@jayyuen66/dsh-ocr-review 0.1.8 → 0.1.9

package/cordis.patch.yml

@@ -1,6 +1,6 @@
 # ocr-review：open-code-review 工作区审查插件（bundle）。
 # 双面包机制：本包含 Host 半（host.ts：7 个工具 ocr_review/ocr_scan/
-# ocr_delegate_preview/ocr_delegate_rule/ocr_session + 由 `Config` 上 `.volatile()`
+# ocr_delegate_preview/ocr_delegate_rule/ocr_session/ocr_rules_check/ocr_llm + 由 `Config` 上 `.volatile()`
 # 隐式投影的设置面（命名空间就是下面这条的 id）+ 设置卡的 `ocrReview` Remote 读面）与
 # Client 半（src/client-entry.ts → client.js：设置卡片，从宿主设置服务的
 # llm-pi-ai.providers 选 provider/model 应用到

package/docs/DETAIL.md

@@ -0,0 +1,28 @@
+# Open code review
+
+Runs the external `ocr` command line over a change set, reports the comments it produces, and manages which model does the reviewing.
+
+## What the card changes
+
+- **Model** — `ocrProvider` and `ocrModel` are not stored settings: they project the host's model namespace, and entries without a usable key are shown but disabled. `chatGptModel` reflects the external CLI's own login state, which this plugin reads but does not own.
+- **Review parameters** — `effort` (`auto`/`low`/`medium`/`high`) is how many review passes run: deeper review costs more time. `language` chooses Chinese or English output. `autoVerify` (on) runs `ocr llm test` after you pick a provider and model, so a wrong choice fails at pick time rather than at first review. `maxComments` (default 12; 0 means all, including comments that cannot be anchored to a line). `timeoutMinutes` (0 requests the host's ceiling; a positive value is minutes, still clamped by the host). `ocrConfigPath` — empty means `~/.opencodereview/config.json`; a non-empty value must be `<dir>/.opencodereview/config.json` and is honoured by redirecting `HOME` (POSIX only).
+
+Six of these are read per call, so a change applies on the next review without restarting the host.
+
+## Two separate things called MCP
+
+The card's MCP-servers editor writes the **external `ocr` tool's own** configuration. It is unrelated to the `integrationMode` / `mcpPort` surface of the Scrapling plugin, and nothing in this plugin serves MCP itself.
+
+## Restart-only values
+
+`llmTestTimeoutMs` (90000), `startupVerify` (on: the endpoint self-check runs at load), `ocrBackgroundMaxMs` (0 = no backstop window), `stdoutMaxBytes` (400000), `ocrNoAutoUpdate` (false: upstream auto-upgrade stays on unless you say otherwise) and `ocrInstallHint` (`both`/`brew`/`npm`). Set them in the `config:` block of this plugin's row in `cordis.patch.yml`.
+
+## What it needs from outside
+
+The `ocr` command line, expected at version **1.13.3**; the expectation is declared in code and mirrored in the package's manifest and READMEs, so a mismatch is reported rather than papered over. Install paths are `brew install open-code-review` or `npm i -g @alibaba-group/open-code-review@1.13.3`. A missing binary is reported as "command not found"; the case where a launcher exists but the binary does not says exactly that. The version probe always forces `OCR_NO_UPDATE=1` so probing cannot trigger an upgrade.
+
+API credentials are not stored here: the plugin writes a `api_key_cmd` that calls a helper script, so the key is fetched at run time instead of landing in a config file. If that script is missing, the card warns rather than sending an unauthenticated request.
+
+## Further detail
+
+The tool list exposed to the model, how background reviews become host jobs and the argument guard's flag table are in the package README (`README.md` / `README.zh-CN.md`).

