@klarkxy/dsh-safe-auto 0.5.2 → 0.5.3

package/README.md

@@ -18,13 +18,13 @@ Replace `web` with your profile name and restart the profile.
 
 Pick **Safe Auto** from the permission menu next to the chat input. It applies only to that session once selected; choosing any other level turns it off.
 
-Under **Plugins → Safe Auto** choose the reviewer model (empty follows the current session model), its reasoning effort, and extra review rules. Changes made elsewhere update this page on their own, and the page works independently of Model Hub.
+Under **Settings → Session Management → Safe Auto** choose the reviewer model, its reasoning effort, and extra review rules. Leaving the model empty follows the default auxiliary model; with no default set, it follows the current session model. The default auxiliary model is shared: set it once under **Settings → Session Management**, and every feature that follows it uses the same one. Changes made elsewhere update this page on their own.
 
 When the model list fails to load or some providers are unavailable, use **Retry** in the settings panel. Retrying keeps your reviewer settings and unsaved draft.
 
 ## Review history
 
-Open **Plugins → Safe Auto → Review history** to read every review this plugin recorded. Filter by search text, session, tool, result, risk, and a start and end time, then page through the matches. Opening a record shows the complete review: what triggered it, the arguments sent, the review input, the verdict, and whether the approved call ran afterwards.
+Open **Settings → Session Management → Safe Auto → Review history** to read every review this plugin recorded. Filter by search text, session, tool, result, risk, and a start and end time, then page through the matches. Opening a record shows the complete review: what triggered it, the arguments sent, the review input, the verdict, the token usage of each attempt, and whether the approved call ran afterwards.
 
 Export one record, or every record matching the current filters, as JSON. Exporting all matches walks the pages one at a time and can be cancelled at any point; a file is written only when the export finishes cleanly.
 
@@ -34,7 +34,7 @@ Recording covers reviews run after installing the review-history feature. Record
 
 | Tool | What it does |
 |---|---|
-| `safe_auto_history` | Read-only lookup of the current session's review history. `list` returns summaries and includes a next-page cursor when more records remain; `get` returns one complete record. Use the Plugins page to read history across sessions. Reading history is purely local and leaves the reviewer model idle. |
+| `safe_auto_history` | Read-only lookup of the current session's review history. `list` returns summaries and includes a next-page cursor when more records remain; `get` returns one complete record. Use Settings → Session Management → Safe Auto to read history across sessions. Reading history is purely local and leaves the reviewer model idle. |
 
 ## What gets reviewed
 
@@ -46,9 +46,11 @@ Reading files, searching, building, and testing run directly without review.
 
 ## How the reviewer decides
 
-- The reviewer sees the conversation, the current working directory, the sandbox workspace boundary, and the complete action arguments. Only your own messages count as authorization; the agent's explanations, tool output, and file contents serve as evidence.
+- The reviewer sees the conversation, the current working directory, the sandbox workspace boundary, and the complete action arguments. Only your own messages count as authorization; the agent's explanations, tool output, and file contents serve as evidence. An earlier approval outcome is a record of another call, never authorization for this one.
+- The reviewer reads the conversation as it stands now: a request you replaced and the turn it produced are no longer evidence, and a message that arrives while a review runs cancels that review.
 - Low- and medium-risk actions are approved. High-risk actions are approved only when you clearly asked for them and the scope is narrow. Critical actions, such as sending secrets to an external destination or broad irreversible deletion, are always denied.
 - If review times out, returns missing or unknown verdict fields, fails, or lacks an available model, the request is denied as a review failure: the agent may retry once or ask you.
+- The shared default auxiliary model is read before every review that follows it. If it cannot be read, the request is denied as a review failure rather than reviewed by a model you did not choose.
 - After 3 consecutive denials, or 10 denials among the last 50 reviews in one turn, automatic approval pauses until your next message.
 
