@klarkxy/dsh-safe-auto 0.1.0-rc.6 → 0.2.0

package/src/index.js

@@ -1,61 +1,72 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { isAbsolute } from 'node:path';
+import { resolveReviewPaths } from './review-paths.js';
+import { createHostRuntimeRegistry } from './host-runtime.js';
 import { isSubagentSession } from '@klarkxy/dsh-plugin-kit/contracts';
 import { parseConfig } from './config.js';
-import { assess, hardRisk } from './policy.js';
-import { assessApproval } from './approval-review.js';
+import { hardRisk, containsSecret } from './policy.js';
+import { analyzeShell, isReadonly, isSafeStaticExposure } from './shell-command.js';
+import { createCredentialReads } from './credential-reads.js';
+import { assessApproval, bindingOf, escalationReason } from './approval-review.js';
 import { createGate } from './gate.js';
-import { assessEscalation, bindingOf, escalationReason, isNativeEscalation } from './escalation.js';
-import { resolveReviewRoutes, sameRoutes } from './model-route.js';
+import { resolveReviewRoute, sameRoute } from './model-route.js';
+import { authority } from './review-context.js';
+import { collectExecutionEvidence } from './execution-evidence.js';
+import { createHumanApprovals } from './human-approval.js';
 export { Config } from './config.js';
+export { authority } from './review-context.js';
 
 export const name = 'dsh-safe-auto';
 export const inject = ['tools', 'sandboxPolicy'];
 
-/** Do not turn assistant/tool/subagent text into user authority, even when it resembles an approval. */
-export function authority(session) {
-  const events = session?.snapshotEvents?.();
-  if (!Array.isArray(events)) return {};
-  for (let i = events.length - 1; i >= 0; i--) {
-    const e = events[i];
-    if (e?.type !== 'user/message' || e.data?.source?.kind !== 'user') continue;
-    const blocks = e.data.content;
-    if (!Array.isArray(blocks) || blocks.some(b => b?.type !== 'text' || typeof b.text !== 'string')) return { task: e.seq ?? i };
-    return { task: e.seq ?? i, intent: blocks.map(b => b.text).join('\n') };
-  }
-  return {};
-}
+const REVIEW_TOOLS = new Set(['write', 'edit', 'pwsh', 'bash']);
+const ESCALATION = new Set(['workspace-write', 'danger-full-access']);
+/** Freshness window for one reviewed grant; not process lifetime, revocation or rollback. */
+const APPROVAL_TTL_MS = 30000;
 
 /** Public DSH seams only. Standing sandbox policy is NEVER written or temporarily switched. */
 export function apply(ctx, raw = {}) {
   const config = parseConfig(raw);
   let control;
   let controlEpoch = 0;
+  const humanApprovals = createHumanApprovals();
   ctx.provide?.('safeAutoRuntime', { base: config, attach(next) {
     if (control) throw new Error('Safe Auto controls already attached');
     control = next; controlEpoch++;
-    return () => { if (control === next) { control = undefined; controlEpoch++; } };
+    return () => { if (control === next) { control = undefined; controlEpoch++; humanApprovals.cancelAll(); } };
+  }, invalidateApprovals() { humanApprovals.invalidate(); },
+  listApprovals(sessionId) {
+    const session = control?.getSession(sessionId);
+    if (!session) throw new Error('Approval controls unavailable');
+    return humanApprovals.list(session);
+  },
+  answerApproval({ sessionId, requestId, outcome } = {}) {
+    const session = control?.getSession(sessionId);
+    if (!session || !control.config(session).enabled) throw new Error('Approval controls unavailable');
+    return humanApprovals.answer(session, requestId, outcome);
   } });
-  const inactiveConfig = parseConfig({ ...config, mode: 'off' });
+  const inactiveConfig = parseConfig({ ...config, enabled: false });
   // UI activation owns review, independently of the native preset identity.
   // Never register official Auto: its fixed FullAccess bundle is not our policy.
   const configFor = exec => control?.config(exec.agent?.session) ?? (controlEpoch ? inactiveConfig : config);
   const controlBinding = exec => JSON.stringify({ epoch: controlEpoch, state: control?.state(exec.agent?.session) });
-  if (config.mode === 'off') return;
+  if (!config.enabled) return;
   if (typeof ctx.tools?.guard !== 'function' || typeof ctx.sandboxPolicy?.resolve !== 'function') throw new Error('DSH Safe Auto requires tools.guard and sandboxPolicy.resolve');
   const decisions = new Map();
   const execution = new AsyncLocalStorage();
   const lifetime = new AbortController();
+  const hostRuntime = createHostRuntimeRegistry(ctx.tools);
+  const credentialReads = createCredentialReads(ctx, lifetime.signal);
   let llm;
-  // Optional dependency: losing a model service must NOT unload the safety guards.
-  // HTTP-only profiles and deterministic checks remain usable without a native adapter.
-  if (!config.endpoint && typeof ctx.inject === 'function') ctx.inject(['llm'], scope => {
+  // Optional dependency: losing the model service must NOT unload the safety guards.
+  if (typeof ctx.inject === 'function') ctx.inject(['llm'], scope => {
     const active = scope.llm;
     llm = active;
     scope.effect(() => () => { if (llm === active) llm = undefined; });
   });
   const gate = createGate(config, { getLlm: () => llm, audit: row => ctx.logger.info('safe-auto %s', JSON.stringify(row)) });
-  ctx.effect(() => () => { lifetime.abort(); gate.dispose(); decisions.clear(); execution.disable(); });
+  ctx.effect(() => () => { lifetime.abort(); hostRuntime.dispose(); humanApprovals.dispose(); gate.dispose(); decisions.clear(); execution.disable(); });
+
+  const reviewable = exec => REVIEW_TOOLS.has(exec.name) && ESCALATION.has(exec.arguments?.sandbox_permissions);
 