package/docs/DETAIL.zh.md

@@ -0,0 +1,28 @@
+# 代码评审（open-code-review）
+
+调用外部 `ocr` 命令行评审一个变更集，回报它给出的意见，并管理用来评审的模型。
+
+## 设置卡上改的是什么
+
+- **模型** — `ocrProvider` 与 `ocrModel` 不是本插件存的值：它们是宿主模型命名空间的投影，没有可用密钥的条目照样列出但禁用。`chatGptModel` 反映的是外部命令行自己的登录态，本插件读它但不拥有它。
+- **审查参数** — `effort`（`auto`/`low`/`medium`/`high`）是跑几轮审查，越深越费时。`language` 选中文或英文输出。`autoVerify`（默认开）在选完提供方与模型后跑一次 `ocr llm test`，选错当场就知道，而不是等第一次评审失败。`maxComments`（默认 12；0 表示全部，包括钉不到行上的意见）。`timeoutMinutes`（0 表示向宿主要上限；正数是分钟数，仍由宿主收口）。`ocrConfigPath`——留空就是 `~/.opencodereview/config.json`；填了就必须是 `<目录>/.opencodereview/config.json` 的形状，生效方式是重定向 `HOME`（仅 POSIX）。
+
+其中六项每次调用现读，改完下一次评审生效，不需要重启宿主。
+
+## 两处都叫 MCP，但不是同一件事
+
+卡上的 MCP servers 编辑器改的是**外部 `ocr` 工具自己的**配置。它与「Scrapling 网页抓取」那套 `integrationMode` / `mcpPort` 的 MCP 面没有关系，本插件也不对外提供 MCP 服务。
+
+## 要重启的值
+
+`llmTestTimeoutMs`（90000）、`startupVerify`（默认开：装载时自检端点）、`ocrBackgroundMaxMs`（0 表示不设兜底窗口）、`stdoutMaxBytes`（400000）、`ocrNoAutoUpdate`（默认 false，即保留上游的自动升级，除非你明确关掉）、`ocrInstallHint`（`both`/`brew`/`npm`）。写在本插件注册行的 `config:` 块，改值随重启生效。
+
+## 需要外部提供什么
+
+`ocr` 命令行，期望版本 **1.13.3**；这个期望写在代码里，并镜像到包清单与两份 README，所以版本不符是被报出来的，不是被掩盖的。装法是 `brew install open-code-review` 或 `npm i -g @alibaba-group/open-code-review@1.13.3`。命令行不存在时按「找不到命令」报；只有垫片没有真二进制时说的也是这一件。版本探测一律强制 `OCR_NO_UPDATE=1`，以免探测顺手触发升级。
+
+API 凭据不存这里：本插件写的是一个 `api_key_cmd`，运行时的密钥由那支辅助脚本现取，不进配置文件。脚本缺失时卡上给出告警，而不是发一次没有鉴权的请求。
+
+## 更完整的说明
+
+暴露给模型的工具清单、后台评审如何落成宿主作业、参数守卫的旗标对照表都写在随包 README（`README.md` / `README.zh-CN.md`）。

package/host.js

@@ -591,16 +591,16 @@ function arrayViolations(schema, value, path, walk) {
 *  能嵌套任意多个候选起点，而「run 内是否存在数字或大写」这类前瞻要把后面整段 run 反向
 *  回溯一遍——逐起点相乘就是 O(n²)（实测 400_000 字符 51 秒，正好是 `stdoutMaxBytes`
 *  的默认档）。run 是首个 `-` 之后的那一段：前缀只含字母，故首个 `-` 必是分界。 */
-const STANDALONE_KEY = /\b[A-Za-z]{2,5}-[A-Za-z0-9_-]{20,}\b/gu;
+const STANDALONE_KEY = /\b[A-Za-z]{2,5}-[\w-]{20,}\b/gu;
 /** `Authorization: <scheme> <value>` / `Proxy-Authorization: …`：认**头名**而不是
 *  枚举认证方案。头名本身就是「后面跟着凭据」的信号，Basic / Token / Digest 乃至
 *  vendor 自定义 scheme 都不会漏；而只认头名还避开了正文里「token based
 *  authentication」这类措辞被误抹。scheme 组连同其后的空白一起捕获，回填时凭据被
 *  替换而 scheme 词保留。 */
-const AUTH_HEADER_VALUE = /(?<name>\b(?:proxy-)?authorization["'\s]*[:=]["'\s]*)(?:(?<scheme>[a-z][a-z0-9_-]*[ \t]+))?[^\s"',;)}\]]{4,}/giu;
+const AUTH_HEADER_VALUE = /(?<name>\b(?:proxy-)?authorization["'\s]*[:=]["'\s]*)(?<scheme>[a-z][\w-]*[ \t]+)?[^\s"',;)}\]]{4,}/giu;
 /** 裸 scheme + 值（没有头名时 OCR 也会整行回显）。scheme 只留 bearer：它在散文中几乎
 *  不出现，而 token / basic 之类会撞上「token count」「basic usage」等普通措辞。 */
-const BEARER_VALUE = /(?<scheme>\bbearer[ \t]+)[a-z0-9._~+/=-]{4,}/giu;
+const BEARER_VALUE = /(?<scheme>\bbearer[ \t]+)[\w.~+/=-]{4,}/giu;
 /** `api_key: "xxx"`、`apiKey=xxx`、`token: xxx`、`x-api-key: xxx` 等赋值形态。
 *  值下限取 4 且容许一个 scheme 词：`token: Basic <base64>` 里赋值形态先能吃到的只是
 *  scheme 词（Basic 恰好 5 字符），下限更高时整条失配，后面那个 base64 就原样进了日志。
@@ -611,16 +611,25 @@ const BEARER_VALUE = /(?<scheme>\bbearer[ \t]+)[a-z0-9._~+/=-]{4,}/giu;
 *
 *  字符类写 `[A-Z0-9]` 而不是 `[A-Za-z0-9]`：这条正则带 `i` 标志，两者等价，
 *  而重复的字符区间会让静态检查报 duplicates-in-character-class。 */
-const KEY_ASSIGNMENT = /(?<name>(?<![A-Z0-9])(?:api[_-]?key|apikey|access[_-]?key|secret[_-]?key|client[_-]?secret|password|token)["'\s]*[:=]["'\s]*)(?:(?<scheme>[a-z][a-z0-9_-]*[ \t]+))?[^\s"',;)}\]]{4,}/giu;
+const KEY_ASSIGNMENT = /(?<name>(?<![A-Z0-9])(?:api[_-]?key|access[_-]?key|secret[_-]?key|client[_-]?secret|password|token)["'\s]*[:=]["'\s]*)(?<scheme>[a-z][\w-]*[ \t]+)?[^\s"',;)}\]]{4,}/giu;
 /** GitHub 系 token 的**下划线**形态（`ghp_…`、`github_pat_…`）：STANDALONE_KEY 要求
 *  「字母前缀 + 连字符」分界，这类值里没有连字符，前缀后又紧跟下划线，故单列一条。
 *  不并进 STANDALONE_KEY 是为了不放开那里的连字符要求——那条要求同时承担「别把
