@lmzhen/dsh-evolution-review 0.1.0-rc.3 → 0.1.0-rc.31

package/README.md

@@ -21,4 +21,10 @@ Independent of request-prefix construction. This package does not alter the asse
 ## Known Limitations and Deferred Work
 
 
-- - Review subagents inherit the host preset; Anchored Standard deployments rely on the default `skill_search`/`skill_load` allow-list.
+- Review subagents inherit the host preset; Anchored Standard deployments rely on the default `skill_search`/`skill_load` allow-list.
+- Review subagents run as `spawn` children on the deployment default preset rather than inheriting the parent agent's composition (`fork`): a fork child is always promoted by the Anchored Standard bootstrap and its narrowed resident catalog would drop the plain `skill` tool from the review allow-list.
+- The review request text is redacted for credential-shaped patterns before it reaches the subagent, but redaction is pattern-based and best-effort, not a security boundary.
+
+## Configuration
+
+`reviewProvider` selects the LLM provider for review subagents. When omitted, the subagent inherits the deployment default route instead of a hardcoded provider name. Model selection stays on the policy (`memoryReviewModel` / `skillReviewModel`).

package/lib/index.js

@@ -1,8 +1,37 @@
 import { createHash, randomUUID } from "node:crypto";
 import z from "@deepseek-ai/schemastery";
-import { CallId, createUserMessage } from "@deepseek-ai/dsh-llm";
-import { PROMPT_BUNDLE, advanceReview, foldTurn, reviewPrompt, verifyPromptBundle } from "@lmzhen/dsh-evolution-core";
+import { createUserMessage } from "@deepseek-ai/dsh-llm";
+import { COMPLETION_SKILL_REVIEW_PROMPT, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_USER_CHAR_LIMIT, PROMPT_BUNDLE, SkillLibrary, advanceReview, evolutionIoAdapter, foldTurn, reviewPrompt, verifyPromptBundle } from "@lmzhen/dsh-evolution-core";
 import { validateEvolutionPlan } from "@lmzhen/dsh-evolution-plan-validator";
+//#region lib/types/redact.js
+/**
+* Review-input redaction. Review/curator subagents are the one place where a
+* cross-session conversation snapshot leaves the owning session's context, so
+* credential-shaped text is masked before it is sent. Redaction is best-effort
+* and conservative: it targets well-known secret shapes and inline
+* assignment patterns, never wholesale content.
+*/
+const SECRET_PATTERNS = [
+	["openai-style key", /sk-[A-Za-z0-9_-]{16,}/g],
+	["aws access key", /AKIA[0-9A-Z]{16}/g],
+	["github token", /gh[pousr]_[A-Za-z0-9]{20,}/g],
+	["gitlab token", /glpat-[A-Za-z0-9_-]{16,}/g],
+	["slack token", /xox[baprs]-[A-Za-z0-9-]{10,}/g],
+	["jwt", /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g],
+	["bearer credential", /Bearer [A-Za-z0-9._~+/=\-]{16,}/g],
+	["inline assignment", /(\b(?:token|api[_-]?key|secret|password|passwd)\b[\s]*[:=][\s]*[\"\x27]?)([A-Z0-9._~+/=\-]{12,})/gi]
+];
+/**
+* Mask credential-shaped text in a review request.
+* @param text - the assembled review request text.
+* @returns the text with matched secrets replaced by `<redacted>`.
+*/
+function redactReviewSecrets(text) {
+	let out = text;
+	for (const [, pattern] of SECRET_PATTERNS) out = out.replace(pattern, (_match, p1) => p1 === void 0 ? "<redacted>" : `${p1}<redacted>`);
+	return out;
+}
+//#endregion
 //#region lib/types/index.js
 /**
 * Background review orchestration: signal gate → one-shot subagent → trusted plan execution.
