@lytharalab/dsh-cons-auto-review 1.1.0

package/src/index.js

@@ -0,0 +1,396 @@
+/** DCAR 1.1.0: CAutoR permission preset and deterministic-first tool gate. */
+import z from "@deepseek-ai/schemastery";
+import { DEFAULTS, resolveConfig, patchConfig } from "./config.js";
+import { ReviewEngine } from "./engine.js";
+import { attachPermissionAdapter } from "./permission-adapter.js";
+import { attachDefaultPersistence } from "./preset-defaults.js";
+import { setApprovalPolicy } from "@deepseek-ai/dsh-user-approval";
+const handoffKey = Symbol.for("dcar.permission-handoff");
+export const name = "@lytharalab/dsh-cons-auto-review";
+export const inject = [
+  "approval",
+  "llm",
+  "permissionPresets",
+  "sessions",
+  "tools",
+  "fs",
+  "sessionProjections",
+];
+export const PRESET = "CAutoR";
+function schema(value) {
+  if (Array.isArray(value)) return z.array(z.string()).default(value);
+  if (value && typeof value === "object")
+    return z
+      .object(
+        Object.fromEntries(
+          Object.entries(value).map(([k, v]) => [k, schema(v)]),
+        ),
+      )
+      .default(value);
+  return (
+    typeof value === "boolean"
+      ? z.boolean()
+      : typeof value === "number"
+        ? z.number()
+        : z.string()
+  ).default(value);
+}
+const fields = Object.fromEntries(
+  Object.entries(DEFAULTS).map(([k, v]) => [k, schema(v)]),
+);
+fields.rules = z
+  .object({
+    ...Object.fromEntries(
+      Object.entries(DEFAULTS.rules)
+        .filter(([k]) => k !== "customTools")
+        .map(([k, v]) => [k, schema(v)]),
+    ),
+    customTools: z
+      .array(
+        z.object({
+          name: z.string().required(),
+          effect: z.union(["read", "write"]).required(),
+          pathFields: z.array(z.string()).required(),
+        }),
+      )
+      .default([]),
+  })
+  .default(DEFAULTS.rules);
+fields.shell = z
+  .object({
+    ...Object.fromEntries(
+      Object.entries(DEFAULTS.shell)
+        .filter(([k]) => k !== "trustedCommands")
+        .map(([k, v]) => [k, schema(v)]),
+    ),
+    trustedCommands: z
+      .array(
+        z.object({
+          executable: z.string().required(),
+          args: z.array(z.string()).required(),
+        }),
+      )
+      .default([]),
+  })
+  .default(DEFAULTS.shell);
+/** DSH plugin settings schema; full semantic validation runs at activation. */
+export const Config = z.object(fields);
+export { resolveConfig, DEFAULTS } from "./config.js";
+export { ReviewEngine } from "./engine.js";
+/** Install the gate before exposing any command that selects CAutoR. */
+export function apply(ctx, input = {}) {
+  const config = resolveConfig(input),
+    presets = ctx.permissionPresets;
+  if (
+    typeof ctx.tools.get !== "function" ||
+    typeof presets.catalog !== "function" ||
+    typeof ctx.fs.resolve !== "function" ||
+    typeof ctx.llm.stream !== "function"
+  )
+    throw new Error(
+      "DCAR requires the DSH tools, filesystem, permission catalog and LLM extension APIs; see docs/COMPATIBILITY.md",
+    );
+  const fallback = presets.resolve(config.lifecycle.fallbackPreset);
+  if (fallback.sandbox === "danger-full-access")
+    throw new Error("DCAR disposal fallback must be a confined preset");
+  const engine = new ReviewEngine(ctx, config),
+    overrides = new WeakMap(),
+    inherited = new WeakSet(),
+    active = new Set();
+  let handoff = Object.getOwnPropertyDescriptor(ctx.fiber, handoffKey)?.value;
+  if (!handoff) {
+    handoff = new WeakMap();
+    Object.defineProperty(ctx.fiber, handoffKey, { value: handoff });
+  }
+  let accepting = true;
+  let stopGate, stopDefaultPersistence, stopSessionCreated, stopAgentCreated;
+  const admit = () => {
+    if (!accepting || !config.enabled) throw new Error("DCAR is disabled or closing");
+  };
+  const getConfig = (session) => overrides.get(session) ?? config;
+  function selected(session) {
+    if (presets.current(session) === PRESET) return true;
+    const state = ctx.sessionProjections.stateOf(session, "permissions");
+    // In-process subagents pin approval=never; configured custom presets otherwise derive as custom.