 *  kebab 小写路径当 key 抹掉」的职责。 */
-const UNDERSCORE_TOKEN = /\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{20,}\b/gu;
+const UNDERSCORE_TOKEN = /\b(?:gh[pousr]|github_pat)_\w{20,}\b/gu;
 const REDACTION = "***REDACTED***";
-/** 独立 key 形态的替换臂：随机串段里真有数字或大写才抹，否则原样交回（文件路径要保持可读）。 */
-function redactStandaloneKey(match) {
-	return /[0-9A-Z]/u.test(match.slice(match.indexOf("-") + 1)) ? REDACTION : match;
+/** token 尾部至少一枚非 `-` 的字母/数字。 */
+const TOKEN_TAIL_CHARACTER = /[0-9A-Z]/u;
+/** 独立 key 形态的替换臂：随机串段里真有数字或大写才抹，否则原样交回（文件路径要保持可读）。
+*  两侧任一是路径分隔符的匹配是路径段而非 key：ocr CLI 会把仓库路径拍平成 kebab 段嵌进
+*  session 的 file_path（`…/sessions/Users-yuanjiang-Documents-…/uuid.jsonl`），原路径里
+*  只要有大写组件（macOS 的 Documents/Desktop 一类）就过得了「数字或大写」那道护栏——
+*  裸 key 从不出现在斜杠两侧，路径段也从不出现在别处，按上下文分比按字符集猜稳。 */
+function redactStandaloneKey(match, offset, whole) {
+	const before = whole[offset - 1];
+	const after = whole[offset + match.length];
+	if (before === "/" || after === "/" || before === "\\" || after === "\\") return match;
+	return TOKEN_TAIL_CHARACTER.test(match.slice(match.indexOf("-") + 1)) ? REDACTION : match;
 }
 /**
 * 抹掉文本里 key 形状的片段。
@@ -693,6 +702,9 @@ function assertToolOutput(schema, value, toolName, messages) {
 	return value;
 }
 // lib/argv-guard.ts
+/** 归一后剥掉的尾随分隔符。 */
+const TRAILING_POSIX_SLASHES = /\/+$/u;
+const TRAILING_PATH_SEPARATORS = /[\\/]+$/u;
 /**
 * POSIX sh 单引号转义：' → '\''。把任意字符串安全放进单引号内，防注入。
 *
@@ -724,11 +736,11 @@ function assertAbsoluteRoot(root, messages) {
 	if (trimmed.includes("\0")) throw new Error(format(messages.noNulBytes, { name: "repo" }));
 	if (trimmed.startsWith("/")) {
 		const normalized = path.posix.normalize(trimmed);
-		return normalized.length > 1 ? normalized.replace(/\/+$/u, "") : normalized;
+		return normalized.length > 1 ? normalized.replace(TRAILING_POSIX_SLASHES, "") : normalized;
 	}
 	if (process.platform === "win32" && path.win32.isAbsolute(trimmed)) {
 		const normalized = path.win32.normalize(trimmed);
-		return normalized.length > 3 ? normalized.replace(/[\\/]+$/u, "") : normalized;
+		return normalized.length > 3 ? normalized.replace(TRAILING_PATH_SEPARATORS, "") : normalized;
 	}
 	throw new Error(format(messages.repoMustBeAbsolute, { root: trimmed }));
 }
@@ -887,8 +899,10 @@ function resolveOutputFormat(value) {
 	return REVIEW_OUTPUT_FORMATS.find((candidate) => candidate === value) ?? "json";
 }
 // lib/cli.ts
-/** `ocr review|scan|delegate preview` 的背景说明 flag（三处命令构造共用一条）。
-*  pushTextFlag 按 `flag.slice(2)` 反推报错用的参数名，故值必须带 `--` 前缀。 */
+/** Homebrew 安装路径（`Cellar` / `Homebrew` 任一段）。 */
+const HOMEBREW_PATH = /(?:^|[/\\])(?:Cellar|Homebrew)(?:[/\\]|$)/iu;
+/** `ocr` 版本行：`open-code-review v1.13.3`（允许预发布/构建元数据）。 */
+const OCR_VERSION = /open-code-review\s+v?(?<version>\d+\.\d+(?:\.\d+)?(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)/u;
 /** `--exclude` 的模式条数上限。**不是审查范围的上限**，只是防一条失控输入把命令串撑爆；
 *  真实使用里几十条就到头，给到 2000 是为了"尽量不截断"——超了会明确告警，不静默丢。 */
 const EXCLUDE_LIST_LIMIT = 2e3;
@@ -898,6 +912,8 @@ const PATH_LIST_LIMIT = 2e3;
 const RULE_FILE_MAX_BYTES = 262144;
 const BACKGROUND_FILE_MAX_BYTES = 1048576;
 const MAX_GIT_PROCS_FLAG = "--max-git-procs";
+/** `ocr review|scan|delegate preview` 的背景说明 flag（三处命令构造共用一条）。
+*  pushTextFlag 按 `flag.slice(2)` 反推报错用的参数名，故值必须带 `--` 前缀。 */
 const BACKGROUND_FLAG = "--background";
 /**
 * 本包的契约是按外部 `ocr` CLI 的哪一版核对的（README 的前置条件、装法建议与工具回显里
@@ -1185,7 +1201,7 @@ function realPathOrSelf(candidate) {
 function inferOcrInstallChannel(candidate) {
 	const resolved = realPathOrSelf(candidate);
 	if (resolved.includes("node_modules")) return "npm";
-	return /(?:^|[/\\])(?:Cellar|Homebrew)(?:[/\\]|$)/iu.test(resolved) ? "brew" : "unknown";
