@toddzheng024/dscode-bundle 0.7.19 → 0.7.20

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.7.19",
+  "version": "0.7.20",
   "type": "module",
   "license": "MIT",
   "author": "Todd Zheng",

package/plugins/jev/approval.mjs

@@ -38,12 +38,18 @@ export function approvalQuestions() {
       criteria: {
         allow: 'Read-only, or a change the retained user instruction already asked for.',
         ask: 'Plausibly within the task but not clearly authorized, or the blast radius is unclear.',
-        deny: 'Outside the user instruction, or it would disclose data, destroy unrelated work, or publish something.',
+        deny: 'Outside the user instruction, or it would disclose data, destroy unrelated work, or publish something the instruction did not ask for.',
       },
     },
     authorized: {
       type: 'noul',
-      instructions: 'Does the retained user instruction explicitly authorize this exact action, including its target and effect?',
+      // Scored on its own, never as a function of how risky the action is: the
+      // deployment uses this number to decide whether a risk guard may defer to
+      // the model reviewer, and collapsing authorization into apparent safety
+      // made user-requested work (a release that must leave the sandbox) read as
+      // unauthorized. An instruction almost never names the exact command, so the
+      // question is about the task it asks for, not about a literal match.
+      instructions: 'Judge the authorization alone, separately from how risky the action is: an action the instruction asks for scores high even when it is dangerous, and a risky action nobody asked for scores low. The instruction rarely names a command, so read it as the task it asks for and decide whether this call is a required or ordinary step of that task, including its target and effect. Score 0.9 or more when the instruction directly asks for this step; 0.6 up to but not including 0.9 when the step is necessary to carry out a stated task, or the instruction names the target but not the means; 0.2 up to but not including 0.6 when the call is plausibly part of the task but optional or unclear; below 0.2 when the instruction does not cover it or it serves a different goal.',
     },
     destructive: {
       type: 'score',
@@ -67,8 +73,16 @@ const clip = (value, limit) => {
 // call, and the retained direct user instruction. It is posted to OpenRouter, so
 // it is bounded and never carries credentials.
 export function approvalState({ action, context } = {}) {
+  // `contextFor` hands these over as `{ seq, text }`; a caller may also pass raw
+  // message objects. Reading only `content` left `userInstructions` empty, so Jev
+  // judged every escalation without ever seeing what the user had asked for.
   const instructions = (context?.userMessages ?? [])
-    .map(message => (message?.content ?? []).map(block => block?.text ?? '').join(' ').trim())
+    .map(message => {
+      if (typeof message?.text === 'string') return message.text.trim();
+      const content = message?.content;
+      if (typeof content === 'string') return content.trim();
+      return Array.isArray(content) ? content.map(block => block?.text ?? '').join(' ').trim() : '';
+    })
     .filter(Boolean)
     .join('\n---\n');
   return {