@@ -13,23 +42,24 @@ const inject = ["agents", "tools"];
 const Config = z.object({
 	reviewEnabled: z.boolean().default(true),
 	reviewMode: z.string().default("subagent"),
-	memoryInterval: z.number().default(10),
-	skillInterval: z.number().default(10),
-	reviewToolAllow: z.array(z.string()).default([
-		"skill",
-		"skill_search",
-		"skill_load"
-	]),
+	memoryInterval: z.number().default(DEFAULT_REVIEW_MEMORY_INTERVAL),
+	skillInterval: z.number().default(DEFAULT_REVIEW_SKILL_INTERVAL),
+	reviewToolAllow: z.array(z.string()).default(["skill"]),
 	reviewTimeoutMs: z.number().default(12e4),
 	executionTimeoutMs: z.number().default(3e4),
 	reviewContextMessages: z.number().default(60),
 	reviewMessageChars: z.number().default(2e3),
-	reviewMaxDepth: z.number().default(0)
+	reviewMaxDepth: z.number().default(0),
+	reviewProvider: z.string(),
+	skillReviewTrigger: z.string().default(DEFAULT_SKILL_REVIEW_TRIGGER),
+	skillReviewCompletionMinToolCalls: z.number().default(DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS)
 });
 function apply(ctx, rawConfig) {
 	if (!verifyPromptBundle(PROMPT_BUNDLE)) throw new Error("dsh-evolution prompt bundle integrity check failed; refusing to schedule review work");
 	const config = rawConfig;
 	const turnStarts = /* @__PURE__ */ new Map();
+	const cumulativeToolCalls = /* @__PURE__ */ new Map();
+	const completionInjected = /* @__PURE__ */ new Set();
 	const policy = () => ctx.get("evolutionPolicy")?.get();
 	ctx.on("session/event", (session, event) => {
 		if (event.type === "turn/start") turnStarts.set(session.id, session.seq - 1);
@@ -58,17 +88,50 @@ function apply(ctx, rawConfig) {
 			substantiveMinAgentChars: snapshot?.substantiveMinAgentChars ?? 500
 		});
 		await stateService?.saveReviewState(session.id, state);
-		if (!kind) return;
-		if (!await trySubagentReview(session, agent, kind, signal)) agent.inject(createUserMessage({
+		const cumulative = (cumulativeToolCalls.get(session.id) ?? 0) + signal.toolCalls;
+		cumulativeToolCalls.set(session.id, cumulative);
+		if (kind) {
+			session.append("evolution/review-scheduled", {
+				kind,
+				toolCalls: signal.toolCalls,
+				userChars: signal.userChars,
+				assistantChars: signal.assistantChars
+			});
+			if (!await trySubagentReview(session, agent, kind, signal)) agent.inject(createUserMessage({
+				content: [{
+					type: "text",
+					text: reviewPrompt(kind)
+				}],
+				source: {
+					kind: "plugin",
+					plugin: "dsh-evolution-review",
+					form: "notice",
+					summary: "auto-review"
+				}
+			}));
+			return;
+		}
+		const trigger = config.skillReviewTrigger;
+		if (trigger !== "completion" && trigger !== "both") return;
+		if (completionInjected.has(session.id)) return;
+		if (!shouldCompletionReview(event.data.reason, cumulative, config.skillReviewCompletionMinToolCalls)) return;
+		completionInjected.add(session.id);
+		session.append("evolution/review-scheduled", {
+			kind: "skill",
+			toolCalls: signal.toolCalls,
+			userChars: signal.userChars,
+			assistantChars: signal.assistantChars
+		});
+		agent.inject(createUserMessage({
 			content: [{
 				type: "text",
-				text: reviewPrompt(kind)
+				text: COMPLETION_SKILL_REVIEW_PROMPT
 			}],
 			source: {
 				kind: "plugin",
 				plugin: "dsh-evolution-review",
 				form: "notice",
-				summary: "auto-review"
+				summary: "completion review"
 			}
 		}));
 	}
@@ -79,7 +142,9 @@ function apply(ctx, rawConfig) {
 		try {
 			const routingPolicy = ctx.get("evolutionPolicy");
 			const model = kind === "memory" ? routingPolicy?.get().memoryReviewModel ?? "deepseek-v4-flash" : routingPolicy?.get().skillReviewModel ?? "deepseek-v4-pro";
-			const reviewText = buildReviewRequest(session, kind, signal, config.reviewContextMessages, config.reviewMessageChars);
+			const reviewText = redactReviewSecrets(buildReviewRequest(session, kind, signal, config.reviewContextMessages, config.reviewMessageChars));
+			const agentOptions = { model };
+			if (config.reviewProvider) agentOptions.provider = config.reviewProvider;
 			const run = await subagents.start("spawn", {
 				label: "dsh-evolution-review",
 				prompt: [{
@@ -89,10 +154,7 @@ function apply(ctx, rawConfig) {