+    return state?.preset === PRESET && state.sandbox === "danger-full-access";
+  }
+  function markInherited(session) {
+    if (!config.inheritSubagents || !session.header.parentSession) return;
+    const parent = ctx.sessions.get(session.header.parentSession);
+    if (!parent) return;
+    const childState = ctx.sessionProjections.stateOf(session, "permissions");
+    const capturedReview =
+      childState?.sandbox === "danger-full-access" &&
+      childState.approval === "never" &&
+      childState.preset !== "danger-full-access" &&
+      childState.preset !== "auto" &&
+      parent
+        .snapshotEvents()
+        .some(
+          (event) =>
+            event.type === "permission/preset" && event.data.preset === PRESET,
+        );
+    // DSH captures its delegation knobs before awaiting child creation. Keep review
+    // if the parent switched away while a captured custom review child was pending.
+    if (selected(parent) || inherited.has(parent) || capturedReview)
+      inherited.add(session);
+  }
+  ctx.effect(function* () {
+    yield attachPermissionAdapter(presets);
+    for (const session of ctx.sessions.list()) markInherited(session);
+    yield stopSessionCreated = ctx.on(
+      "session/created",
+      (session) => {
+        if (!accepting) return;
+        markInherited(session);
+        const state = ctx.sessionProjections.stateOf(session, "permissions");
+        if (!session.header.parentSession && state?.preset === null &&
+            state.sandbox === null && state.approval === null && !state.seeded &&
+            presets.defaultPreset === PRESET)
+          presets.set(session, accepting && config.enabled ? PRESET : config.lifecycle.fallbackPreset);
+      },
+      { prepend: true },
+    );
+    yield stopAgentCreated = ctx.on("agent/created", ({ agent }) => {
+      if (!accepting) return;
+      if (inherited.has(agent.session))
+        agent.session.append("permission/preset", { preset: PRESET });
+    });
+    yield stopGate = ctx.on(
+      "tools/pre-execute",
+      async (exec, next) => {
+        if (
+          !exec.agent ||
+          (exec.parent === undefined && exec.name === "run_code")
+        )
+          return next();
+        if (!selected(exec.agent.session) && !inherited.has(exec.agent.session))
+          return next();
+        if (!accepting) return { kind: "cancel" };
+        let done;
+        const completed = new Promise((resolve) => {
+          done = resolve;
+        });
+        active.add(completed);
+        try {
+          const c = getConfig(exec.agent.session);
+          const decision = c.enabled
+            ? await engine.review(exec, c)
+            : engine.nonAllow(
+                exec,
+                "ask",
+                "DCAR is disabled; select another permission mode",
+                "DCAR_REVIEW_FAILED",
+              );
+          if (!accepting || exec.signal.aborted) return { kind: "cancel" };
+          // A DCAR allow delegates: other policy listeners and DSH tool guards retain their decisions.
+          if (decision.kind !== "allow") return decision;
+          return await next();
+        } finally {
+          active.delete(completed);
+          done();
+        }
+      },
+      { prepend: true },
+    );
+    yield presets.registerReviewPreset(
+      PRESET,
+      {
+        sandbox: "danger-full-access",
+        approval: "ask",
+        name: PRESET,
+        description: "Con's 自动审查：程序直接放行安全操作，其余交给 LLM。",
+      },
+      admit,
+    );
+    // Dependency reloads reuse this plugin fiber. Restore only the exact session
+    // cursor we confined on unload; a later user permission change invalidates it.
