@lmzhen/dsh-evolution-approval 0.3.36 → 0.3.38

package/lib/index.js

@@ -155,16 +155,20 @@ var EvolutionApproval = class extends Service {
 	}
 	/**
 	* 0.3.17 (S3.1): platform-side session policy derivation — the platform's
-	* approval service (`overrideOf`) is the authority; a caller's self-reported
-	* sessionPolicy is a fallback only without it (E-22). The mount check is
-	* lazy: the platform service can start before or after this plugin.
+	* approval service (`overrideOf`) is the authority; a deployment-level
+	* `config.policy` is the fallback (V6-27, 0.3.37: the deploy default used to
+	* be ignored here, so a `policy: 'never'` deployment still staged writes for
+	* sessions without an override — same chain as the exported
+	* `effectiveSessionPolicy`, overrideOf ?? config.policy ?? 'ask'). The mount
+	* check is lazy: the platform service can start before or after this plugin.
 	*/
 	deriveSessionPolicy(sessionId) {
 		if (!sessionId) return void 0;
 		const platformApproval = this.ctx.get("approval");
 		if (!platformApproval) return void 0;
-		const override = platformApproval.overrideOf?.(sessionId);
-		return override === "never" || override === "ask" ? override : void 0;
+		const override = platformApproval.overrideOf(sessionId);
+		if (override === "never" || override === "ask") return override;
+		return platformApproval.config?.policy ?? "ask";
 	}
 	dedupe(id, task) {
 		const existing = this.inFlight.get(id);

package/lib/types/index.d.ts

@@ -140,9 +140,12 @@ export declare class EvolutionApproval extends Service {
     }>;
     /**
      * 0.3.17 (S3.1): platform-side session policy derivation — the platform's
-     * approval service (`overrideOf`) is the authority; a caller's self-reported
-     * sessionPolicy is a fallback only without it (E-22). The mount check is
-     * lazy: the platform service can start before or after this plugin.
+     * approval service (`overrideOf`) is the authority; a deployment-level
+     * `config.policy` is the fallback (V6-27, 0.3.37: the deploy default used to
+     * be ignored here, so a `policy: 'never'` deployment still staged writes for
+     * sessions without an override — same chain as the exported
+     * `effectiveSessionPolicy`, overrideOf ?? config.policy ?? 'ask'). The mount
+     * check is lazy: the platform service can start before or after this plugin.
      */
     private deriveSessionPolicy;
     private dedupe;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-approval",
   "description": "Stage/pending approval service for Hermes-style self-evolution writes (community build)",
-  "version": "0.3.36",
+  "version": "0.3.38",
   "publishConfig": {
     "access": "public"
   },
@@ -35,15 +35,15 @@
   "peerDependencies": {
     "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
     "@deepseek-ai/cordis": "^4.0.1",
-    "@lmzhen/dsh-evolution-state-storage": "^0.3.36",
-    "@lmzhen/dsh-evolution-state": "^0.3.36"
+    "@lmzhen/dsh-evolution-state-storage": "^0.3.38",
+    "@lmzhen/dsh-evolution-state": "^0.3.38"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
-    "@lmzhen/dsh-evolution-state-storage": "^0.3.36",
-    "@lmzhen/dsh-evolution-state": "^0.3.36",
-    "@lmzhen/dsh-evolution-io": "^0.3.36",
-    "@lmzhen/dsh-evolution-io-node": "^0.3.36",
-    "@lmzhen/dsh-evolution-state-json": "^0.3.36"
+    "@lmzhen/dsh-evolution-state-storage": "^0.3.38",
+    "@lmzhen/dsh-evolution-state": "^0.3.38",
+    "@lmzhen/dsh-evolution-io": "^0.3.38",
+    "@lmzhen/dsh-evolution-io-node": "^0.3.38",
+    "@lmzhen/dsh-evolution-state-json": "^0.3.38"
   }
 }