@feng0531/dsh-code-review 0.87.2 → 0.87.3

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.87.3 — 明确审核指令不再重复确认
+
+- 明确要求审核且内部预览与当前授权范围、模型及发送目的地一致时，工具指导直接继续执行，不再要求第二次人工确认；仅预览或超出授权时仍暂停。
+- 保留 confirmed 参数、快照与版本新鲜度、会话／目录／模型身份、一次性预览及宿主权限检查；私有模型工件仍需独立明确同意。
+
 ## 0.87.2 — 导出案例回归修复
 
 - 大文件稀疏、远距离编辑增加有界最短编辑回退，避免二维差异表超限后不必要地扩大为近全文包络；超预算仍明确受限。

package/DEVELOPMENT.md

@@ -18,6 +18,12 @@
 
 项目捕获完整清单最多 10000 节点、1000 选择节点、16 MiB。Git 显式选择以精确字面路径查询所选索引，单次查询最多 64 KiB、总计 2 MiB，不受未选索引数量影响；初次、执行前及末尾复核使用相同范围。局部清单不宣称全仓完整性或总数，只绑定所选索引和正文，未选索引变动不使其失效。公开工具的显式列表仍最多 200 项。不设默认总模型调用次数或执行秒表，初次捕获/复核均遵循宿主与用户取消。SVN 仍枚举本地完整已观察清单，项目模式拒绝不支持节点属性，不隐式继承固定历史审查的网络权限。
 
+## 预览与当前人类授权
+
+- 明确要求“审核 r7364”等执行请求，在范围、模型和发送目的地明确且一致时就是当前审核授权；Agent 仍须先内部 preview，固定并核对 scope、route、budget 与权限，再使用真实 `previewId` 和 `confirmed:true` 执行，不重复询问确认。只要求预览或明确要求等待确认时，不得执行；范围、模型或发送目的地超出授权，或边界不明确时，先询问。SVN 远端读取等独立权限不由审核请求隐式授予。
+- `confirmed:true` 是 Agent 对当前人类明确授权且本次预览匹配的声明，不是取消确认参数或无授权绕过。保留 preview→execute 两阶段与 service 确认参数，不新增一键执行 API；宿主／会话工具权限、模型发送许可、快照新鲜度、会话／目录／路由身份及预算校验均不变。
+- 源变化、预览过期或身份变化须生成新 preview 并重新核对当前授权，不能将旧预览批准用于新快照。保存的后台记录、`resumeFromJobId`、自动续跑及 host 重启本身都不授予外发权限；显式续审须有当前人类授权和新预览，匹配时无需重复询问。私有模型工件的源码提示与独立明确同意要求保持不变。
+
 ## 变更审查调度与离线对照
 
 生产 changes 服务默认 `changesConcurrency=2`，配置范围 1～4；底层 `reviewSnapshot` 未传该选项时保持串行兼容。所有文件共用原批准快照 reader，不能按 worker 重置额度。业务分组先完成，交互 owner 等待此前成员链结束；窗口、轮次与复核仍串行依赖，固定索引归并结果。取消或 checkpoint 失败必须先排空所有在途链再释放锁。

package/README.md

@@ -1,6 +1,6 @@
 # DSH Code Review
 
-在 **DeepSeek Harness（DSH）的 Agent 对话里**审查 Git / SVN 代码变更。插件会先列出审查范围，得到确认后，再用当前 Agent 选择的模型生成中文问题报告。
+在 **DeepSeek Harness（DSH）的 Agent 对话里**审查 Git / SVN 代码变更。插件先预览并核对审查范围，再在当前人类明确授权内，用当前 Agent 选择的模型生成中文问题报告；已明确要求审核且预览匹配时，不重复询问确认。
 