   function callOf(exec, includeAuthority = false) {
     const session = exec.agent?.session;
@@ -65,234 +76,195 @@ export function apply(ctx, raw = {}) {
       cwd: session?.header?.cwd, sandbox, signal: exec.signal,
       subagent: isSubagentSession(session),
       nested: exec.parent !== undefined, ...info };
-    if (isNativeEscalation(call) || (configFor(exec).approvalReview && ['write', 'edit', 'pwsh', 'bash'].includes(call.tool) &&
-        ['workspace-write', 'danger-full-access'].includes(call.args?.sandbox_permissions))) {
+    if (REVIEW_TOOLS.has(exec.name)) {
       // These are optional capability reads, not model assertions about its environment.
       const fs = ctx.get?.('fs');
       const shell = ctx.get?.('shell');
-      const paths = [call.cwd, ...(['bash', 'pwsh'].includes(call.tool)
-        ? (call.args.workdir === undefined ? [] : [call.args.workdir]) : [call.args.file_path])];
-      call.localExecution = paths.every(p => typeof p === 'string' && isAbsolute(p) && fs?.processPathFromHostPath?.(p) === p);
+      call.reviewPaths = resolveReviewPaths(call, fs);
+      call.localExecution = call.reviewPaths.localExecution;
+      if (call.localExecution && ['bash', 'pwsh'].includes(call.tool)) call.trustedRuntime = hostRuntime.get(exec);
       call.jobsAvailable = typeof ctx.get !== 'function' || ctx.get('jobs') !== undefined;
       call.shellConfined = ['read-only', 'workspace-write', 'danger-full-access'].includes(shell?.sandboxMode);
     }
     return call;
   }
 
-  function currentEscalation(exec, saved) {
-    const config = configFor(exec);
-    const call = callOf(exec, true);
-    const assessment = assessEscalation(call, config);
-    return { call, assessment, unchanged: bindingOf(call, assessment) === saved.binding };
-  }
-
   function sameReviewer(exec, decision) {
-    const config = configFor(exec);
-    if (!decision.reviewRoutes) return true;
-    return sameRoutes(decision.reviewRoutes, resolveReviewRoutes(config, callOf(exec))) &&
-      (decision.reviewRoutes.fast.transport !== 'dsh' || decision.reviewLlm === llm);
+    if (!decision.reviewRoute) return true;
+    try {
+      return sameRoute(decision.reviewRoute, resolveReviewRoute(configFor(exec), callOf(exec))) && decision.reviewLlm === llm;
+    } catch { return false; }
   }
 