+    for (const session of ctx.sessions.list()) {
+      const pending = handoff.get(session);
+      handoff.delete(session);
+      if (!config.enabled || !pending || pending.seq !== session.seq) continue;
+      presets.apply(session, PRESET, (policy) => setApprovalPolicy(session, pending.approval === "never" ? "never" : policy));
+      if (pending.inherited) inherited.add(session);
+    }
+    // A session created while the persisted default's provider was absent starts
+    // confined. Restore an untouched fresh root only after the review gate is live.
+    if (config.enabled)
+      for (const session of ctx.sessions.list()) {
+        const state = ctx.sessionProjections.stateOf(session, "permissions");
+        if (session.header.parentSession || state?.preset !== PRESET ||
+            state.sandbox !== "read-only" || state.approval !== "never") continue;
+        const events = session.snapshotEvents();
+        if (events.some((event) => ["turn/start", "user/message", "assistant/message"].includes(event.type)) ||
+            events.filter((event) => event.type === "sandbox/mode").length !== 1 ||
+            events.filter((event) => event.type === "approval/policy").length !== 1) continue;
+        presets.set(session, PRESET);
+      }
+    ctx.inject(["configEditor"], (child) => {
+      child.effect(() => {
+        const dispose = attachDefaultPersistence(child.configEditor, presets, admit);
+        stopDefaultPersistence = dispose;
+        return dispose;
+      });
+    });
+    if (config.commands.enabled)
+      ctx.inject(["commands"], (child) => {
+        child.effect(() =>
+          child.commands.register({
+            name: config.commands.name,
+            description: "Con's 自动审查：切换 CAutoR、查看统计、历史和配置",
+            input: {
+              hint: "on | off | status | stats | history [N] | config [JSON] | reset | clear-cache | check <tool> <JSON>",
+            },
+            handler: async ({ agent, rawInput, signal }) => {
+              const text = rawInput.trim(),
+                space = text.indexOf(" "),
+                cmd = space < 0 ? text : text.slice(0, space),
+                rest = space < 0 ? "" : text.slice(space + 1).trim(),
+                session = agent.session;
+              try {
+                if (cmd === "on") {
+                  if (!getConfig(session).enabled)
+                    throw new Error("DCAR is disabled in configuration");
+                  presets.set(session, PRESET);
+                  return { kind: "success", text: "CAutoR 已启用。" };
+                }
+                if (cmd === "off") {
+                  presets.set(session, config.lifecycle.fallbackPreset);
+                  inherited.delete(session);
+                  return {
+                    kind: "success",
+                    text: `已切换至 ${config.lifecycle.fallbackPreset}。`,
+                  };
+                }
+                if (cmd === "config") {
+                  if (rest) {
+                    if (!config.commands.allowSessionConfig)
+                      throw new Error("Session configuration is disabled");
+                    const patch = JSON.parse(rest);
+                    if (
+                      Object.keys(patch).some(
+                        (k) =>
+                          ![
+                            "enabled",
+                            "rules",
+                            "shell",
+                            "review",
+                            "cache",
+                            "audit",
+                          ].includes(k),
+                      )
+                    )
+                      throw new Error(
+                        "Change lifecycle, commands and inheritSubagents in the profile configuration and restart DSH",
+                      );
+                    overrides.set(
+                      session,
+                      patchConfig(getConfig(session), patch),
+                    );
+                    engine.clearCache();
+                  }
+                  return {
+                    kind: "success",
+                    text: JSON.stringify(getConfig(session), null, 2),
+                  };
+                }
+                if (cmd === "stats")