 				parent: agent,
 				signal: AbortSignal.timeout(config.reviewTimeoutMs),
 				maxDepth: config.reviewMaxDepth,
-				agentOptions: {
-					provider: "deepseek-official",
-					model
-				},
+				agentOptions,
 				persona: reviewPrompt(kind),
 				toolFilter: { allow: [...config.reviewToolAllow] },
 				outputSchema: {
@@ -119,20 +181,23 @@ function apply(ctx, rawConfig) {
 			const policyFingerprint = fingerprintPolicy(snapshot);
 			const validation = validateEvolutionPlan(plan, {
 				sessionSeq: session.seq - 1,
-				maxOpsPerPlan: snapshot?.maxOpsPerPlan ?? 32,
+				maxOpsPerPlan: snapshot?.maxOpsPerPlan ?? DEFAULT_MAX_OPS_PER_PLAN,
 				protectedSkillNames: new Set(snapshot?.protectedSkillNames ?? []),
-				maxMemoryChars: snapshot?.memoryChars ?? 2200,
-				maxUserChars: snapshot?.userChars ?? 1375,
-				maxSkillContentChars: snapshot?.skillContentChars ?? 1e5
+				maxMemoryChars: snapshot?.memoryChars ?? DEFAULT_MEMORY_CHAR_LIMIT,
+				maxUserChars: snapshot?.userChars ?? DEFAULT_USER_CHAR_LIMIT,
+				maxSkillContentChars: snapshot?.skillContentChars ?? DEFAULT_SKILL_CONTENT_CHARS
 			});
-			const actions = await executePlan(validation.accepted, agent);
-			const evidenceQuotes = [...validation.accepted.memoryOps ?? [], ...validation.accepted.skillOps ?? []].reduce((total, op) => total + (Array.isArray(op.evidence) ? op.evidence.length : 0), 0);
+			const acceptedSkillOps = validation.accepted.skillOps ?? [];
+			const skippedUnread = filterUnreadSkillOps(acceptedSkillOps, collectReadSkillNames(session));
+			validation.accepted.skillOps = acceptedSkillOps;
+			const actions = await executePlan(validation.accepted);
+			const evidenceQuotes = [...validation.accepted.memoryOps ?? [], ...acceptedSkillOps].reduce((total, op) => total + (Array.isArray(op.evidence) ? op.evidence.length : 0), 0);
 			session.append("evolution/plan-applied", {
 				planId: randomUUID(),
 				policyFingerprint,
 				memoryApplied: actions.filter((action) => action.startsWith("Memory")).length,
 				skillApplied: actions.filter((action) => action.startsWith("Skill ")).length,
-				rejectedOps: validation.rejected.length,
+				rejectedOps: validation.rejected.length + skippedUnread,
 				evidenceQuotes,
 				estimatedInputChars: reviewText.length
 			});
@@ -149,11 +214,12 @@ function apply(ctx, rawConfig) {
 				}
 			}));
 			return true;
-		} catch {
+		} catch (error) {
+			ctx.logger.warn(`dsh-evolution-review: subagent review failed: ${error instanceof Error ? error.message : String(error)}`);
 			return false;
 		}
 	}
-	async function executePlan(plan, parent) {
+	async function executePlan(plan) {
 		const memory = ctx.get("memory");
 		const approval = ctx.get("evolutionApproval");
 		const actions = [];
@@ -173,10 +239,11 @@ function apply(ctx, rawConfig) {
 				...op,
 				evidence: op.evidence
 			};
-			if ((approval ? await runApproved("skill", `skill ${op.action ?? "patch"} ${op.name}`, {
+			const runnerArgs = {
 				operation: args,
 				origin: "background_review"
-			}, args) : await executeSkillTool(parent, args))?.ok) actions.push(`Skill ${op.name} ${op.action ?? "patch"}`);
+			};
+			if ((approval ? await runApproved("skill", `skill ${op.action ?? "patch"} ${op.name}`, runnerArgs, runnerArgs) : await executeSkillDirect(args))?.ok) actions.push(`Skill ${op.name} ${op.action ?? "patch"}`);
 		}
 		return actions;
 		async function runApproved(kind, summary, stored, runnerArgs) {
@@ -193,26 +260,92 @@ function apply(ctx, rawConfig) {
 			};
 			return await approval.run(kind, runnerArgs);
 		}
-		async function executeSkillTool(agent, args) {
-			return (await ctx.tools.execute({
-				callId: CallId(`evolution-${randomUUID()}`),
-				name: "skill_manage",
-				arguments: args,
-				agent,
-				signal: AbortSignal.timeout(config.executionTimeoutMs)
-			})).isError ? {
+		/**
+		* Approval-disabled path: execute the skill op through SkillLibrary with an
+		* EXPLICIT background_review origin. Going through ctx.tools.execute would
+		* make tool-skill-manage infer origin from the parent agent's header
+		* (not 'subagent'), silently escaping the .hermes-managed marker and the
+		* pinned write guard.
