dsh-auto-check 0.1.1 → 0.2.0

package/README.md

@@ -9,7 +9,7 @@
 - 自动审查请求的 `system` 提示以 `REVIEW_POLICY\n` 开头，这是插件识别它的唯一稳定标记。
 - 命中后，插件用配置的 provider / model 重新发起一次 LLM 请求；未配置或只配置了一半时，保持原有行为。
 - 改写后的请求会被标记，避免再次进入本插件造成递归。
-- 不替换、不修改自带的 `auto-review` 插件；自动审查的策略、审批和拒绝逻辑全部保持原样。
+- 不替换、不修改自带的 `auto-review` 插件；审查策略本身保持原样。插件只在其外层包一层 `tools/pre-execute` 监听，把「审查拒绝 / 审查失败」交给用户选择（见下文「审查拒绝时」）。
 
 ## 配置
 
@@ -20,8 +20,32 @@
    - **自动识别**（默认）：目标模型名包含 `Qwen3Guard` 时使用 Qwen3Guard 适配，否则使用标准 JSON 协议。
    - **标准 JSON**：要求审查模型严格输出 `{risk, decision, reason?}`，适用于通用模型。
    - **Qwen3Guard 安全分级**：适用于 Qwen3Guard-Gen 系列（0.6B / 4B / 8B）。
+5. 按需设置「审查拒绝时」（`onBlock`）与「审查超时」（`reviewTimeoutMs`），见下一节。
 
-模型列表来自当前会话可路由的模型目录。只影响自动审查，不影响主对话或子代理。
+模型列表来自当前会话可路由的模型目录。打开页面、窗口重新聚焦，以及模型/凭据设置变更时会自动刷新；也可以点击「刷新列表」手动重新拉取。只影响自动审查，不影响主对话或子代理。
+
+## 审查拒绝时：把选择权交还给你
+
+自动审查在以下三种情况下会阻止工具调用：
+
+| 情况 | 原有行为 | 现在（`onBlock: ask`，默认） |
+| --- | --- | --- |
+| 审查模型拒绝，审批策略为 `never` 覆盖 | 直接拒绝 | 弹出问题让你选择 |
+| 审查模型拒绝，审批策略为 `ask` | 弹出审批确认 | 不变（仍由宿主的审批卡片确认） |
+| 审查模型拒绝，配置的审批策略为 `never` | 审批服务自动拒绝 | 弹出问题让你选择 |
+| 审查模型出错 / 无响应 / 超时 | 直接拒绝（fail-closed） | 弹出问题让你选择 |
+
+问题卡片会显示工具名和审查原因（例如 `Qwen3Guard: Controversial (categories: ...)`），选项为：
+
+- **维持拒绝**（推荐，默认预选）：工具不执行，代理收到原来的拒绝结果。
+- **仍要执行（放行一次）**：只执行这一次调用，不会放行其他调用。
+
+安全底线：只有明确点选「放行一次」才会执行。跳过、取消、自定义输入、会话中止、没有可用的提问通道（例如无界面运行或子代理）或提问出错时，**一律维持原拒绝**，绝不静默放行。
+
+- `onBlock`：`ask`（默认）或 `deny`。`deny` 恢复原有行为：不弹问题，按原策略拒绝。
+- `reviewTimeoutMs`：单独配置的审查模型在此时长（毫秒）内没有给出结果时，插件中止该请求并以 `REVIEWER_TIMEOUT` 错误结束审查流，自动审查据此判定「审查失败」，再交给你选择。默认 `60000`，`0` 表示不限时。只对本插件改写过路由的审查请求生效；「跟随主模型」时不加超时，但主模型出错导致的审查失败同样会弹出选择。
+
+实现说明：宿主的审查闸门以 `prepend` 方式注册在 `tools/pre-execute` 上。cordis 的 `prepend` 使用 `unshift`，`waterfall` 从数组第 0 个开始执行，所以最后注册的 `prepend` 监听在最外层。插件加载顺序不固定，因此本插件监听 `internal/listener`：每当有新的 `prepend` 监听注册到 `tools/pre-execute`，就在下一个微任务把自己重新注册回最外层，保证总能拿到闸门的结果。测试用真实 cordis 验证了两种加载顺序。
 