+                  return {
+                    kind: "success",
+                    text: JSON.stringify(
+                      engine.audit.stats(session.id),
+                      null,
+                      2,
+                    ),
+                  };
+                if (cmd === "history") {
+                  const n = rest ? Number(rest) : 20;
+                  if (
+                    !Number.isSafeInteger(n) ||
+                    n < 1 ||
+                    n > getConfig(session).audit.historyLimit
+                  )
+                    throw new Error(
+                      `N must be 1..${getConfig(session).audit.historyLimit}`,
+                    );
+                  return {
+                    kind: "success",
+                    text: JSON.stringify(
+                      engine.audit.history(session.id, n),
+                      null,
+                      2,
+                    ),
+                  };
+                }
+                if (cmd === "reset") {
+                  engine.audit.reset(session.id);
+                  overrides.delete(session);
+                  engine.clearCache();
+                  return {
+                    kind: "success",
+                    text: "会话配置、统计和审查缓存已重置。",
+                  };
+                }
+                if (cmd === "clear-cache") {
+                  engine.clearCache();
+                  return { kind: "success", text: "审查缓存已清空。" };
+                }
+                if (cmd === "check") {
+                  const i = rest.indexOf(" ");
+                  if (i < 1)
+                    throw new Error("Usage: /dcar check <tool> <JSON>");
+                  const { deterministic } = await import("./deterministic.js");
+                  const result = await deterministic(
+                    {
+                      name: rest.slice(0, i),
+                      arguments: JSON.parse(rest.slice(i + 1)),
+                      agent,
+                      signal,
+                    },
+                    ctx,
+                    getConfig(session),
+                    signal,
+                  );
+                  return {
+                    kind: "success",
+                    text: JSON.stringify(result, null, 2),
+                  };
+                }
+                if (cmd === "" || cmd === "status")
+                  return {
+                    kind: "success",
+                    text: `DCAR 1.1.0 | 当前权限：${presets.current(session)} | CAutoR 审查：${selected(session) || inherited.has(session) ? "启用" : "未启用"}\n/dcar on · off · stats · history · config · reset · clear-cache · check`,
+                  };
+                return {
+                  kind: "error",
+                  text: `未知子命令 ${cmd}；使用 /${config.commands.name} 查看帮助。`,
+                };
+              } catch (error) {
+                return { kind: "error", text: String(error.message ?? error) };
+              }
+            },
+          }),
+        );
+      });
+    yield async () => {
+      accepting = false;
+      engine.lifecycle.abort(new Error("DCAR plugin disposed"));
+      try {
+        for (const session of ctx.sessions.list())
+          if (selected(session) || inherited.has(session)) {
+            const state = ctx.sessionProjections.stateOf(session, "permissions");
+            const wasInherited = inherited.has(session);
+            presets.set(session, config.lifecycle.fallbackPreset);
+            handoff.set(session, { seq: session.seq, approval: state?.approval, inherited: wasInherited });
+          }
+      } finally {
+        stopGate?.();
+        stopSessionCreated?.();
+        stopAgentCreated?.();
+        stopDefaultPersistence?.();
+        await Promise.allSettled([...active]);
+        await engine.stop();
+      }
+    };
+  }, "DCAR authorization lifecycle");
+}

package/src/paths.js

@@ -0,0 +1,94 @@
+/** DSH filesystem resolution + the upstream canonical containment check. */
+import { basename, isAbsolute, resolve } from "node:path";
+import { writableRoots } from "@deepseek-ai/dsh-sandbox";
+import { isPathUnder } from "./containment.js";
+export const allow = (code, reason) => ({ kind: "allow", code, reason });
