dsh-approval-review 0.2.6 → 0.3.0

package/README-zh.md

@@ -61,8 +61,8 @@ dsh --profile <profile> --dump-config | grep -A6 'id: approval-review'
 |---|---|---|
 | `enabled` | `true` | 总开关。`false` 时插件仍挂载但不认领任何请求。 |
 | `enabledByDefault` | `true` | 会话初始的运行时开关状态。 |
-| `reviewTools` | `[bash, pwsh, write]` | 送往复核者的工具名 glob。 |
-| `defaultPolicy` | `human` | 未命中 glob 的工具走哪种策略：`ai` / `human` / `never`。 |
+| `reviewTools` | `['*']` | 送往复核者的工具名 glob。`*` = 所有工具，这是出厂立场：**由复核者裁决，而不是由工具名决定是否弹窗**。 |
+| `defaultPolicy` | `ai` | 未命中 glob 的工具走哪种策略：`ai` / `human` / `never`。默认 `ai`，所以漏配的工具也是**被裁决**，而不是悄悄退回人工。 |
 | `rules` | `[]` | 有序的 `{pattern, policy, field?, note?}` 正则规则，优先于工具表求值。`field` 可为 `reason`（默认）、`toolName`、`arguments`。 |
 | `reviewer.mode` | `subagent` | `subagent` 跑只读子代理（能读工作区）；`direct` 走一次性纯模型调用。 |
 | `reviewer.provider` / `.model` | *(继承)* | 复核路由；不填则继承调用 Agent 自己的路由。会话内可用 `/approval-review model [<provider>/]<id>` 覆盖（**「审批」页签右上角可以直接选**：点开即列出本机配置的模型，候选来自客户端自己的模型目录服务 `modelDirectories`——和 `/model` 选择器、输入框里的模型座位读的是同一份目录。列表由插件自己渲染（原生 `datalist`/`select` 的弹层字号字重无法用 CSS 控制，会显得比页面吵），支持输入过滤、方向键+回车，也可以手打目录里没有的 id）。 |
@@ -105,7 +105,11 @@ dsh --profile <profile> --dump-config | grep -A6 'id: approval-review'
 - **`human`** —— 用 `next()` 交还给应答链，也就是原本的审批弹窗。插件不会短路它。
 - **`never`** —— 直接 `rejected` 并附说明，不调复核、不弹窗。用于对某类工具做硬禁用。
 
-`edit` 故意**没有**放进默认 `reviewTools`：原地修改已有文件是日常操作里后果最重的一类，在部署方明确决定之前，它继续走人工审批。
+**出厂立场是「任何审批请求都先交给复核者」**（`reviewTools: ['*']` + `defaultPolicy: ai`），包括 `edit`、`web_fetch`、以及别的插件（如 `dsh-permission-rules` 的网络/路径规则）触发的 `ask`。风险不高就放行、风险高或复核者不确定才找人，闸门分别是 `maxAutoAllowRisk`、`onRiskExceeded`、`onUncertain`。
+
+代价是**每个请求一次复核模型调用**（十几秒到几十秒 + token），所以每回合的 `budget.maxReviewsPerTurn` 才是真正的刹车；想更保守的部署可以把 `reviewTools` 收窄回工具白名单，或把 `defaultPolicy` 设回 `human`。
+
+注意 `never` 规则（以及别的插件的确定性 `deny`）仍然在进入应答链**之前**硬拦——它们不是"审批请求"，是硬禁用。
 
 ### 示例：更严格的部署
 

package/cordis.patch.yml

@@ -18,16 +18,21 @@
         enabled: true
         # Session-start default for that switch.
         enabledByDefault: true
-        # Tool names routed to the reviewer model. Everything else falls through
-        # to `defaultPolicy`, whose default delegates to the human answerer.
-        # `edit` is deliberately absent: in-place modification of an existing
-        # file is the highest-consequence routine action, so it keeps the human
-        # prompt until a deployment decides otherwise.
+        # EVERY request reaches the reviewer, not just a tool list.
+        #
+        # `*` matches every tool name, and `defaultPolicy: ai` covers a request
+        # whose tool is not in the table at all, so nothing falls through to a
+        # human prompt on account of its tool name. A request still goes to a
+        # human for a reason the operator can see — see `onRiskExceeded`,
+        # `onUncertain`, `onReviewerFailure`, `budget.onExhausted` — and a `never`
+        # rule (or another plugin's deterministic deny) still hard-stops the
+        # catastrophic few BEFORE the seam, which is the point of keeping them.
+        #
+        # The cost is one reviewer subagent per request (tens of seconds and a
+        # model call each), so `budget.maxReviewsPerTurn` is what bounds a turn.
         reviewTools:
-          - bash
-          - pwsh
-          - write
-        defaultPolicy: human
+          - '*'
+        defaultPolicy: ai
         # Ordered regex rules, evaluated before the tool table. `field` selects
         # what the pattern is matched against: `reason` (default), `toolName`, or
         # `arguments`.

package/lib/index.js

@@ -29,12 +29,8 @@ const Config = Schema.object({
 	enabled: Schema.boolean().default(true).description("Master switch. When false the plugin registers nothing that claims a request."),
 	enabledByDefault: Schema.boolean().default(true).description("Session-start default for the per-session switch; `/approval-review off` overrides it durably."),
 	reviewerPreset: Schema.string().default("approve-for-me").description("Permission preset that turns auto-approval on. Empty means always claim. Set this to the preset key you added to `permissionPresets` (see cordis.patch.yml)."),
-	reviewTools: Schema.array(Schema.string()).default([
-		"bash",
-		"pwsh",
-		"write"
-	]).description("Tool-name glob patterns routed to the reviewer model."),
-	defaultPolicy: Schema.union(TOOL_POLICIES).default("human").description("Policy for tools matching no `reviewTools` pattern."),
+	reviewTools: Schema.array(Schema.string()).default(["*"]).description("Tool-name glob patterns routed to the reviewer model. `*` is every tool, which is the shipping stance: the reviewer decides, not the tool name."),
+	defaultPolicy: Schema.union(TOOL_POLICIES).default("ai").description("Policy for tools matching no `reviewTools` pattern. Defaults to `ai` so an unlisted tool is still judged rather than handed to a human prompt by default."),
 	rules: Schema.array(Schema.object({
 		pattern: Schema.string().required(),
 		policy: Schema.union(TOOL_POLICIES).required(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-approval-review",
-  "version": "0.2.6",
+  "version": "0.3.0",
   "description": "Codex-style agent auto-approval for DeepSeek Harness: an independent reviewer model decides allow/deny on the approval answerer chain, fail-closed, with a per-decision rationale — refusals and allows alike — in a dedicated Approvals tab. · DSH 插件：Codex 风格的 Agent 自动审批，独立 reviewer 模型裁决、fail-closed、每次审批（放行与否决）都留下详细理由，并在独立的「审批」页签中展示。",
   "type": "module",
   "main": "./lib/index.js",