+	return HOMEBREW_PATH.test(resolved) ? "brew" : "unknown";
 }
 /** brew 的 formula 名与 npm 的包名不同：formula 不带 scope。 */
 const OCR_BREW_FORMULA = "open-code-review";
@@ -1324,7 +1340,7 @@ function buildVersionCommand() {
 * 读不出即 null：未发布构建的 `<Version>` 是 `dev`，没有版本号可报，猜一个等于编一个。
 */
 function parseOcrVersion(text) {
-	return /open-code-review\s+v?(?<version>\d+\.\d+(?:\.\d+)?(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)/u.exec(text)?.groups?.["version"] ?? null;
+	return OCR_VERSION.exec(text)?.groups?.["version"] ?? null;
 }
 /**
 * `--format` 交给 OCR 的取值：本包只认 json——`lib/parse.ts` 的解析层只解 JSON 一份形状。
@@ -1729,6 +1745,8 @@ function aggregateComments(comments) {
 	};
 }
 // lib/parse.ts
+/** 只认十进制整数的行号/计数文本。 */
+const DECIMAL_INTEGER = /^\d+$/u;
 /**
 * OCR 评审 JSON 的 status 枚举（判据在 CLI 侧 `cmd/opencodereview/output.go` 的 jsonOutput
 * 装配与 `internal/session/manifest.go` 的 TerminalState）。
@@ -1784,7 +1802,7 @@ function num(value) {
 	if (typeof value === "number") return nonNegativeInt(value);
 	if (typeof value === "string") {
 		const trimmed = value.trim();
-		if (!/^\d+$/u.test(trimmed)) return 0;
+		if (!DECIMAL_INTEGER.test(trimmed)) return 0;
 		return nonNegativeInt(Number(trimmed));
 	}
 	return 0;
@@ -1849,7 +1867,7 @@ function capLines(lines, total, messages) {
 *  否则 "x" 或 -1 会被 num 折成 0，把「读不出」伪装成「零失败」）。 */
 function isCount(value) {
 	if (typeof value === "number") return Number.isSafeInteger(value) && value >= 0;
-	return typeof value === "string" && /^\d+$/u.test(value.trim());
+	return typeof value === "string" && DECIMAL_INTEGER.test(value.trim());
 }
 /**
 * 解析 `tool_calls`。字段缺失或为 null（这一场没有工具调用记录）返回 null；
@@ -2931,6 +2949,8 @@ const ROUTING_ORDER = 1555;
 // lib/provider-projection.ts
 /** llm-pi-ai 命名空间里 provider 表的字段名。 */
 const PROVIDERS_FIELD = "providers";
+/** provider 的 baseURL 只认 http(s)。 */
+const HTTP_URL$1 = /^https?:\/\//iu;
 /**
 * llm-pi-ai 的 `api` 协议 → OCR config 的 `protocol` 映射。
 *
@@ -3005,7 +3025,7 @@ function providerFromRaw(name, raw) {
 	const api = apiKeyOf(entry["api"]);
 	const protocol = api === null ? "openai" : OCR_PROTOCOL_BY_API.get(api) ?? api;
 	const baseURL = typeof entry["baseURL"] === "string" ? entry["baseURL"].trim() : "";
-	if (!baseURL || !/^https?:\/\//iu.test(baseURL)) return null;
+	if (!baseURL || !HTTP_URL$1.test(baseURL)) return null;
 	const modelsRaw = Array.isArray(entry["models"]) ? entry["models"] : [];
 	const models = modelsRaw.map((model) => modelFromRaw(model)).filter((model) => model !== null);
 	if (modelsRaw.length > 0 && models.length === 0) return null;
@@ -3156,6 +3176,11 @@ async function markKeyFlags(gateway, providers) {
 // lib/config-store.ts
 /** api_key_cmd 脚本名（pluginDir 兜底路径的唯一拼法来源）。 */
 const GET_CRED_SCRIPT = path.join("scripts", "get-cred.mjs");
+/** 尾部反斜杠 / 翻倍反斜杠 / env 键 / 行首 node 命令。 */
+const TRAILING_BACKSLASHES = /\\+$/u;
+const DOUBLED_BACKSLASHES = /(?:\\\\)+$/u;
+const ENV_KEY = /^[A-Z0-9_]+$/u;
+const LEADING_NODE_CMD = /^node[ \t]+/u;
 /** 未知值 → 安全字符串（非字符串给 ''）。 */
 function strOf(value) {
 	return typeof value === "string" ? value : "";
@@ -3228,7 +3253,7 @@ function readExistingText(configPath, messages) {
 * 保证常规路径形态正确）。
 */
 function shqDyn(value) {
-	if (process.platform === "win32") return `"${value.replaceAll("\"", "\"\"").replace(/\\+$/u, (backslashes) => backslashes + backslashes)}"`;
+	if (process.platform === "win32") return `"${value.replaceAll("\"", "\"\"").replace(TRAILING_BACKSLASHES, (backslashes) => backslashes + backslashes)}"`;
 	return `'${value.replaceAll("'", String.raw`'\''`)}'`;
 }
 /** api_key_cmd 值构造：脚本路径与 env key 名（及可选的 dsh 数据目录）shq 转义后