   ctx.tools.guard(exec => {
     const config = configFor(exec);
     const pending = decisions.get(exec.token);
     if (pending?.controlBinding !== undefined && pending.controlBinding !== controlBinding(exec)) return 'safe-auto: SETTINGS_CHANGED';
-    if (config.mode === 'shadow' || config.mode === 'off') return undefined;
+    if (!config.enabled) return undefined;
     if (exec.signal.aborted || lifetime.signal.aborted) return 'safe-auto: CANCELLED';
     try {
-      if (config.approvalReview) {
-        const hard = hardRisk(callOf(exec));
-        return hard ? `safe-auto: ${hard.code}` : undefined;
-      }
-      const hard = assess(callOf(exec), config);
-      if (hard.kind === 'deny') return `safe-auto: ${hard.code}`;
-      const saved = decisions.get(exec.token);
-      if (!saved) return 'safe-auto: PREFLIGHT_NOT_RUN';
-      if (!sameReviewer(exec, saved)) return 'safe-auto: REVIEW_MODEL_CHANGED';
-      if (saved.preflightBinding) {
-        const current = callOf(exec, true);
-        if (bindingOf(current, assess(current, config)) !== saved.preflightBinding) return 'safe-auto: PREFLIGHT_CHANGED';
-      }
-      if (saved.kind === 'escalation') {
-        const current = currentEscalation(exec, saved);
-        if (current.assessment.kind === 'deny') return `safe-auto: ${current.assessment.code}`;
-        if (!current.unchanged) return 'safe-auto: ESCALATION_CHANGED';
-        return undefined;
-      }
-      if (saved.kind === 'allow' && hard.kind === 'ask') return 'safe-auto: POLICY_CHANGED';
-      if (saved.kind === 'deny' || saved.kind === 'cancel') return `safe-auto: ${saved.code}`;
+      const hard = hardRisk(callOf(exec));
+      return hard ? `safe-auto: ${hard.code}` : undefined;
     } catch { return 'safe-auto: POLICY_UNAVAILABLE'; }
-    return undefined;
   });
 
   ctx.on('tools/pre-execute', async (exec, next) => {
+    hostRuntime.begin(exec);
     const config = configFor(exec);
-    const selectedControl = controlBinding(exec);
-    if (config.mode === 'off') return next();
-    if (config.approvalReview) {
-      if (exec.signal.aborted || lifetime.signal.aborted) return { kind: 'cancel' };
-      const hard = hardRisk(callOf(exec));
-      if (hard && config.mode !== 'shadow') return { kind: 'deny', reason: `safe-auto: ${hard.code}` };
-      // Native policy remains authoritative; this opt-in never manufactures asks.
-      return next();
-    }
-    let decision;
-    try {
-      if (decisions.size >= 1024) decision = { kind: 'deny', code: 'TOO_MANY_PENDING_CALLS' };
-      else {
-        const call = callOf(exec);
-        if (isNativeEscalation(call)) {
-          Object.assign(call, authority(call.session));
-          const assessed = assessEscalation(call, config);
-          decision = assessed.kind === 'deny' ? assessed : {
-            kind: 'escalation', code: assessed.code, binding: bindingOf(call, assessed), signal: exec.signal,
-          };
-        } else {
-          const assessment = assess(call, config);
-          if (assessment.kind === 'review') Object.assign(call, authority(call.session));
-          // Capture before awaiting: session/policy state can change during review or downstream policy.
-          const preflightBinding = assessment.kind === 'review' ? bindingOf(call, assessment) : undefined;
-          decision = await gate.decide(call, 'preflight', config);
-          if (decision.kind === 'allow' && preflightBinding) decision = { ...decision, preflightBinding };
-          const latest = assess(callOf(exec), config);
-          if (latest.kind === 'deny' || (decision.kind === 'allow' && latest.kind === 'ask')) decision = latest;
-          // An explicit denial or cancellation must never be downgraded into a fresh approval chance.
-          if (call.intent !== undefined && decision.kind !== 'deny' && decision.kind !== 'cancel') {
-            const current = authority(call.session);
-            if (current.task !== call.task || current.intent !== call.intent) decision = { kind: 'ask', code: 'AUTHORITY_CHANGED' };
-          }
-        }
-      }
-    } catch { decision = { kind: 'ask', code: 'POLICY_UNAVAILABLE' }; }
-    if (exec.signal.aborted || lifetime.signal.aborted) decision = { kind: 'cancel', code: 'CANCELLED' };
-    if (config.mode === 'unattended' && decision.kind === 'ask') decision = { ...decision, kind: 'deny' };
-    if (config.mode === 'shadow' || config.mode === 'off') return next();
-    decision = { ...decision, controlBinding: selectedControl };
-    if (decisions.size < 1024) decisions.set(exec.token, decision);
-    if (decision.kind === 'deny') return { kind: 'deny', reason: `safe-auto: ${decision.code}` };
-    if (decision.kind === 'cancel') return { kind: 'cancel' };
-    const downstream = await next();
-    if (downstream.kind !== 'allow' || decision.kind === 'allow' || decision.kind === 'escalation') return downstream;
-    return { kind: 'ask', reason: `safe-auto: ${decision.code}` };
+    if (!config.enabled) return next();
+    if (exec.signal.aborted || lifetime.signal.aborted) return { kind: 'cancel' };
+    const hard = hardRisk(callOf(exec));
+    if (hard) return { kind: 'deny', reason: `safe-auto: ${hard.code}` };
+    // Native policy remains authoritative; this plugin never manufactures asks.
+    return next();
   }, { prepend: true });
 