 ## Qwen3Guard 适配
 
@@ -42,9 +66,38 @@ Categories: <分类列表 | None>
 
 > Qwen3Guard 只判断内容安全，不判断工具调用的业务正确性；`Safe` 只代表内容没有命中安全分类，不代表这次工具调用一定符合你的意图。
 
-> Qwen3Guard 只支持 Gen 系列的安全分级输出，Stream 系列是逐 token 审核，不适用本适配。`Controversial` 在本插件中映射为中风险拒绝：在 auto review 的默认审批策略下，它可能被转成一次用户确认，而不是直接丢弃；如果审批策略是 `never`，则会直接拒绝。若模型别名不含 `Qwen3Guard`，请在「审查协议」中显式选择 Qwen3Guard。
+> Qwen3Guard 只支持 Gen 系列的安全分级输出，Stream 系列是逐 token 审核，不适用本适配。`Controversial` 在本插件中映射为中风险拒绝：默认（`onBlock: ask`）会弹出问题，由你选择放行一次或维持拒绝，审批策略为 `never` 时也是如此；设为 `onBlock: deny` 则恢复原有行为（`never` 下直接拒绝）。若模型别名不含 `Qwen3Guard`，请在「审查协议」中显式选择 Qwen3Guard。
+
+> 审查模型不可用（例如凭据失效、模型下线、超过「审查超时」）时，默认会把失败原因展示给你并由你选择放行一次或维持拒绝；`onBlock: deny` 时按原有失败策略直接拒绝。长期不可用时请换回「跟随主模型」或选择一个可用模型。
+
+### 长会话与 32k 上下文
+
+自动审查会把当前会话的过滤历史和待审工具调用一起发给审查模型。长会话的审查输入可能达到数万 Token，超过 Qwen3Guard-Gen 本地 32k 上下文，导致自动审查失败（默认每次都会弹出选择，`onBlock: deny` 时直接拒绝）。
+
+「最大审查字符数」用于 Qwen3Guard 协议：超过预算时保留开头（环境与项目指令）和结尾（最近历史与待审调用），截断中间并插入标记。默认 `64000` 字符（约 16k Token），适配 32k 上下文并留出输出余量；设为 `0` 可关闭截断。使用更大上下文的远程模型时可以调高或关闭。
+
+### 云端 / 兼容网关：`store` 字段被拒绝
+
+一些 OpenAI 兼容网关（例如 newapi 代理的 Qwen3Guard）会返回：
+
+```text
+400 'store' is not supported by this endpoint (param: store, code: unsupported_field)
+```
+
+这是 pi-ai 的兼容层在 `compat.supportsStore` 为真时自动附加了 `store: false`，而网关不接受该字段。给该 provider 的模型配置 `compat`：
+
+```yaml
+security-huahuo-newapi:
+  api: openai-completions
+  baseURL: https://newapi.amaicat.work/v1
+  compat:
+    supportsStore: false
+  models:
+    - id: Qwen3Guard-Gen-4B
+      name: Qwen3Guard-Gen-4B
+```
 
-> 审查模型不可用（例如凭据失效、模型下线）时，自动审查会按原有失败策略拒绝工具调用。换回「跟随主模型」或选择一个可用模型即可恢复。
+本插件也会在 Qwen3Guard 请求中主动丢弃 `store`，但适配器层附加的字段需要在 provider 配置里关闭。
 
 ## 安装
 
@@ -58,12 +111,13 @@ Categories: <分类列表 | None>
 ## 开发验证
 
 ```powershell
-node --test test/review-route.test.mjs
+npm test
 node --check lib/index.js
+node --check lib/review-choice.js
 node --check client.js
 ```
 
-测试覆盖：普通请求放行、审查请求改写、递归回放、空配置回退、同路由不重复改写、Qwen3Guard 协议探测、请求改写、标签映射与流转换。
+测试覆盖：普通请求放行、审查请求改写、递归回放、空配置回退、同路由不重复改写、Qwen3Guard 协议探测、请求改写、字符预算截断、标签映射与流转换；审查闸门三种拒绝形态识别、提问与答案解析、提问失败一律维持拒绝、审查超时合成 `REVIEWER_TIMEOUT` 结束块，以及在真实 cordis 中两种加载顺序下都位于闸门外层（找不到宿主 checkout 时该项跳过）。
 