@@ -3239,7 +3264,7 @@ function shqDyn(value) {
 *  env key 白名单维持 ^[A-Z0-9_]+$（刻意比宿主 CredentialRef 的语法紧：OCR 侧
 *  惯例大写，且这是写进 config.json 的可信输入）。 */
 function buildApiKeyCmd(scriptPath, envKey, dshHome, messages) {
-	if (!/^[A-Z0-9_]+$/u.test(envKey)) throw new Error(format(messages.badEnvKey, { key: envKey }));
+	if (!ENV_KEY.test(envKey)) throw new Error(format(messages.badEnvKey, { key: envKey }));
 	const parts = [
 		"node",
 		shqDyn(scriptPath),
@@ -3319,7 +3344,7 @@ function readDqToken(body, start) {
 	}
 	if (!closed) return null;
 	return {
-		value: value.replace(/(?:\\\\)+$/u, (backslashes) => "\\".repeat(backslashes.length / 2)),
+		value: value.replace(DOUBLED_BACKSLASHES, (backslashes) => "\\".repeat(backslashes.length / 2)),
 		next: i
 	};
 }
@@ -3361,13 +3386,13 @@ function readDqTokens(body) {
 * 把用户手写的凭据取用方式弄坏，而那正是本包明令不该插手的部分。
 */
 function parseApiKeyCmd(command) {
-	const body = command.replace(/^node[ \t]+/u, "");
+	const body = command.replace(LEADING_NODE_CMD, "");
 	if (body === command) return null;
 	const tokens = readShqTokens(body) ?? readDqTokens(body);
 	if (tokens === null) return null;
 	const script = tokens[0] ?? "";
 	const envKey = tokens[1] ?? "";
-	if (script === "" || tokens.length < 2 || tokens.length > 3 || !/^[A-Z0-9_]+$/u.test(envKey)) return null;
+	if (script === "" || tokens.length < 2 || tokens.length > 3 || !ENV_KEY.test(envKey)) return null;
 	return {
 		script,
 		envKey,
@@ -3818,6 +3843,8 @@ const OCR_REMOTE_NAMESPACE = "ocrReview";
 // lib/mcp-config.ts
 /** 整体上限：MCP 配置是一份人工维护的小表，不承载大文件。 */
 const MCP_MAX_BYTES = 65536;
+/** remote MCP server 的 url 只认 http(s)。 */
+const HTTP_URL = /^https?:\/\//iu;
 const MCP_MAX_SERVERS = 100;
 const MCP_MAX_ARRAY = 100;
 const MCP_MAX_TEXT = 4096;
@@ -3907,7 +3934,7 @@ function normalizeRemote(raw, name, messages) {
 	if (raw["command"] !== void 0 || raw["args"] !== void 0 || raw["env"] !== void 0 || raw["setup"] !== void 0) return failure(name, "type", "remote does not accept command/args/env/setup", messages);
 	const url = textField(raw["url"], name, "url", messages);
 	if (!url.ok) return url;
-	if (!/^https?:\/\//iu.test(url.value)) return failure(name, "url", "must start with http:// or https://", messages);
+	if (!HTTP_URL.test(url.value)) return failure(name, "url", "must start with http:// or https://", messages);
 	const entry = {
 		type: "remote",
 		url: url.value
@@ -4118,10 +4145,13 @@ function isLiveOcrStatus(status) {
 * @param jobs 官方注册表
 * @returns {void}
 */
-function pruneOcrJobHistory(jobs) {
-	const settled = jobs.list().filter((job) => job.kind === OCR_JOB_KIND && !isLiveOcrStatus(job.status));
+function pruneOcrJobHistory(jobs, owner, ledger) {
+	const settled = jobs.list(owner).filter((job) => job.kind === OCR_JOB_KIND && !isLiveOcrStatus(job.status));
 	const excess = settled.length - 9;
-	for (const job of settled.slice(0, Math.max(excess, 0))) jobs.remove(job.id);
+	for (const job of settled.slice(0, Math.max(excess, 0))) {
+		jobs.remove(job.id, owner);
+		ledger.delete(job.id);
+	}
 }
 /**
 * 在 controller 闸门下起一条未拥有作业，起完立刻摘掉。
@@ -4169,10 +4199,44 @@ async function enforceOcrDeadline(jobs, id, reason, backgroundMaxMs) {
 * @param reason 写进模型可见 detail 的理由（双语字典取）
 * @returns {void}
 */
-function reclaimOcrJobs(jobs, reason) {
-	const mine = jobs.list().filter((job) => job.kind === OCR_JOB_KIND);
-	for (const job of mine) if (isLiveOcrStatus(job.status)) jobs.kill(job.id, void 0, reason);
-	else jobs.remove(job.id);
+function reclaimSessionJobs(jobs, reason, owner, ledger) {
+	for (const job of jobs.list(owner)) if (job.kind === OCR_JOB_KIND && job.owner === owner) {
