@lmzhen/dsh-evolution-approval 0.22.0 → 0.23.0

package/lib/index.js

@@ -1,6 +1,6 @@
 import { Service } from "@deepseek-ai/cordis";
 import { randomUUID } from "node:crypto";
-import { clampOnce, elapsedSince, isLoopbackRequest, isProcessAlive, parseLockBody, readJsonObject, textDiffFacts, writeJson } from "@lmzhen/dsh-evolution-core";
+import { clampOnce, elapsedSince, isLoopbackRequest, readJsonObject, textDiffFacts, writeJson } from "@lmzhen/dsh-evolution-core";
 import z from "@deepseek-ai/schemastery";
 import { PENDING_STATUSES } from "@lmzhen/dsh-evolution-state-storage";
 //#region lib/types/routes.js
@@ -228,6 +228,30 @@ function makeApprovalRoutes(approval) {
 *
 * @module @lmzhen/dsh-evolution-approval
 */
+/** A claim id carries its holder pid as `<pid>:<hex token>` (minted by `newClaimId()`). */
+const CLAIM_ID_RE = /^(\d+):[0-9a-f]*$/;
+/**
+* @param claimId - an id from a record's `claimedBy` field.
+* @returns the holder pid, or null when the id does not have the claim shape (pre-v43 bare UUID).
+*/
+function claimHolderPid(claimId) {
+	const match = CLAIM_ID_RE.exec(claimId.trim());
+	return match === null ? null : Number(match[1]);
+}
+/**
+* Whether a pid can still be running. `kill(pid, 0)` is the POSIX/Windows probe: it sends no
+* signal and answers through the error — EPERM means the process EXISTS but is not ours.
+* @param pid - the holder pid from a claim id (callers guard `> 0`; there is no pid 0).
+* @returns true when the process exists.
+*/
+function isProcessAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code === "EPERM";
+	}
+}
 /** The requesting session's effective policy (override ?? configured default);
 * undefined when the approval service is not mounted or no session is
 * available — callers keep their previous behavior. Single source (G4.8,
@@ -242,7 +266,12 @@ var EvolutionApproval = class extends Service {
 	static Config = z.object({
 		enabled: z.boolean().default(false),
 		stageForeground: z.boolean().default(true),
-		pendingTtlMs: z.number().min(0).default(0).volatile()
+		pendingTtlMs: z.number().min(0).default(0).volatile(),
+		approvalConfirm: z.union([
+			z.const("auto"),
+			z.const("ask"),
+			z.const("timeout")
+		]).default("auto").volatile()
 	});
 	enabled;
 	stageForegroundConfig;
@@ -427,9 +456,9 @@ var EvolutionApproval = class extends Service {
 	* core/instance-scope.ts, i.e. PER PROCESS, so a second process over one home
 	* is not excluded at all. Two checks stand in its place:
 	* 1. `inFlight` — an approve/reject running in THIS service instance;
-	* 2. the claim's holder pid. Claim ids are minted as `<pid>:<hex token>`, the
-	*    same body shape the io write lock uses, so `parseLockBody` + the core
-	*    `isProcessAlive` probe answer whether that holder can still be running: a
+	* 2. the claim's holder pid. Claim ids are minted as `<pid>:<hex token>` (this
+	*    service's own grammar, see `claimHolderPid`), so that id plus a liveness
+	*    probe answer whether the holder can still be running: a
 	*    LIVE FOREIGN pid REFUSES the release; our own pid is this process's
 	*    leftover (a live in-process approve is what `inFlight` covers); a dead pid
 	*    is a crash. The last two are releasable, which is the S2-P2-22 case.
@@ -461,7 +490,7 @@ var EvolutionApproval = class extends Service {
 			ok: false,
 			message: `Pending write "${id}" carries no claim to release (unexpected record shape) — reject it instead.`
 		};
-		const holderPid = parseLockBody(claimId);
+		const holderPid = claimHolderPid(claimId);
 		if (holderPid !== null && holderPid > 0 && holderPid !== process.pid && isProcessAlive(holderPid)) return {
 			ok: false,
 			message: `Pending write "${id}" is claimed by pid ${holderPid}, which is ALIVE — another process may be running this approve. Do not release it: verify the write effect instead and let that run finish (a completed approve resolves its own record).`
@@ -531,12 +560,11 @@ var EvolutionApproval = class extends Service {
 		if (override === "never" || override === "ask") return override;
 		return platformApproval.config?.policy ?? "ask";
 	}
-	/** v43 FLOW2-1: a claim id that CARRIES its holder pid — `parseLockBody`
-	* reads it back and `isProcessAlive` turns it into `release()`'s verifiable
-	* orphan criterion. The `<pid>:<hex token>` body is the io write lock's own
-	* shape, so one set of core helpers reads both; the token stays unique per
-	* call, so two approves of one record can never share a claim (the token is a
-	* dashed UUID stripped to hex because `LOCK_BODY_RE` accepts only hex). */
+	/** v43 FLOW2-1: a claim id that CARRIES its holder pid — `claimHolderPid` reads
+	* it back and the liveness probe turns it into `release()`'s verifiable orphan
+	* criterion. The token stays unique per call, so two approves of one record can
+	* never share a claim (a dashed UUID stripped to hex, which is what the
+	* claim-id grammar accepts). */
 	newClaimId() {
 		return `${process.pid}:${randomUUID().split("-").join("")}`;
 	}