 ## Limits

package/README.zh-CN.md

@@ -18,13 +18,13 @@ dsh plugin --profile web add @klarkxy/dsh-safe-auto
 
 在输入框旁的权限菜单中选择「安全自动」。选中后仅对当前会话生效，选回其他档位即关闭。
 
-在「插件 → 安全自动」中选择审核模型（留空跟随当前会话模型）、思考强度和额外的审核要求。设置在别处改动时本页会自动同步，可独立于模型枢纽使用。
+在「设置 → 会话管理 → 安全自动」中选择审核模型、思考强度和额外的审核要求。模型留空时跟随默认辅助模型；没有设置默认辅助模型时，跟随当前会话模型。默认辅助模型是共享设置：在「设置 → 会话管理」里设置一次，所有跟随它的功能都用同一个模型。设置在别处改动时本页会自动同步。
 
 模型列表读取失败或部分提供商不可用时，可在设置面板点击「重试」。重试会保留审核配置和未保存的草稿。
 
 ## 审核历史
 
-在「插件 → 安全自动 → 审核历史」里查看插件记录下的每一次审核。可以按搜索词、会话、工具、结果、风险和起止时间筛选，再逐页翻看。点开一条记录会看到这次审核的全貌：触发原因、实际送审的参数、送审内容、判定结果，以及放行的调用后来是否实际执行。
+在「设置 → 会话管理 → 安全自动 → 审核历史」里查看插件记录下的每一次审核。可以按搜索词、会话、工具、结果、风险和起止时间筛选，再逐页翻看。点开一条记录会看到这次审核的全貌：触发原因、实际送审的参数、送审内容、判定结果、每次尝试的 token 用量，以及放行的调用后来是否实际执行。
 
 可以导出单条记录，或导出符合当前筛选条件的全部记录，格式为 JSON。导出全部时逐页拉取，可随时取消；仅在完整导出成功后写入文件。
 
@@ -34,7 +34,7 @@ dsh plugin --profile web add @klarkxy/dsh-safe-auto
 
 | 工具 | 作用 |
 |---|---|
-| `safe_auto_history` | 只读查询当前会话的审核历史：`list` 返回摘要列表，还有后续记录时提供下一页游标；`get` 返回单条完整记录。跨会话历史可在插件页查看。查询历史仅读取本地记录，保持审核模型空闲。 |
+| `safe_auto_history` | 只读查询当前会话的审核历史：`list` 返回摘要列表，还有后续记录时提供下一页游标；`get` 返回单条完整记录。跨会话历史可在「设置 → 会话管理 → 安全自动」查看。查询历史仅读取本地记录，保持审核模型空闲。 |
 
 ## 会审核什么
 
@@ -46,9 +46,11 @@ dsh plugin --profile web add @klarkxy/dsh-safe-auto
 
 ## 审核怎么判断
 
-- 审核模型会看到对话记录、当前工作目录、沙箱工作区边界和这次操作的完整参数。只有你发的消息算授权，智能体的说明、工具输出和文件内容都只作参考。
+- 审核模型会看到对话记录、当前工作目录、沙箱工作区边界和这次操作的完整参数。只有你发的消息算授权，智能体的说明、工具输出和文件内容都只作参考；早先的审批结论是另一次调用的记录，不构成这次的授权。
+- 审核读的是对话当前的样子：你改写过的请求和它产生的那一轮都不再算依据；审核进行期间有新消息到达，这次审核即作废。
 - 低风险和中风险的操作放行；高风险只在你明确要求且范围有限时放行；严重风险（例如把密钥发到外部、大范围不可逆删除）一律拒绝。
 - 审核超时、返回字段缺失或含未知值、出错或缺少可用模型时，请求按审核失败拒绝，智能体可以重试一次或向你询问。
+- 跟随默认辅助模型的审核，每次都会先读取这个共享默认。读不到时按审核失败拒绝，而不是换一个你没选过的模型来审。
 - 同一轮对话里连续拒绝 3 次，或最近 50 次里拒绝了 10 次，就暂停自动审批，等你发下一条消息。
 
 ## 限制

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "@klarkxy/dsh-safe-auto",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "main": "src/index.js",
   "description": "Safe Auto: a reviewer model answers native approval requests, Codex auto-review style; only a pass approves that one call.",
   "engines": {