@klarkxy/dsh-safe-auto 0.3.0 → 0.4.0

package/README.md

@@ -18,7 +18,7 @@ Replace `web` with your profile name and restart the profile.
 
 Pick **Safe Auto** from the permission menu next to the chat input. It applies only to that session; choosing any other level turns it off. Nothing happens automatically until you pick it.
 
-Under **Plugins → Safe Auto** you can choose the reviewer model (empty follows the current session model), its reasoning effort, and extra review rules.
+Under **Plugins → Safe Auto** you can choose the reviewer model (empty follows the current session model), its reasoning effort, and extra review rules. Changes made elsewhere update this page on their own; Model Hub is not required.
 
 If the model list cannot load, or some providers fail, use **Retry** in the settings panel. Retrying keeps your reviewer settings and unsaved draft.
 
@@ -32,9 +32,9 @@ Reading files, searching, building, and testing need no approval; they are not i
 
 ## How the reviewer decides
 
-- The reviewer sees the conversation, the working directory, and the complete arguments of the action. Only your own messages count as authorization; the agent's explanations, tool output, and file contents are treated as evidence.
+- The reviewer sees the conversation, the current working directory, the sandbox workspace boundary, and the complete arguments of the action. Only your own messages count as authorization; the agent's explanations, tool output, and file contents are treated as evidence.
 - Low- and medium-risk actions are approved. High-risk actions are approved only when you clearly asked for them and the scope is narrow. Critical actions, such as sending secrets to an external destination or broad irreversible deletion, are always denied.
-- If the review times out, fails, or no model is available, the request is not approved, and the agent is told this was a review failure: it may retry once or ask you.
+- If the review times out, returns missing or unknown verdict fields, fails, or no model is available, the request is not approved, and the agent is told this was a review failure: it may retry once or ask you.
 - After 3 consecutive denials, or 10 denials among the last 50 reviews in one turn, automatic approval pauses until your next message.
 
 ## Limits

package/README.zh-CN.md

@@ -18,7 +18,7 @@ dsh plugin --profile web add @klarkxy/dsh-safe-auto
 
 在输入框旁的权限菜单中选择「安全自动」。它只对当前会话生效，选回其他档位即关闭；选择之前不会有任何自动行为。
 
-在「插件 → 安全自动」中可以选择审核模型（留空跟随当前会话模型）、思考强度，以及额外的审核要求。
+在「插件 → 安全自动」中可以选择审核模型（留空跟随当前会话模型）、思考强度，以及额外的审核要求。设置在别处改动时，这个页面会自行更新，不需要安装模型枢纽。
 
 模型列表加载失败或部分提供商不可用时，可在设置面板点击「重试」。重试会保留审核配置和未保存的草稿。
 
@@ -32,9 +32,9 @@ dsh plugin --profile web add @klarkxy/dsh-safe-auto
 
 ## 审核怎么判断
 
-- 审核模型会看到对话记录、工作目录和这次操作的完整参数。只有你发的消息算授权，智能体的说明、工具输出和文件内容都只作参考。
+- 审核模型会看到对话记录、当前工作目录、沙箱工作区边界和这次操作的完整参数。只有你发的消息算授权，智能体的说明、工具输出和文件内容都只作参考。
 - 低风险和中风险的操作放行；高风险只在你明确要求并且范围有限时放行；严重风险（例如把密钥发到外部、大范围不可逆删除）一律拒绝。
-- 审核超时、出错或模型不可用时，这次请求不放行，智能体会被告知这是审核失败，可以重试一次或者来问你。
+- 审核超时、返回字段缺失或含未知值、出错或模型不可用时，这次请求不放行，智能体会被告知这是审核失败，可以重试一次或者来问你。
 - 同一轮对话里连续拒绝 3 次，或最近 50 次拒绝了 10 次，本轮就暂停自动审批，等你发下一条消息。
 
