dsh-approval-consult 1.1.3 → 1.1.5

package/README.en.md

@@ -53,7 +53,7 @@ notes or reject blindly. This plugin adds a consultation panel on top of the app
 
 Requires DSH Web `0.2.1-rc.2` (tested) and Node `>=20`.
 
-Current version **v1.1.3**, published to npm ([`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)) and as a [GitHub release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.3).
+Current version **v1.1.5**, published to npm ([`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)) and as a [GitHub release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.5).
 
 ```bash
 npm install dsh-approval-consult
@@ -61,7 +61,7 @@ npm install dsh-approval-consult
 
 Or install the release tarball:
 
-1. Download `dsh-approval-consult-1.1.3.tgz` from
+1. Download `dsh-approval-consult-1.1.5.tgz` from
    [Releases](https://github.com/0tests/dsh-approval-consult/releases/latest).
 2. Open DSH Web → **Plugins** → **Add plugin** → **Install third-party plugin** and point it at the
    tarball's absolute path (or the download URL directly).

package/README.md

@@ -37,7 +37,7 @@ Auto 审查（`@deepseek-ai/dsh-experimental-auto-review`）会在工具执行
 
 ## 安装
 
-> 当前版本 **v1.1.3**，已发布到 npm（[`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)）和 [GitHub Release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.3)。
+> 当前版本 **v1.1.5**，已发布到 npm（[`dsh-approval-consult`](https://www.npmjs.com/package/dsh-approval-consult)）和 [GitHub Release](https://github.com/0tests/dsh-approval-consult/releases/tag/v1.1.5)。
 > `npm install dsh-approval-consult`，或让 Agent 用 `plugin_manager` 安装这个包名；下面也保留了 tarball / 本地目录两种方式。
 
 ### 方式 A：npm
@@ -49,10 +49,10 @@ Auto 审查（`@deepseek-ai/dsh-experimental-auto-review`）会在工具执行
 ### 方式 B：从 Release 安装（tarball）
 
 1. 在 [Releases](https://github.com/0tests/dsh-approval-consult/releases/latest) 下载
-   `dsh-approval-consult-1.1.3.tgz`；
+   `dsh-approval-consult-1.1.5.tgz`；
 2. 打开 DSH Web → 左侧「插件」→「添加插件」→「安装第三方插件」，填这个 tarball 的绝对路径，
    或直接填下载链接
-   `https://github.com/0tests/dsh-approval-consult/releases/download/v1.1.3/dsh-approval-consult-1.1.3.tgz`；
+   `https://github.com/0tests/dsh-approval-consult/releases/download/v1.1.5/dsh-approval-consult-1.1.5.tgz`；
 3. 安装完成后点「立即启用」，重启一次 `dsh web` 更稳。
 
 ### 方式 C：本地目录（源码 / 开发）

package/lib/impl.js

@@ -1278,6 +1278,7 @@ export function apply(ctx, config, runtime) {
 
     /* 上面的 await 会让出执行权：必须在不再 await 的临界段里重新核对审批状态与并发名额，
        否则多个并发请求会一起通过数量检查（安全审查 2026-11-03）。 */
+    refreshReconstructed(record)
     if (record.resolvedAt !== null) {
       throw httpError(409, 'approval-resolved', '这次审批已经结束了，不能继续提问。')
     }
@@ -1394,6 +1395,8 @@ export function apply(ctx, config, runtime) {
         entry.answer = job.text
         entry.truncated = finishKind === 'length'
         entry.usage = job.usage
+        // 模型可能在后台轮询前就结束：提交结果/自动重试前同步审批。
+        refreshReconstructed(record)
         if (job.controller.signal.aborted) {
           job.status = 'cancelled'
           entry.status = 'cancelled'
@@ -1677,6 +1680,8 @@ export function apply(ctx, config, runtime) {
             if (chunk.reason?.kind === 'error' || chunk.reason?.kind === 'aborted') error = messageOf(chunk.reason.failure)
           }
         }
+        refreshReconstructed(record)
+        if (controller.signal.aborted) throw controller.signal.reason ?? new Error('review cancelled')
         review.text = text
         review.decisionText = text.trim()
         review.decision = parseReviewDecision(review.decisionText)
@@ -1833,7 +1838,8 @@ export function apply(ctx, config, runtime) {
     const key = typeof input?.consultKey === 'string' ? input.consultKey : ''
     if (key.length > 0) {
       const direct = state.pendings.get(key)
-      if (direct !== undefined) return direct
+      // 命中缓存也要同步状态：重建记录可能在别处已经被允许/拒绝（安全复查 2026-11-04）。
+      if (direct !== undefined) return refreshReconstructed(direct)
     }
     const sessionId = input?.sessionId === undefined || input.sessionId === null ? '' : String(input.sessionId)
     if (sessionId.length === 0) return null
@@ -1842,56 +1848,60 @@ export function apply(ctx, config, runtime) {
