-        this.ctx.timeout(this._timeoutMs).then(() => ({ kind: "timeout" })),
-      ]);
-    } finally {
-      if (signal && typeof signal.removeEventListener === "function") {
-        signal.removeEventListener("abort", onAbort);
-      }
-      // Whether we lost the race to timeout/cancel or the request already
-      // settled, closing the transport is always safe.
-      try {
-        controller.abort();
-      } catch (e) {
-        /* controller abort never blocks the outcome */
-      }
-    }
-    const durationMs = Date.now() - startedAt;
-
-    if (winner.kind === "result") {
-      return this._jevVerdict(session, winner.body, cfg, base, trustKey, durationMs);
-    }
-    if (winner.kind === "aborted") {
-      this._record(session, { ...base, outcome: "cancelled", riskLevel: "-", model: "jev(" + cfg.model + ")", rationale: "request cancelled while Jev was judging" });
-      return "cancelled";
-    }
-    if (winner.kind === "timeout") {
-      this._record(session, {
-        ...base,
-        outcome: "unavailable",
-        riskLevel: "-",
-        model: "jev(" + cfg.model + ")",
-        rationale: "Jev request timed out after " + String(this._timeoutMs) + "ms (fail closed)",
-      });
-      return "unavailable";
-    }
-    if (winner.aborted) {
-      this._record(session, { ...base, outcome: "cancelled", riskLevel: "-", model: "jev(" + cfg.model + ")", rationale: "request cancelled while Jev was judging" });
-      return "cancelled";
-    }
-    this._record(session, { ...base, outcome: "unavailable", riskLevel: "-", model: "jev(" + cfg.model + ")", rationale: "Jev request failed: " + errText(winner.error) });
-    return "unavailable";
-  }
-
-  /** The single POST to the System One endpoint; resolves the parsed body.
-   *  `questions` defaults to the escalation set; the review path passes
-   *  `JEV_REVIEW_QUESTIONS`. */
   async _jevRequest(cfg, state, abortSignal, questions) {
     const response = await fetch(cfg.endpoint, {
       method: "POST",
@@ -2137,7 +2052,7 @@ export class AgentApprovalService extends TypertRemoteService {
       body: JSON.stringify({
         state: state,
         model: cfg.model,
-        questions: questions === undefined ? JEV_QUESTIONS : questions,
+        questions: questions === undefined ? JEV_REVIEW_QUESTIONS : questions,
       }),
       signal: abortSignal,
     });
@@ -2156,9 +2071,9 @@ export class AgentApprovalService extends TypertRemoteService {
   }
 
   /**
-   * Parse + gate one Jev response into a normalized verdict, shared by the
-   * escalation path (`_jevVerdict`) and the per-call review path
-   * (`_reviewWithJev`) so both judge to exactly the same standard:
+   * Parse + gate one Jev response into a normalized verdict, shared by every
+   * review call (the escalation path stopped using Jev in v1.10.0) so the
+   * review judge always holds to the same standard:
    *   - `{ kind: "malformed", served }` — any missing/out-of-shape answer
    *   - `{ kind: "low-confidence", served, choice, riskLevel, confidence, gate }`
    *   - `{ kind: "verdict", served, choice, riskLevel, rationale }`
@@ -2231,56 +2146,6 @@ export class AgentApprovalService extends TypertRemoteService {
     return { kind: "verdict", served: served, choice: choice, riskLevel: riskChoice, rationale: rationale };
   }
 
-  /**
-   * Map a Jev response to the same outcomes the subagent path produces.
-   * Returns the waterfall outcome string; records the audit line itself.
-   */
-  _jevVerdict(session, body, cfg, base, trustKey, durationMs) {
-    const parsed = this._jevParse(body, cfg);
-    const label = "jev(" + parsed.served + ")";
-    base.durationMs = durationMs;
-
-    if (parsed.kind === "malformed") {
-      this._record(session, {
-        ...base,
-        outcome: "unavailable",
-        riskLevel: "-",
-        model: label,
-        rationale: "Jev returned no valid verdict shape (decision/riskLevel/concreteRisk incomplete)",
-      });
-      return "unavailable";
-    }
-    if (parsed.kind === "low-confidence") {
-      this._record(session, {
-        ...base,
-        outcome: "unavailable",
-        riskLevel: parsed.riskLevel,
-        model: label,
-        rationale:
-          "Jev confidence " + parsed.confidence.toFixed(2) + " is below the gate " + parsed.gate.toFixed(2) + " (decision draft: " + parsed.choice + ") — fail closed",
-      });
-      return "unavailable";
-    }
-
-    const approved = parsed.choice === "approve";
-    this._record(session, {
-      ...base,
-      outcome: approved ? "allowed-once" : "rejected",
-      riskLevel: parsed.riskLevel,
-      model: label,
-      rationale: trunc(parsed.rationale, 600),
-    });
-    if (approved && trustKey !== undefined) {
-      let set = this._trusted.get(session.id);
-      if (set === undefined) {
-        set = new Set();
-        this._trusted.set(session.id, set);
-      }
-      set.add(trustKey);
-    }
-    return approved ? "allowed-once" : "rejected";
-  }
-
   // ---- v1.8.0 per-call review mode (agent-review) ----------------------------
 