   // Bind the approval to the active execution, never a process-wide visible callId cache.
   ctx.on('tools/execute', async (exec, next) => {
     const config = configFor(exec);
-    if (config.mode === 'shadow' || config.mode === 'off') return next();
-    let saved = decisions.get(exec.token);
-    if (config.approvalReview) {
-      if (!['write', 'edit', 'pwsh', 'bash'].includes(exec.name) ||
-          !['workspace-write', 'danger-full-access'].includes(exec.arguments?.sandbox_permissions)) return next();
-      const call = callOf(exec, true);
-      saved = { kind: 'approval', binding: bindingOf(call, assessApproval(call, config)), signal: exec.signal, controlBinding: controlBinding(exec) };
-      if (decisions.size >= 1024) return next();
-      decisions.set(exec.token, saved);
-    } else if (saved?.kind !== 'escalation') return next();
+    if (!config.enabled) return next();
+    const run = () => credentialReads.execute(exec, next);
+    if (!reviewable(exec)) return run();
+    const call = callOf(exec, true);
+    const saved = { kind: 'approval', binding: bindingOf(call, assessApproval(call, config)), signal: exec.signal, controlBinding: controlBinding(exec) };
+    if (decisions.size >= 1024) return run();
+    decisions.set(exec.token, saved);
     const store = { exec, saved, active: true, claimed: false };
-    try { return await execution.run(store, next); }
+    try {
+      const result = await execution.run(store, run);
+      // Around-dispatch may return result content; tools/result is a read-only
+      // observer in the pinned host. Expose recovery through the actual result.
+      if (result?.isError && saved.feedback) return { ...result,
+        content: [...(result.content ?? []), { type: 'text', text: saved.feedback }] };
+      return result;
+    }
     finally { store.active = false; }
   }, { prepend: true });
 
   ctx.on('tools/result', (exec, result) => {
+    hostRuntime.observe(exec, result);
     decisions.delete(exec.token);
     ctx.logger.info('safe-auto %s', JSON.stringify({ phase: 'result', tool: exec.name,
-      callId: String(exec.callId), isError: result?.isError, mode: config.mode }));
+      callId: String(exec.callId), isError: result?.isError }));
   });
 