 ## 发布到 npm
 

package/client.js

@@ -1,10 +1,12 @@
 window.__ModuleLoader__.load({
   id: "dsh-auto-check",
   factory: (require) => {
+    const React = require("react");
     const { jsx, jsxs } = require("react/jsx-runtime");
     const {
       SettingsForm,
       SettingsFormModel,
+      settingsNumberField,
       settingsTextField,
     } = require("@deepseek-ai/dsh-client-ui-primitives");
 
@@ -17,7 +19,13 @@ window.__ModuleLoader__.load({
       ".dshAutoCheckLabel{color:var(--dsw-alias-label-primary);font-size:13px;line-height:1.5}" +
       ".dshAutoCheckSelect{background:var(--dsw-alias-bg-layer-1);border:.5px solid var(--dsw-alias-border-l4);border-radius:var(--dsw-radius-md);color:var(--dsw-alias-label-primary);font:inherit;font-size:13px;min-height:32px;padding:4px 8px;width:100%;max-width:520px}" +
       ".dshAutoCheckSelect:disabled{opacity:.6}" +
+      ".dshAutoCheckInput{background:var(--dsw-alias-bg-layer-1);border:.5px solid var(--dsw-alias-border-l4);border-radius:var(--dsw-radius-md);color:var(--dsw-alias-label-primary);font:inherit;font-size:13px;min-height:32px;padding:4px 8px;width:100%;max-width:260px}" +
+      ".dshAutoCheckInput:disabled{opacity:.6}" +
       ".dshAutoCheckHint{margin:0;color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:1.5}" +
+      ".dshAutoCheckRefresh{display:flex;align-items:center;gap:8px;margin:0}" +
+      ".dshAutoCheckRefresh button{background:0 0;border:.5px solid var(--dsw-alias-border-l3);border-radius:var(--dsw-radius-sm);color:var(--dsw-alias-label-primary);cursor:pointer;font:inherit;font-size:12px;line-height:18px;padding:2px 10px}" +
+      ".dshAutoCheckRefresh button:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}" +
+      ".dshAutoCheckRefresh button:disabled{opacity:.5;cursor:default}" +
       ".dshAutoCheckNotice{margin:0;color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:1.5}" +
       ".dshAutoCheckError{display:flex;align-items:center;gap:12px;margin:0;color:var(--dsw-alias-state-error-primary);font-size:12px;line-height:1.5}" +
       ".dshAutoCheckError button{background:0 0;border:0;color:var(--dsw-alias-brand-primary);cursor:pointer;font:inherit;padding:0}";
@@ -44,8 +52,20 @@ window.__ModuleLoader__.load({
       protocolJson: "标准 JSON（通用模型）",
       protocolQwen3Guard: "Qwen3Guard 安全分级",
       protocolHint: "Qwen3Guard 模式会去掉 auto review 的 JSON 策略，把待审内容作为用户消息发送，并把 Safety 标签映射为风险等级：Safe 放行，Controversial / Unsafe 拒绝。",
-      protocolWarning: "Controversial 按中风险拒绝；默认审批策略下可能转人工确认，审批策略为 never 时直接拒绝。",
+      protocolWarning: "Controversial 按中风险拒绝。按下方「审查拒绝时」的设置，默认会弹出问题让你选择放行一次或维持拒绝（审批策略为 never 时同样如此）。",
+      onBlock: "审查拒绝时",
+      onBlockAsk: "询问我：放行一次或维持拒绝（默认）",
+      onBlockDeny: "直接拒绝（原有行为）",
+      onBlockHint: "审查模型拒绝、出错或超时时，默认把原因展示给你并由你选择；跳过、取消或无法弹出问题时一律维持拒绝。选「直接拒绝」恢复原有的失败即拒绝行为。",
+      reviewTimeoutMs: "审查超时",
+      reviewTimeoutMsHint: "单独配置的审查模型超过此时长仍未给出结果时，视为无响应并交给你选择。0 表示不限时。跟随主模型时不生效。",
+      reviewTimeoutMsUnit: "毫秒",
+      maxInputChars: "最大审查字符数",
+      maxInputCharsHint: "Qwen3Guard 模式下，超过此长度的审查内容会保留首尾、截断中间，避免 32k 本地模型上下文溢出。0 表示不截断。",
+      maxInputCharsUnit: "字符",
       loading: "正在加载可用模型…",
+      refresh: "刷新列表",
+      refreshing: "刷新中…",
       loadFailed: "无法加载模型列表。",
       retry: "重试",
       partial: "部分提供商暂不可用，列表可能不完整。",
@@ -68,8 +88,20 @@ window.__ModuleLoader__.load({
       protocolJson: "Standard JSON (general models)",
       protocolQwen3Guard: "Qwen3Guard safety grading",
       protocolHint: "Qwen3Guard mode removes auto review's JSON policy, sends the pending content as the user message, and maps the Safety label to a risk level: Safe allows; Controversial / Unsafe deny.",
-      protocolWarning: "Controversial is denied as medium risk; the default approval policy may turn it into a user confirmation, while a `never` override denies it outright.",
+      protocolWarning: "Controversial is denied as medium risk. With \"When review blocks\" below set to ask (the default), you are asked to allow it once or keep it denied, including under the `never` approval policy.",
+      onBlock: "When review blocks",
+      onBlockAsk: "Ask me: allow once or keep denied (default)",
+      onBlockDeny: "Deny outright (original behaviour)",
+      onBlockHint: "When the reviewer denies, errors or times out, the reason is shown and you decide. A skipped, cancelled or undeliverable question always keeps the denial. Choose \"Deny outright\" to restore the original fail-closed behaviour.",
+      reviewTimeoutMs: "Review timeout",
+      reviewTimeoutMsHint: "If a dedicated reviewer model gives no result within this time, it counts as unresponsive and you decide. 0 disables the timeout. Not applied when following the main model.",
+      reviewTimeoutMsUnit: "milliseconds",
+      maxInputChars: "Maximum review characters",
+      maxInputCharsHint: "In Qwen3Guard mode, longer review input keeps its head and tail and drops the middle, so a 32k local model does not overflow. 0 disables truncation.",
+      maxInputCharsUnit: "characters",
       loading: "Loading available models…",
+      refresh: "Refresh list",
+      refreshing: "Refreshing…",
       loadFailed: "Could not load the model list.",
       retry: "Retry",
       partial: "Some providers are unavailable, so the list may be incomplete.",
@@ -97,6 +129,9 @@ window.__ModuleLoader__.load({
           settingsTextField("provider"),
           settingsTextField("model"),
           settingsTextField("protocol"),
+          settingsNumberField("maxInputChars"),
+          settingsTextField("onBlock"),
+          settingsNumberField("reviewTimeoutMs"),
         ]);
         this.actions = this.form.actions();
         this.store = this.form.bind(() => this.projection());
@@ -104,7 +139,6 @@ window.__ModuleLoader__.load({
         this.catalogStatus = "loading";
         this.catalogPartial = false;
         this.generation = 0;
-        void this.refreshCatalog();
       }
 