     const keys = state.pendingBySession.get(sessionId)
     if (!Array.isArray(keys) || keys.length === 0) {
       const rebuilt = reconstructPending(sessionId, callId.length > 0 ? callId : undefined, toolName.length > 0 ? toolName : undefined)
-      if (rebuilt !== null) refreshReconstructed(rebuilt)
-      return rebuilt
+      return rebuilt === null ? null : refreshReconstructed(rebuilt)
     }
     for (let index = keys.length - 1; index >= 0; index -= 1) {
       const record = state.pendings.get(keys[index])
       if (record === undefined || record.resolvedAt !== null) continue
       if (callId.length > 0) {
-        if (record.callId === callId) return record
+        if (record.callId === callId) return refreshReconstructed(record)
         continue
       }
       if (toolName.length > 0) {
-        if (record.toolName === toolName) return record
+        if (record.toolName === toolName) return refreshReconstructed(record)
         continue
       }
-      return record
+      return refreshReconstructed(record)
     }
     for (let index = keys.length - 1; index >= 0; index -= 1) {
       const record = state.pendings.get(keys[index])
       if (record === undefined) continue
       if (callId.length > 0 && record.callId !== callId) continue
       if (callId.length === 0 && toolName.length > 0 && record.toolName !== toolName) continue
-      return record
+      return refreshReconstructed(record)
     }
     // 记录可能因插件热重载/重启丢失：从会话日志里的 approval/asked（尚无 approval/decided）重建。
     const rebuilt = reconstructPending(sessionId, callId.length > 0 ? callId : undefined, toolName.length > 0 ? toolName : undefined)
-    if (rebuilt !== null) refreshReconstructed(rebuilt)
-    return rebuilt
+    return rebuilt === null ? null : refreshReconstructed(rebuilt)
   }
 
   /**
    * 重建出来的记录没有连接到 approval/request 的 next()，需要自己看日志确认是否已经有结果，
-   * 否则用户一旦在别处决定，面板会一直停在“等待审批”。
+   * 否则用户一旦在别处决定，面板会一直停在“等待审批”（安全复查 2026-11-04）。
+   * 命中结果时统一走 finalizePending，确保中止侧调用、失效图片引用等清理一致。
    */
-  function refreshReconstructed(record) {
-    if (record.reconstructed !== true || record.resolvedAt !== null) return
-    if (record.approvalId === undefined) return
+  function refreshReconstructed(record, decisionsBySession) {
+    if (record === null || record === undefined) return record
+    if (record.reconstructed !== true || record.resolvedAt !== null) return record
+    if (record.approvalId === undefined) return record
     try {
-      const agent = liveAgentBySessionId(record.sessionId)
-      if (agent === null || typeof agent.session?.snapshotEvents !== 'function') return
-      const events = agent.session.snapshotEvents()
-      for (const event of events) {
-        if (event?.type !== 'approval/decided') continue
-        if (event.data?.id === undefined || String(event.data.id) !== record.approvalId) continue
-        record.resolvedAt = Date.now()
-        record.outcome = typeof event.data?.outcome === 'string' ? event.data.outcome : null
-        return
+      let decisions = decisionsBySession?.get(record.sessionId)
+      if (decisions === undefined) {
+        const agent = liveAgentBySessionId(record.sessionId)
+        if (agent === null || typeof agent.session?.snapshotEvents !== 'function') return record
+        decisions = new Map()
+        for (const event of agent.session.snapshotEvents()) {
+          if (event?.type !== 'approval/decided' || event.data?.id === undefined) continue
+          decisions.set(String(event.data.id), typeof event.data?.outcome === 'string' ? event.data.outcome : null)
+        }
+        // 后台一轮检查中，同一会话只读取和索引一次日志。
+        decisionsBySession?.set(record.sessionId, decisions)
       }
-    } catch {
-      /* ignore */
+      if (decisions.has(record.approvalId)) finalizePending(record, decisions.get(record.approvalId), null)
+    } catch (error) {
+      noteError('refresh-reconstructed', error)
     }
+    return record
   }
 
   /**
@@ -2234,6 +2244,7 @@ export function apply(ctx, config, runtime) {
     const jobId = typeof query.jobId === 'string' ? query.jobId : ''
