dsh-approval-consult 1.1.1 → 1.1.3

package/README.en.md

@@ -53,7 +53,7 @@ notes or reject blindly. This plugin adds a consultation panel on top of the app
 
 Requires DSH Web `0.2.1-rc.2` (tested) and Node `>=20`.
 
-Current version **v1.1.1**, published to npm ([`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)) and as a [GitHub release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.1).
+Current version **v1.1.3**, published to npm ([`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)) and as a [GitHub release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.3).
 
 ```bash
 npm install dsh-approval-consult
@@ -61,7 +61,7 @@ npm install dsh-approval-consult
 
 Or install the release tarball:
 
-1. Download `dsh-approval-consult-1.1.1.tgz` from
+1. Download `dsh-approval-consult-1.1.3.tgz` from
    [Releases](https://github.com/0tests/dsh-approval-consult/releases/latest).
 2. Open DSH Web → **Plugins** → **Add plugin** → **Install third-party plugin** and point it at the
    tarball's absolute path (or the download URL directly).

package/README.md

@@ -37,7 +37,7 @@ Auto 审查（`@deepseek-ai/dsh-experimental-auto-review`）会在工具执行
 
 ## 安装
 
-> 当前版本 **v1.1.1**，已发布到 npm（[`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)）和 [GitHub Release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.1)。
+> 当前版本 **v1.1.3**，已发布到 npm（[`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)）和 [GitHub Release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.3)。
 > `npm install dsh-approval-consult`，或让 Agent 用 `plugin_manager` 安装这个包名；下面也保留了 tarball / 本地目录两种方式。
 
 ### 方式 A：npm
@@ -49,10 +49,10 @@ Auto 审查（`@deepseek-ai/dsh-experimental-auto-review`）会在工具执行
 ### 方式 B：从 Release 安装（tarball）
 
 1. 在 [Releases](https://github.com/0tests/dsh-approval-consult/releases/latest) 下载
-   `dsh-approval-consult-1.1.1.tgz`；
+   `dsh-approval-consult-1.1.3.tgz`；
 2. 打开 DSH Web → 左侧「插件」→「添加插件」→「安装第三方插件」，填这个 tarball 的绝对路径，
    或直接填下载链接
-   `https://github.com/0tests/dsh-approval-consult/releases/download/v1.1.1/dsh-approval-consult-1.1.1.tgz`；
+   `https://github.com/0tests/dsh-approval-consult/releases/download/v1.1.3/dsh-approval-consult-1.1.3.tgz`；
 3. 安装完成后点「立即启用」，重启一次 `dsh web` 更稳。
 
 ### 方式 C：本地目录（源码 / 开发）

package/lib/impl.js

@@ -492,6 +492,8 @@ export function apply(ctx, config, runtime) {
       jobs: new Map(),
       /** uploadId -> 附件引用登记（图片只存引用，字节在 DSH 附件服务里） */
       attachments: new Map(),
+      /** consultKey -> 进行中的上传预占数（先占名额再 saveImage，失败释放） */
+      attachmentPending: new Map(),
       /** 侧调用 options 集合（对象身份），llm/stream 捕获器直接跳过 */
       sideOptions: new WeakSet(),
       /** 已被本插件包装/记录过的 options（避免根与 agent 两处监听重复处理） */
@@ -540,6 +542,7 @@ export function apply(ctx, config, runtime) {
     state = previousState
     // 瞬态字段一律重建；旧 jobs 已被上一代 dispose 中止。
     state.jobs = new Map()
+    state.attachmentPending = new Map()
     state.sideOptions = new WeakSet()
     state.wrappedOptions = new WeakSet()
     state.agentDisposers = new Map()
@@ -947,8 +950,9 @@ export function apply(ctx, config, runtime) {
   }
 
   /**
-   * 把这次审批和一条审查记录配对：优先用「审查理由出现在审批理由里」精确匹配，
-   * 其次用工具名 + 参数一致，最后退化为同 session 下同工具名且未被认领的最近审查。
+   * 把这次审批和一条审查记录配对：只接受**可验证的关联**——参数完全一致，或审批理由里
+   * 原样包含审查理由。工具名相同不再构成匹配依据，也不跨 session 猜测（安全审查 2026-11-03）。
+   * 无法准确关联时返回 null，让面板显示「缺少审查材料」或对当前调用重新评估。
    */
   function matchReview(sessionId, toolName, exec, reason) {