 ## 限制

package/dsh.plugin.json

@@ -1,10 +1,10 @@
 {
   "id": "@klarkxy/dsh-safe-auto",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "main": "src/index.js",
   "description": "Safe Auto: a reviewer model answers native approval requests, Codex auto-review style; only a pass approves that one call.",
   "engines": {
-    "dsh": ">=0.2.0-rc.2"
+    "dsh": ">=0.2.1-rc.1"
   },
   "contributes": {
     "tools": [],

package/lib/client.js

@@ -1414,25 +1414,18 @@ function createPluginReadGate(now = Date.now) {
 }
 //#endregion
 //#region ../dsh-plugin-kit/lib/contracts.js
-/**
-* Remote contribution for model-settings change notifications.
-* Provided by `@klarkxy/dsh-model-hub` (`ModelSettingsChangesController`);
-* subscribers degrade silently when that package is not installed.
-* The stream carries invalidations only — `ready` is never a settings snapshot.
-*/
-const MODEL_SETTINGS_CHANGES_REMOTE = {
-	package: "@klarkxy/dsh-model-hub",
-	descriptors: [{
-		id: "modelSettingsChanges/watch",
-		service: "modelSettingsChangesController",
-		namespace: "modelSettingsChanges",
-		method: "watch",
-		mode: "stream",
-		invocation: { kind: "direct" },
-		parameters: [],
-		cancellation: { parameter: "signal" }
-	}]
-};
+/** `@klarkxy/dsh-git-commit` becomes `KlarkxyDshGitCommitModelSettingsChanges`. */
+function modelSettingsChangesIdentity(packageName) {
+	const scoped = /^@([^/]+)\/(.+)$/.exec(packageName);
+	const parts = (scoped ? `${scoped[1]}/${scoped[2]}` : packageName).split(/[^A-Za-z0-9]+/).filter(Boolean);
+	if (!parts.length) throw new Error("Model settings package name has no RPC segment");
+	const segment = `${parts.map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("")}ModelSettingsChanges`;
+	if (!/^[A-Z][A-Za-z0-9]*$/.test(segment)) throw new Error(`Model settings sync name is not an RPC segment: ${segment}`);
+	return {
+		service: segment,
+		namespace: segment
+	};
+}
 //#endregion
 //#region ../dsh-plugin-kit/lib/model-settings-client.js
 /** This stream carries invalidations only; ready is never a settings snapshot. */
@@ -1447,17 +1440,44 @@ function parseModelSettingsChangeFrame(value) {
 	};
 	throw new Error("Invalid model settings change frame");
 }
-MODEL_SETTINGS_CHANGES_REMOTE.package, MODEL_SETTINGS_CHANGES_REMOTE.descriptors.map((descriptor) => ({
-	...descriptor,
-	result: {
-		mode: "strict",
-		typeSymbol: "ModelSettings.ChangeFrame",
-		create: () => ({ parse: parseModelSettingsChangeFrame })
-	}
-}));
+/** One owner's contribution. Each package mounts only its own endpoint. */
+function modelSettingsChangesRemote(packageName, identity = modelSettingsChangesIdentity(packageName)) {
+	return {
+		package: packageName,
+		descriptors: [{
+			id: `${identity.namespace}/watch`,
+			service: identity.service,
+			namespace: identity.namespace,
+			method: "watch",
+			mode: "stream",
+			invocation: { kind: "direct" },
+			parameters: [],
+			cancellation: { parameter: "signal" },
+			result: {
+				mode: "strict",
+				typeSymbol: "ModelSettings.ChangeFrame",
+				create: () => ({ parse: parseModelSettingsChangeFrame })
+			}
+		}]
+	};
+}
+/** Mount from a synchronous apply. Disposal waits for an in-flight mount and
+* then withdraws it, so the contribution cannot outlive the plugin. */
+function mountModelSettingsChanges(ctx, packageName) {
+	const contribution = modelSettingsChangesRemote(packageName);
+	ctx.inject(["remote"], (injected) => {
+		const scope = injected;
+		const mounting = scope.remote.$mount(contribution);
+		mounting.catch(() => {});
+		scope.effect(() => async () => {
+			await (await mounting.catch(() => void 0))?.();
+		});
+	});
+}
 /** Native RemoteStream owns carrier reconnects; no timers or browser transport.
 * A factory shares one logical stream while at least one subscriber remains. */