 **只读：不修改代码，不自动修复，不提交、回滚或更新你的业务工作副本。**
 
@@ -53,7 +53,9 @@ dsh plugin add https://github.com/f-e-n-g-0531/dsh-code-review.git
 确认刚才展示的预览范围和模型，使用该 previewId 执行只读审查。
 ```
 
-插件使用预览返回的 ID 执行。默认预览有效期约 **5 分钟**，返回 `expiresAt` 与 `validForMs`；到期、文件、模型或会话目录变化后，需要重新预览和确认。计划最少调用只是初始下限，不是总调用数或耗时上限，后续取证、复核与综合会增加工作量。宿主权限不允许时，确认也不能绕过限制。
+以上是“只预览，等我确认”的流程。若你已明确要求“审核 r7364”（SVN 远端访问仍须单独授权），Agent 应先内部预览，固定并核对范围、模型路由、预算与权限；预览符合当前明确授权时，直接执行，不再要求你重复确认。只要求预览或明确要求等待确认时不得执行；范围、模型或发送目的地超出授权，或授权边界不明确时，先询问。
+
+插件使用预览返回的 ID 执行。默认预览有效期约 **5 分钟**，返回 `expiresAt` 与 `validForMs`；到期、文件、模型或会话目录变化后，需要新预览并重新核对当前授权，不能复用旧预览批准。`confirmed:true` 表示当前人类已明确授权且本次预览与授权一致，不是无授权绕过。计划最少调用只是初始下限，不是总调用数或耗时上限，后续取证、复核与综合会增加工作量。会话工具权限与宿主安全校验照旧，确认不能绕过限制。
 
 ### 后台执行如何等待
 
@@ -67,7 +69,7 @@ dsh plugin add https://github.com/f-e-n-g-0531/dsh-code-review.git
 
 ## 按场景直接使用
 
-下面的自然语言可以直接发给 Agent。每个场景都应先预览、展示范围，再确认执行。
+下面的自然语言可以直接发给 Agent。其中只要求预览或明确要求等待确认的示例，不得直接执行；若直接明确要求审核，则按上面的授权规则内部核对预览后执行，不重复询问。
 
 ### 只审查几个文件（Git / SVN 工作副本）
 
@@ -224,16 +226,16 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 
 ## 长任务：后台预览、审查与取回结果
 
-全项目或慢仓库建议使用后台工具，不让一次外层调用等待整个项目。仍先预览，再由你确认外发；启动返回jobId不等于审核完成。
+全项目或慢仓库建议使用后台工具，不让一次外层调用等待整个项目。仍先预览并核对当前明确授权，匹配时直接执行；仅要求预览则停在预览，超授权则询问。启动返回jobId不等于审核完成。
 
 1. 调用code_review_start，phase设为preview，previewArgs填原预览参数（例如reviewMode=project）。
 2. 用code_review_status和jobId查询；完成后读取resultSummary中的预览范围、模型和previewId。
-3. 展示预览，确认后调用code_review_start，phase设为execute，传previewId与confirmed=true。
+3. 内部检查预览的范围、模型、发送目的地、预算和权限；当前人类已明确要求匹配的审核时，不重复询问，调用code_review_start，phase设为execute，传previewId与confirmed=true。仅要求预览或等待确认时先展示并等待；超授权时先询问。
 4. 持续调用code_review_wait等待进度变化或终态，不因启动返回任务ID就结束用户请求。可展示阶段与“处理数/总数”，不分批汇报问题；抓取阶段分母未知则不显示虚假百分比。等待返回仍running就继续等待，不重新启动。任务结束后取回并统一交付一份最终报告。查询审查任务；offset/limit分页取回检查点、文件状态和发现；单个检查点内的大清单用checkpointIndex指定其零基索引，再用offset/limit取回内部全部条目。可调用code_review_cancel取消。
 
 报告保存在宿主profile的data/dsh-code-review/jobs目录；没有profile环境时使用用户主目录.dsh下的数据目录，不写入业务仓库。内容可能含源码片段，应按源码敏感级别保护。本次启动调用结束不自动取消后台任务；明确取消、停用插件或宿主退出会停止它。
 
-重启后可按原jobId读回保存记录，原运行标记interrupted，不自动继续外发。recovery给出已观察文件/窗口与未完成路径；它不是完整分母或新授权，补审必须重新预览确认。新预览的runtime包含实际加载版本和模块位置，排查不同工作区时分别核对，不根据另一台机器推断。
+重启后可按原jobId读回保存记录，原运行标记interrupted，不自动继续外发。recovery给出已观察文件/窗口与未完成路径；它不是完整分母或新授权；宿主重启及自动恢复本身不授权外发，补审必须有当前明确授权并重新预览核对。新预览的runtime包含实际加载版本和模块位置，排查不同工作区时分别核对，不根据另一台机器推断。
 
 变更审查的独立文件链默认最多 2 条并行；配置 `changesConcurrency` 为 1～4（1 回退串行），跨文件综合等待相关前置主审结束。配置 `maxRetrievalRounds` 为 0～50，默认为 3，限制每阶段检索请求回合数（不是成功读取次数；非法请求也会消耗回合）（0 只允许最终答复）。配置不是 preview 参数，不改变模型或来源授权；并发仍共享同一份读取/调用预算，额度不足时完成顺序可能影响哪些任务未完成，不能保证与串行逐项结果相同。提供方限流时应降低并发。复核可预取批准快照中候选锚点附近的同侧原文，仍允许追加反证读取并逐字校验；不复用主审结论或其他会话凭据。完整变更计划可容纳时仅生成一次再分发到窗口，否则保留原分窗口计划并在预览估算中体现。
 
@@ -241,7 +243,7 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 
 ### 显式续审与私有模型工件
 
-需要补审时，在**新预览**中传入 `resumeFromJobId`，例如 `{"resumeFromJobId":"原执行任务的真实jobId"}`；仍须展示新范围、重新确认并通过当前宿主权限。只复用同一会话、工作目录、模型路由／思考设置下，完整快照、配置和运行时身份均匹配的已完成且符合复用条件的文件链；项目模式还绑定对应批次。来源或配置变化不做猜测复用。旧发现标记 `priorRun`，不伪造本轮读取凭据、模型调用或覆盖。变更模式开启阶段续审时，schema2 检查点还可保存已接受但所在文件链未完成的 primary 生成；它只省去匹配的主审生成，综合、交互和复核在新安全边界执行，复核重新取得独立回执。预览分别显示可复用文件、生成及仍需的新鲜复核；不能把保存了正文或候选当作阶段完成。
+需要补审时，在**新预览**中传入 `resumeFromJobId`，例如 `{"resumeFromJobId":"原执行任务的真实jobId"}`；仍须核对新范围与当前明确续审授权并通过当前宿主权限；不能复用旧批准，明确要求匹配的补审时无需再重复询问。只复用同一会话、工作目录、模型路由／思考设置下，完整快照、配置和运行时身份均匹配的已完成且符合复用条件的文件链；项目模式还绑定对应批次。来源或配置变化不做猜测复用。旧发现标记 `priorRun`，不伪造本轮读取凭据、模型调用或覆盖。变更模式开启阶段续审时，schema2 检查点还可保存已接受但所在文件链未完成的 primary 生成；它只省去匹配的主审生成，综合、交互和复核在新安全边界执行，复核重新取得独立回执。预览分别显示可复用文件、生成及仍需的新鲜复核；不能把保存了正文或候选当作阶段完成。
 
 后台审查会在上述宿主任务目录的 `artifacts` 子目录留存有界模型工件，包括失败／取消时已捕获的文本或工具参数；不含 reasoning。它们可能含源码，应按源码保护，不会自动加入提示词、当作已确认发现或在普通状态报告公开。默认单工件 1 MiB、每任务原文总量 8 MiB、最多 4096 条记录；截断由工件标记，存储超限明确返回遗漏标记和无源码诊断。读取绑定原会话、目录、提供方、模型和思考设置。需要查看时，Agent 必须先提示“可能把源码／模型原文带入当前对话”，取得你的明确同意，再调用 `code_review_artifacts({jobId,confirmed:true})`；可用 `offset`／`limit` 分页，默认一次 1 条、最多 100 条。返回内容标为 `sourceBearing:true`、`untrusted:true`，不是批准证据；普通 `status` 不返回工件原文。目录／文件使用 0700／0600 权限模式及原子写入；Windows 模式位不等于额外 ACL 保证。
 
@@ -277,8 +279,8 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 普通使用者只需上面的对话请求，不必手工构造 ID。需要精确控制时，让 Agent 按下列顺序调用：
 
 1. 调用 `code_review_preview`，参数可以是 `{}` 或上面的 JSON 示例。
-2. 展示返回的仓库、模型、文件与限制，保留返回的 `previewId`。**此时还没有完成审查。**
-3. 用户确认后，调用 `code_review_execute`：
+2. 内部核对返回的仓库、模型路由、发送目的地、文件、预算与权限，保留返回的 `previewId`；只预览或需确认时向用户展示。**此时还没有完成审查。**
+3. 当前人类已明确要求审核且预览与授权一致时，直接调用 `code_review_execute`，不重复询问；只预览、等待确认或超授权时不得直接执行：
 
