@lmzhen/dsh-evolution-approval 0.3.16 → 0.3.17

package/lib/index.js

@@ -52,8 +52,18 @@ var EvolutionApproval = class extends Service {
 	hasRunner(kind) {
 		return this.runners.has(kind);
 	}
-	/** Trusted plan-executor entry point: replay a write through the registered runner exactly once. */
-	async run(kind, args) {
+	/**
+	* Trusted plan-executor entry point: replay a write through the registered
+	* runner exactly once. 0.3.17 (S3.2, E-23): this is the BACKGROUND-REVIEW
+	* replay channel only — the caller must declare the intent (the review
+	* pipeline is the sole production consumer); a bare call is refused so the
+	* staging boundary cannot be bypassed by accident from another surface.
+	*/
+	async run(kind, args, intent) {
+		if (intent?.interface !== "background_review") return {
+			ok: false,
+			message: "approval.run is the background-review replay channel; direct execution must use the tool path (staging is the only gate bypass for foreground)."
+		};
 		const runner = this.runners.get(kind);
 		if (!runner) return {
 			ok: false,
@@ -68,7 +78,7 @@ var EvolutionApproval = class extends Service {
 			action: "allow",
 			message: "Approval disabled."
 		};
-		if (input.sessionPolicy === "never") return {
+		if ((this.deriveSessionPolicy(input.sessionId) ?? (this.ctx.get("approval") ? void 0 : input.sessionPolicy)) === "never") return {
 			action: "allow",
 			message: "Session approval policy is \"never\"; write allowed without staging."
 		};
@@ -80,7 +90,9 @@ var EvolutionApproval = class extends Service {
 				summary,
 				args: input.args,
 				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-				status: "pending"
+				status: "pending",
+				origin: input.origin,
+				...input.sessionId ? { sessionId: input.sessionId } : {}
 			};
 			await this.state().savePending(record);
 			return {
@@ -103,21 +115,46 @@ var EvolutionApproval = class extends Service {
 	async reject(id) {
 		return await this.dedupe(`reject:${id}`, async () => {
 			const claimId = randomUUID();
-			if (!await this.state().claimPending(id, claimId)) return {
-				ok: false,
-				message: `Pending write "${id}" is already being resolved by another writer.`
-			};
+			if (!await this.state().claimPending(id, claimId)) {
+				if ((await this.state().listPending("executing")).find((item) => item.id === id)) return (await this.state().tryResolvePending(id, "rejected")).applied ? {
+					ok: true,
+					message: `Rejected executing write "${id}" (crashed approve cleaned up; verify the write state manually).`
+				} : {
+					ok: false,
+					message: `Pending write "${id}" could not be rejected: it resolved concurrently.`
+				};
+				return {
+					ok: false,
+					message: `Pending write "${id}" is already being resolved by another writer.`
+				};
+			}
 			const resolution = await this.state().tryResolvePending(id, "rejected");
-			if (!resolution.applied || !resolution.record) return {
-				ok: false,
-				message: `Pending write "${id}" is not pending (already resolved or missing).`
-			};
+			if (!resolution.applied || !resolution.record) {
+				await this.state().releasePendingClaim(id, claimId);
+				return {
+					ok: false,
+					message: `Pending write "${id}" is not pending (already resolved or missing).`
+				};
+			}
 			return {
 				ok: true,
 				message: `Rejected ${resolution.record.kind} write "${id}".`
 			};
 		});
 	}
+	/**
+	* 0.3.17 (S3.1): platform-side session policy derivation — the platform's
+	* approval service (`overrideOf`) is the authority; a caller's self-reported
+	* sessionPolicy is a fallback only without it (E-22). The mount check is
+	* lazy: the platform service can start before or after this plugin.
+	*/
+	deriveSessionPolicy(sessionId) {
+		if (!sessionId) return void 0;
+		const platformApproval = this.ctx.get("approval");
+		if (!platformApproval) return void 0;
+		const override = platformApproval.overrideOf?.(sessionId);
+		return override === "never" || override === "ask" ? override : void 0;
+	}
 	dedupe(id, task) {
 		const existing = this.inFlight.get(id);
 		if (existing) return existing;
@@ -130,10 +167,16 @@ var EvolutionApproval = class extends Service {
 	async doApprove(id) {
 		const claimId = randomUUID();
 		const record = await this.state().claimPending(id, claimId);
-		if (!record) return {
-			ok: false,
-			message: `Pending write "${id}" is already being resolved by another writer.`
-		};
+		if (!record) {
+			if ((await this.state().listPending("executing")).find((item) => item.id === id)) return {
+				ok: false,
+				message: `Pending write "${id}" is executing (a previous approve may have run before a crash). Verify its effect manually, then reject it — /evolution pending shows it as EXECUTING.`
+			};
+			return {
+				ok: false,
+				message: `Pending write "${id}" is already being resolved by another writer.`
+			};
+		}
 		const runner = this.runners.get(record.kind);
 		if (!runner) {
 			if (record.kind === "capability") {
@@ -175,7 +218,7 @@ var EvolutionApproval = class extends Service {
 		};
 		return {
 			ok: true,
-			message: `Approved ${record.kind}`
+			message: `Approved ${record.kind} write "${id}" (${record.summary}).`
 		};
 	}
 };

