dsh-approval-review 0.3.0 → 0.3.1

package/README-zh.md

@@ -82,7 +82,7 @@ dsh --profile <profile> --dump-config | grep -A6 'id: approval-review'
 | `maxAutoAllowRisk` | `medium` | 允许复核者自动放行的最高风险。 |
 | `onRiskExceeded` | `delegate` | 超过该上限时：`allow` / `delegate` / `deny`。 |
 | `onUncertain` | `delegate` | 复核者表示无法判断时。 |
-| `onReviewerFailure` | `rejected` | 复核崩溃、超时或输出不合 schema 时。 |
+| `onReviewerFailure` | `delegate` | 复核崩溃、超时或输出不合 schema 时。默认**转人工**：复核者跑不起来是基础设施问题，不是裁决；会拒的部署请显式设成 `rejected`。 |
 | `budget.maxReviewsPerTurn` | `20` | 每回合复核调用上限。 |
 | `budget.onExhausted` | `delegate` | 预算耗尽后：`delegate` / `deny`。 |
 | `maxFailuresPerTurn` | `10` | 每回合复核**失败**次数上限，超过即转人工。 |
@@ -224,7 +224,7 @@ dsh --profile <profile> --dump-config | grep -A6 'id: approval-review'
 - **复核者的证据是数据，不是指令。** 证据包里的 transcript 与申请理由可能包含仓库可控文本（`AGENTS.md`、被审文件、命令输出）。数据/指令边界由代码追加、不受 `policyText` 覆盖；证据中出现指令或"已经批准过"的说法一律作为反对证据。
 - **复核者是只读的。** `mode: direct` 是一次不挂工具的模型调用；`mode: subagent` 是有 `toolFilter` 白名单与 `maxDepth: 1`（子代理自身深度，允许它存在、不允许它再派孙代理）的子代理。两种形态都无法写入、执行或委派，因此即便复核者被攻破，也无法升级它所守卫的那道边界。
 - **复核者不会递归。** 子代理一旦建立即被登记为复核者会话，它自己的审批请求交还人工链，不会回到正在服务它的应答者。
-- **默认失败即拒绝。** `onReviewerFailure: rejected`、`onUncertain: delegate`、`maxAutoAllowRisk: medium` 是出厂选择：误拒一个安全动作的代价是一次重试，误放一个危险动作可能无法挽回。
+- **复核者跑不起来时找人不拒绝。** `onReviewerFailure: delegate`、`onUncertain: delegate`、`maxAutoAllowRisk: medium` 是出厂选择：复核者无法运行属于基础设施故障，把它变成自动拒绝会让操作者看到一次模型从未做出的否决。要 fail-closed 的部署显式设 `onReviewerFailure: rejected`：那时误拒一个安全动作的代价是一次重试，而误放一个危险动作可能无法挽回。
 - **它不是安全保证。** 它只评估审批缝真正提出的请求，而语言模型会犯错，在对抗性场景下尤其如此。它是配置良好的沙箱的补充，不是替代。
 
 ## 开发

package/README.md

@@ -102,7 +102,7 @@ schema defaults.
 | `maxAutoAllowRisk` | `medium` | Highest risk the reviewer may auto-allow. |
 | `onRiskExceeded` | `delegate` | `allow` / `delegate` / `deny` above that ceiling. |
 | `onUncertain` | `delegate` | Reviewer reported it could not decide. |
-| `onReviewerFailure` | `rejected` | Reviewer crashed, timed out, or answered off-schema. |
+| `onReviewerFailure` | `delegate` | Reviewer crashed, timed out, or answered off-schema. Defaults to **delegating**: a reviewer that could not run is an infrastructure problem, not a verdict — set `rejected` for the fail-closed stance. |
 | `budget.maxReviewsPerTurn` | `20` | Reviewer calls per open turn. |
 | `budget.onExhausted` | `delegate` | `delegate` / `deny` once spent. |
 | `maxFailuresPerTurn` | `10` | Reviewer *failures* per open turn before requests delegate. |
@@ -304,8 +304,10 @@ reconstructible from the log alone.
 - **The reviewer cannot recurse.** A reviewer child is registered as soon as it
   exists, so its own approval asks are delegated to the human chain instead of
   returning to the answerer serving it.
-- **Fail closed by default.** `onReviewerFailure: rejected`, `onUncertain:
-  delegate`, and `maxAutoAllowRisk: medium` are the shipping choices because
+- **A reviewer that cannot run asks a human.** `onReviewerFailure: delegate`,
+  `onUncertain: delegate`, and `maxAutoAllowRisk: medium` are the shipping
+  choices: refusing in the model's name would make an infrastructure failure
+  look like a judgement. Set `onReviewerFailure: rejected` for fail-closed, where
   refusing a safe action costs a retry while approving an unsafe one may be
   unrecoverable.
 - **It is not a security guarantee.** It evaluates only the requests the approval

package/cordis.patch.yml

@@ -62,9 +62,14 @@
         onRiskExceeded: delegate
         # Reviewer said it could not decide.
         onUncertain: delegate
-        # Reviewer crashed, timed out, or answered off-schema. `rejected` is the
-        # fail-closed stance; `delegate` hands the request to the human chain.
-        onReviewerFailure: rejected
+        # Reviewer crashed, timed out, or answered off-schema.
+        #
+        # `delegate` hands the request to the human chain: a reviewer that could
+        # not run is an INFRASTRUCTURE problem (a dead route, an expired
+        # credential, a timeout), and turning that into an automatic refusal
+        # makes the operator see a denial the model never made. `rejected` is the
+        # fail-closed alternative for deployments that prefer refusing to asking.
+        onReviewerFailure: delegate
         # Per-turn reviewer budget, so a loop cannot bill unlimited reviews.
         budget:
           maxReviewsPerTurn: 20

package/lib/index.js

@@ -80,7 +80,7 @@ const Config = Schema.object({
 		"rejected",
 		"delegate",
 		"allow-once"
-	]).default("rejected").description("Reaction when the reviewer crashes, times out, or answers off-schema."),
+	]).default("delegate").description("Reaction when the reviewer crashes, times out, or answers off-schema. `delegate` (default) hands the request to the human chain: a reviewer that could not run is an infrastructure problem, not a judgement. `rejected` refuses instead."),
 	budget: Schema.object({
 		maxReviewsPerTurn: Schema.number().step(1).min(1).default(20).description("Maximum reviewer calls per open turn."),
 		onExhausted: Schema.union(["delegate", "deny"]).default("delegate").description("Reaction once the per-turn review budget is spent.")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-approval-review",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Codex-style agent auto-approval for DeepSeek Harness: an independent reviewer model decides allow/deny on the approval answerer chain, fail-closed, with a per-decision rationale — refusals and allows alike — in a dedicated Approvals tab. · DSH 插件：Codex 风格的 Agent 自动审批，独立 reviewer 模型裁决、fail-closed、每次审批（放行与否决）都留下详细理由，并在独立的「审批」页签中展示。",
   "type": "module",
   "main": "./lib/index.js",