 ```json
 {"previewId":"替换为本次预览真实返回的ID","confirmed":true}
@@ -312,7 +314,7 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 | Agent 没有调用代码审查工具，只给了普通文字分析 | 明确要求调用 `code_review_preview`；若工具不可用，检查插件是否启用并已加载到当前会话 |
 | 找不到仓库 / 选错仓库 | 检查会话工作目录；多仓库时用 `repositoryPath` 指定子仓库根目录 |
 | 新文件没有出现 | 用 `selectedPaths` 显式选择未跟踪文件；路径相对于仓库 |
-| 预览过期、文件已变化、模型已变化 | 重新预览，核对新范围后再确认，不复用旧 ID |
+| 预览过期、文件已变化、模型已变化 | 新预览并重新核对当前授权，不复用旧 ID 或旧批准；超出授权时询问 |
 | SVN 历史提示需要网络许可 | 确认可以访问仓库后，预览参数增加 `svnAllowNetwork:true` |
 | SVN 登录、权限或版本不存在 | 检查 SVN 本身的访问权限和版本号；不要把密码写进对话或仓库 URL |
 | 文件被阻断或报告 partial | 阅读具体原因；缩小变更批次、补充允许的上下文，或处理真实冲突后重新预览。不能把排除文件视为通过 |

package/RELEASE-NOTES.md

@@ -1,23 +1,17 @@
-# v0.87.2 发布说明
+# v0.87.3 发布说明
 
-使用方式见 [README](README.md)，历史变化见 [变更记录](CHANGELOG.md)，发布门禁见 [开发说明](DEVELOPMENT.md)。
+## 审核授权与内部预览
 
-## 差异交付与预算恢复
+明确要求审核（例如“用 dsh-code-review 审核 r7364”）且内部预览与当前授权范围、模型及发送目的地一致时，工具描述和后台预览完成提示指导 Agent 直接继续执行，不再机械要求第二次确认。只要求预览、要求等待，或范围／模型／目的地超出授权时仍须取得授权。
 
-大文件稀疏、远距离编辑增加有界最短编辑回退，避免差异表超限后不必要地扩大为近全文包络；耗尽预算仍明确受限。文件／窗口主审保留同次检索链，等待其他阶段释放局部额度后有限续跑，不重置总账、检索轮数、纠正许可或超时。
+此次修复的是 Agent 工具指引与预览完成提示，不新增一键自动执行 API，也不在后台自行推断自然语言授权。Agent 仍须捕获并核对预览，再传 confirmed=true。
 
-正常组主审仍合并调用；仅真实局部分配失败且尚未接受组结果时明确回退成员主审，保留已消费预算、不回放已接受生成。组风险规划明确要求各成员提供 risks（允许空数组）；缺失或畸形仍报告限制，合法发现保留，不隐藏补发规划。
+## 保留的安全边界
 
-## 迁移对照与安全边界
+服务层确认参数、一次性预览、快照新鲜度、有效期、会话／目录／模型身份、宿主工具权限及独立远端许可不变。重启、保存任务或旧批准本身不授权再次外发。私有模型工件仍需展示隐私警告并取得独立明确同意，不能借审核请求读取。
 
-迁移导航保留旧公开入口、旧委托实现及新入口。删除导出、单例调用和不同名新入口仅提供有限词法候选导航，强制 uncertain，不证明类型、宏语义、共享状态身份或回归因果。不支持或歧义的旧入口明确报告限制。
+## 验证
 
-全部宿主迁移合同从批准快照独立重建并匹配完整身份，防止删除种类、基线或来源字段降级绕过限制；拒绝不可信访问器、Proxy 和自定义序列化钩子。独立复核仍使用本代新证据回执。
+补充同步／后台工具描述与终态预览提示回归测试，覆盖明确授权直接继续、仅预览不执行、超授权需询问及私有工件独立同意。发布以全量测试和四矩阵标签 CI 为门禁。
 
-预览返回有效截止时间并区分失效原因；后台分别显示阶段限制与全局余量，调用下限不是成本或耗时上限。批准等待中的取消或模型变化不能发送源码。
-
-## 验证与交付
-
-修复冻结本地完整回归1309项：1305通过、0失败、4跳过；最终独立复核定向65项通过。真实DSH ToolRuntime加载／工具注册、包内容与差异检查通过。这些不是业务项目真实模型重跑，也不保证召回率或实际耗时。
-
-正式发布须通过冻结标签 Ubuntu／Windows × Node.js22／24 四矩阵，并核验 Actions、npm 与 GitHub Release 的同一原始安装包及校验清单。发布不自动安装、升级或重启当前宿主。
+安装与使用见 [README](README.md)，历史变化见 [变更记录](CHANGELOG.md)，发布门禁见 [开发说明](DEVELOPMENT.md)。发布不等于自动升级或重启当前桌面宿主。

package/index.mjs

@@ -6,10 +6,10 @@ import { reviewToolOutput } from './src/tool-view.mjs';
 export const name = 'dsh-code-review';
 export const inject = ['tools', 'llm'];
 