+		ledger.delete(job.id);
+		if (isLiveOcrStatus(job.status)) jobs.kill(job.id, owner, reason);
+		else jobs.remove(job.id, owner);
+	}
+}
+/** 卸载时收一条有主作业：id 只有台账知道，kill/remove 必须带 owner 作 caller。 */
+function reclaimOwnedJob(jobs, id, owner, reason) {
+	try {
+		if (isLiveOcrStatus(jobs.get(id, owner).status)) jobs.kill(id, owner, reason);
+		else jobs.remove(id, owner);
+	} catch {}
+}
+/**
+* 卸载时收掉本包起过的全部作业：无主的经 `list()` 枚举，有主的只有台账知道 id
+* （注册表对没有 caller 的视图隐藏它们，且 kill/remove 必须带 owner 作 caller）。
+*/
+function reclaimAllJobs(jobs, reason, ledger) {
+	for (const job of jobs.list()) if (job.kind === OCR_JOB_KIND) {
+		if (isLiveOcrStatus(job.status)) jobs.kill(job.id, void 0, reason);
+		else jobs.remove(job.id);
+	}
+	const owned = new Map(ledger);
+	ledger.clear();
+	for (const [id, owner] of owned) if (owner !== void 0) reclaimOwnedJob(jobs, id, owner, reason);
+}
+/** 工具调用发起时的会话 id；形状不对就当没有（agentless）。 */
+function sessionIdOf(exec) {
+	const id = exec.agent?.session?.id;
+	return typeof id === "string" && id.length > 0 ? id : void 0;
+}
+/** 该调用可绑定的作业 owner：会话 id 存在、且宿主注册表里确有这条活 Agent。
+*  给不出活 Agent 时退回 agentless —— 拿一个注册表不认的 id 去 start 只会整条失败。 */
+function ownerOf(host, exec) {
+	const id = sessionIdOf(exec);
+	const agents = host.get("agents");
+	return id !== void 0 && agents?.get(id) !== void 0 ? id : void 0;
 }
 /** 当前会话工作区（repo 缺省回退源）；非字符串视为缺。
 *  官方形状：`agent?: Agent` → `session: Session` → `header: SessionHeader` →
@@ -4393,7 +4457,7 @@ async function outcomeWhenSettled(proc) {
 * @param job 这次后台评审的描述
 * @returns 后台启动回执（canonical 对象，模型侧契约）
 */
-async function startBackground(host, job) {
+async function startBackground(host, job, ledger) {
 	const registry = host.get("jobs");
 	if (registry === void 0) throw new Error("background review unavailable: the host provides no ctx.jobs (load @deepseek-ai/dsh-jobs-local); run it with wait:true instead");
 	const spec = host.shell.resolve({
@@ -4405,13 +4469,14 @@ async function startBackground(host, job) {
 		sandboxPolicy: ocrSandboxPolicy(job.workdir)
 	});
 	const proc = await host.shell.execute(spec);
-	pruneOcrJobHistory(registry);
+	pruneOcrJobHistory(registry, job.owner, ledger);
 	const messages = localeMessages(host);
 	let jobId;
 	try {
 		jobId = startUnderOcrController(registry, {
 			kind: OCR_JOB_KIND,
 			label: `${job.tool} ${job.repo}`,
+			...job.owner === void 0 ? {} : { owner: job.owner },
 			output: reviewSources(proc, messages),
 			run: () => ({
 				cancel: () => {
@@ -4424,6 +4489,7 @@ async function startBackground(host, job) {
 		killProc(proc);
 		throw error;
 	}
+	ledger.set(jobId, job.owner);
 	const backstopMinutes = Math.round(job.backgroundMaxMs / 6e4);
 	enforceOcrDeadline(registry, jobId, format(messages.jobReasonTimeout, { minutes: String(backstopMinutes) }), job.backgroundMaxMs);
 	return {
@@ -5359,7 +5425,7 @@ async function runScanPreview(run) {
 		});
 	}
 }
-function registerReviewTool(host, config, probe, versionSink) {
+function registerReviewTool(host, config, probe, versionSink, ledger) {
 	const msgs = localeMessages(host);
 	define(host, {
 		name: "ocr_review",
@@ -5481,10 +5547,11 @@ function registerReviewTool(host, config, probe, versionSink) {
 					workdir,
 					tool: "ocr_review",
 					repo,
+					owner: ownerOf(host, exec),
 					stdoutMaxBytes: config.stdoutMaxBytes,
 					backgroundMaxMs: config.ocrBackgroundMaxMs,
 					env: ocrEnv(config)
-				});
+				}, ledger);
 				try {
 					await runForeground(host, guarded, workdir, tuningOf(config), exec.signal);
 				} catch (error) {
@@ -5508,7 +5575,7 @@ function registerReviewTool(host, config, probe, versionSink) {
 		}