+export const escalate = (code, reason) => ({ kind: "escalate", code, reason });
+const regexCache = new Map();
+/** Match a slash-normalized full path against an administrator-configured glob. */
+export function matchesGlob(path, pattern) {
+  let r = regexCache.get(pattern);
+  if (!r) {
+    let s = "";
+    for (let i = 0; i < pattern.length; i++) {
+      const ch = pattern[i];
+      if (ch === "*" && pattern[i + 1] === "*") {
+        i++;
+        if (pattern[i + 1] === "/") {
+          i++;
+          s += "(?:.*/)?";
+        } else s += ".*";
+      } else if (ch === "*") s += "[^/]*";
+      else if (ch === "?") s += "[^/]";
+      else s += ch.replace(/[\\^$+?.()|{}[\]]/g, "\\$&");
+    }
+    r = new RegExp(`^${s}$`, process.platform === "win32" ? "i" : "");
+    if (regexCache.size > 500) regexCache.clear();
+    regexCache.set(pattern, r);
+  }
+  return r.test(path.replaceAll("\\", "/"));
+}
+export function protectedPath(path, config) {
+  const sample = config.rules.safeEnvironmentFiles.includes(basename(path));
+  const normalized = path.replaceAll("\\", "/");
+  return config.rules.protectedPaths.some(
+    (p) =>
+      !(sample && p.startsWith("**/.env")) &&
+      (matchesGlob(normalized, p) || matchesGlob(`${normalized}/`, p)),
+  );
+}
+/** Check every path, including aliases and missing targets, without changing sandbox policy. */
+export async function checkPaths(paths, effect, cwd, ctx, config, signal) {
+  if (!paths.length)
+    return escalate("INVALID_PATH", "No target paths supplied");
+  if (!isAbsolute(cwd))
+    return escalate("WORKSPACE_UNAVAILABLE", "No absolute session workspace");
+  const roots = config.rules.includeTempRoots
+    ? writableRoots({ mode: "workspace-write", workspaceRoot: cwd })
+    : [cwd];
+  roots.push(
+    ...config.rules.additionalWritableRoots.map((p) =>
+      isAbsolute(p) ? p : resolve(cwd, p),
+    ),
+  );
+  for (const path of paths) {
+    if (typeof path !== "string" || !path.trim())
+      return escalate("INVALID_PATH", "Path arguments are missing or invalid");
+    // Windows alternate data streams, devices, and ambiguous namespace spellings require review.
+    if (
+      process.platform === "win32" &&
+      (/^\\\\[?.]\\/.test(path) ||
+        /(^|[\\/])(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)/i.test(path) ||
+        /:/.test(path.replace(/^[a-z]:/i, "")))
+    )
+      return escalate(
+        "WINDOWS_SPECIAL_PATH",
+        "Device paths or alternate data streams require review",
+      );
+    const target = await ctx.fs.resolve(path, { cwd, signal });
+    const key = String(target.targetKey);
+    if (protectedPath(key, config) || protectedPath(target.displayPath, config))
+      return escalate(
+        "PROTECTED_PATH",
+        `Protected path: ${target.displayPath}`,
+      );
+    if (effect === "read" && config.rules.allowOutsideReads) continue;
+    let contained = false;
+    for (const root of roots) {
+      const canonical = await ctx.fs.resolve(root, { cwd, signal });
+      if (await isPathUnder(key, String(canonical.targetKey))) {
+        contained = true;
+        break;
+      }
+    }
+    if (!contained)
+      return escalate(
+        "OUTSIDE_WORKSPACE",
+        `Path is outside permitted ${effect} roots: ${target.displayPath}`,
+      );
+  }
+  return allow(
+    effect === "write" ? "WORKSPACE_WRITE" : "SAFE_READ",
+    `All ${effect} paths passed DSH workspace rules`,
+  );
+}

package/src/permission-adapter.js

@@ -0,0 +1,75 @@
+/** Extend the live host service; no profile row replacement or second service. */
+import { registerReviewPreset } from "./preset-defaults.js";
+function descriptorOf(service, name) {
+  for (let object = service; object; object = Object.getPrototypeOf(object)) {
+    const descriptor = Object.getOwnPropertyDescriptor(object, name);
+    if (descriptor) return descriptor;
+  }
+}
+
+/**
+ * Patch only this service instance for the DCAR effect lifetime. Methods use
+ * their calling `this`, so Cordis caller-context proxies and the original
+ * service's projection/command closures all see the same registration.
+ */
+export function attachPermissionAdapter(service) {
+  // Compatibility with the 1.0.0 adapter that some existing profiles retain.
