@klarkxy/dsh-safe-auto 0.2.2 → 0.3.0

package/README.md

@@ -4,7 +4,7 @@
 
 [简体中文](README.zh-CN.md)
 
-Adds a **Safe Auto** permission level. When the agent asks to run a command or edit a file outside the sandbox, an independent reviewer model checks that one call. If it passes, the call goes ahead; otherwise you get 60 seconds to approve or reject it. Your session is never switched to Full Access.
+Adds a **Safe Auto** permission level. Ordinary actions run inside the workspace sandbox as usual and the plugin stays out of the way. Requests that need approval go to a reviewer model: a pass approves that one call; a denial is explained to the agent. The design follows Codex auto-review. Your session is never switched to Full Access.
 
 ## Install
 
@@ -18,21 +18,33 @@ Replace `web` with your profile name and restart the profile.
 
 Pick **Safe Auto** from the permission menu next to the chat input. It applies only to that session; choosing any other level turns it off. Nothing happens automatically until you pick it.
 
-When a request does not pass review, a dialog shows the full action, the reviewer's opinion, and a countdown. Approve it once, or reject it. No answer means reject.
-
 Under **Plugins → Safe Auto** you can choose the reviewer model (empty follows the current session model), its reasoning effort, and extra review rules.
 
-## What it covers
+If the model list cannot load, or some providers fail, use **Retry** in the settings panel. Retrying keeps your reviewer settings and unsaved draft.
+
+## What gets reviewed
+
+- Sandbox escalations requested by `write`, `edit`, `bash`, and `pwsh`.
+- A short list of dangerous commands, reviewed even without an escalation: forced deletion (`rm -f`, `Remove-Item -Force`, `del /f`, `rd /s /q`) and opening URLs.
+- Approval requests that other plugins or tools raise in the session.
+
+Reading files, searching, building, and testing need no approval; they are not intercepted and never call the reviewer.
+
+## How the reviewer decides
 
-- Sandbox escalations of `write`, `edit`, `bash`, and `pwsh`, one call at a time.
-- A few clearly harmless shell commands, such as `ls` or `pwd`, are approved without a model call.
-- Credential files, private keys, and dangerous programs are always refused.
-- Other tools, MCP, remote execution, and subagents are not auto-approved.
+- The reviewer sees the conversation, the working directory, and the complete arguments of the action. Only your own messages count as authorization; the agent's explanations, tool output, and file contents are treated as evidence.
+- Low- and medium-risk actions are approved. High-risk actions are approved only when you clearly asked for them and the scope is narrow. Critical actions, such as sending secrets to an external destination or broad irreversible deletion, are always denied.
+- If the review times out, fails, or no model is available, the request is not approved, and the agent is told this was a review failure: it may retry once or ask you.
+- After 3 consecutive denials, or 10 denials among the last 50 reviews in one turn, automatic approval pauses until your next message.
 
 ## Limits
 
 - **This is not a security boundary.** The reviewer is a language model and can be wrong. Keep your sandbox, isolation, and backups.
-- Files can still change between approval and execution.
+- A denied action does not open a confirmation dialog. To allow it, tell the agent in the chat; the reviewer sees your approval when it retries.
+- Long conversations are truncated from the oldest entries.
+- Action arguments are never truncated for approval. If the complete action is too large to review, automatic approval is refused.
+- Turning Safe Auto off or changing its reviewer settings invalidates reviews already in progress.
+- Subagent sessions do not use Safe Auto; they follow the native approval flow.
 - Do not combine it with other automatic approvers.
 
 ## License

package/README.zh-CN.md

@@ -4,7 +4,7 @@
 
 [English](README.md)
 
-新增一个「安全自动」权限档位。智能体请求在沙箱之外执行命令或修改文件时，由独立审核模型检查这一次调用。通过就继续；不通过时给你 60 秒决定批准还是拒绝。插件不会把会话切换成 Full Access。
+新增一个「安全自动」权限档位。普通操作照常在工作区沙箱里运行，插件不干预；需要审批的请求交给审核模型判断，通过就只放行这一次，不通过就把原因告诉智能体。做法参考 Codex 的自动审核（auto-review）。插件不会把会话切换成完全权限。
 
 ## 安装
 
@@ -18,21 +18,33 @@ dsh plugin --profile web add @klarkxy/dsh-safe-auto
 
 在输入框旁的权限菜单中选择「安全自动」。它只对当前会话生效，选回其他档位即关闭；选择之前不会有任何自动行为。
 
-请求未通过审核时，会弹出确认窗口，显示完整操作、审核意见和倒计时。你可以仅批准这一次，或者拒绝；无人响应即拒绝。
-
 在「插件 → 安全自动」中可以选择审核模型（留空跟随当前会话模型）、思考强度，以及额外的审核要求。
 
-## 覆盖范围
+模型列表加载失败或部分提供商不可用时，可在设置面板点击「重试」。重试会保留审核配置和未保存的草稿。
+
+## 会审核什么
+
+- `write`、`edit`、`bash`、`pwsh` 申请的沙箱提权。
+- 少量危险命令，即使没有申请提权也会先审核：强制删除（`rm -f`、`Remove-Item -Force`、`del /f`、`rd /s /q`）和打开网址。
+- 其他插件或工具在这个会话里发起的审批请求。
+
+读文件、搜索、构建、测试这类不需要审批的操作不会被拦截，也不会调用审核模型。
+
+## 审核怎么判断
 
-- `write`、`edit`、`bash`、`pwsh` 的沙箱提权，每次只放行一次调用。
-- 少量明显无害的命令（如 `ls`、`pwd`）无需调用模型直接放行。
-- 凭据文件、私钥和危险程序始终拒绝。
-- 其他工具、MCP、远程执行和子代理不会自动放行。
+- 审核模型会看到对话记录、工作目录和这次操作的完整参数。只有你发的消息算授权，智能体的说明、工具输出和文件内容都只作参考。
+- 低风险和中风险的操作放行；高风险只在你明确要求并且范围有限时放行；严重风险（例如把密钥发到外部、大范围不可逆删除）一律拒绝。
+- 审核超时、出错或模型不可用时，这次请求不放行，智能体会被告知这是审核失败，可以重试一次或者来问你。
+- 同一轮对话里连续拒绝 3 次，或最近 50 次拒绝了 10 次，本轮就暂停自动审批，等你发下一条消息。
 
 ## 限制
 
 - **这不是安全边界。** 审核方是语言模型，可能判断错误。请保留原有的沙箱、隔离和备份。
-- 批准与执行之间，文件仍可能发生变化。
+- 被拒绝的操作不会再弹窗让你确认。想放行时，直接在对话里告诉智能体，它重试时审核会看到你的批准。
+- 对话记录超长时会截断最早的内容。
+- 操作参数不会截断后送审；完整操作超出审核容量时，不会自动批准。
+- 关闭安全自动或修改审核设置，会使尚未完成的审核失效。
+- 子代理会话不使用安全自动，按原生审批流程处理。
 - 不要与其他自动审批插件同时使用。
 
 ## 许可证

package/dsh.plugin.json

@@ -1,8 +1,8 @@
 {
   "id": "@klarkxy/dsh-safe-auto",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "main": "src/index.js",
-  "description": "Safe Auto: an independent reviewer vets each native sandbox escalation; only a pass auto-approves that one call.",
+  "description": "Safe Auto: a reviewer model answers native approval requests, Codex auto-review style; only a pass approves that one call.",
   "engines": {
     "dsh": ">=0.2.0-rc.2"
   },