   ctx.on('approval/request', async (req, next) => {
     const store = execution.getStore();
     const config = configFor(store?.exec ?? { agent: req.agent });
     if (store?.saved.controlBinding !== undefined && store.saved.controlBinding !== controlBinding(store.exec)) return 'rejected';
-    if (config.mode === 'shadow' || config.mode === 'off') return next();
-    if (config.approvalReview) {
-      // The waterfall is not a human-only channel. Active opt-in owns all asks:
-      // missing evidence must reject, never delegate to another automatic answerer.
-      if (req.signal?.aborted || lifetime.signal.aborted) return 'cancelled';
-      if (!store || store.saved.kind !== 'approval') return 'rejected';
-      const { exec, saved } = store;
-      const matches = () => req.agent === exec.agent && req.toolName === exec.name && req.callId === exec.callId &&
-        req.signal === exec.signal && req.reason === escalationReason(callOf(exec));
-      if (!matches()) return 'rejected';
-      if (!store.active || store.claimed) return 'rejected';
-      store.claimed = true;
-      const signal = AbortSignal.any([saved.signal, exec.signal, req.signal, lifetime.signal]);
-      const started = performance.now();
-      let reviewed;
-      const bound = () => {
-        if (signal.aborted || !store.active || decisions.get(exec.token) !== saved || saved.controlBinding !== controlBinding(exec) || !matches()) return false;
-        try {
-          const current = configFor(exec), call = callOf(exec, true);
-          return current.approvalReview && current.mode !== 'off' && current.mode !== 'shadow' &&
-            bindingOf(call, assessApproval(call, current)) === saved.binding && (!reviewed || sameReviewer(exec, reviewed));
-        } catch { return false; }
-      };
-      const finish = (outcome, source, decision) => {
-        if (signal.aborted) outcome = 'cancelled';
-        else if (!bound()) outcome = 'rejected';
-        try { ctx.logger.info('safe-auto %s', JSON.stringify({ phase: 'approval', tool: exec.name, callId: String(exec.callId),
-          decision: outcome, source, code: decision?.code, scope: 'this-call-only', durationMs: Math.round(performance.now() - started) })); }
-        catch { return 'rejected'; }
-        return outcome;
-      };
-      if (!bound()) return finish('rejected', 'binding');
-      let decision;
-      try { decision = await gate.decide({ ...callOf(exec, true), signal }, 'approval', config); }
-      catch { decision = { kind: 'ask', code: 'REVIEW_UNAVAILABLE' }; }
-      if (decision.kind === 'allow') reviewed = decision;
-      if (!bound()) return finish('rejected', 'binding', decision);
-      if (performance.now() - started > config.escalationApprovalTtlMs) decision = { kind: 'ask', code: 'APPROVAL_LEASE_EXPIRED' };
-      if (decision.kind === 'allow') return finish('allowed-once', 'reviewer', decision);
-      if (decision.kind === 'deny') return finish('rejected', 'reviewer', decision);
-      if (decision.kind === 'cancel') return finish('cancelled', 'reviewer', decision);
-      // Uncertainty, unavailable review, budget exhaustion and expired leases
-      // fail closed. No verified human-only DSH contract is available here.
-      return finish('rejected', 'policy', decision);
-    }
-    if (!store) return config.mode === 'unattended' ? (req.signal?.aborted ? 'cancelled' : 'rejected') : next();
+    if (req.signal?.aborted || lifetime.signal.aborted) return 'cancelled';
+    if (!config.enabled) return store?.saved.kind === 'approval' ? 'rejected' : next();
+    // A foreign tool's native ask is not ours. An owned execution context,
+    // including an inactive or mismatched one, must never escape to another
+    // answerer. Likewise an unbound ask impersonating one of our tools fails
+    // closed. Human takeover for owned asks uses only the UI queue below.
+    if (!store) return REVIEW_TOOLS.has(req.toolName) ? 'rejected' : next();
+    if (store.saved.kind !== 'approval') return 'rejected';
     const { exec, saved } = store;
+    const matches = () => req.agent === exec.agent && req.toolName === exec.name && req.callId === exec.callId &&
+      req.signal === exec.signal && req.reason === escalationReason(callOf(exec));
+    if (!matches()) return 'rejected';
     if (!store.active || store.claimed) return 'rejected';
-    if (typeof req.reason !== 'string' || !req.reason.startsWith('escalate sandbox to ')) {
-      return config.mode === 'unattended' ? 'rejected' : next();
-    }
-    if (req.agent !== exec.agent || req.toolName !== exec.name || req.callId !== exec.callId ||
-        req.signal !== exec.signal || req.reason !== escalationReason(callOf(exec))) return 'rejected';
     store.claimed = true;
     const signal = AbortSignal.any([saved.signal, exec.signal, req.signal, lifetime.signal]);