     const list = state.reviews.get(sessionId)
@@ -962,45 +966,28 @@ export function apply(ctx, config, runtime) {
       const action = review.action
       if (action === null) continue
       if (action.name !== toolName) continue
+      const reviewArgs = canonicalJson(normalizeArguments(action.arguments))
+      const argsKnown = execArgs !== undefined && reviewArgs.length > 0
+      const sameArgs = argsKnown && reviewArgs === execArgs
+      const reasonHit =
+        typeof reason === 'string' &&
+        typeof review.decision?.reason === 'string' &&
+        review.decision.reason.length >= 12 &&
+        reason.includes(review.decision.reason)
+      // 参数已知且不一致：无论理由文字是否命中都不复用——理由文本不能替代调用身份。
+      if (argsKnown && !sameArgs) continue
+      // 参数未知时，才退化为「理由原样命中」这一弱证据；两者都无法核对则不复用。
+      if (!sameArgs && !reasonHit) continue
       let score = 1
-      if (typeof reason === 'string' && typeof review.decision?.reason === 'string' && review.decision.reason.length > 0) {
-        if (reason.includes(review.decision.reason)) score += 4
-      }
-      if (execArgs !== undefined) {
-        const reviewArgs = canonicalJson(normalizeArguments(action.arguments))
-        if (reviewArgs.length > 0 && reviewArgs === execArgs) score += 3
-      }
+      if (reasonHit) score += 4
+      if (sameArgs) score += 3
       if (review.decision !== null) score += 1
       if (score > bestScore || (score === bestScore && best !== null && review.at > best.at)) {
         best = review
         bestScore = score
       }
     }
-    if (best !== null) return best
-    const sameTool = candidates.filter((review) => review.action?.name === toolName)
-    if (sameTool.length === 1) return sameTool[0]
-    // 跨 session 兜底：某些会话的审查请求可能被记到了别的 sessionId 上。
-    // 只接受高置信匹配（参数完全一致或审查理由原样出现在审批理由里），且必须唯一。
-    let crossMatch = null
-    for (const [otherSession, otherList] of state.reviews) {
-      if (otherSession === sessionId || !Array.isArray(otherList)) continue
-      for (const review of otherList) {
-        if (review.claimedBy !== null || review.error !== null) continue
-        if (review.action === null || review.action.name !== toolName) continue
-        if (Date.now() - review.at > 120_000) continue
-        const reviewArgs = canonicalJson(normalizeArguments(review.action.arguments))
-        const sameArgs = execArgs !== undefined && reviewArgs.length > 0 && reviewArgs === execArgs
-        const reasonHit =
-          typeof reason === 'string' &&
-          typeof review.decision?.reason === 'string' &&
-          review.decision.reason.length >= 12 &&
-          reason.includes(review.decision.reason)
-        if (!sameArgs && !reasonHit) continue
-        if (crossMatch !== null) return null
-        crossMatch = review
-      }
-    }
-    return crossMatch
+    return best
   }
 
   /** pending 结束：记录结果、中止仍在流式输出的侧调用。 */
@@ -1025,6 +1012,16 @@ export function apply(ctx, config, runtime) {
         /* ignore */
       }
     }
+    // 审批结束：中止仍在进行的「重新评估」，避免审批结束后继续计费（安全审查 2026-11-03）。
+    for (const candidate of [record.review, record.advisoryReview]) {
+      const classifyController = candidate?.classifyController ?? null
+      if (classifyController === null) continue
+      try {
+        classifyController.abort(new Error('approval resolved'))
+      } catch {
+        /* ignore */
+      }
+    }
     log.info(`[approval-consult] pending ${record.key} resolved outcome=${String(record.outcome)}`)
