@klarkxy/dsh-safe-auto 0.5.1 → 0.5.3

package/README.md

@@ -4,7 +4,7 @@
 
 [简体中文](README.zh-CN.md)
 
-Adds a **Safe Auto** permission level. Ordinary actions run inside the workspace sandbox as usual and the plugin stays out of the way. Requests that need approval go to a reviewer model: a pass approves that one call, a denial is explained to the agent. The design follows Codex auto-review. Your session is never switched to Full Access.
+Adds a **Safe Auto** permission level. Ordinary actions run inside the workspace sandbox as usual. Requests that need approval go to a reviewer model: a pass approves that single call, and a denial is explained to the agent. The design follows Codex auto-review while keeping the session within its workspace sandbox rather than switching to Full Access.
 
 ## Install
 
@@ -16,53 +16,55 @@ Replace `web` with your profile name and restart the profile.
 
 ## Use
 
-Pick **Safe Auto** from the permission menu next to the chat input. It applies only to that session; choosing any other level turns it off. Nothing happens automatically until you pick it.
+Pick **Safe Auto** from the permission menu next to the chat input. It applies only to that session once selected; choosing any other level turns it off.
 
-Under **Plugins → Safe Auto** choose the reviewer model (empty follows the current session model), its reasoning effort, and extra review rules. Changes made elsewhere update this page on their own; Model Hub is not required.
+Under **Settings → Session Management → Safe Auto** choose the reviewer model, its reasoning effort, and extra review rules. Leaving the model empty follows the default auxiliary model; with no default set, it follows the current session model. The default auxiliary model is shared: set it once under **Settings → Session Management**, and every feature that follows it uses the same one. Changes made elsewhere update this page on their own.
 
-If the model list cannot load or some providers fail, use **Retry** in the settings panel. Retrying keeps your reviewer settings and unsaved draft.
+When the model list fails to load or some providers are unavailable, use **Retry** in the settings panel. Retrying keeps your reviewer settings and unsaved draft.
 
 ## Review history
 
-Open **Plugins → Safe Auto → Review history** to read every review this plugin recorded. Filter by search text, session, tool, result, risk, and a start and end time, then page through the matches. Opening a record shows the whole review: what triggered it, the arguments that were sent, the review input, the verdict, and whether the approved call actually ran afterwards.
+Open **Settings → Session Management → Safe Auto → Review history** to read every review this plugin recorded. Filter by search text, session, tool, result, risk, and a start and end time, then page through the matches. Opening a record shows the complete review: what triggered it, the arguments sent, the review input, the verdict, the token usage of each attempt, and whether the approved call ran afterwards.
 
-Export one record, or every record matching the current filters, as JSON. Exporting all matches walks the pages one at a time, can be cancelled at any point, and a failed or cancelled export writes no file.
+Export one record, or every record matching the current filters, as JSON. Exporting all matches walks the pages one at a time and can be cancelled at any point; a file is written only when the export finishes cleanly.
 
-Recording starts after installing the review-history feature; earlier reviews are not backfilled. Records stay in the Harness profile and are never deleted automatically.
+Recording covers reviews run after installing the review-history feature. Records stay in the Harness profile until you remove them.
 
 ### Tools
 
 | Tool | What it does |
 |---|---|
-| `safe_auto_history` | Read-only lookup of the current session's review history. `list` returns summaries and a next-page cursor only when more records remain; `get` returns one complete record. Use the Plugins page to read history across sessions. Reading history never triggers a review and never calls the reviewer model. |
+| `safe_auto_history` | Read-only lookup of the current session's review history. `list` returns summaries and includes a next-page cursor when more records remain; `get` returns one complete record. Use Settings → Session Management → Safe Auto to read history across sessions. Reading history is purely local and leaves the reviewer model idle. |
 
 ## What gets reviewed
 
 - Sandbox escalations requested by `write`, `edit`, `bash`, and `pwsh`.
-- A short list of dangerous commands, reviewed even without an escalation: forced deletion (`rm -f`, `Remove-Item -Force`, `del /f`, `rd /s /q`) and opening URLs.
+- A short list of dangerous commands, reviewed even inside the sandbox: forced deletion (`rm -f`, `Remove-Item -Force`, `del /f`, `rd /s /q`) and opening URLs.
 - Approval requests other plugins or tools raise in the session.
 