     const started = performance.now();
-    const requestReason = req.reason;
     let reviewed;
-    function stillBound() {
-      if (signal.aborted || !store.active || decisions.get(exec.token) !== saved || saved.controlBinding !== controlBinding(exec)) return false;
-      if (req.agent !== exec.agent || req.toolName !== exec.name || req.callId !== exec.callId ||
-          req.signal !== exec.signal || req.reason !== requestReason) return false;
-      try { return currentEscalation(exec, saved).unchanged && (!reviewed || sameReviewer(exec, reviewed)); }
-      catch { return false; }
-    }
-    function finish(outcome, source, code) {
-      if (signal.aborted) outcome = 'cancelled';
-      else if (!stillBound()) outcome = 'rejected';
+    const bound = () => {
+      if (signal.aborted || !store.active || decisions.get(exec.token) !== saved || saved.controlBinding !== controlBinding(exec) || !matches()) return false;
       try {
-        ctx.logger.info('safe-auto %s', JSON.stringify({ phase: 'escalation', tool: exec.name,
-          callId: String(exec.callId), decision: outcome, source, code,
-          from: 'workspace-write', to: 'danger-full-access', scope: 'this-call-only',
-          binding: saved.binding, durationMs: Math.round(performance.now() - started) }));
-      } catch { return 'rejected'; }
+        const current = configFor(exec), call = callOf(exec, true);
+        return current.enabled && bindingOf(call, assessApproval(call, current)) === saved.binding && (!reviewed || sameReviewer(exec, reviewed));
+      } catch { return false; }
+    };
+    const finish = (outcome, source, decision) => {
+      if (signal.aborted) outcome = 'cancelled';
+      else if (!bound()) outcome = 'rejected';
+      if (outcome !== 'allowed-once') {
+        const code = !bound() ? 'GRANT_INVALIDATED' : decision?.code ?? 'APPROVAL_BINDING_INVALID';
+        const recovery = code === 'HUMAN_APPROVAL_EXPIRED'
+          ? 'The human confirmation window expired. No permission was granted; a fresh execution requires a new review and confirmation.'
+          : code === 'HUMAN_REJECTED'
+            ? 'The user rejected this operation. Do not retry it through another execution path.'
+            : code === 'MODEL_NOT_ALLOWED'
+          ? 'The reviewer denied this action. Do not retry it through wrappers or alternate execution; choose a materially safer action or ask the user with the concrete risk.'
+          : code === 'AUTHORITY_CONTEXT_INCOMPLETE'
+            ? 'Human authorization history is incomplete, sensitive or over its limit. No permission was granted; use a fresh conversation with the full task scope and restrictions.'
+            : code === 'REVIEW_NEEDS_CONFIRMATION'
+              ? 'The reviewer needs more evidence or explicit human authorization. No permission was granted; ask the user about the actual target and side effects, or supply a safer, verifiable action.'
+              : 'No permission was granted. This review failure is not proof that the action is unsafe. Resolve the reported evidence, service or budget problem before requesting review again; do not bypass the approval boundary.';
+        const rationale = typeof decision?.reason === 'string' && !containsSecret(decision.reason)
+          ? ` Reviewer rationale (untrusted): ${decision.reason.slice(0, 512)}` : '';
+        saved.feedback = `safe-auto: ${code}. ${recovery}${rationale}`;
+      }
+      try { ctx.logger.info('safe-auto %s', JSON.stringify({ phase: 'approval', tool: exec.name, callId: String(exec.callId),
+        decision: outcome, source, code: decision?.code, scope: 'this-call-only', durationMs: Math.round(performance.now() - started) })); }
+      catch { return 'rejected'; }
       return outcome;
-    }
-    if (!stillBound()) return finish('rejected', 'binding', 'ESCALATION_CHANGED');
+    };
+    if (!bound()) return finish('rejected', 'binding');
     let decision;
-    try { decision = await gate.decide({ ...callOf(exec, true), signal }, 'escalation', config); }
-    catch { decision = { kind: 'ask', code: 'REVIEW_UNAVAILABLE' }; }
-    if (decision.kind === 'allow') reviewed = decision;
-    if (!stillBound()) return finish('rejected', 'binding', 'ESCALATION_CHANGED');
-    if (performance.now() - started > config.escalationApprovalTtlMs) decision = { kind: 'ask', code: 'ESCALATION_LEASE_EXPIRED' };
-    if (decision.kind === 'allow') return finish('allowed-once', 'reviewer', decision.code);
-    if (decision.kind === 'cancel') return finish('cancelled', 'reviewer', decision.code);
-    if (decision.kind === 'deny' || config.mode === 'unattended') return finish('rejected', 'policy', decision.code);
+    let evidence;
+    const assessment = assessApproval(callOf(exec, true), config);