     // 审批结束：立即失效该审批下的图片引用（字节仍由 DSH 附件服务保留，不在这里删）。
     try {
@@ -1279,6 +1276,25 @@ export function apply(ctx, config, runtime) {
       }
     }
 
+    /* 上面的 await 会让出执行权：必须在不再 await 的临界段里重新核对审批状态与并发名额，
+       否则多个并发请求会一起通过数量检查（安全审查 2026-11-03）。 */
+    if (record.resolvedAt !== null) {
+      throw httpError(409, 'approval-resolved', '这次审批已经结束了，不能继续提问。')
+    }
+    if (target === 'reviewer') {
+      const reviewAfterAwait = record.review ?? record.advisoryReview ?? null
+      if (reviewAfterAwait === null || reviewAfterAwait.options === null || reviewAfterAwait.options === undefined) {
+        throw httpError(409, 'reviewer-context-missing', '本次审批的审查材料已失效，请重新评估后再提问。')
+      }
+      if (reviewAfterAwait.advisory === true && reviewAfterAwait.decision === null) {
+        throw httpError(409, 'review-not-initialized', '审查材料已就绪，但还没有重新评估。请先点「让审查 AI 重新评估」，再继续提问。')
+      }
+    }
+    const activeJobsAfterAwait = [...record.jobs].filter((jobId) => state.jobs.get(jobId)?.status === 'streaming').length
+    if (activeJobsAfterAwait >= cfg.maxConcurrentJobs) {
+      throw httpError(429, 'too-many-jobs', `同一审批下最多同时有 ${cfg.maxConcurrentJobs} 个回答在生成，请等其中一个结束。`)
+    }
+
     const entry = {
       id: `q:${nextSeq()}`,
       question,
@@ -1626,37 +1642,65 @@ export function apply(ctx, config, runtime) {
     if (review.decision !== null) {
       return { review, reused: true }
     }
-    const controller = new AbortController()
-    const timer = setTimeout(() => controller.abort(new Error('advisory review timeout')), 90_000)
-    const options = {
-      ...review.options,
-      maxTokens: 1800,
-      signal: controller.signal,
+    if (record.resolvedAt !== null && record.resolvedAt !== undefined) {
+      throw httpError(409, 'approval-resolved', '这次审批已经结束了，不能继续重新评估。')
     }
-    state.sideOptions.add(options)
-    state.stats.sideCalls += 1
-    try {
-      for await (const chunk of ctx.llm.stream(options)) {
-        if (!chunk || typeof chunk !== 'object') continue
-        if (chunk.type === 'text-delta' && typeof chunk.text === 'string') review.text += chunk.text
-        else if (chunk.type === 'block-end' && chunk.block?.type === 'text' && typeof chunk.block.text === 'string' && review.text.length === 0) review.text = chunk.block.text
-        else if (chunk.type === 'usage') review.usage = chunk.usage ?? null
-        else if (chunk.type === 'finish') {
-          review.finishKind = chunk.reason?.kind ?? null
-          if (chunk.reason?.kind === 'error' || chunk.reason?.kind === 'aborted') review.error = messageOf(chunk.reason.failure)
-        }
+    // 同一条记录只允许一个进行中的评估：重复请求共享同一个 Promise，避免重复计费与输出混合。
+    if (review.classifyPromise !== undefined && review.classifyPromise !== null) {
+      await review.classifyPromise
+      return { review, reused: true }
+    }
+    const task = (async () => {
+      const controller = new AbortController()
+      const timer = setTimeout(() => controller.abort(new Error('advisory review timeout')), 90_000)
+      review.classifyController = controller
+      // 每次尝试使用独立缓冲：上一次失败留下的半截输出/错误不能污染本次结果。
+      let text = ''
+      let error = null
+      let usage = null
+      let finishKind = null
+      const options = {
+        ...review.options,
+        maxTokens: 1800,
+        signal: controller.signal,
       }
-      review.decisionText = review.text.trim()