-Reading files, searching, building, and testing need no approval; they are not intercepted and never call the reviewer.
+Reading files, searching, building, and testing run directly without review.
 
 ## How the reviewer decides
 
-- The reviewer sees the conversation, the current working directory, the sandbox workspace boundary, and the complete action arguments. Only your own messages count as authorization; the agent's explanations, tool output, and file contents are evidence.
+- The reviewer sees the conversation, the current working directory, the sandbox workspace boundary, and the complete action arguments. Only your own messages count as authorization; the agent's explanations, tool output, and file contents serve as evidence. An earlier approval outcome is a record of another call, never authorization for this one.
+- The reviewer reads the conversation as it stands now: a request you replaced and the turn it produced are no longer evidence, and a message that arrives while a review runs cancels that review.
 - Low- and medium-risk actions are approved. High-risk actions are approved only when you clearly asked for them and the scope is narrow. Critical actions, such as sending secrets to an external destination or broad irreversible deletion, are always denied.
-- If review times out, returns missing or unknown verdict fields, fails, or no model is available, the request is not approved and the agent is told this was a review failure: it may retry once or ask you.
+- If review times out, returns missing or unknown verdict fields, fails, or lacks an available model, the request is denied as a review failure: the agent may retry once or ask you.
+- The shared default auxiliary model is read before every review that follows it. If it cannot be read, the request is denied as a review failure rather than reviewed by a model you did not choose.
 - After 3 consecutive denials, or 10 denials among the last 50 reviews in one turn, automatic approval pauses until your next message.
 
 ## Limits
 
 - **This is not a security boundary.** The reviewer is a language model and can be wrong. Keep your sandbox, isolation, and backups.
-- A denied action opens no confirmation dialog. To allow it, tell the agent in the chat; the reviewer sees your approval when it retries.
+- A denied action returns directly to the agent in the conversation. To allow it, tell the agent in the chat; the reviewer sees your approval when it retries.
 - Long conversations are truncated from the oldest entries.
-- Action arguments are never truncated for approval. If the complete action is too large to review, automatic approval is refused.
+- Action arguments are sent to the reviewer in full; if the complete action exceeds the review size limit, automatic approval is refused.
 - Turning Safe Auto off or changing its reviewer settings invalidates reviews already in progress.
-- Subagent sessions do not use Safe Auto; they follow the native approval flow.
-- Do not combine it with other automatic approvers.
-- History contains redacted copies of review evidence. Known credentials are masked on a best-effort basis; unfamiliar secret formats can remain. Oversized or invalid actions that cannot be reviewed carry explicit capture limits.
-- The reviewer verdict, the observed approval decision, and the tool result are recorded separately. A passed review does not establish that permission was granted; unobserved approval and execution results remain marked as such. The local audit record provides no tamper-proof guarantee.
-- If an audit record cannot be saved, automatic approval is refused.
+- Safe Auto applies to top-level sessions; subagent sessions follow the native approval flow.
+- Use Safe Auto as the sole automatic approver in a profile.
+- History contains redacted copies of review evidence. Known credentials are masked on a best-effort basis, while unfamiliar secret formats may remain. Oversized or invalid actions carry explicit capture limits.
+- The reviewer verdict, the observed approval decision, and the tool result are recorded as separate fields; unobserved approval and execution results are marked explicitly. Local audit records are plain profile data rather than tamper-proof logs.
+- Automatic approval requires the audit record to save first.
 