       projection() {
@@ -113,6 +147,9 @@ window.__ModuleLoader__.load({
           provider: this.form.field("provider"),
           model: this.form.field("model"),
           protocol: this.form.field("protocol"),
+          maxInputChars: this.form.field("maxInputChars"),
+          onBlock: this.form.field("onBlock"),
+          reviewTimeoutMs: this.form.field("reviewTimeoutMs"),
           groups: this.groups,
           catalogStatus: this.catalogStatus,
           catalogPartial: this.catalogPartial,
@@ -175,11 +212,33 @@ window.__ModuleLoader__.load({
     function AutoCheckCard(props) {
       const { t } = props;
       const state = props.useAutoCheckCard((snapshot) => snapshot);
+      const refreshRef = React.useRef(props.refreshCatalog);
+      refreshRef.current = props.refreshCatalog;
+
+      React.useEffect(() => {
+        refreshRef.current();
+      }, []);
+
+      React.useEffect(() => {
+        const refresh = () => refreshRef.current();
+        const onVisibility = () => {
+          if (document.visibilityState === "visible") refresh();
+        };
+        window.addEventListener("focus", refresh);
+        document.addEventListener("visibilitychange", onVisibility);
+        return () => {
+          window.removeEventListener("focus", refresh);
+          document.removeEventListener("visibilitychange", onVisibility);
+        };
+      }, []);
+
       if (props.view === "summary") return t("description");
 