-const PREVIEW_DESCRIPTION = 'Preview Git/SVN working-copy or Git commit/range review scope and model destination without sending source to a model. repositoryPath selects an explicit child repository relative to session workspace; file paths are repository-relative. Each session reviews one selected repository independently; reviewMode=project selects tracked current source instead of changes; changeScope=staged or unstaged narrows a Git working-copy review to the index or to unstaged edits. Show the preview before execution.';
+const PREVIEW_DESCRIPTION = 'Preview Git/SVN working-copy or Git commit/range review scope and model destination without sending source to a model. repositoryPath selects an explicit child repository relative to session workspace; file paths are repository-relative. Each session reviews one selected repository independently; reviewMode=project selects tracked current source instead of changes; changeScope=staged or unstaged narrows a Git working-copy review to the index or to unstaged edits. Always capture and inspect the preview internally before execution. An explicit user request to review the selected code already authorizes execution within that request: proceed without asking the user to confirm the same review again. Ask only if the preview exceeds the requested scope or changes the authorized model/destination, or authorization is unclear. Never execute if the user requested preview only or explicitly asked to wait for confirmation. Preserve host tool permissions and all snapshot/identity checks.';
 const PREVIEW_PARAMETERS = { type: 'object', additionalProperties: false, properties: { resumeFromJobId: { type: 'string', description: 'Explicit terminal job to reuse identity-matching completed chains. Requires a fresh captured preview, confirmation and authorization; does not restore old approval.' }, reviewMode: {type:'string',enum:['changes','project'],description:'project reviews all tracked current files, including unchanged files, in bounded batches with shared session budget. Does not include ignored/untracked/external contents. Each DSH session owns independent preview, lock and model budget.'}, changeScope: {type:'string',enum:['worktree','staged','unstaged'],description:'Git working-copy comparison scope. worktree (default) compares HEAD to the working tree (net change); staged compares HEAD to the index so only staged content is reviewed; unstaged compares the index to the working tree so only unstaged edits are reviewed and staged content is the old side. Requires a Git working copy; mutually exclusive with Git history, SVN parameters and project mode.'}, svnReplacementBaseRevision: {type:'string',description:'Working-copy file replacement only: explicitly compare to this fixed repository revision at the target URL. Not local BASE and not proof of the removed-node revision. Requires separate remote opt-in when applicable; identity and properties frozen in preview.'}, svnReplacementAllowNetwork: {type:'boolean',description:'Explicit permission to read the selected working-copy target URL at svnReplacementBaseRevision. Does not permit arbitrary URLs, updates, merges or writes.'}, svnBasePath: {type:'string',description:'Explicit old endpoint path relative to the current SVN repository root; requires svnTargetPath and fixed revision range. Not an arbitrary URL. Same repository UUID required.'}, svnTargetPath: {type:'string',description:'Explicit new endpoint repository-relative path paired with svnBasePath. Each side content/context stays at its URL/revision; shared capture budgets and remote opt-in apply.'}, svnEffectiveMergeinfo: { type: 'boolean', description: 'Explicit SVN opt-in to bounded BASE/working or fixed-history ancestor mergeinfo property reads on each selected side. Offline for working copies; history uses existing remote permission and budgets. Mixed BASE revisions, unsafe ancestors or incomplete URL boundaries remain unknown. No branch source reads or merge attribution.' }, svnRevision: { type: 'string', description: 'SVN fixed numeric revision reviewed against revision minus one. Requires SVN working-copy root; no HEAD/date aliases.' }, svnBaseRevision: { type: 'string', description: 'SVN fixed numeric old endpoint; requires svnTargetRevision, mutually exclusive with svnRevision and Git revision parameters.' }, svnTargetRevision: { type: 'string', description: 'SVN fixed numeric new endpoint, greater than old endpoint. Fixed repository objects, not working-copy text. Supports explicitly selected target context with verified baseline provenance and target rules; explicit old-only context is also supported with fixed SVN provenance; autoContext follows at most three independent fixed-side dependency layers with bounded parent listings and shared capture budgets; callerScopePaths supports bounded fixed-side SVN historical literal discovery; only matched sides captured, never complete caller coverage.' }, svnAllowNetwork: { type: 'boolean', description: 'Explicit opt-in to read the working-copy repository URL at fixed SVN revisions during preview/execute; preview sends no source to a model. Required for non-file repository URLs; default denies remote access. Does not allow checkout/update/merge or arbitrary URLs.' }, reviewRounds: { type: 'integer', minimum: 1, maximum: 3, description: 'Explicit independent review passes, default 1. Preview discloses extra sends; later passes omit the first risk plan. Shares existing timeout, call and retrieval budgets, not provider reasoning effort. Bound to this preview; execute cannot override.' }, oldContextPaths: { type: 'array', maxItems: 20, items: { type: 'string' }, description: 'Explicit Git/SVN historical baseline-only context paths. Git uses fixed blobs; SVN uses UUID/URL/peg/operative revision/hash. Shares 20 context slots. No target text is inferred; selected old changes reuse original identity, excluded changes cannot reenter. Unsupported on working reviews.' }, callerScopePaths: { type: 'array', minItems: 1, maxItems: 4, items: { type: 'string' }, description: 'Explicit non-root repository-relative directories for bounded tracked literal reverse import/include discovery. Git/SVN working review or fixed Git/SVN historical review. SVN uses offline normal nodes, rejects unsafe ancestor states and special/keyword properties. Historical sides share scan budgets and use object blobs only. Preview reads candidate bodies, including nonmatches; only captured matching context is sent. Navigation only, not complete caller coverage.' }, businessRequirement: { type: 'string', maxLength: 16384, description: 'Optional business constraint text up to 16KiB UTF8; untrusted data, not evidence or permission. Bound to preview and sent in review phases.' }, commit: { type: 'string', description: 'Git commit versus sole parent; root empty, merge requires range.' }, baseRevision: { type: 'string', description: 'Git old endpoint; requires targetRevision, mutually exclusive with commit.' }, targetRevision: { type: 'string', description: 'Git new endpoint, exact tree endpoints not merge-base. Explicit context uses target tree with available baseline provenance; oldContextPaths is baseline-only. Historical caller discovery scans fixed sides; explicit rules use target-tree blobs.' }, repositoryPath: { type: 'string', description: 'Workspace-relative explicit child Git/SVN repository root, forward slashes; omit for current repository.' }, selectedPaths: { type: 'array', items: { type: 'string' }, maxItems: 200 }, autoContext: { type: 'boolean', description: 'Opt in to tracked literal import/include context shown in preview. Working Git follows changed and explicitly selected context sources at most 3 dependency layers under shared 512 exact probes, 20 candidates/context slots, 1MiB source and 30s verification budget. Git history follows at most 3 baseline/target dependency layers with shared limits, object reads only; SVN follows at most 3 safe offline current-side layers with exact path probes and node/ancestor identity verification, sharing limits; no SVN historical review. Not semantic binding or complete definitions.' }, contextPaths: { type: 'array', items: { type: 'string' }, maxItems: 20 }, rulePaths: { type: 'array', items: { type: 'string' }, maxItems: 4 } } };
-const EXECUTE_DESCRIPTION = 'Execute a previewed read-only code review using the current DSH model. Sends the approved snapshot to the current Agent model under DSH tool execution policy; no separate plugin approval prompt. Never modifies the reviewed repository.';
-const EXECUTE_PARAMETERS = { type: 'object', additionalProperties: false, properties: { previewId: { type: 'string' }, confirmed: { type: 'boolean' } }, required: ['previewId', 'confirmed'] };
+const EXECUTE_DESCRIPTION = 'Execute a previewed read-only code review using the current DSH model. Sends the approved snapshot to the current Agent model under DSH tool execution policy; no separate plugin approval prompt. confirmed=true attests that the current user explicitly requested this review and the inspected preview matches that authorization; it does not require a second confirmation message. Never execute a preview-only or explicit wait-for-confirmation request, or exceed authorized scope/model/destination. Never modifies the reviewed repository.';
+const EXECUTE_PARAMETERS = { type: 'object', additionalProperties: false, properties: { previewId: { type: 'string' }, confirmed: { type: 'boolean', description: 'True only when the current user explicitly authorized this review and the inspected preview matches the requested scope/model/destination. The original explicit review request is sufficient; do not ask again for the same review. Preview-only or explicit wait-for-confirmation requests do not authorize execution.' } }, required: ['previewId', 'confirmed'] };
 