   /**
@@ -2573,12 +2438,12 @@ export class AgentApprovalService extends TypertRemoteService {
   }
 
   /**
-   * Judge one pending call through the Jev HTTP API (the review-mode judge).
-   * Mirrors `_judgeWithJev`'s fail-closed contract exactly — same `_jevParse`
-   * standard, same confidence gate — but every outcome is FINAL: rejections,
-   * low confidence, timeouts and faults all deny the call (no human
-   * fallback). Returns `undefined` to allow, otherwise a pre-execute
-   * decision.
+   * Judge one pending call through the Jev HTTP API — the review mode's only
+   * judge, and the only remaining Jev caller since v1.10.0. Fail-closed
+   * through `_jevParse` (same validation, same confidence gate) but every
+   * outcome is FINAL: rejections, low confidence, timeouts and faults all
+   * deny the call (no human fallback). Returns `undefined` to allow,
+   * otherwise a pre-execute decision.
    */
   async _reviewWithJev(session, exec, argsRaw, base, trustKey) {
     const cfg = this._jevEffective();
@@ -2776,15 +2641,18 @@ export class AgentApprovalService extends TypertRemoteService {
 
   /**
    * Set the judge model override. Empty strings clear it (the judge then runs
-   * on the harness default route, never the requester's). Persisted.
+   * on the harness default route, never the requester's). v1.10.0: Jev is no
+   * longer a judge provider — a legacy `typesafe` selection migrates to the
+   * harness default route. Persisted.
    */
   async setModel(request) {
     const provider = request && typeof request.provider === "string" ? request.provider : "";
     const model = request && typeof request.model === "string" ? request.model : "";
-    if (provider === JEV_PROVIDER) {
-      // The Jev backend ignores the harness route table; an unset model just
-      // means the latest alias.
-      this._model = { provider: JEV_PROVIDER, model: model !== "" ? model : JEV_DEFAULT_MODEL };
+    if (provider === JEV_LEGACY_PROVIDER) {
+      // v1.6.0–v1.9.x routed the escalation judge to Jev. That option is gone
+      // (Jev judges the per-call review mode only), so an old client still
+      // sending it clears the override instead of resurrecting a dead route.
+      this._model = { provider: "", model: "" };
     } else {
       this._model =
         provider !== "" && model !== "" ? { provider, model } : { provider: "", model: "" };
@@ -2828,20 +2696,35 @@ export class AgentApprovalService extends TypertRemoteService {
   }
 
   /**
-   * Set the TypeSafe Jev backend settings (only provided fields change).
-   * `confidence` is the gate below which Jev's answer is not trusted and the
-   * outcome resolves fail-closed; clamped to [0.01, 0.99]. Persisted.
+   * Set the TypeSafe Jev backend settings (only provided fields change) — the
+   * 自动审查 mode's own, independent configuration (v1.10.0: Jev is not a
+   * judge provider, so nothing here touches the approval route). Saving a
+   * resolvable key OPENS the review gate, and opening the gate for the first
+   * time turns 自动审查 on for new sessions (`_reviewDefault`) — "配置了 Jev
+   * 就启用自动审查". The same card switches it back off. `confidence` is the
+   * gate below which Jev's answer is not trusted and the call is denied;
+   * clamped to [0.01, 0.99]. Persisted.
    */
   async setJevConfig(request) {
     const r = request && typeof request === "object" ? request : {};
+    const gateBefore = this._jevGateOk();
     if (typeof r.apiKey === "string") this._jev.apiKey = r.apiKey.trim();
     if (typeof r.endpoint === "string") this._jev.endpoint = r.endpoint.trim();
     if (typeof r.model === "string") this._jev.model = r.model.trim();
     if (typeof r.confidence === "number" && Number.isFinite(r.confidence)) {
       this._jev.confidence = Math.min(0.99, Math.max(0.01, r.confidence));
     }
+    const gateAfter = this._jevGateOk();
+    if (gateAfter && !gateBefore) this._reviewDefault = true;
     this._persistConfig();
-    return { ok: true, value: { jev: this._jevShape() } };
+    return {
+      ok: true,
+      value: {
+        jev: this._jevShape(),
+        reviewAvailable: gateAfter,
+        reviewDefault: this._reviewDefault,
+      },
+    };
   }
 