-function createModelSettingsSubscriber(ctx, namespace) {
+function createModelSettingsSubscriber(ctx, packageName, identity = modelSettingsChangesIdentity(packageName), accept = (ns) => ns === packageName) {
+	const endpoint = identity;
 	const listeners = /* @__PURE__ */ new Set();
 	let injection;
 	let current;
@@ -1483,12 +1503,18 @@ function createModelSettingsSubscriber(ctx, namespace) {
 	};
 	const start = () => {
 		const life = ++lifecycle;
-		injection = ctx.inject(["remote", "remote.modelSettingsChanges"], (injected) => {
+		injection = ctx.inject(["remote", `remote.${endpoint.namespace}`], (injected) => {
 			if (life !== lifecycle || !listeners.size) return;
 			const scope = injected;
+			const service = scope.remote[endpoint.namespace];
+			if (!service || !("watch" in service) || !service.watch) {
+				report("Model settings sync service unavailable");
+				return;
+			}
+			const watch = service.watch;
 			const stream = scope.remote.$stream({
 				name: "Model settings sync",
-				open: (signal) => scope.remote.modelSettingsChanges.watch(signal),
+				open: (signal) => watch(signal),
 				ended: (accepted) => /* @__PURE__ */ new Error(`Model settings sync stream ended ${accepted ? "after" : "before"} ready; refresh or reopen the page`)
 			});
 			const session = {
@@ -1523,7 +1549,7 @@ function createModelSettingsSubscriber(ctx, namespace) {
 							invalidate();
 						} else {
 							if (!ready) throw new Error("Model settings sync change arrived before ready");
-							if (namespace === "*" || frame.ns === namespace) invalidate();
+							if (accept(frame.ns)) invalidate();
 						}
 					}
 				} catch (error) {
@@ -2249,6 +2275,7 @@ function SettingsPanel({ view, api, locale, initialSettings = null, initialCatal
 	}, t("saved")));
 }
 function apply(ctx) {
+	mountModelSettingsChanges(ctx, BUNDLE);
 	const settingsSubscriber = createModelSettingsSubscriber(ctx, BUNDLE);
 	const call = (endpoint, payload) => unwrapRpc((...args) => ctx.connection.rpc.call(...args), endpoint, payload);
 	const api = Object.freeze({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@klarkxy/dsh-safe-auto",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Safe Auto: a reviewer model answers native approval requests, Codex auto-review style; only a pass approves that one call.",
   "icon": "./icon.svg",
   "type": "module",
@@ -28,7 +28,7 @@
   },
   "engines": {
     "node": "^22.19.0 || >=24.0.0",
-    "dsh": ">=0.2.0-rc.2"
+    "dsh": ">=0.2.1-rc.1"
   },
   "license": "SEE LICENSE IN LICENSE",
   "repository": {
@@ -58,30 +58,38 @@
     }
   },
   "dependencies": {
-    "@klarkxy/dsh-plugin-kit": "0.3.4",
+    "@klarkxy/dsh-plugin-kit": "0.4.0",
     "zod": "^4.1.5"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": ">=4.0.4",
-    "@deepseek-ai/dsh-storage-domain": ">=0.2.0-rc.2"
+    "@deepseek-ai/dsh-storage-domain": ">=0.2.0-rc.2",
+    "@deepseek-ai/dsh-working-directory": ">=0.2.1-rc.1"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-storage-domain": {
       "optional": true
+    },
+    "@deepseek-ai/cordis": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-working-directory": {
+      "optional": true
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.4",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-storage-domain": "0.2.0-rc.2",
-    "@klarkxy/dsh-model-route": "0.2.4",
-    "jsdom": "29.1.1"
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-storage-domain": "0.2.1-rc.1",
+    "@klarkxy/dsh-model-route": "0.2.5",
+    "jsdom": "29.1.1",
+    "@deepseek-ai/dsh-working-directory": "0.2.1-rc.1"
   },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
   "dshRelease": {
-    "contentHash": "4479e79ba77c55f0446e01d5ac8a9b2db9079aedde794debb60fea69e85221a0"
+    "contentHash": "fbbaa607cab540cfc58b7d99946f5a0954f3b4c51b9ceb90e452fb3fd0522bed"
   }
 }