 export function apply(ctx, config = {}) {
   // This entry runs only when the host invokes the registered tool.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.87.2",
+  "version": "0.87.3",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/background-review.mjs

@@ -3,8 +3,8 @@ import os from 'node:os';
 import { createReviewJobs } from './review-jobs.mjs';
 import { reviewToolOutput } from './tool-view.mjs';
 
-const START_DESCRIPTION = 'Start a durable background preview or confirmed review. Returns a job ID immediately, NOT task completion. Keep the user request active using code_review_wait until terminal status; never final-answer only that a task started. Preview phase never sends source. For execute supply the approved previewId and confirmed=true. Use code_review_status to collect progress/results; code_review_cancel to stop. Does not automatically resume after host restart or grant new source approval.';
-const START_PARAMETERS = { type: 'object', additionalProperties: false, properties: { phase: { type: 'string', enum: ['preview', 'execute'] }, previewArgs: { type: 'object', description: 'Same parameters as code_review_preview; do not include execute fields.' }, previewId: { type: 'string' }, confirmed: { type: 'boolean' } }, required: ['phase'] };
+const START_DESCRIPTION = 'Start a durable background preview or confirmed review. Returns a job ID immediately, NOT task completion. Keep the user request active using code_review_wait until terminal status; never final-answer only that a task started. Preview phase never sends source. Always inspect the captured preview internally. An explicit current user request to review the selected code authorizes execution when the preview matches its scope/model/destination: proceed with phase=execute, previewId and confirmed=true without asking for duplicate confirmation. If the user requested preview only or explicitly asked to wait for confirmation, do not execute. Ask for scope expansion, a changed authorized model/destination, or unclear authorization. Host permissions and snapshot/identity checks still apply. Use code_review_status to collect progress/results; code_review_cancel to stop. Does not automatically resume after host restart or grant new source approval.';
+const START_PARAMETERS = { type: 'object', additionalProperties: false, properties: { phase: { type: 'string', enum: ['preview', 'execute'] }, previewArgs: { type: 'object', description: 'Same parameters as code_review_preview; do not include execute fields.' }, previewId: { type: 'string' }, confirmed: { type: 'boolean', description: 'Attest current explicit review authorization after inspecting the preview. A matching explicit review request is sufficient; do not ask again. Preview-only or explicit wait-for-confirmation is not execution authorization.' } }, required: ['phase'] };
 
 const STATUS_DESCRIPTION = 'Read a background review task owned by this session, directory and model. Returns saved progress or final preview/report. completed task means the tool returned; inspect nested report coverage/status. Interrupted tasks retain checkpoints but require new preview and approval to resend.';
 const STATUS_PARAMETERS = { type: 'object', additionalProperties: false, properties: { jobId: { type: 'string' }, offset: { type: 'integer', minimum: 0 }, checkpointIndex: { type: 'integer', minimum: 0, description: 'Read one checkpoint nested files/findings page; offset/limit apply within it.' }, limit: { type: 'integer', minimum: 1, maximum: 100 } }, required: ['jobId'] };
@@ -12,7 +12,7 @@ const STATUS_PARAMETERS = { type: 'object', additionalProperties: false, propert
 const CANCEL_DESCRIPTION = 'Cancel a background review task owned by this session. Does not discard saved checkpoints. No source is sent by cancellation.';
 const CANCEL_PARAMETERS = { type: 'object', additionalProperties: false, properties: { jobId: { type: 'string' } }, required: ['jobId'] };
 
-const WAIT_DESCRIPTION = 'Wait for review progress or terminal result without ending the user request. Prefer waitFor=terminal to ignore intermediate checkpoints; progress preserves checkpoint-by-checkpoint compatibility. Reuse the exact returned waitRevision as after; never guess increments or call status after every event. Timeout defaults to 60000ms and is bounded to 60000ms; changed=false means timeout, not completion or cancellation. Call again while queued/running. Preview completion requires confirmation; execute completion returns one final consolidated report.';
+const WAIT_DESCRIPTION = 'Wait for review progress or terminal result without ending the user request. Prefer waitFor=terminal to ignore intermediate checkpoints; progress preserves checkpoint-by-checkpoint compatibility. Reuse the exact returned waitRevision as after; never guess increments or call status after every event. Timeout defaults to 60000ms and is bounded to 60000ms; changed=false means timeout, not completion or cancellation. Call again while queued/running. Preview completion is not review completion. If the current user explicitly requested the matching review, proceed to execute with confirmed=true without asking again; preview-only, explicit wait-for-confirmation or out-of-authorization scope/model/destination requires user authorization; execute completion returns one final consolidated report.';
 const WAIT_PARAMETERS = { type: 'object', additionalProperties: false, properties: { jobId: { type: 'string' }, after: { type: 'integer', minimum: 0, description: 'Exact waitRevision returned by start/status/wait; do not increment it yourself.' }, waitFor: { type: 'string', enum: ['progress', 'terminal'], default: 'progress', description: 'Use terminal to wait through intermediate saves; progress wakes on each durable checkpoint.' }, timeoutMs: { type: 'integer', minimum: 1, maximum: 60000, default: 60000 } }, required: ['jobId'] };
 