-      review.decision = parseReviewDecision(review.decisionText)
-      if (review.decision === null && review.error === null) {
-        review.error = `审查输出无法解析：${clip(review.decisionText, 200)}`
+      state.sideOptions.add(options)
+      state.stats.sideCalls += 1
+      try {
+        for await (const chunk of ctx.llm.stream(options)) {
+          if (!chunk || typeof chunk !== 'object') continue
+          if (chunk.type === 'text-delta' && typeof chunk.text === 'string') text += chunk.text
+          else if (chunk.type === 'block-end' && chunk.block?.type === 'text' && typeof chunk.block.text === 'string' && text.length === 0) text = chunk.block.text
+          else if (chunk.type === 'usage') usage = chunk.usage ?? null
+          else if (chunk.type === 'finish') {
+            finishKind = chunk.reason?.kind ?? null
+            if (chunk.reason?.kind === 'error' || chunk.reason?.kind === 'aborted') error = messageOf(chunk.reason.failure)
+          }
+        }
+        review.text = text
+        review.decisionText = text.trim()
+        review.decision = parseReviewDecision(review.decisionText)
+        if (review.decision === null && error === null) {
+          error = `审查输出无法解析：${clip(review.decisionText, 200)}`
+        }
+      } catch (thrown) {
+        review.text = text
+        error = friendlySideCallError(thrown)
+        noteError('advisory-classify', thrown)
+      } finally {
+        review.error = error
+        review.usage = usage
+        review.finishKind = finishKind
+        clearTimeout(timer)
+        state.sideOptions.delete(options)
+        review.classifyController = null
       }
-    } catch (error) {
-      review.error = friendlySideCallError(error)
-      noteError('advisory-classify', error)
+    })()
+    review.classifyPromise = task
+    try {
+      await task
     } finally {
-      clearTimeout(timer)
-      state.sideOptions.delete(options)
+      review.classifyPromise = null
     }
     return { review, reused: false }
   }
@@ -2455,6 +2499,11 @@ export function apply(ctx, config, runtime) {
           if (item === undefined || item.consultKey !== consultKey || Date.now() > item.expiresAt) {
             throw httpError(404, 'attachment-unknown', '这张图片已经失效，请重新上传。')
           }
+          // 审批结束后图片引用必须立即失效（finalizePending 会清理，这里兜底防止竞态残留）。
+          const pendingForImage = state.pendings.get(consultKey)
+          if (pendingForImage === undefined || pendingForImage.resolvedAt !== null) {
+            throw httpError(404, 'attachment-unknown', '这张图片已经失效，请重新上传。')
+          }
           if (attachmentStore === null || typeof attachmentStore.readImage !== 'function') {
             throw httpError(409, 'attachment-unavailable', '当前环境没有可用的附件服务。')
           }
@@ -2487,20 +2536,35 @@ export function apply(ctx, config, runtime) {
         }
         const serviceLimit = Number(attachmentStore.imageLimits?.maxImageBytes)
         const limit = Math.min(cfg.maxAttachmentBytes, Number.isFinite(serviceLimit) && serviceLimit > 0 ? serviceLimit : MAX_ATTACHMENT_BODY_BYTES)
-        const data = await readBinaryBody(req, limit)
-        if (data.length === 0) throw httpError(400, 'attachment-bad-request', '图片内容为空。')
-        let ref = null
+        // 先占名额再读取/保存：超额或并发上传不会浪费宿主存储与解析资源。
+        reserveAttachmentSlot(record.key)
         try {
-          ref = await attachmentStore.saveImage({
-            data,