     const job = state.jobs.get(jobId)
     if (job === undefined) throw httpError(404, 'job-not-found', '这次回答已经过期或不存在。')
+    refreshReconstructed(state.pendings.get(job.consultKey))
     const cursor = intIn(query.cursor, 0, 0, Number.MAX_SAFE_INTEGER)
     const safeCursor = Math.min(cursor, job.text.length)
     return {
@@ -2500,7 +2511,7 @@ export function apply(ctx, config, runtime) {
             throw httpError(404, 'attachment-unknown', '这张图片已经失效，请重新上传。')
           }
           // 审批结束后图片引用必须立即失效（finalizePending 会清理，这里兜底防止竞态残留）。
-          const pendingForImage = state.pendings.get(consultKey)
+          const pendingForImage = refreshReconstructed(state.pendings.get(consultKey))
           if (pendingForImage === undefined || pendingForImage.resolvedAt !== null) {
             throw httpError(404, 'attachment-unknown', '这张图片已经失效，请重新上传。')
           }
@@ -2513,6 +2524,11 @@ export function apply(ctx, config, runtime) {
           } catch (error) {
             throw mapAttachmentError(error)
           }
+          // readImage 等待期间也可能结束审批或撤销引用，发送字节前再次核对。
+          refreshReconstructed(pendingForImage)
+          if (pendingForImage.resolvedAt !== null || state.attachments.get(id) !== item || Date.now() > item.expiresAt) {
+            throw httpError(404, 'attachment-unknown', '这张图片已经失效，请重新上传。')
+          }
           sendImage(res, stored.data, stored.ref?.mediaType ?? item.ref.mediaType)
           return
         }
@@ -2542,6 +2558,7 @@ export function apply(ctx, config, runtime) {
           const data = await readBinaryBody(req, limit)
           if (data.length === 0) throw httpError(400, 'attachment-bad-request', '图片内容为空。')
           // 读取期间审批可能已经结束：结束后的图片一律不再登记（否则会“复活”已失效引用）。
+          refreshReconstructed(record)
           if (record.resolvedAt !== null) {
             throw httpError(409, 'approval-resolved', '这次审批已经结束，不能再上传图片。')
           }
@@ -2557,6 +2574,7 @@ export function apply(ctx, config, runtime) {
           }
           // saveImage 也可能耗时：登记前再复核一次；若此时审批已结束，本次保存的宿主对象
           // 没有对应引用（宿主接口未提供删除语义），但绝不会被登记成可读取的附件。
+          refreshReconstructed(record)
           if (record.resolvedAt !== null) {
             throw httpError(409, 'approval-resolved', '这次审批已经结束，不能再上传图片。')
           }
@@ -3452,6 +3470,14 @@ export function apply(ctx, config, runtime) {
     }
   }
 
+  // 重建记录没有原审批的完成回调：即使面板关闭，也要取消侧调用并失效附件。
+  // 后台延迟为一次轮询间隔（正常调度下约 1 秒）；敏感路由另做即时复核。
+  const reconstructedTimer = setInterval(() => {
+    const decisionsBySession = new Map()
+    for (const record of state.pendings.values()) refreshReconstructed(record, decisionsBySession)
+  }, 1000)
+  if (typeof reconstructedTimer.unref === 'function') reconstructedTimer.unref()
+  addDisposer(() => clearInterval(reconstructedTimer))
 
   const sweepTimer = setInterval(() => {
     try {
@@ -3524,6 +3550,11 @@ export function apply(ctx, config, runtime) {
       }
     }
     disposers.length = 0
+    for (const record of state.pendings.values()) {
+      for (const review of [record.review, record.advisoryReview]) {
+        review?.classifyController?.abort(new Error('approval-consult unloaded'))
+      }
+    }
     for (const job of state.jobs.values()) {
       if (job.status !== 'streaming') continue
       job.status = 'cancelled'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-approval-consult",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "license": "MIT",
   "type": "module",
   "description": "Approval consultation panel for DeepSeek Harness: while a tool call waits for approval, ask the executor AI and the auto-review AI independently, in two isolated channels with prompt-cache reuse.",
@@ -34,7 +34,7 @@
     "NOTICE.md"
   ],
   "scripts": {
-    "test": "node tests/unit.mjs && node tests/locale-parity.mjs && node tests/css-classes.mjs && node tests/security.mjs",
+    "test": "node tests/unit.mjs && node tests/locale-parity.mjs && node tests/css-classes.mjs && node tests/security.mjs && node tests/security-lifecycle.mjs",
     "check": "node --check lib/impl.js && node --check lib/client.js && node --check lib/index.js"
   },
   "engines": {