 ## License
 

package/README.zh-CN.md

@@ -4,7 +4,7 @@
 
 [English](README.md)
 
-新增一个「安全自动」权限档位。普通操作照常在工作区沙箱里运行，插件不干预；需要审批的请求交给审核模型判断，通过就只放行这一次，不通过就把原因告诉智能体。做法参考 Codex 的自动审核（auto-review）。插件不会把会话切换成完全权限。
+新增一个「安全自动」权限档位。普通操作照常在工作区沙箱里运行；需要审批的请求交给审核模型判断，通过就只放行这一次，拒绝就把原因告诉智能体。做法参考 Codex 的自动审核（auto-review），始终保持工作区沙箱隔离，而非切换到完全权限。
 
 ## 安装
 
@@ -16,53 +16,55 @@ dsh plugin --profile web add @klarkxy/dsh-safe-auto
 
 ## 使用
 
-在输入框旁的权限菜单中选择「安全自动」。它只对当前会话生效，选回其他档位即关闭；选择之前不会有任何自动行为。
+在输入框旁的权限菜单中选择「安全自动」。选中后仅对当前会话生效，选回其他档位即关闭。
 
-在「插件 → 安全自动」中选择审核模型（留空跟随当前会话模型）、思考强度和额外的审核要求。设置在别处改动时这个页面会自行更新，不需要安装模型枢纽。
+在「设置 → 会话管理 → 安全自动」中选择审核模型、思考强度和额外的审核要求。模型留空时跟随默认辅助模型；没有设置默认辅助模型时，跟随当前会话模型。默认辅助模型是共享设置：在「设置 → 会话管理」里设置一次，所有跟随它的功能都用同一个模型。设置在别处改动时本页会自动同步。
 
-模型列表加载失败或部分提供商不可用时，可在设置面板点击「重试」。重试会保留审核配置和未保存的草稿。
+模型列表读取失败或部分提供商不可用时，可在设置面板点击「重试」。重试会保留审核配置和未保存的草稿。
 
 ## 审核历史
 
-在「插件 → 安全自动 → 审核历史」里查看插件记录下的每一次审核。可以按搜索词、会话、工具、结果、风险和起止时间筛选，再逐页翻看。点开一条记录会看到这次审核的全貌：触发原因、实际送审的参数、送审内容、判定结果，以及放行的调用后来是否真的执行了。
+在「设置 → 会话管理 → 安全自动 → 审核历史」里查看插件记录下的每一次审核。可以按搜索词、会话、工具、结果、风险和起止时间筛选，再逐页翻看。点开一条记录会看到这次审核的全貌：触发原因、实际送审的参数、送审内容、判定结果、每次尝试的 token 用量，以及放行的调用后来是否实际执行。
 
-可以导出单条记录，或导出符合当前筛选条件的全部记录，格式为 JSON。导出全部时逐页拉取，随时可以取消；导出失败或取消都不会写入文件。
+可以导出单条记录，或导出符合当前筛选条件的全部记录，格式为 JSON。导出全部时逐页拉取，可随时取消；仅在完整导出成功后写入文件。
 
-安装审核历史功能后开始记录，更早的审核不会补录。记录保存在 Harness profile 中，不会自动删除。
+历史记录涵盖安装审核历史功能之后的每次审核，持久保存在 Harness profile 中。
 
 ### 工具
 
 | 工具 | 作用 |
 |---|---|
-| `safe_auto_history` | 只读查询当前会话的审核历史：`list` 返回摘要列表，仅在还有记录时提供下一页游标；`get` 返回单条完整记录。跨会话历史可在插件页查看。查询历史不会触发审核，也不会调用审核模型。 |
+| `safe_auto_history` | 只读查询当前会话的审核历史：`list` 返回摘要列表，还有后续记录时提供下一页游标；`get` 返回单条完整记录。跨会话历史可在「设置 → 会话管理 → 安全自动」查看。查询历史仅读取本地记录，保持审核模型空闲。 |
 