+		*/
+		async function executeSkillDirect(skillArgs) {
+			const io = ctx.get("evolutionIo");
+			if (!io) return {
 				ok: false,
-				message: "skill_manage execution failed"
-			} : {
-				ok: true,
-				message: "skill_manage executed"
+				message: "evolution-io service not mounted"
+			};
+			const library = new SkillLibrary(void 0, evolutionIoAdapter(() => io.provider()));
+			const op = skillArgs;
+			const name = op.name ?? "";
+			const origin = "background_review";
+			if (op.action === "create") return await library.create(name, op.content ?? "", origin);
+			if (op.action === "edit" || op.action === "update") return await library.update(name, op.content ?? "", origin);
+			if (op.action === "patch") return await library.patch(name, op.old_string ?? "", op.new_string ?? "", op.file_path ?? "", false, origin);
+			if (op.action === "delete") return await library.archive(name, op.absorbed_into ? { absorbedInto: op.absorbed_into } : {});
+			if (op.action === "write_file") return await library.writeSupportFile(name, op.file_path ?? "", op.file_content ?? op.content ?? "", origin);
+			if (op.action === "remove_file") return await library.removeSupportFile(name, op.file_path ?? "", origin);
+			return {
+				ok: false,
+				message: `Unknown skill action "${op.action ?? ""}"`
 			};
 		}
 	}
 	ctx.effect(() => () => {
 		turnStarts.clear();
+		cumulativeToolCalls.clear();
+		completionInjected.clear();
 	}, "dsh-evolution-review.cleanup");
 }
+/** Completion-channel decision: task finished normally AND the session is proven long. */
+function shouldCompletionReview(reason, sessionToolCalls, minToolCalls) {
+	return reason?.kind === "completed" && sessionToolCalls >= minToolCalls;
+}
+/** Skill names this session loaded (read-before-write source for the background review). */
+function collectReadSkillNames(session) {
+	const names = /* @__PURE__ */ new Set();
+	for (const event of session.events) {
+		if (event.type !== "tool/call") continue;
+		if (event.data.name !== "skill" && event.data.name !== "skill_load") continue;
+		const raw = event.data.arguments;
+		let parsed = {};
+		if (typeof raw === "string") try {
+			parsed = JSON.parse(raw);
+		} catch {
+			continue;
+		}
+		else parsed = raw ?? {};
+		const name = typeof parsed.name === "string" ? parsed.name : typeof parsed.skill === "string" ? parsed.skill : "";
+		if (name) names.add(name);
+	}
+	return names;
+}
+/**
+* Drop mutating ops whose target was not read this session, in place.
+* Create is exempt (no read required to author a new skill). Covers the same
+* mutating surface Hermes guards (edit/patch/write_file/remove_file), so a
+* background review cannot blind-touch support files or edits of skills it
+* never loaded. Returns the count of dropped ops so the plan event can report
+* them as rejected.
+*/
+function filterUnreadSkillOps(ops, readNames) {
+	const READ_REQUIRED = [
+		"edit",
+		"update",
+		"patch",
+		"delete",
+		"write_file",
+		"remove_file"
+	];
+	let dropped = 0;
+	for (let index = ops.length - 1; index >= 0; index -= 1) {
+		const op = ops[index];
+		if (!op) continue;
+		if (op.action !== void 0 && READ_REQUIRED.includes(op.action) && op.name && !readNames.has(op.name)) {
+			ops.splice(index, 1);
+			dropped += 1;
+		}
+	}
+	return dropped;
+}
 function fingerprintPolicy(snapshot) {
 	try {
 		return createHash("sha256").update(JSON.stringify(snapshot)).digest("hex").slice(0, 12);
@@ -236,4 +369,4 @@ function buildReviewRequest(session, kind, signal, maxMessages, maxMessageChars)
 	].join("\n");
 }
 //#endregion
-export { Config, apply, inject, name };
+export { Config, apply, collectReadSkillNames, filterUnreadSkillOps, inject, name, shouldCompletionReview };

package/lib/types/index.d.ts

@@ -4,6 +4,7 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
+import type { Session } from '@deepseek-ai/dsh-session';
 export declare const name = "evolution-review";
 export declare const inject: string[];
 export interface Config {
@@ -11,14 +12,42 @@ export interface Config {
     reviewMode?: string;
     memoryInterval?: number;
     skillInterval?: number;
-    /** Tools the one-shot review subagent may use. Defaults include the Anchored Standard discovery pair. */
+    /**
+     * Tools the one-shot review subagent may use. Only actually-existing tools
+     * may be listed (the DSH tool catalog has `skill`; the `skill_search` /
+     * `skill_load` discovery pair does not exist on this platform).
