dsh-approval-consult 1.1.3 → 1.1.4

package/README.en.md

@@ -53,7 +53,7 @@ notes or reject blindly. This plugin adds a consultation panel on top of the app
 
 Requires DSH Web `0.2.1-rc.2` (tested) and Node `>=20`.
 
-Current version **v1.1.3**, published to npm ([`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)) and as a [GitHub release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.3).
+Current version **v1.1.4**, published to npm ([`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)) and as a [GitHub release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.4).
 
 ```bash
 npm install dsh-approval-consult
@@ -61,7 +61,7 @@ npm install dsh-approval-consult
 
 Or install the release tarball:
 
-1. Download `dsh-approval-consult-1.1.3.tgz` from
+1. Download `dsh-approval-consult-1.1.4.tgz` from
    [Releases](https://github.com/0tests/dsh-approval-consult/releases/latest).
 2. Open DSH Web → **Plugins** → **Add plugin** → **Install third-party plugin** and point it at the
    tarball's absolute path (or the download URL directly).

package/README.md

@@ -37,7 +37,7 @@ Auto 审查（`@deepseek-ai/dsh-experimental-auto-review`）会在工具执行
 
 ## 安装
 
-> 当前版本 **v1.1.3**，已发布到 npm（[`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)）和 [GitHub Release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.3)。
+> 当前版本 **v1.1.4**，已发布到 npm（[`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)）和 [GitHub Release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.4)。
 > `npm install dsh-approval-consult`，或让 Agent 用 `plugin_manager` 安装这个包名；下面也保留了 tarball / 本地目录两种方式。
 
 ### 方式 A：npm
@@ -49,10 +49,10 @@ Auto 审查（`@deepseek-ai/dsh-experimental-auto-review`）会在工具执行
 ### 方式 B：从 Release 安装（tarball）
 
 1. 在 [Releases](https://github.com/0tests/dsh-approval-consult/releases/latest) 下载
-   `dsh-approval-consult-1.1.3.tgz`；
+   `dsh-approval-consult-1.1.4.tgz`；
 2. 打开 DSH Web → 左侧「插件」→「添加插件」→「安装第三方插件」，填这个 tarball 的绝对路径，
    或直接填下载链接
-   `https://github.com/0tests/dsh-approval-consult/releases/download/v1.1.3/dsh-approval-consult-1.1.3.tgz`；
+   `https://github.com/0tests/dsh-approval-consult/releases/download/v1.1.4/dsh-approval-consult-1.1.4.tgz`；
 3. 安装完成后点「立即启用」，重启一次 `dsh web` 更稳。
 
 ### 方式 C：本地目录（源码 / 开发）

package/lib/impl.js

@@ -1833,7 +1833,8 @@ export function apply(ctx, config, runtime) {
     const key = typeof input?.consultKey === 'string' ? input.consultKey : ''
     if (key.length > 0) {
       const direct = state.pendings.get(key)
-      if (direct !== undefined) return direct
+      // 命中缓存也要同步状态：重建记录可能在别处已经被允许/拒绝（安全复查 2026-11-04）。
+      if (direct !== undefined) return refreshReconstructed(direct)
     }
     const sessionId = input?.sessionId === undefined || input.sessionId === null ? '' : String(input.sessionId)
     if (sessionId.length === 0) return null
@@ -1842,56 +1843,56 @@ export function apply(ctx, config, runtime) {
     const keys = state.pendingBySession.get(sessionId)
     if (!Array.isArray(keys) || keys.length === 0) {
       const rebuilt = reconstructPending(sessionId, callId.length > 0 ? callId : undefined, toolName.length > 0 ? toolName : undefined)
-      if (rebuilt !== null) refreshReconstructed(rebuilt)
-      return rebuilt
+      return rebuilt === null ? null : refreshReconstructed(rebuilt)
     }
     for (let index = keys.length - 1; index >= 0; index -= 1) {
       const record = state.pendings.get(keys[index])
       if (record === undefined || record.resolvedAt !== null) continue
       if (callId.length > 0) {
-        if (record.callId === callId) return record
+        if (record.callId === callId) return refreshReconstructed(record)
         continue
       }
       if (toolName.length > 0) {
-        if (record.toolName === toolName) return record
+        if (record.toolName === toolName) return refreshReconstructed(record)
         continue
       }
-      return record
+      return refreshReconstructed(record)
     }
     for (let index = keys.length - 1; index >= 0; index -= 1) {
       const record = state.pendings.get(keys[index])
       if (record === undefined) continue
       if (callId.length > 0 && record.callId !== callId) continue
       if (callId.length === 0 && toolName.length > 0 && record.toolName !== toolName) continue
-      return record
+      return refreshReconstructed(record)
     }
     // 记录可能因插件热重载/重启丢失：从会话日志里的 approval/asked（尚无 approval/decided）重建。
     const rebuilt = reconstructPending(sessionId, callId.length > 0 ? callId : undefined, toolName.length > 0 ? toolName : undefined)
-    if (rebuilt !== null) refreshReconstructed(rebuilt)
-    return rebuilt
+    return rebuilt === null ? null : refreshReconstructed(rebuilt)
   }
 
   /**
    * 重建出来的记录没有连接到 approval/request 的 next()，需要自己看日志确认是否已经有结果，
-   * 否则用户一旦在别处决定，面板会一直停在“等待审批”。
+   * 否则用户一旦在别处决定，面板会一直停在“等待审批”（安全复查 2026-11-04）。
+   * 命中结果时统一走 finalizePending，确保中止侧调用、失效图片引用等清理一致。
    */
   function refreshReconstructed(record) {
-    if (record.reconstructed !== true || record.resolvedAt !== null) return
-    if (record.approvalId === undefined) return
+    if (record === null || record === undefined) return record
+    if (record.reconstructed !== true || record.resolvedAt !== null) return record
+    if (record.approvalId === undefined) return record
     try {
       const agent = liveAgentBySessionId(record.sessionId)
-      if (agent === null || typeof agent.session?.snapshotEvents !== 'function') return
+      if (agent === null || typeof agent.session?.snapshotEvents !== 'function') return record
       const events = agent.session.snapshotEvents()
       for (const event of events) {
         if (event?.type !== 'approval/decided') continue
         if (event.data?.id === undefined || String(event.data.id) !== record.approvalId) continue
-        record.resolvedAt = Date.now()
-        record.outcome = typeof event.data?.outcome === 'string' ? event.data.outcome : null
-        return
+        finalizePending(record, typeof event.data?.outcome === 'string' ? event.data.outcome : null, null)
+        break
       }
-    } catch {
-      /* ignore */
+    } catch (error) {
+      noteError('refresh-reconstructed', error)
     }
+    return record
   }
 
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-approval-consult",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "license": "MIT",
   "type": "module",
   "description": "Approval consultation panel for DeepSeek Harness: while a tool call waits for approval, ask the executor AI and the auto-review AI independently, in two isolated channels with prompt-cache reuse.",