package/src/index.js

@@ -8,7 +8,7 @@ import { resolveReviewRoute } from './model-route.js';
 export { Config } from './config.js';
 
 export const name = 'dsh-safe-auto';
-export const inject = ['sandboxPolicy'];
+export const inject = ['sandboxPolicy', 'workingDirectory'];
 
 /*
  * Safe Auto routes native approval requests to a reviewer model, following
@@ -199,7 +199,7 @@ export function apply(ctx, raw = {}) {
     const agent = req.agent, callId = String(req.callId), token = exec.token;
     const environment = () => {
       const sandbox = ctx.sandboxPolicy.resolve({ session });
-      return JSON.stringify({ platform: process.platform, cwd: session.header?.cwd,
+      return JSON.stringify({ platform: process.platform, cwd: ctx.workingDirectory.get(session),
         workspaceRoot: sandbox?.workspaceRoot, sandbox: sandbox?.mode });
     };
     let rawAction, rawEnvironment, revision, input;

package/src/model-route.js

@@ -34,8 +34,6 @@ export function resolveReviewRoute(config, owner) {
     ...(config.reasoningEffort ? { reasoningEffort: config.reasoningEffort } : {}) });
 }
 
-export const sameRoute = (a, b) => JSON.stringify(a) === JSON.stringify(b);
-
 function usageTotal(usage) {
   if (!usage || typeof usage !== 'object') return undefined;
   if (Number.isSafeInteger(usage.totalTokens) && usage.totalTokens >= 0) return usage.totalTokens;

package/src/reviewer.js

@@ -65,12 +65,17 @@ export function parseVerdict(text) {
   if (end <= start) throw new Error('INVALID_REVIEW_RESPONSE');
   let value;
   try { value = JSON.parse(text.slice(start, end + 1)); } catch { throw new Error('INVALID_REVIEW_RESPONSE'); }
-  if (!value || typeof value !== 'object' || !['allow', 'deny'].includes(value.outcome)) throw new Error('INVALID_REVIEW_RESPONSE');
-  const risk = RISKS.includes(value.risk_level) ? value.risk_level : undefined;
-  const authorization = AUTHORIZATIONS.includes(value.user_authorization) ? value.user_authorization : undefined;
-  const rationale = typeof value.rationale === 'string' ? value.rationale.trim().slice(0, 600) : '';
-  // `critical` never auto-approves, whatever the stated outcome.
-  const outcome = risk === 'critical' ? 'deny' : value.outcome;
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || !['allow', 'deny'].includes(value.outcome)
+    || !RISKS.includes(value.risk_level) || !AUTHORIZATIONS.includes(value.user_authorization)
+    || typeof value.rationale !== 'string' || !value.rationale.trim()) throw new Error('INVALID_REVIEW_RESPONSE');
+  const risk = value.risk_level;
+  const authorization = value.user_authorization;
+  const rationale = value.rationale.trim().slice(0, 600);
+  // Retain model denials (including malicious injection and broad scope), but
+  // enforce the policy's authorization floor even if the model says allow.
+  const outcome = risk === 'critical' || (risk === 'high' && !['medium', 'high'].includes(authorization))
+    ? 'deny' : value.outcome;
   return Object.freeze({ outcome, risk, authorization, rationale });
 }
 

package/src/ui-host.js

@@ -1,5 +1,7 @@
 import { createControl, CHANNEL, REVIEW_FIELDS } from './control.js';
 import { registerHostRpc } from '@klarkxy/dsh-plugin-kit/host-rpc';
+import { modelSettingsChangesIdentity } from '@klarkxy/dsh-plugin-kit/contracts';
+import { createModelSettingsChanges } from '@klarkxy/dsh-plugin-kit/model-settings-changes';
 import { registerModelSettings, notifyModelSettingsChanged } from '@klarkxy/dsh-plugin-kit/model-settings';
 
 export const name = 'dsh-safe-auto-ui-host';
@@ -21,6 +23,7 @@ export function registerControlRoute(ctx, call) {
 }
 
 export async function apply(ctx) {
+  createModelSettingsChanges(ctx, modelSettingsChangesIdentity('@klarkxy/dsh-safe-auto'), '@klarkxy/dsh-safe-auto');
   // Loaded only by the separate UI row; the review plugin keeps its minimal dependencies.
   const [{ defineDomain, domainTable }, { z }] = await Promise.all([import('@deepseek-ai/dsh-storage-domain'), import('zod')]);
   // No strict(): rows saved by 0.1.x carry retired keys (fastProvider, approvalReview, …),