+     */
     reviewToolAllow?: string[];
     reviewTimeoutMs?: number;
     executionTimeoutMs?: number;
     reviewContextMessages?: number;
     reviewMessageChars?: number;
     reviewMaxDepth?: number;
+    /** LLM provider for review subagents. Omit to inherit the deployment default route. */
+    reviewProvider?: string;
+    /** Skill-review trigger: cadence (interval) | completion (once after a proven-long task) | both. */
+    skillReviewTrigger?: string;
+    /** Cumulative session tool calls before a session counts as proven-long for the completion channel. */
+    skillReviewCompletionMinToolCalls?: number;
 }
 export declare const Config: z<Config>;
 export declare function apply(ctx: Context, rawConfig: Config): void;
+/** Completion-channel decision: task finished normally AND the session is proven long. */
+export declare function shouldCompletionReview(reason: {
+    kind?: string;
+} | undefined, sessionToolCalls: number, minToolCalls: number): boolean;
+/** Skill names this session loaded (read-before-write source for the background review). */
+export declare function collectReadSkillNames(session: Session): Set<string>;
+/**
+ * Drop mutating ops whose target was not read this session, in place.
+ * Create is exempt (no read required to author a new skill). Covers the same
+ * mutating surface Hermes guards (edit/patch/write_file/remove_file), so a
+ * background review cannot blind-touch support files or edits of skills it
+ * never loaded. Returns the count of dropped ops so the plan event can report
+ * them as rejected.
+ */
+export declare function filterUnreadSkillOps(ops: Array<{
+    action?: string;
+    name?: string;
+}>, readNames: ReadonlySet<string>): number;
 //# sourceMappingURL=index.d.ts.map

package/lib/types/redact.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Review-input redaction. Review/curator subagents are the one place where a
+ * cross-session conversation snapshot leaves the owning session's context, so
+ * credential-shaped text is masked before it is sent. Redaction is best-effort
+ * and conservative: it targets well-known secret shapes and inline
+ * assignment patterns, never wholesale content.
+ */
+/**
+ * Mask credential-shaped text in a review request.
+ * @param text - the assembled review request text.
+ * @returns the text with matched secrets replaced by `<redacted>`.
+ */
+export declare function redactReviewSecrets(text: string): string;
+//# sourceMappingURL=redact.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-review",
   "description": "Background review orchestration (community build)",
-  "version": "0.1.0-rc.3",
+  "version": "0.1.0-rc.31",
   "publishConfig": {
     "access": "public"
   },
@@ -33,8 +33,8 @@
   "license": "MIT",
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@lmzhen/dsh-evolution-core": "^0.1.0-rc.3",
-    "@lmzhen/dsh-evolution-plan-validator": "^0.1.0-rc.3"
+    "@lmzhen/dsh-evolution-core": "^0.1.0-rc.31",
+    "@lmzhen/dsh-evolution-plan-validator": "^0.1.0-rc.31"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
@@ -43,7 +43,7 @@
     "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-session": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-tools": "^0.1.0-rc.6",
-    "@lmzhen/dsh-evolution-state": "^0.1.0-rc.3"
+    "@lmzhen/dsh-evolution-state": "^0.1.0-rc.31"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-agent": "^0.1.0-rc.6",
@@ -52,8 +52,8 @@
     "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-session": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-tools": "^0.1.0-rc.6",
-    "@lmzhen/dsh-evolution-core": "^0.1.0-rc.3",
-    "@lmzhen/dsh-evolution-plan-validator": "^0.1.0-rc.3",
-    "@lmzhen/dsh-evolution-state": "^0.1.0-rc.3"
+    "@lmzhen/dsh-evolution-core": "^0.1.0-rc.31",
+    "@lmzhen/dsh-evolution-plan-validator": "^0.1.0-rc.31",
+    "@lmzhen/dsh-evolution-state": "^0.1.0-rc.31"
   }
 }