 const TERMINAL_STATUSES = ['completed', 'failed', 'cancelled', 'interrupted'];
@@ -45,10 +45,10 @@ function terminalSummary(value) {
     if (value.resultPage) lines.push('当前页：文件 ' + (value.resultPage.files?.length ?? 0) + '/' + count(value.resultPage.totalFiles) + '，发现 ' + (value.resultPage.findings?.length ?? 0) + '/' + count(value.resultPage.totalFindings) + '；code_review_status 的 offset/limit 仅切换结果页。');
     lines.push('完整报告：调用一次 code_review_wait（jobId 同上，waitFor=terminal）立即取得最终报告；无需继续轮询。');
   } else if (report?.previewId) {
-    lines.push('预览已完成，尚未执行审查；请展示批准范围并取得用户确认后再执行。');
+    lines.push('预览已完成，尚未执行审查；请先内部核对范围、模型与发送目的地。用户已明确要求审核且预览符合该授权时，直接以 confirmed=true 继续执行，不要重复询问确认。仅要求预览时不得执行；明确要求等待确认时也不得执行。超出原授权范围、改变授权模型／发送目的地或授权边界不明确时才询问。宿主权限及快照／身份校验仍须通过。');
     lines.push('预览文件总量：' + count(report.filePage?.total ?? report.files?.length) + '；计划最少调用：' + count(report.plan?.minimumCalls));
     lines.push('最少调用仅为初始计划下限，不是总调用数或耗时上限；后续取证、复核及综合会增加工作量。');
-    if (typeof report.expiresAt === 'string' && Number.isFinite(Date.parse(report.expiresAt))) lines.push('预览有效至：' + new Date(report.expiresAt).toISOString() + '；过期后须重新预览并确认。');
+    if (typeof report.expiresAt === 'string' && Number.isFinite(Date.parse(report.expiresAt))) lines.push('预览有效至：' + new Date(report.expiresAt).toISOString() + '；过期后须重新预览并核对当前授权，不得复用旧预览或恢复旧批准。');
   } else {
     lines.push('未提供完整报告摘要；终态不会自动恢复或重新发送源码。请检查已保存检查点和未完成范围。');
   }

package/src/preview-validity.mjs

@@ -1,6 +1,6 @@
 // Preview validity is diagnostic only: it never restores approval or bypasses recapture.
 export function previewValidity(preview, current, now) {
-  const fail = (code, message) => { const error = new Error(message + '; preview again and obtain fresh confirmation'); error.code = code; throw error; };
+  const fail = (code, message) => { const error = new Error(message + '; preview again and verify current explicit user authorization; do not reuse old approval. A matching explicit review request needs no duplicate confirmation; preview-only or explicit wait-for-confirmation does not authorize execution, and scope/model/destination changes require authorization'); error.code = code; throw error; };
   if (!preview) fail('PREVIEW_MISSING', 'Preview missing or already consumed');
   if (preview.expires <= now) fail('PREVIEW_EXPIRED', 'Preview expired');
   if (preview.agent !== current.agent) fail('PREVIEW_OWNER_CHANGED', 'Preview owner changed');

package/src/project-review-service.mjs

@@ -13,7 +13,7 @@ import { reviewProjectBatches, projectConcurrency as validateProjectConcurrency,
 import { createDshModel } from './dsh-model.mjs';
 import { retrievalRounds } from './review-execution-policy.mjs';
 
-const PREVIEW_NOTICE_SUFFIX = ' Full current source audit, not regression-only diff. Shared session execution budget: no internal elapsed-time or model-call cutoff, 16MiB capture memory protection. Blocked/excluded/pending files are not reviewed successfully. No untracked/ignored/external bodies; no complete semantic call graph. Independent approved batches run with bounded concurrency; per-batch evidence and global model-call budgets remain enforced. Show scope and model before confirmed execute.';
+const PREVIEW_NOTICE_SUFFIX = ' Full current source audit, not regression-only diff. Shared session execution budget: no internal elapsed-time or model-call cutoff, 16MiB capture memory protection. Blocked/excluded/pending files are not reviewed successfully. No untracked/ignored/external bodies; no complete semantic call graph. Independent approved batches run with bounded concurrency; per-batch evidence and global model-call budgets remain enforced. Inspect scope and model against current explicit user authorization before execute. A matching explicit review request needs no duplicate confirmation; do not execute preview-only or explicit wait-for-confirmation requests, and ask if scope/model/destination exceeds authorization or is unclear. Host permissions and snapshot/identity checks remain required.';
 const REPORT_NOTICE_SUFFIX = ' Coverage counts processing of selected tracked files only, not proof of correctness. Excluded and blocked are never completed. No cross-batch whole-program semantic coverage is claimed.';
 
 function owner(exec) {

package/src/recovery-coverage.mjs

@@ -1,5 +1,5 @@
 // Saved evidence is a ledger, not renewed source authority or automatic resume.
-const NOTICE = 'Saved approved manifest (when present) plus checkpoints; before that, only observed scope, not a complete denominator. Completed windows are not a completed file. New source sends require fresh preview and confirmation; no approval is restored from this ledger.';
+const NOTICE = 'Saved approved manifest (when present) plus checkpoints; before that, only observed scope, not a complete denominator. Completed windows are not a completed file. New source sends require fresh preview and current explicit user authorization; no approval is restored from this ledger. A matching explicit resume request needs no duplicate confirmation; preview-only or explicit wait-for-confirmation does not authorize execution, and scope/model/destination changes require authorization.';
 
 export function recoveryCoverage(record) {
   const states = new Map(), windows = new Map(), stages = new Map();