+    // A fresh exact-call UI answer supplies authority when historical text is
+    // incomplete. Waive only this review-input limitation, then revalidate all
+    // structural, secret and host constraints under the original live binding.
+    const manualAssessment = assessment.code === 'AUTHORITY_CONTEXT_INCOMPLETE'
+      ? assessApproval({ ...callOf(exec, true), authorityIncomplete: false }, config) : assessment;
+    // No mutation is only half the proof: content/environment dumps can expose
+    // credentials. Only metadata/literal output may skip evidence and review.
+    let staticAllow = false;
+    if (assessment.kind === 'review' && config.staticReadonly && exec.name === 'bash') {
+      try {
+        const analysis = analyzeShell(exec.arguments?.command);
+        staticAllow = isReadonly(analysis) && isSafeStaticExposure(analysis);
+      } catch { staticAllow = false; }
+    }
     try {
-      const human = await next();
-      return finish(['allowed-once', 'rejected', 'cancelled', 'unavailable'].includes(human) ? human : 'unavailable', 'native', decision.code);
-    } catch { return finish('unavailable', 'native', 'APPROVAL_UNAVAILABLE'); }
+      const call = callOf(exec, true);
+      if (staticAllow) decision = { kind: 'allow', code: 'STATIC_READONLY' };
+      else {
+        // Do not read files or ask a model for an ineligible execution.
+        if (assessment.kind === 'review') {
+          const evidenceSignal = AbortSignal.any([signal, AbortSignal.timeout(Math.min(config.timeoutMs, 30000))]);
+          evidence = await collectExecutionEvidence(call, ctx.get?.('fs'), evidenceSignal);
+        }
+        if (!bound()) return finish('unavailable', 'binding', { code: 'GRANT_INVALIDATED' });
+        decision = await gate.decide({ ...call, signal, executionEvidence: evidence?.data }, config);
+        if (decision.kind === 'allow' && evidence && !await evidence.verify(signal)) decision = { kind: 'ask', code: 'EVIDENCE_CHANGED' };
+      }
+    }
+    catch (error) { decision = { kind: 'ask', code: ['EVIDENCE_CHANGED', 'EVIDENCE_PROVIDER_UNBOUNDED'].includes(error.message)
+      ? error.message : signal.aborted ? 'REVIEW_CANCELLED' : 'EVIDENCE_UNAVAILABLE' }; }
+    if (decision.kind === 'allow') reviewed = decision;
+    if (!bound()) return finish('rejected', 'binding', decision);
+    if (decision.kind === 'allow' && performance.now() - started > APPROVAL_TTL_MS) decision = { kind: 'ask', code: 'APPROVAL_LEASE_EXPIRED' };
+    if (decision.kind === 'allow') return finish('allowed-once', decision.code === 'STATIC_READONLY' ? 'static' : 'reviewer', decision);
+    if (decision.kind === 'cancel') return finish('cancelled', 'reviewer', decision);
+    // Structural refusals, changed operations and audit failures are terminal.
+    // Model refusal (including risk opinions) and review failures may be
+    // overridden only by an explicit response to this exact UI request.
+    const terminal = new Set(['AUDIT_UNAVAILABLE', 'STALE_REVIEW', 'EVIDENCE_CHANGED', 'EVIDENCE_PROVIDER_UNBOUNDED']);
+    if (manualAssessment.kind === 'review' && !terminal.has(decision.code) && config.humanApprovalTimeoutMs > 0 && control) {
+      reviewed = undefined; // Human authorization does not inherit a stale model lease.
+      const review = { code: decision.code,
+        ...(decision.risk ? { risk: decision.risk } : {}),
+        ...(decision.authorization ? { authorization: decision.authorization } : {}),
+        ...(typeof decision.reason === 'string' && !containsSecret(decision.reason) ? { reason: decision.reason.slice(0, 512) } : {}) };
+      const answer = await humanApprovals.request({ session: exec.agent.session, action: manualAssessment.action, review,
+        signal, timeoutMs: config.humanApprovalTimeoutMs, valid: bound });
+      if (answer.kind === 'allow') {
+        try {
+          const verificationSignal = AbortSignal.any([signal, AbortSignal.timeout(Math.min(config.timeoutMs, 30000))]);
+          if (evidence && !await evidence.verify(verificationSignal)) return finish('rejected', 'human', { code: 'EVIDENCE_CHANGED' });
+          if (!humanApprovals.beforeDeadline(answer)) return finish('rejected', 'human', { code: 'HUMAN_APPROVAL_EXPIRED' });
+          const outcome = finish('allowed-once', 'human', answer);
+          if (outcome === 'allowed-once') gate.humanAllowed(callOf(exec, true));
+          return outcome;
+        } catch { return finish(signal.aborted ? 'cancelled' : 'rejected', 'human', { code: 'EVIDENCE_UNAVAILABLE' }); }
+      }
+      return finish(answer.kind === 'cancel' ? 'cancelled' : 'rejected', 'human', answer);
+    }
+    if (decision.kind === 'deny') return finish('rejected', 'reviewer', decision);
+    return finish('unavailable', 'policy', decision);
   }, { prepend: true });
 }