   /** Set the judge timeout (clamped to [MIN, MAX] milliseconds). Persisted. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@duke-dsh-plugins/dsh-agent-approval",
-  "version": "1.9.0",
-  "description": "Agent-decided approvals for DeepSeek Harness: an 自动审批 permission mode where every sandbox escalation is judged automatically (default judge: one direct LLM call with no subagent session; optional isolated judge subagent or the TypeSafe Jev decision model), plus an opt-in 自动审查 per-call review mode (Full access base; every tool call reviewed by the Jev judge before execution, with interpreter scripts the command references expanded into the judge state so temp scripts are judged by their actual code; risky calls rejected with no human fallback), with a configurable judge model and a per-session audit trail in the conversation window's 审批 tab.",
+  "version": "1.10.0",
+  "description": "Agent-decided approvals for DeepSeek Harness: an 自动审批 permission mode where every sandbox escalation is judged automatically by an LLM (default judge: one direct LLM call with no subagent session; optional isolated judge subagent) plus an independent 自动审查 per-call review mode (Full access base; every tool call reviewed before execution by the TypeSafe Jev decision model, with interpreter scripts the command references expanded into the judge state so temp scripts are judged by their actual code; risky calls rejected with no human fallback), with a configurable judge model and a per-session audit trail in the conversation window's 审批 tab.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/MoonlitDropOfBlood/dsh-agent-approval.git"

package/typert.host.js

@@ -115,9 +115,17 @@ const setReviewDefaultValueSchema = z
   })
   .readonly();
 
+/**
+ * v1.10.0: the TypeSafe Jev backend belongs to the 自动审查 (per-call review)
+ * mode alone — it is NOT a judge provider. `setJevConfig` therefore reports
+ * the review gate and the (possibly auto-enabled) review default so the
+ * client can reflect "配置了 Jev 就启用自动审查" without a second round trip.
+ */
 const setJevValueSchema = z
   .object({
     jev: jevConfigSchema,
+    reviewAvailable: z.boolean(),
+    reviewDefault: z.boolean(),
   })
   .readonly();
 
@@ -557,17 +565,17 @@ export const TYPERT = {
             kind: "method",
             name: "setModel",
             signature: "@Remote('setModel') async setModel(request: AgentApprovalSetModelRequest): Promise<AgentApprovalSetModelResult>",
-            summary: "Set the judge model route (empty strings = inherit the requesting session's; provider 'typesafe' selects the Jev backend).",
+            summary: "Set the judge model route (empty strings = use the harness default model; the escalation judge is always an LLM).",
             jsDoc:
-              "/**\n * Set provider/model used by the approval judge; empty strings clear the override. The synthetic provider 'typesafe' routes judging through the TypeSafe Jev HTTP API instead of a harness subagent.\n * @param request - { provider, model }.\n * @returns the stored route.\n */",
+              "/**\n * Set provider/model used by the approval judge; empty strings clear the override (the judge then uses the harness default model). Since v1.10.0 Jev is not a judge provider — a legacy 'typesafe' selection clears the override.\n * @param request - { provider, model }.\n * @returns the stored route.\n */",
           },
           {
             kind: "method",
             name: "setJevConfig",
             signature: "@Remote('setJevConfig') async setJevConfig(request: AgentApprovalSetJevRequest): Promise<AgentApprovalSetJevResult>",
-            summary: "Set the TypeSafe Jev backend settings (API key, endpoint, model, confidence gate; persisted).",
+            summary: "Set the TypeSafe Jev backend settings of the 自动审查 mode (API key, endpoint, model, confidence gate; persisted; a resolvable key opens the review gate and enables 自动审查 for new sessions).",
             jsDoc:
-              "/**\n * Update the Jev backend settings used when the judge provider is 'typesafe'. Only provided fields change; confidence (the fail-closed gate) is clamped to [0.01, 0.99].\n * @param request - { apiKey, endpoint, model, confidence }.\n * @returns the stored Jev settings.\n */",
+              "/**\n * Update the Jev backend settings of the per-call review mode (independent of the approval judge). Only provided fields change; confidence (the fail-closed gate) is clamped to [0.01, 0.99]. Saving a resolvable API key opens the review gate and turns 自动审查 on for new sessions.\n * @param request - { apiKey, endpoint, model, confidence }.\n * @returns the stored Jev settings plus the review gate and the review default.\n */",
           },
           {
             kind: "method",
@@ -642,7 +650,7 @@ export const TYPERT = {
           {
             name: "AgentApprovalSetJevResult",
             declaration:
-              "export type AgentApprovalSetJevResult = { ok: true; value: { readonly jev: AgentApprovalJevConfig } } | { ok: false; error: { code: string; message?: string } };",
+              "export type AgentApprovalSetJevResult = { ok: true; value: { readonly jev: AgentApprovalJevConfig; readonly reviewAvailable: boolean; readonly reviewDefault: boolean } } | { ok: false; error: { code: string; message?: string } };",
           },
           {
             name: "AgentApprovalEnabledSession",