package/lib/types/index.d.ts

@@ -31,6 +31,9 @@ export interface ApprovalRequest {
      * (no session / no approval service) keeps the previous behavior.
      */
     sessionPolicy?: 'ask' | 'never';
+    /** 0.3.17 (E-25): the requesting session id, kept on the record for
+     * audit attribution (staged AND resolved history). */
+    sessionId?: string;
 }
 export interface ApprovalDecision {
     action: 'allow' | 'staged';
@@ -68,8 +71,16 @@ export declare class EvolutionApproval extends Service {
      * design, so they are exempt from the staging pre-check.
      */
     hasRunner(kind: PendingKind): boolean;
-    /** Trusted plan-executor entry point: replay a write through the registered runner exactly once. */
-    run(kind: PendingKind, args: unknown): Promise<{
+    /**
+     * Trusted plan-executor entry point: replay a write through the registered
+     * runner exactly once. 0.3.17 (S3.2, E-23): this is the BACKGROUND-REVIEW
+     * replay channel only — the caller must declare the intent (the review
+     * pipeline is the sole production consumer); a bare call is refused so the
+     * staging boundary cannot be bypassed by accident from another surface.
+     */
+    run(kind: PendingKind, args: unknown, intent?: {
+        interface: 'background_review';
+    }): Promise<{
         ok: boolean;
         message: string;
     }>;
@@ -84,6 +95,13 @@ export declare class EvolutionApproval extends Service {
         ok: boolean;
         message: string;
     }>;
+    /**
+     * 0.3.17 (S3.1): platform-side session policy derivation — the platform's
+     * approval service (`overrideOf`) is the authority; a caller's self-reported
+     * sessionPolicy is a fallback only without it (E-22). The mount check is
+     * lazy: the platform service can start before or after this plugin.
+     */
+    private deriveSessionPolicy;
     private dedupe;
     private doApprove;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-approval",
   "description": "Stage/pending approval service for Hermes-style self-evolution writes (community build)",
-  "version": "0.3.16",
+  "version": "0.3.17",
   "publishConfig": {
     "access": "public"
   },
@@ -37,15 +37,15 @@
   "peerDependencies": {
     "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
     "@deepseek-ai/cordis": "^4.0.1",
-    "@lmzhen/dsh-evolution-state-storage": "^0.3.16",
-    "@lmzhen/dsh-evolution-state": "^0.3.16"
+    "@lmzhen/dsh-evolution-state-storage": "^0.3.17",
+    "@lmzhen/dsh-evolution-state": "^0.3.17"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
-    "@lmzhen/dsh-evolution-state-storage": "^0.3.16",
-    "@lmzhen/dsh-evolution-state": "^0.3.16",
-    "@lmzhen/dsh-evolution-io": "^0.3.16",
-    "@lmzhen/dsh-evolution-io-node": "^0.3.16",
-    "@lmzhen/dsh-evolution-state-json": "^0.3.16"
+    "@lmzhen/dsh-evolution-state-storage": "^0.3.17",
+    "@lmzhen/dsh-evolution-state": "^0.3.17",
+    "@lmzhen/dsh-evolution-io": "^0.3.17",
+    "@lmzhen/dsh-evolution-io-node": "^0.3.17",
+    "@lmzhen/dsh-evolution-state-json": "^0.3.17"
   }
 }