+  if (typeof service.registerReviewPreset === "function") return () => {};
+  const keys = ["names", "specOf", "derive", "apply", "registerReviewPreset"];
+  const own = new Map(keys.map((key) => [key, Object.getOwnPropertyDescriptor(service, key)]));
+  const names = descriptorOf(service, "names")?.get;
+  const original = Object.fromEntries(
+    ["specOf", "derive", "apply"].map((key) => [key, descriptorOf(service, key)?.value]),
+  );
+  if (typeof names !== "function" ||
+      Object.values(original).some((method) => typeof method !== "function") ||
+      typeof service.emitCatalogChanged !== "function")
+    throw new Error("DCAR requires the DSH 0.1.7-rc.2 / 0.2.0-rc.2 permission service runtime APIs");
+  if (!Object.isExtensible(service) || [...own.values()].some((d) => d && !d.configurable))
+    throw new Error("DCAR cannot extend this permission service instance");
+  const entries = new Map();
+  const installed = {
+    names: { get() { return [...new Set([...names.call(this), ...entries.keys()])]; } },
+    specOf: { value: function (name) {
+      return entries.get(name)?.spec ?? original.specOf.call(this, name);
+    } },
+    derive: { value: function (state) {
+      const entry = entries.get(state.preset);
+      if (entry && state.sandbox === entry.spec.sandbox &&
+          (state.approval === entry.spec.approval || state.approval === "never"))
+        return state.preset;
+      const derived = original.derive.call(this, state);
+      return derived === "CAutoR" && entries.has("CAutoR") ? "custom" : derived;
+    } },
+    apply: { value: function (session, name, setApproval) {
+      entries.get(name)?.admit();
+      return original.apply.call(this, session, name, setApproval);
+    } },
+    registerReviewPreset: { value: function (name, spec, admit) {
+      return registerReviewPreset(this, entries, name, spec, admit);
+    } },
+  };
+  // Validate before changing anything; rollback an unexpected partial failure.
+  const changed = [];
+  const restore = () => {
+    for (const key of [...changed].reverse()) {
+      const prior = own.get(key);
+      if (prior) Object.defineProperty(service, key, prior);
+      else Reflect.deleteProperty(service, key);
+    }
+  };
+  try {
+    for (const key of keys) {
+      Object.defineProperty(service, key, { ...installed[key], configurable: true });
+      changed.push(key);
+    }
+  } catch (error) { restore(); throw error; }
+  let live = true;
+  return () => {
+    if (!live) return;
+    live = false;
+    entries.clear();
+    restore();
+    service.emitCatalogChanged();
+  };
+}

package/src/permission-presets.js

@@ -0,0 +1,77 @@
+/**
+ * DSH 0.1.7-rc.2 / 0.2.0-rc.2 permission service adapter.
+ * Adds effect-scoped review presets without changing DSH's built-in knob setters,
+ * /permission command, session projection, catalog Remote, or official Auto integration.
+ */
+import PermissionPresetService from "@deepseek-ai/dsh-permission-presets";
+import { registerReviewPreset } from "./preset-defaults.js";
+function entries(service) {
+  return service.dcarReviewPresets;
+}
+export default class DCARPermissionPresetService extends PermissionPresetService {
+  constructor(ctx, config) {
+    for (const method of ["specOf", "derive", "apply", "emitCatalogChanged"])
+      if (typeof PermissionPresetService.prototype[method] !== "function")
+        throw new Error(
+          `DCAR permission adapter requires DSH 0.1.7-rc.2 or 0.2.0-rc.2 (${method} is unavailable)`,
+        );
+    super(ctx, config);
+    this.dcarReviewPresets = new Map();
+    // A restored CAutoR session cannot execute while its review provider is absent.