 ## 会审核什么
 
 - `write`、`edit`、`bash`、`pwsh` 申请的沙箱提权。
-- 少量危险命令，即使没有申请提权也会先审核：强制删除（`rm -f`、`Remove-Item -Force`、`del /f`、`rd /s /q`）和打开网址。
+- 少量危险命令，在沙箱内也会先送审：强制删除（`rm -f`、`Remove-Item -Force`、`del /f`、`rd /s /q`）和打开网址。
 - 其他插件或工具在这个会话里发起的审批请求。
 
-读文件、搜索、构建、测试这类不需要审批的操作不会被拦截，也不会调用审核模型。
+读文件、搜索、构建、测试这类常规操作直接运行，无需送审。
 
 ## 审核怎么判断
 
-- 审核模型会看到对话记录、当前工作目录、沙箱工作区边界和这次操作的完整参数。只有你发的消息算授权，智能体的说明、工具输出和文件内容都只作参考。
+- 审核模型会看到对话记录、当前工作目录、沙箱工作区边界和这次操作的完整参数。只有你发的消息算授权，智能体的说明、工具输出和文件内容都只作参考；早先的审批结论是另一次调用的记录，不构成这次的授权。
+- 审核读的是对话当前的样子：你改写过的请求和它产生的那一轮都不再算依据；审核进行期间有新消息到达，这次审核即作废。
 - 低风险和中风险的操作放行；高风险只在你明确要求且范围有限时放行；严重风险（例如把密钥发到外部、大范围不可逆删除）一律拒绝。
-- 审核超时、返回字段缺失或含未知值、出错或模型不可用时，这次请求不放行，智能体会被告知这是审核失败，可以重试一次或者来问你。
+- 审核超时、返回字段缺失或含未知值、出错或缺少可用模型时，请求按审核失败拒绝，智能体可以重试一次或向你询问。
+- 跟随默认辅助模型的审核，每次都会先读取这个共享默认。读不到时按审核失败拒绝，而不是换一个你没选过的模型来审。
 - 同一轮对话里连续拒绝 3 次，或最近 50 次里拒绝了 10 次，就暂停自动审批，等你发下一条消息。
 
 ## 限制
 
 - **这不是安全边界。** 审核方是语言模型，可能判断错误。请保留原有的沙箱、隔离和备份。
-- 被拒绝的操作不会弹窗让你确认。想放行时直接在对话里告诉智能体，它重试时审核会看到你的批准。
+- 被拒绝的操作直接把原因返回给对话中的智能体。想放行时直接在对话里告诉智能体，它重试时审核会看到你的批准。
 - 对话记录超长时会截断最早的内容。
-- 操作参数不会截断后送审；完整操作超出审核容量时不会自动批准。
+- 操作参数以完整内容送审；完整操作超出审核容量时拒绝自动批准。
 - 关闭安全自动或修改审核设置，会使尚未完成的审核失效。
-- 子代理会话不使用安全自动，按原生审批流程处理。
-- 不要与其他自动审批插件同时使用。
-- 历史保存脱敏后的审核依据。已知凭据会尽力遮盖，未知格式的敏感内容仍可能保留；超大或无效、无法送审的操作会明确标注记录范围。
-- 审核结论、观察到的实际审批与工具结果分别记录。审核通过不代表权限已经授予；未观察到审批或执行结果都会明确标注。本地审核记录不提供防篡改保证。
-- 审核记录无法保存时，不会自动批准操作。
+- 安全自动仅作用于顶层会话，子代理会话沿用原生审批流程。
+- 同一 profile 中请单独使用本插件处理自动审批。
+- 历史保存脱敏后的审核依据。已知凭据会尽力遮盖，未知格式的敏感内容仍可能保留；超大或无效的操作会明确标注记录范围。
+- 审核结论、观察到的实际审批与工具结果分别记录；未观察到审批或执行结果时会明确标注。本地审核记录作为普通 profile 数据保存。
+- 自动批准以审核记录成功落盘为前提。
 
 ## 许可证
 

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "@klarkxy/dsh-safe-auto",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "main": "src/index.js",
   "description": "Safe Auto: a reviewer model answers native approval requests, Codex auto-review style; only a pass approves that one call.",
   "engines": {