dsh-approval-consult 1.1.2 → 1.1.3

package/README.en.md

@@ -53,7 +53,7 @@ notes or reject blindly. This plugin adds a consultation panel on top of the app
 
 Requires DSH Web `0.2.1-rc.2` (tested) and Node `>=20`.
 
-Current version **v1.1.2**, published to npm ([`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)) and as a [GitHub release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.2).
+Current version **v1.1.3**, published to npm ([`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)) and as a [GitHub release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.3).
 
 ```bash
 npm install dsh-approval-consult
@@ -61,7 +61,7 @@ npm install dsh-approval-consult
 
 Or install the release tarball:
 
-1. Download `dsh-approval-consult-1.1.2.tgz` from
+1. Download `dsh-approval-consult-1.1.3.tgz` from
    [Releases](https://github.com/0tests/dsh-approval-consult/releases/latest).
 2. Open DSH Web → **Plugins** → **Add plugin** → **Install third-party plugin** and point it at the
    tarball's absolute path (or the download URL directly).

package/README.md

@@ -37,7 +37,7 @@ Auto 审查（`@deepseek-ai/dsh-experimental-auto-review`）会在工具执行
 
 ## 安装
 
-> 当前版本 **v1.1.2**，已发布到 npm（[`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)）和 [GitHub Release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.2)。
+> 当前版本 **v1.1.3**，已发布到 npm（[`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)）和 [GitHub Release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.3)。
 > `npm install dsh-approval-consult`，或让 Agent 用 `plugin_manager` 安装这个包名；下面也保留了 tarball / 本地目录两种方式。
 
 ### 方式 A：npm
@@ -49,10 +49,10 @@ Auto 审查（`@deepseek-ai/dsh-experimental-auto-review`）会在工具执行
 ### 方式 B：从 Release 安装（tarball）
 
 1. 在 [Releases](https://github.com/0tests/dsh-approval-consult/releases/latest) 下载
-   `dsh-approval-consult-1.1.2.tgz`；
+   `dsh-approval-consult-1.1.3.tgz`；
 2. 打开 DSH Web → 左侧「插件」→「添加插件」→「安装第三方插件」，填这个 tarball 的绝对路径，
    或直接填下载链接
-   `https://github.com/0tests/dsh-approval-consult/releases/download/v1.1.2/dsh-approval-consult-1.1.2.tgz`；
+   `https://github.com/0tests/dsh-approval-consult/releases/download/v1.1.3/dsh-approval-consult-1.1.3.tgz`；
 3. 安装完成后点「立即启用」，重启一次 `dsh web` 更稳。
 
 ### 方式 C：本地目录（源码 / 开发）

package/lib/impl.js

@@ -974,7 +974,9 @@ export function apply(ctx, config, runtime) {
         typeof review.decision?.reason === 'string' &&
         review.decision.reason.length >= 12 &&
         reason.includes(review.decision.reason)
-      // 参数已知但不一致、或两者都无法核对：一律不复用（宁可缺材料，不展示错误结论）。
+      // 参数已知且不一致：无论理由文字是否命中都不复用——理由文本不能替代调用身份。
+      if (argsKnown && !sameArgs) continue
+      // 参数未知时，才退化为「理由原样命中」这一弱证据；两者都无法核对则不复用。
       if (!sameArgs && !reasonHit) continue
       let score = 1
       if (reasonHit) score += 4
@@ -1652,6 +1654,11 @@ export function apply(ctx, config, runtime) {
       const controller = new AbortController()
       const timer = setTimeout(() => controller.abort(new Error('advisory review timeout')), 90_000)
       review.classifyController = controller
+      // 每次尝试使用独立缓冲：上一次失败留下的半截输出/错误不能污染本次结果。
+      let text = ''
+      let error = null
+      let usage = null
+      let finishKind = null
       const options = {
         ...review.options,
         maxTokens: 1800,
@@ -1662,23 +1669,28 @@ export function apply(ctx, config, runtime) {
       try {
         for await (const chunk of ctx.llm.stream(options)) {
           if (!chunk || typeof chunk !== 'object') continue
-          if (chunk.type === 'text-delta' && typeof chunk.text === 'string') review.text += chunk.text
-          else if (chunk.type === 'block-end' && chunk.block?.type === 'text' && typeof chunk.block.text === 'string' && review.text.length === 0) review.text = chunk.block.text
-          else if (chunk.type === 'usage') review.usage = chunk.usage ?? null
+          if (chunk.type === 'text-delta' && typeof chunk.text === 'string') text += chunk.text