+    ctx.inject(["tools"], (child) => {
+      child.on(
+        "tools/pre-execute",
+        async (exec, next) => {
+          if (exec.agent) {
+            const state = ctx.sessionProjections.stateOf(
+              exec.agent.session,
+              "permissions",
+            );
+            if (
+              state?.preset === "CAutoR" &&
+              state.sandbox === "danger-full-access" &&
+              !entries(this)?.has("CAutoR")
+            )
+              return {
+                kind: "deny",
+                reason:
+                  "CAutoR review provider is unavailable; select workspace-write or enable DCAR.",
+                info: {
+                  name: "DCARUnavailableError",
+                  code: "DCAR_UNAVAILABLE",
+                },
+              };
+          }
+          return next();
+        },
+        { prepend: true },
+      );
+    });
+  }
+  get names() {
+    return [...new Set([...super.names, ...(entries(this)?.keys() ?? [])])];
+  }
+  specOf(name) {
+    return entries(this)?.get(name)?.spec ?? super.specOf(name);
+  }
+  derive(state) {
+    const entry =
+      state.preset === null ? undefined : entries(this)?.get(state.preset);
+    if (
+      entry &&
+      state.sandbox === entry.spec.sandbox &&
+      (state.approval === entry.spec.approval || state.approval === "never")
+    )
+      return state.preset;
+    const derived = super.derive(state);
+    return derived === "CAutoR" && entries(this)?.has("CAutoR") ? "custom" : derived;
+  }
+  apply(session, name, setApproval) {
+    entries(this)?.get(name)?.admit();
+    return super.apply(session, name, setApproval);
+  }
+  /** Register an effect-owned custom review mode and its synchronous selection guard. */
+  registerReviewPreset(name, spec, admit) {
+    return registerReviewPreset(this, entries(this), name, spec, admit);
+  }
+}

package/src/presentation.js

@@ -0,0 +1,48 @@
+/** Chinese human-facing prompts; raw diagnostics stay in the audit/agent error. */
+function visible(value) {
+  return String(value).replace(
+    /[\u0000-\u0008\u000b-\u001f\u007f\u202a-\u202e\u2066-\u2069]/g,
+    "",
+  );
+}
+export function bounded(text, limit) {
+  const value = visible(text);
+  return value.length <= limit
+    ? value
+    : `${value.slice(0, limit)}\n（内容过长，展示已截断）`;
+}
+export function actionText(exec, c) {
+  if (!c.review.showAction) return "";
+  const args = exec.arguments;
+  let body;
+  if (args && typeof args === "object" && typeof args.command === "string") {
+    const { command, ...rest } = args;
+    body =
+      `命令：${command}` +
+      (Object.keys(rest).length ? `\n其他参数：${JSON.stringify(rest)}` : "");
+  } else {
+    try {
+      body = `参数：${JSON.stringify(args) ?? "（无）"}`;
+    } catch {
+      body = "参数无法展示，请查看原生工具详情。";
+    }
+  }
+  return `\n\n待执行工具：${visible(exec.name)}\n${bounded(body, c.review.maxActionChars)}`;
+}
+export function reviewFailureMessage(error, c, trace) {
+  const message = String(error.message ?? error);
+  if (error.code === "DCAR_MAX_TOKENS")
+    return `自动审查达到输出 token 上限，未取得完整结论（最后一次预算 ${trace.lastMaxTokens}，配置上限 ${c.review.maxTokensLimit}，已扩容重试 ${trace.tokenRetries} 次）。`;
+  if (error.code === "DCAR_REVIEW_TIMEOUT")
+    return `自动审查超时（总时限 ${c.review.timeoutMs} 毫秒，包含排队、重试和中文翻译），未取得完整结论。`;
+  if (error.code === "DCAR_REVIEW_INPUT")
+    return `授权上下文超过 ${c.review.maxInputChars} 字符的配置上限，自动审查未完成。`;
+  if (message === "DCAR review queue is full")
+    return "自动审查等待队列已满，未取得审查结论。";
+  if (["DCAR_REVIEW_INVALID", "DCAR_REVIEW_STREAM"].includes(error.code))
+    return "自动审查返回的结论格式无效或响应不完整，无法据此批准。";
+  return "自动审查服务请求失败，未取得有效结论。";
+}
+export function approvalText(exec, c, explanation) {
+  return `Con's 自动审查：是否允许本次操作？\n${visible(explanation)}${actionText(exec, c)}\n\n允许仅针对这一次调用；拒绝则不执行。`;
+}