package/lib/types/index.d.ts

@@ -164,6 +164,12 @@ export interface Config {
      * reference and is read at USE time — a settings write changes the window without a reload.
      */
     pendingTtlMs?: Volatile<number>;
+    /**
+     * U-6: what the confirmation before an APPROVE does. The same three words `skillWriteConfirm` uses
+     * for a skill write (`tool-skill-manage/src/write-gates.ts:50`) — mirrored, not imported: the two
+     * packages do not depend on each other and this is a vocabulary, not behaviour.
+     */
+    approvalConfirm?: Volatile<'auto' | 'ask' | 'timeout'>;
 }
 export declare class EvolutionApproval extends Service {
     static inject: string[];
@@ -171,10 +177,12 @@ export declare class EvolutionApproval extends Service {
         enabled: z<boolean, boolean, "defined">;
         stageForeground: z<boolean, boolean, "defined">;
         pendingTtlMs: z<number, number, "volatile-defined">;
+        approvalConfirm: z<"ask" | "auto" | "timeout", "ask" | "auto" | "timeout", "volatile-defined">;
     }>>, Schemastery.ObjectT<NoInfer<{
         enabled: z<boolean, boolean, "defined">;
         stageForeground: z<boolean, boolean, "defined">;
         pendingTtlMs: z<number, number, "volatile-defined">;
+        approvalConfirm: z<"ask" | "auto" | "timeout", "ask" | "auto" | "timeout", "volatile-defined">;
     }>>, "plain">;
     private readonly enabled;
     private readonly stageForegroundConfig;
@@ -263,9 +271,9 @@ export declare class EvolutionApproval extends Service {
      * core/instance-scope.ts, i.e. PER PROCESS, so a second process over one home
      * is not excluded at all. Two checks stand in its place:
      * 1. `inFlight` — an approve/reject running in THIS service instance;
-     * 2. the claim's holder pid. Claim ids are minted as `<pid>:<hex token>`, the
-     *    same body shape the io write lock uses, so `parseLockBody` + the core
-     *    `isProcessAlive` probe answer whether that holder can still be running: a
+     * 2. the claim's holder pid. Claim ids are minted as `<pid>:<hex token>` (this
+     *    service's own grammar, see `claimHolderPid`), so that id plus a liveness
+     *    probe answer whether the holder can still be running: a
      *    LIVE FOREIGN pid REFUSES the release; our own pid is this process's
      *    leftover (a live in-process approve is what `inFlight` covers); a dead pid
      *    is a crash. The last two are releasable, which is the S2-P2-22 case.
@@ -294,12 +302,11 @@ export declare class EvolutionApproval extends Service {
      * check is lazy: the platform service can start before or after this plugin.
      */
     private deriveSessionPolicy;
-    /** v43 FLOW2-1: a claim id that CARRIES its holder pid — `parseLockBody`
-     * reads it back and `isProcessAlive` turns it into `release()`'s verifiable
-     * orphan criterion. The `<pid>:<hex token>` body is the io write lock's own
-     * shape, so one set of core helpers reads both; the token stays unique per
-     * call, so two approves of one record can never share a claim (the token is a
-     * dashed UUID stripped to hex because `LOCK_BODY_RE` accepts only hex). */
+    /** v43 FLOW2-1: a claim id that CARRIES its holder pid — `claimHolderPid` reads
+     * it back and the liveness probe turns it into `release()`'s verifiable orphan
+     * criterion. The token stays unique per call, so two approves of one record can
+     * never share a claim (a dashed UUID stripped to hex, which is what the
+     * claim-id grammar accepts). */
     private newClaimId;
     private dedupe;
     private doApprove;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-approval",
   "description": "Stage/pending approval service for Hermes-style self-evolution writes (community build)",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "publishConfig": {
     "access": "public"
   },
@@ -27,18 +27,18 @@
   "license": "MIT",
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.4",
-    "@lmzhen/dsh-evolution-core": "^0.22.0"
+    "@lmzhen/dsh-evolution-core": "^0.23.0"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/dsh-host-webserver": "^0.2.0-rc.1",
-    "@lmzhen/dsh-evolution-state-storage": "^0.22.0",
-    "@lmzhen/dsh-evolution-state": "^0.22.0"
+    "@lmzhen/dsh-evolution-state-storage": "^0.23.0",
+    "@lmzhen/dsh-evolution-state": "^0.23.0"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-host-webserver": "^0.2.0-rc.1",
-    "@lmzhen/dsh-evolution-core": "^0.22.0",
-    "@lmzhen/dsh-evolution-state-storage": "^0.22.0",
-    "@lmzhen/dsh-evolution-state": "^0.22.0"
+    "@lmzhen/dsh-evolution-core": "^0.23.0",
+    "@lmzhen/dsh-evolution-state-storage": "^0.23.0",
+    "@lmzhen/dsh-evolution-state": "^0.23.0"
   }
 }