package/src/model-route.js

@@ -3,23 +3,12 @@ const id = value => typeof value === 'string' && value.length > 0 && value.lengt
   value === value.trim() && !/[\x00-\x1f\x7f]/.test(value);
 
 export function validateModelConfig(config) {
-  const { endpoint, fastProvider = '', fastModel, deepProvider = '', deepModel } = config;
-  for (const value of [fastProvider, fastModel, deepProvider, deepModel]) {
+  const { provider = '', model = '', reasoningEffort = '' } = config;
+  for (const value of [provider, model, reasoningEffort]) {
     if (value !== '' && !id(value)) throw new Error('invalid reviewer provider/model identifier');
   }
-  for (const key of ['fastReasoningEffort', 'deepReasoningEffort']) {
-    const value = config[key] === undefined ? '' : config[key];
-    if (value !== '' && !id(value)) throw new Error(`invalid ${key} identifier`);
-  }
-  if (config.deepReasoningEffort && !deepModel) throw new Error('deepReasoningEffort requires a deep reviewer model');
-  if (endpoint) {
-    if (config.fastReasoningEffort || config.deepReasoningEffort) throw new Error('HTTP reviewer does not support reasoning effort; use a native DSH route');
-    if (fastProvider || deepProvider) throw new Error('HTTP endpoint cannot be combined with native reviewer providers');
-    if (!fastModel) throw new Error('endpoint requires fastModel');
-  } else {
-    if (Boolean(fastProvider) !== Boolean(fastModel)) throw new Error('fastProvider and fastModel must be configured together');
-    if (Boolean(deepProvider) !== Boolean(deepModel)) throw new Error('deepProvider and deepModel must be configured together');
-  }
+  if (Boolean(provider) !== Boolean(model)) throw new Error('provider and model must be configured together');
+  if (reasoningEffort && !model) throw new Error('reasoningEffort requires a reviewer model');
 }
 
 /** Use the accepted request's route, not a deployment default or another session's model. */
@@ -33,23 +22,15 @@ export function conversationRoute(owner = {}) {
   return Object.freeze({ provider: selected.provider, model: selected.model });
 }
 
-/** Snapshot both stages once. No implicit fallback between providers or transports. */
-export function resolveReviewRoutes(config, owner) {
+/** Snapshot the route once per review. No implicit fallback to another provider. */
+export function resolveReviewRoute(config, owner) {
   validateModelConfig(config);
-  if (config.endpoint) return Object.freeze({
-    fast: Object.freeze({ transport: 'http', endpoint: config.endpoint, model: config.fastModel }),
-    deep: config.deepModel ? Object.freeze({ transport: 'http', endpoint: config.endpoint, model: config.deepModel }) : null,
-  });
-  const selected = config.fastProvider ? { provider: config.fastProvider, model: config.fastModel } : conversationRoute(owner);
-  return Object.freeze({
-    fast: Object.freeze({ transport: 'dsh', ...selected,
-      ...(config.fastReasoningEffort ? { reasoningEffort: config.fastReasoningEffort } : {}) }),
-    deep: config.deepModel ? Object.freeze({ transport: 'dsh', provider: config.deepProvider, model: config.deepModel,
-      ...(config.deepReasoningEffort ? { reasoningEffort: config.deepReasoningEffort } : {}) }) : null,
-  });
+  const selected = config.provider ? { provider: config.provider, model: config.model } : conversationRoute(owner);
+  return Object.freeze({ ...selected,
+    ...(config.reasoningEffort ? { reasoningEffort: config.reasoningEffort } : {}) });
 }
 
-export const sameRoutes = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+export const sameRoute = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 
 function usageTotal(usage) {
   if (!usage || typeof usage !== 'object') return undefined;