+          else if (chunk.type === 'block-end' && chunk.block?.type === 'text' && typeof chunk.block.text === 'string' && text.length === 0) text = chunk.block.text
+          else if (chunk.type === 'usage') usage = chunk.usage ?? null
           else if (chunk.type === 'finish') {
-            review.finishKind = chunk.reason?.kind ?? null
-            if (chunk.reason?.kind === 'error' || chunk.reason?.kind === 'aborted') review.error = messageOf(chunk.reason.failure)
+            finishKind = chunk.reason?.kind ?? null
+            if (chunk.reason?.kind === 'error' || chunk.reason?.kind === 'aborted') error = messageOf(chunk.reason.failure)
           }
         }
-        review.decisionText = review.text.trim()
+        review.text = text
+        review.decisionText = text.trim()
         review.decision = parseReviewDecision(review.decisionText)
-        if (review.decision === null && review.error === null) {
-          review.error = `审查输出无法解析：${clip(review.decisionText, 200)}`
+        if (review.decision === null && error === null) {
+          error = `审查输出无法解析：${clip(review.decisionText, 200)}`
         }
-      } catch (error) {
-        review.error = friendlySideCallError(error)
-        noteError('advisory-classify', error)
+      } catch (thrown) {
+        review.text = text
+        error = friendlySideCallError(thrown)
+        noteError('advisory-classify', thrown)
       } finally {
+        review.error = error
+        review.usage = usage
+        review.finishKind = finishKind
         clearTimeout(timer)
         state.sideOptions.delete(options)
         review.classifyController = null
@@ -2487,6 +2499,11 @@ export function apply(ctx, config, runtime) {
           if (item === undefined || item.consultKey !== consultKey || Date.now() > item.expiresAt) {
             throw httpError(404, 'attachment-unknown', '这张图片已经失效，请重新上传。')
           }
+          // 审批结束后图片引用必须立即失效（finalizePending 会清理，这里兜底防止竞态残留）。
+          const pendingForImage = state.pendings.get(consultKey)
+          if (pendingForImage === undefined || pendingForImage.resolvedAt !== null) {
+            throw httpError(404, 'attachment-unknown', '这张图片已经失效，请重新上传。')
+          }
           if (attachmentStore === null || typeof attachmentStore.readImage !== 'function') {
             throw httpError(409, 'attachment-unavailable', '当前环境没有可用的附件服务。')
           }
@@ -2524,6 +2541,10 @@ export function apply(ctx, config, runtime) {
         try {
           const data = await readBinaryBody(req, limit)
           if (data.length === 0) throw httpError(400, 'attachment-bad-request', '图片内容为空。')
+          // 读取期间审批可能已经结束：结束后的图片一律不再登记（否则会“复活”已失效引用）。
+          if (record.resolvedAt !== null) {
+            throw httpError(409, 'approval-resolved', '这次审批已经结束，不能再上传图片。')
+          }
           let ref = null
           try {
             ref = await attachmentStore.saveImage({
@@ -2534,6 +2555,11 @@ export function apply(ctx, config, runtime) {
           } catch (error) {
             throw mapAttachmentError(error)
           }
+          // saveImage 也可能耗时：登记前再复核一次；若此时审批已结束，本次保存的宿主对象
+          // 没有对应引用（宿主接口未提供删除语义），但绝不会被登记成可读取的附件。
+          if (record.resolvedAt !== null) {
+            throw httpError(409, 'approval-resolved', '这次审批已经结束，不能再上传图片。')
+          }
           const item = registerAttachment(ref, record.key, record.sessionId)
           sendJson(res, 200, { ok: true, attachment: attachmentMeta(item) })
         } finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-approval-consult",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "license": "MIT",
   "type": "module",
   "description": "Approval consultation panel for DeepSeek Harness: while a tool call waits for approval, ask the executor AI and the auto-review AI independently, in two isolated channels with prompt-cache reuse.",