-            mediaType,
-            name: sanitizeAttachmentName(query.get('name')),
-          })
-        } catch (error) {
-          throw mapAttachmentError(error)
+          const data = await readBinaryBody(req, limit)
+          if (data.length === 0) throw httpError(400, 'attachment-bad-request', '图片内容为空。')
+          // 读取期间审批可能已经结束：结束后的图片一律不再登记（否则会“复活”已失效引用）。
+          if (record.resolvedAt !== null) {
+            throw httpError(409, 'approval-resolved', '这次审批已经结束，不能再上传图片。')
+          }
+          let ref = null
+          try {
+            ref = await attachmentStore.saveImage({
+              data,
+              mediaType,
+              name: sanitizeAttachmentName(query.get('name')),
+            })
+          } catch (error) {
+            throw mapAttachmentError(error)
+          }
+          // saveImage 也可能耗时：登记前再复核一次；若此时审批已结束，本次保存的宿主对象
+          // 没有对应引用（宿主接口未提供删除语义），但绝不会被登记成可读取的附件。
+          if (record.resolvedAt !== null) {
+            throw httpError(409, 'approval-resolved', '这次审批已经结束，不能再上传图片。')
+          }
+          const item = registerAttachment(ref, record.key, record.sessionId)
+          sendJson(res, 200, { ok: true, attachment: attachmentMeta(item) })
+        } finally {
+          releaseAttachmentSlot(record.key)
         }
-        const item = registerAttachment(ref, record.key, record.sessionId)
-        sendJson(res, 200, { ok: true, attachment: attachmentMeta(item) })
       }),
     )
     addDisposer(
@@ -3230,6 +3294,30 @@ export function apply(ctx, config, runtime) {
     return out
   }
 
+  /** 该审批下进行中的上传预占数。 */
+  function pendingAttachmentCount(consultKey) {
+    return state.attachmentPending.get(consultKey) ?? 0
+  }
+
+  /**
+   * 上传前预占名额：超额/并发上传不会先 saveImage 再被拒（安全审查 2026-11-03）。
+   * 调用方必须在 finally 里 releaseAttachmentSlot。
+   */
+  function reserveAttachmentSlot(consultKey) {
+    const existing = attachmentsForConsult(consultKey).length
+    const pending = pendingAttachmentCount(consultKey)
+    if (existing + pending >= cfg.maxAttachmentsPerConsult) {
+      throw httpError(413, 'attachment-too-many', `同一审批下最多保留 ${cfg.maxAttachmentsPerConsult} 张图片。`)
+    }
+    state.attachmentPending.set(consultKey, pending + 1)
+  }
+
+  function releaseAttachmentSlot(consultKey) {
+    const pending = pendingAttachmentCount(consultKey)
+    if (pending <= 1) state.attachmentPending.delete(consultKey)
+    else state.attachmentPending.set(consultKey, pending - 1)
+  }
+
   /** 登记一张已存入附件服务的图片，返回对外展示的元数据。 */
   function registerAttachment(ref, consultKey, sessionId) {
     const existing = attachmentsForConsult(consultKey)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-approval-consult",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "license": "MIT",
   "type": "module",
   "description": "Approval consultation panel for DeepSeek Harness: while a tool call waits for approval, ask the executor AI and the auto-review AI independently, in two isolated channels with prompt-cache reuse.",
@@ -34,7 +34,7 @@
     "NOTICE.md"
   ],
   "scripts": {
-    "test": "node tests/unit.mjs && node tests/locale-parity.mjs && node tests/css-classes.mjs",
+    "test": "node tests/unit.mjs && node tests/locale-parity.mjs && node tests/css-classes.mjs && node tests/security.mjs",
     "check": "node --check lib/impl.js && node --check lib/client.js && node --check lib/index.js"
   },
   "engines": {