 	});
 }
-function registerScanTool(host, config, probe, versionSink) {
+function registerScanTool(host, config, probe, versionSink, ledger) {
 	const msgs = localeMessages(host);
 	define(host, {
 		name: "ocr_scan",
@@ -5616,10 +5683,11 @@ function registerScanTool(host, config, probe, versionSink) {
 					workdir,
 					tool: "ocr_scan",
 					repo,
+					owner: ownerOf(host, exec),
 					stdoutMaxBytes: config.stdoutMaxBytes,
 					backgroundMaxMs: config.ocrBackgroundMaxMs,
 					env: ocrEnv(config)
-				});
+				}, ledger);
 				try {
 					await runForeground(host, guarded, workdir, tuningOf(config), exec.signal);
 				} catch (error) {
@@ -6006,26 +6074,29 @@ function apply(ctx, config, probe) {
 	const host = resolveHost(ctx);
 	const endpointVerify = { value: null };
 	const versionSink = { value: null };
+	const jobLedger = /* @__PURE__ */ new Map();
 	if (config.startupVerify) {
 		probeEndpointAtApply(host, config, endpointVerify);
 		probeVersionAtApply(host, config, versionSink);
 	}
 	ctx.effect(() => () => {
 		const jobs = ctx.get("jobs");
-		if (jobs !== void 0) reclaimOcrJobs(jobs, localeMessages(ctx).jobReasonUnload);
+		if (jobs !== void 0) reclaimAllJobs(jobs, localeMessages(ctx).jobReasonUnload, jobLedger);
 	}, "ocr-review: background jobs");
-	ctx.effect(() => ctx.on("session/disposed", () => {
+	ctx.effect(() => ctx.on("session/disposed", (session) => {
 		const jobs = ctx.get("jobs");
 		if (jobs === void 0) return;
+		const owner = session.id;
+		if (typeof owner !== "string" || owner.length === 0) return;
 		try {
-			reclaimOcrJobs(jobs, localeMessages(ctx).jobReasonSessionStopped);
+			reclaimSessionJobs(jobs, localeMessages(ctx).jobReasonSessionStopped, owner, jobLedger);
 		} catch {}
 	}), "ocr-review: session stop reaps background runs");
 	host.inject(["settings"], (child) => {
 		child.effect(() => child.settings.configure({ auto: false }, host.fiber));
 	});
-	registerReviewTool(host, config, probe, versionSink);
-	registerScanTool(host, config, probe, versionSink);
+	registerReviewTool(host, config, probe, versionSink, jobLedger);
+	registerScanTool(host, config, probe, versionSink, jobLedger);
 	registerDelegatePreviewTool(host, config, probe);
 	registerDelegateRuleTool(host, config, probe);
 	registerSessionTool(host, config, probe);

package/locale/en.json

@@ -0,0 +1,7 @@
+{
+  "meta": {
+    "title": "Open code review",
+    "description": "Runs the external ocr CLI over a change set, reports its review comments, and manages the model it reviews with.",
+    "detail": "docs/DETAIL.md"
+  }
+}

package/locale/zh.json

@@ -0,0 +1,7 @@
+{
+  "meta": {
+    "title": "代码评审（open-code-review）",
+    "description": "调用外部 ocr 命令行跑变更集评审，回报它给出的意见，并管理评审所用的模型。",
+    "detail": "docs/DETAIL.zh.md"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jayyuen66/dsh-ocr-review",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "dsh 工作区代码审查插件：把 open-code-review（ocr CLI）封装为 7 个模型工具 + 设置卡片（从宿主设置服务的 provider 清单选 provider/model 应用到 OCR 配置）。",
   "keywords": [
     "ai-code-review",
@@ -22,6 +22,9 @@
     "url": "git+https://github.com/JayYuen666/dsh-ocr-review.git"
   },
   "files": [
+    "locale/zh.json",
+    "locale/en.json",
+    "docs",
     "icon.svg",
     "host.js",
     "client.js",
@@ -40,6 +43,7 @@
     ".": "./host.js",
     "./client": "./client.js",
     "./cordis.patch.yml": "./cordis.patch.yml",
+    "./locale/*.json": "./locale/*.json",
     "./package.json": "./package.json"
   },
   "publishConfig": {
@@ -47,47 +51,51 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@jayyuen66/dsh-plugin-shared": "0.1.9",
-    "js-yaml": "^5.4.3"