package/src/review-jobs.mjs

@@ -78,7 +78,7 @@ export function createReviewJobs({directory}={}){
   },
   async resume(id,exec){const r=await owned(id,exec);if(jobs.get(id)&&!jobs.get(id).settled||['queued','running'].includes(r.status)||!r.resumeState)throw new Error('No terminal completed-chain resume state available');return structuredClone(r.resumeState);},
   async artifacts(id,exec,page){const r=await owned(id,exec);return artifacts.read(id,r.owner,page);},
-  async status(id,exec,page){const r=structuredClone(await owned(id,exec));delete r.resumeState;const active=jobs.get(id);if(active&&!active.settled&&!['queued','running'].includes(r.status)){r.status='running';r.stage='finalizing';delete r.result;delete r.finishedAt;}r.recovery=recoveryCoverage(r);r.progress=jobProgress(r);r.waitRevision=jobs.get(id)?.savedRevision??r.checkpoints.length;r.nextAction=['queued','running'].includes(r.status)?'Call code_review_wait with waitFor=terminal; reuse the exact returned waitRevision as after, never guess increments. No code_review_status call is needed after each event. Do not end the user request while task runs.':r.result?.previewId?'Show preview and request user confirmation before execute.':'Collect final report and unfinished scope, then provide one final answer.';if(!page)return r;const {offset=0,limit=20,checkpointIndex}=page;if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(limit)||limit<1||limit>100)throw new Error('Invalid result page');if(checkpointIndex!==undefined){if(!Number.isSafeInteger(checkpointIndex)||checkpointIndex<0||checkpointIndex>=r.checkpoints.length)throw new Error('Invalid checkpoint index');return {jobId:r.jobId,status:r.status,waitRevision:r.waitRevision,progress:r.progress,nextAction:r.nextAction,checkpointIndex,checkpoint:pageCheckpoint(r.checkpoints[checkpointIndex],offset,limit),page:{offset,limit}};}const result=r.result;const report=result?.report;return {...r,result:undefined,recovery:{...r.recovery,unfinishedStages:r.recovery.unfinishedStages.slice(offset,offset+limit),files:r.recovery.files.slice(offset,offset+limit),windows:r.recovery.windows.slice(offset,offset+limit),suggestedPaths:r.recovery.suggestedPaths.slice(offset,offset+limit),totalObservedFiles:r.recovery.files.length},checkpoints:r.checkpoints.slice(offset,offset+limit).map(c=>pageCheckpoint(c,0,limit)),checkpointPage:{offset,limit,total:r.checkpoints.length},...(result?{resultSummary:report?{status:report.status,coverage:report.coverage,model:report.model,snapshotId:report.snapshotId,diagnostics:report.diagnostics,execution:report.execution,modelCalls:report.modelCalls,totalFiles:report.files?.length,totalFindings:report.findings?.length,totalLimitations:report.limitations?.length}:({...result,files:result.files?.slice(offset,offset+limit),filePage:result.files?{offset,limit,total:result.files.length}:undefined}),resultPage:report?{files:report.files?.slice(offset,offset+limit),findings:report.findings?.slice(offset,offset+limit),totalFiles:report.files?.length,totalFindings:report.findings?.length}:undefined}: {})};},
+  async status(id,exec,page){const r=structuredClone(await owned(id,exec));delete r.resumeState;const active=jobs.get(id);if(active&&!active.settled&&!['queued','running'].includes(r.status)){r.status='running';r.stage='finalizing';delete r.result;delete r.finishedAt;}r.recovery=recoveryCoverage(r);r.progress=jobProgress(r);r.waitRevision=jobs.get(id)?.savedRevision??r.checkpoints.length;r.nextAction=['queued','running'].includes(r.status)?'Call code_review_wait with waitFor=terminal; reuse the exact returned waitRevision as after, never guess increments. No code_review_status call is needed after each event. Do not end the user request while task runs.':r.result?.previewId?'Inspect preview against current explicit user authorization. For a matching explicit review request, execute with confirmed=true without asking again. Do not execute preview-only or explicit wait-for-confirmation requests; ask for authorization if scope/model/destination exceeds authorization or is unclear. Preserve host permissions and snapshot/identity checks.':'Collect final report and unfinished scope, then provide one final answer.';if(!page)return r;const {offset=0,limit=20,checkpointIndex}=page;if(!Number.isSafeInteger(offset)||offset<0||!Number.isSafeInteger(limit)||limit<1||limit>100)throw new Error('Invalid result page');if(checkpointIndex!==undefined){if(!Number.isSafeInteger(checkpointIndex)||checkpointIndex<0||checkpointIndex>=r.checkpoints.length)throw new Error('Invalid checkpoint index');return {jobId:r.jobId,status:r.status,waitRevision:r.waitRevision,progress:r.progress,nextAction:r.nextAction,checkpointIndex,checkpoint:pageCheckpoint(r.checkpoints[checkpointIndex],offset,limit),page:{offset,limit}};}const result=r.result;const report=result?.report;return {...r,result:undefined,recovery:{...r.recovery,unfinishedStages:r.recovery.unfinishedStages.slice(offset,offset+limit),files:r.recovery.files.slice(offset,offset+limit),windows:r.recovery.windows.slice(offset,offset+limit),suggestedPaths:r.recovery.suggestedPaths.slice(offset,offset+limit),totalObservedFiles:r.recovery.files.length},checkpoints:r.checkpoints.slice(offset,offset+limit).map(c=>pageCheckpoint(c,0,limit)),checkpointPage:{offset,limit,total:r.checkpoints.length},...(result?{resultSummary:report?{status:report.status,coverage:report.coverage,model:report.model,snapshotId:report.snapshotId,diagnostics:report.diagnostics,execution:report.execution,modelCalls:report.modelCalls,totalFiles:report.files?.length,totalFindings:report.findings?.length,totalLimitations:report.limitations?.length}:({...result,files:result.files?.slice(offset,offset+limit),filePage:result.files?{offset,limit,total:result.files.length}:undefined}),resultPage:report?{files:report.files?.slice(offset,offset+limit),findings:report.findings?.slice(offset,offset+limit),totalFiles:report.files?.length,totalFindings:report.findings?.length}:undefined}: {})};},
   async wait(id,exec,{after,waitFor='progress',timeoutMs=60000,signal}={}){
    const r=await owned(id,exec);
    if(!Number.isSafeInteger(timeoutMs)||timeoutMs<1||timeoutMs>60000)throw new Error('Invalid wait duration');

package/src/review-resume.mjs

@@ -199,6 +199,6 @@ export function validateResumeState(value, snapshot, options) {
 }
 
