@toddzheng024/dscode-bundle 0.7.18 → 0.7.20

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.7.18",
+  "version": "0.7.20",
   "type": "module",
   "license": "MIT",
   "author": "Todd Zheng",

package/plugins/auto-review/index.mjs

@@ -94,6 +94,9 @@ export function apply(ctx, config) {
         announce(req.agent, `Automatic review rejected ${req.toolName}: ${decision.reason}. Do not retry the same outcome via another command or tool. Continue only with a materially safer alternative or ask the user.${state.blocked ? ' Stop this turn: three consecutive denials.' : ''}`);
         return 'rejected';
       }
+      // Only an explicit allow runs: `defer` and any future verdict value fall back
+      // to the human instead of being read as approval.
+      if (decision.decision !== 'allow') return fallback(decision.reason ?? 'Unrecognized review verdict.', details);
       state.denials = 0;
       return 'allowed-once';
     };
@@ -132,13 +135,18 @@ export function apply(ctx, config) {
         verdict = undefined;
       }
       if (verdict !== undefined) {
-        return applyVerdict({ decision: verdict.decision, reason: verdict.reason }, {
+        const jevDetails = {
           actionHash, provider: 'openrouter', model: verdict.model, source: 'jev',
           choice: verdict.choice, confidence: verdict.confidence, denyProbability: verdict.denyProbability,
           authorized: verdict.authorized, destructive: verdict.destructive, credentialRisk: verdict.credentialRisk,
           durationMs: verdict.durationMs ?? (Date.now() - started),
           usage: verdict.usage ?? null, usageComplete: verdict.usage != null,
-        });
+        };
+        // Jev hands its risk guards over when the instruction authorizes the work;
+        // the reviewer model below sees the pending arguments and decides, and its
+        // own `human` verdict still reaches the user.
+        if (verdict.decision !== 'defer') return applyVerdict({ decision: verdict.decision, reason: verdict.reason }, jevDetails);
+        record(req, { decision: 'deferred', reason: verdict.reason, ...jevDetails });
       }
       // A caller that cancelled must not fall through to a reviewer request.
       if (req.signal?.aborted) {

package/plugins/jev/approval.mjs

@@ -38,12 +38,18 @@ export function approvalQuestions() {
       criteria: {
         allow: 'Read-only, or a change the retained user instruction already asked for.',
         ask: 'Plausibly within the task but not clearly authorized, or the blast radius is unclear.',
-        deny: 'Outside the user instruction, or it would disclose data, destroy unrelated work, or publish something.',
+        deny: 'Outside the user instruction, or it would disclose data, destroy unrelated work, or publish something the instruction did not ask for.',
       },
     },
     authorized: {
       type: 'noul',
-      instructions: 'Does the retained user instruction explicitly authorize this exact action, including its target and effect?',
+      // Scored on its own, never as a function of how risky the action is: the
+      // deployment uses this number to decide whether a risk guard may defer to
+      // the model reviewer, and collapsing authorization into apparent safety
+      // made user-requested work (a release that must leave the sandbox) read as
+      // unauthorized. An instruction almost never names the exact command, so the
+      // question is about the task it asks for, not about a literal match.
+      instructions: 'Judge the authorization alone, separately from how risky the action is: an action the instruction asks for scores high even when it is dangerous, and a risky action nobody asked for scores low. The instruction rarely names a command, so read it as the task it asks for and decide whether this call is a required or ordinary step of that task, including its target and effect. Score 0.9 or more when the instruction directly asks for this step; 0.6 up to but not including 0.9 when the step is necessary to carry out a stated task, or the instruction names the target but not the means; 0.2 up to but not including 0.6 when the call is plausibly part of the task but optional or unclear; below 0.2 when the instruction does not cover it or it serves a different goal.',
     },
     destructive: {
       type: 'score',
@@ -67,8 +73,16 @@ const clip = (value, limit) => {
 // call, and the retained direct user instruction. It is posted to OpenRouter, so
 // it is bounded and never carries credentials.
 export function approvalState({ action, context } = {}) {
+  // `contextFor` hands these over as `{ seq, text }`; a caller may also pass raw
+  // message objects. Reading only `content` left `userInstructions` empty, so Jev
+  // judged every escalation without ever seeing what the user had asked for.
   const instructions = (context?.userMessages ?? [])
-    .map(message => (message?.content ?? []).map(block => block?.text ?? '').join(' ').trim())
+    .map(message => {
+      if (typeof message?.text === 'string') return message.text.trim();
+      const content = message?.content;
+      if (typeof content === 'string') return content.trim();
+      return Array.isArray(content) ? content.map(block => block?.text ?? '').join(' ').trim() : '';
+    })
     .filter(Boolean)
     .join('\n---\n');
   return {
@@ -100,10 +114,18 @@ export function approvalVerdict(answers, thresholds = DEFAULT_THRESHOLDS) {
   }
 
   // Everything below guards the allow direction: high risk or a non-allowing
-  // answer never runs without the human.
-  if (credentialRisk >= thresholds.credentialRisk) return { decision: 'human', reason: 'Automatic review found possible credential handling.', ...detail };
-  if (destructive >= thresholds.destructiveCeiling) return { decision: 'human', reason: 'Automatic review judged this action hard to undo.', ...detail };
-  if (verdict.choice !== 'allow') return { decision: 'human', reason: 'Automatic review asked for a human decision.', ...detail };
-  if (confidence < thresholds.autoAllow) return { decision: 'human', reason: `Automatic review was not confident enough (${confidence.toFixed(2)}).`, ...detail };
+  // answer must not run on Jev's word alone. None of these guards is a denial, so
+  // when the instruction itself authorizes the work they defer to the reviewer
+  // model, which sees the exact pending arguments and the retained instruction:
+  // Jev's scores are coarse, and this deployment already allows ordinary network
+  // access and a CLI's own stored credentials. A caller that does not know
+  // `defer` must treat it as "review me", never as an allow.
+  const guard = reason => authorized >= thresholds.authorizedVeto
+    ? { decision: 'defer', reason, ...detail }
+    : { decision: 'human', reason, ...detail };
+  if (credentialRisk >= thresholds.credentialRisk) return guard('Automatic review found possible credential handling.');
+  if (destructive >= thresholds.destructiveCeiling) return guard('Automatic review judged this action hard to undo.');
+  if (verdict.choice !== 'allow') return guard('Automatic review asked for a human decision.');
+  if (confidence < thresholds.autoAllow) return guard(`Automatic review was not confident enough (${confidence.toFixed(2)}).`);
   return { decision: 'allow', reason: 'Automatic review approved the action.', ...detail };
 }