+    "@jayyuen66/dsh-plugin-shared": "0.2.1",
+    "js-yaml": "^5.4.3",
+    "zod": "4.6.7"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.5",
-    "@deepseek-ai/dsh-agent": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-api-remotes": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-atomic-write": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-store": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-credentials": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-home-paths": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-jobs": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-jobs-local": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-output-retention": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-package-manifest": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-ptc-runtime": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-scope": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-session": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-session-projection": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-settings": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-shell": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-tools": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-user-approval": "0.2.1-rc.3",
-    "@deepseek-ai/schemastery": "3.18.5",
-    "@types/node": "26.6.5",
+    "@deepseek-ai/cordis": "4.0.6-alpha.1",
+    "@deepseek-ai/dsh-agent": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-api-remotes": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-atomic-write": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-store": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-credentials": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-home-paths": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-jobs": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-jobs-local": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-output-retention": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-package-manifest": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-ptc-runtime": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-scope": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-session": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-settings": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-shell": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-tools": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-user-approval": "0.2.2-alpha.2",
+    "@deepseek-ai/schemastery": "3.18.6-alpha.1",
+    "@e18e/eslint-plugin": "0.8.1",
+    "@types/node": "26.6.6",
     "@types/react": "19.3.0",
     "@vitest/coverage-v8": "5.0.5",
+    "eslint-plugin-regexp": "3.3.2",
     "eslint-plugin-sonarjs": "4.2.2",
-    "oxfmt": "0.74.0",
-    "oxlint": "1.89.0",
+    "eslint-plugin-zod": "5.2.2",
+    "oxfmt": "0.75.0",
+    "oxlint": "1.90.0",
     "oxlint-tsgolint": "7.0.2005",
     "react": "^19.3.0",
     "rolldown": "1.2.15",
@@ -96,11 +104,11 @@
     "vitest": "5.0.5"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-atomic-write": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-credentials": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-home-paths": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.3",
-    "@deepseek-ai/schemastery": "3.18.5"
+    "@deepseek-ai/dsh-atomic-write": "^0.2.1-rc.3",
+    "@deepseek-ai/dsh-credentials": "^0.2.1-rc.3",
+    "@deepseek-ai/dsh-home-paths": "^0.2.1-rc.3",
+    "@deepseek-ai/dsh-typert-protocol": "^0.2.1-rc.3",
+    "@deepseek-ai/schemastery": "3.18.6-alpha.1"
   },
   "icon": "icon.svg",
   "engines": {