 export function resumePreview(state, sourceJobId) {
-  if (state.schemaVersion === 2) return { sourceJobId, reusableFiles: state.completed.length, fileIds: state.completed.map(item => item.fileId), reusableGenerations: state.stageGenerations.length, stageFileIds: [...new Set(state.stageGenerations.map(item => item.fileId))], notice: 'Exact-identity accepted primary generations may skip generation only. Pending chains are not completed reviews. Verification always runs again with fresh independent receipts; secondary stages restart at a fresh provenance boundary. Saved continuation is historical bookkeeping, not fresh completion or a new attempt allowance. Fresh preview confirmation and model authorization remain required.' };
-  return { sourceJobId, reusableFiles: state.completed.length, fileIds: state.completed.map(item => item.fileId), notice: 'Only exact-identity completed file chains are reusable. Pending/interrupted stages run again; old findings retain prior-run provenance, not fresh model evidence. Fresh preview confirmation and model authorization are still required.' };
+  if (state.schemaVersion === 2) return { sourceJobId, reusableFiles: state.completed.length, fileIds: state.completed.map(item => item.fileId), reusableGenerations: state.stageGenerations.length, stageFileIds: [...new Set(state.stageGenerations.map(item => item.fileId))], notice: 'Exact-identity accepted primary generations may skip generation only. Pending chains are not completed reviews. Verification always runs again with fresh independent receipts; secondary stages restart at a fresh provenance boundary. Saved continuation is historical bookkeeping, not fresh completion or a new attempt allowance. Fresh preview and current explicit user/model authorization remain required; a matching explicit resume request needs no duplicate confirmation. Preview-only or explicit wait-for-confirmation does not authorize execution; ask for scope/model/destination changes.' };
+  return { sourceJobId, reusableFiles: state.completed.length, fileIds: state.completed.map(item => item.fileId), notice: 'Only exact-identity completed file chains are reusable. Pending/interrupted stages run again; old findings retain prior-run provenance, not fresh model evidence. Fresh preview and current explicit user/model authorization are still required; a matching explicit resume request needs no duplicate confirmation. Preview-only or explicit wait-for-confirmation does not authorize execution; ask for scope/model/destination changes.' };
 }

package/src/service.mjs

@@ -53,7 +53,7 @@ function describeFile(file, snapshot) {
 /** Compose the user-facing preview notice; text is verbatim from the original rules. */
 function buildPreviewNotice(snapshot, options, enableRiskPlanning, changesConcurrency, maxRetrievalRounds) {
   const scopeNotice = options.changeScope !== undefined && options.changeScope !== 'worktree' ? changeScopePreviewNotice(options.changeScope) : '';
-  return scopeNotice + (snapshot.history?.vcs==='svn'&&options.autoContext===true?'SVN历史autoContext为精确依赖定位读取固定版本父目录有界清单，包含同目录非匹配名字元数据；仅匹配捕获正文发送模型，不扫描全仓，不用工作树替代历史版本。':'') + (options.oldContextPaths !== undefined ? 'oldContextPaths仅为baseline旧侧正文，无目标侧替代；选中变更复用原old身份，旧侧不能证明新侧行为。' : '') + (snapshot.callerDiscovery ? 'callerScopePaths已授权预览读取限定目录内tracked候选正文，包括不匹配文件；非匹配正文不发送模型，匹配捕获上下文会发送。仅字面引用导航，不是函数调用或完整调用覆盖。' : '') + (enableRiskPlanning ? '执行按plan阈值决定风险假设规划，小变更可跳过独立规划但仍主审并复核；计划不是证据，所有阶段共享原预算。' : '') + `执行会向上述模型提供方发送可审查文件两侧内容、预览列出的显式/自动上下文、所选项目规则全文及预览业务需求文本。模型可在该快照范围内多轮只读检索，不读取范围外文件；候选生成后会进行证据与反证复核，两阶段各最多${maxRetrievalRounds}轮检索；独立文件审查链最多${changesConcurrency}条并发，不设插件内部默认时间或总模型调用次数截止，遵循宿主/用户取消；输入字节和检索轮次保护仍保留；复核不能证明缺陷成立。plan.reviewRounds为独立审查工作量，非模型reasoning effort；后续轮不带首轮风险计划，所有轮共享原超时与预算。plan仅预检初始输入，ready不代表已审查；minimumCalls不含后续检索/复核/动态业务综合；多文件可先进行业务分组，分组失败保留原组并记录限制，动态综合数执行前未知，实际预算可能不足。请先向用户展示范围，获得确认后执行。`;
+  return scopeNotice + (snapshot.history?.vcs==='svn'&&options.autoContext===true?'SVN历史autoContext为精确依赖定位读取固定版本父目录有界清单，包含同目录非匹配名字元数据；仅匹配捕获正文发送模型，不扫描全仓，不用工作树替代历史版本。':'') + (options.oldContextPaths !== undefined ? 'oldContextPaths仅为baseline旧侧正文，无目标侧替代；选中变更复用原old身份，旧侧不能证明新侧行为。' : '') + (snapshot.callerDiscovery ? 'callerScopePaths已授权预览读取限定目录内tracked候选正文，包括不匹配文件；非匹配正文不发送模型，匹配捕获上下文会发送。仅字面引用导航，不是函数调用或完整调用覆盖。' : '') + (enableRiskPlanning ? '执行按plan阈值决定风险假设规划，小变更可跳过独立规划但仍主审并复核；计划不是证据，所有阶段共享原预算。' : '') + `执行会向上述模型提供方发送可审查文件两侧内容、预览列出的显式/自动上下文、所选项目规则全文及预览业务需求文本。模型可在该快照范围内多轮只读检索，不读取范围外文件；候选生成后会进行证据与反证复核，两阶段各最多${maxRetrievalRounds}轮检索；独立文件审查链最多${changesConcurrency}条并发，不设插件内部默认时间或总模型调用次数截止，遵循宿主/用户取消；输入字节和检索轮次保护仍保留；复核不能证明缺陷成立。plan.reviewRounds为独立审查工作量，非模型reasoning effort；后续轮不带首轮风险计划，所有轮共享原超时与预算。plan仅预检初始输入，ready不代表已审查；minimumCalls不含后续检索/复核/动态业务综合；多文件可先进行业务分组，分组失败保留原组并记录限制，动态综合数执行前未知，实际预算可能不足。请先内部核对预览与当前人类授权。用户已明确要求审核且范围、模型和发送目的地一致时直接执行，不重复询问确认；只要求预览或明确要求等待确认时不得执行，超出授权或边界不明确时才询问。宿主权限和快照／身份校验仍须通过。`;
 }
 
 function createSessionReviewService(llm, { capture = captureSnapshot, now = Date.now, ttlMs = 300000, maxPreviews = 8, allowModelSending = false, enableRiskPlanning = false, skipSmallRiskPlans = true, reviewRounds = 1, enableBusinessGrouping = false, enableAnchorCorrection = false, changesConcurrency = 2, maxRetrievalRounds = 3, riskPlanningMode = 'separate', readerBudgetPolicy = 'fixed', optimizeReviewCalls = false, enablePrimarySeeds = false, focusPrimaryContext = false, enableSearchSeeds = false, nativeOutputTools = false, enableGroupPrimary = false, enableEvidenceContext = false, inlineInteractionRisks = false, enableMigrationContracts = false, enableMigrationRegression = false, enableGroupInteractions = false, enableStageContinuation = false, authorize = async () => false } = {}) {