@toddzheng024/dscode-bundle 0.7.17 → 0.7.19

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.7.17",
+  "version": "0.7.19",
   "type": "module",
   "license": "MIT",
   "author": "Todd Zheng",

package/plugins/auto-review/index.mjs

@@ -94,6 +94,9 @@ export function apply(ctx, config) {
         announce(req.agent, `Automatic review rejected ${req.toolName}: ${decision.reason}. Do not retry the same outcome via another command or tool. Continue only with a materially safer alternative or ask the user.${state.blocked ? ' Stop this turn: three consecutive denials.' : ''}`);
         return 'rejected';
       }
+      // Only an explicit allow runs: `defer` and any future verdict value fall back
+      // to the human instead of being read as approval.
+      if (decision.decision !== 'allow') return fallback(decision.reason ?? 'Unrecognized review verdict.', details);
       state.denials = 0;
       return 'allowed-once';
     };
@@ -132,13 +135,18 @@ export function apply(ctx, config) {
         verdict = undefined;
       }
       if (verdict !== undefined) {
-        return applyVerdict({ decision: verdict.decision, reason: verdict.reason }, {
+        const jevDetails = {
           actionHash, provider: 'openrouter', model: verdict.model, source: 'jev',
           choice: verdict.choice, confidence: verdict.confidence, denyProbability: verdict.denyProbability,
           authorized: verdict.authorized, destructive: verdict.destructive, credentialRisk: verdict.credentialRisk,
           durationMs: verdict.durationMs ?? (Date.now() - started),
           usage: verdict.usage ?? null, usageComplete: verdict.usage != null,
-        });
+        };
+        // Jev hands its risk guards over when the instruction authorizes the work;
+        // the reviewer model below sees the pending arguments and decides, and its
+        // own `human` verdict still reaches the user.
+        if (verdict.decision !== 'defer') return applyVerdict({ decision: verdict.decision, reason: verdict.reason }, jevDetails);
+        record(req, { decision: 'deferred', reason: verdict.reason, ...jevDetails });
       }
       // A caller that cancelled must not fall through to a reviewer request.
       if (req.signal?.aborted) {

package/plugins/jev/approval.mjs

@@ -100,10 +100,18 @@ export function approvalVerdict(answers, thresholds = DEFAULT_THRESHOLDS) {
   }
 
   // Everything below guards the allow direction: high risk or a non-allowing
-  // answer never runs without the human.
-  if (credentialRisk >= thresholds.credentialRisk) return { decision: 'human', reason: 'Automatic review found possible credential handling.', ...detail };
-  if (destructive >= thresholds.destructiveCeiling) return { decision: 'human', reason: 'Automatic review judged this action hard to undo.', ...detail };
-  if (verdict.choice !== 'allow') return { decision: 'human', reason: 'Automatic review asked for a human decision.', ...detail };
-  if (confidence < thresholds.autoAllow) return { decision: 'human', reason: `Automatic review was not confident enough (${confidence.toFixed(2)}).`, ...detail };
+  // answer must not run on Jev's word alone. None of these guards is a denial, so
+  // when the instruction itself authorizes the work they defer to the reviewer
+  // model, which sees the exact pending arguments and the retained instruction:
+  // Jev's scores are coarse, and this deployment already allows ordinary network
+  // access and a CLI's own stored credentials. A caller that does not know
+  // `defer` must treat it as "review me", never as an allow.
+  const guard = reason => authorized >= thresholds.authorizedVeto
+    ? { decision: 'defer', reason, ...detail }
+    : { decision: 'human', reason, ...detail };
+  if (credentialRisk >= thresholds.credentialRisk) return guard('Automatic review found possible credential handling.');
+  if (destructive >= thresholds.destructiveCeiling) return guard('Automatic review judged this action hard to undo.');
+  if (verdict.choice !== 'allow') return guard('Automatic review asked for a human decision.');
+  if (confidence < thresholds.autoAllow) return guard(`Automatic review was not confident enough (${confidence.toFixed(2)}).`);
   return { decision: 'allow', reason: 'Automatic review approved the action.', ...detail };
 }