       const provider = state.provider.text.trim();
       const model = state.model.text.trim();
       const protocol = state.protocol.text.trim() || "auto";
+      const onBlock =
+        (state.onBlock?.text ?? "").trim().toLowerCase() === "deny" ? "deny" : "ask";
       const current = provider !== "" && model !== "" ? provider + SEP + model : "";
       const routes = new Set();
       for (const group of state.groups) {
@@ -285,6 +344,81 @@ window.__ModuleLoader__.load({
                 }),
               ],
             }),
+            jsxs("div", {
+              className: "dshAutoCheckField",
+              children: [
+                jsx("label", {
+                  className: "dshAutoCheckLabel",
+                  htmlFor: "dsh-auto-check-max-input",
+                  children: t("maxInputChars"),
+                }),
+                jsx("input", {
+                  className: "dshAutoCheckInput",
+                  id: "dsh-auto-check-max-input",
+                  type: "number",
+                  min: 0,
+                  step: 1000,
+                  value: state.maxInputChars?.text ?? "",
+                  disabled: !state.writable || state.saving,
+                  onChange: (event) =>
+                    props.edit("maxInputChars", event.target.value),
+                }),
+                jsx("p", {
+                  className: "dshAutoCheckHint",
+                  children: t("maxInputCharsHint"),
+                }),
+              ],
+            }),
+            jsxs("div", {
+              className: "dshAutoCheckField",
+              children: [
+                jsx("label", {
+                  className: "dshAutoCheckLabel",
+                  htmlFor: "dsh-auto-check-on-block",
+                  children: t("onBlock"),
+                }),
+                jsx("select", {
+                  className: "dshAutoCheckSelect",
+                  id: "dsh-auto-check-on-block",
+                  value: onBlock,
+                  disabled: !state.writable || state.saving,
+                  onChange: (event) => props.edit("onBlock", event.target.value),
+                  children: [
+                    jsx("option", { value: "ask", children: t("onBlockAsk") }, "ask"),
+                    jsx("option", { value: "deny", children: t("onBlockDeny") }, "deny"),
+                  ],
+                }),
+                jsx("p", {
+                  className: "dshAutoCheckHint",
+                  children: t("onBlockHint"),
+                }),
+              ],
+            }),
+            jsxs("div", {
+              className: "dshAutoCheckField",
+              children: [
+                jsx("label", {
+                  className: "dshAutoCheckLabel",
+                  htmlFor: "dsh-auto-check-review-timeout",
+                  children: t("reviewTimeoutMs") + " (" + t("reviewTimeoutMsUnit") + ")",
+                }),
+                jsx("input", {
+                  className: "dshAutoCheckInput",
+                  id: "dsh-auto-check-review-timeout",
+                  type: "number",
+                  min: 0,
+                  step: 1000,
+                  value: state.reviewTimeoutMs?.text ?? "",
+                  disabled: !state.writable || state.saving,
+                  onChange: (event) =>
+                    props.edit("reviewTimeoutMs", event.target.value),
+                }),
+                jsx("p", {
+                  className: "dshAutoCheckHint",
+                  children: t("reviewTimeoutMsHint"),
+                }),
+              ],
+            }),
             jsx("p", {
               className: "dshAutoCheckHint",
               children: t("hint"),
@@ -299,6 +433,20 @@ window.__ModuleLoader__.load({
                   children: t("protocolWarning"),
                 })
               : null,
+            jsxs("div", {
+              className: "dshAutoCheckRefresh",
+              children: [
+                jsx("button", {
+                  type: "button",
+                  disabled: state.catalogStatus === "loading" || state.saving,
+                  onClick: () => props.refreshCatalog(),
+                  children:
+                    state.catalogStatus === "loading"
+                      ? t("refreshing")
+                      : t("refresh"),
+                }),
+              ],
+            }),
             state.catalogStatus === "loading"
               ? jsx("p", {
                   className: "dshAutoCheckNotice",
@@ -350,6 +498,25 @@ window.__ModuleLoader__.load({
       );
       ctx.effect(() => () => card.dispose(), "dsh-auto-check: form subscription");
 
+      ctx.effect(() => {
+        const events = [
+          "llm/adapters-updated",
+          "settings/document-updated",
+          "credentials/record-updated",
+          "credentials/reference-updated",
+        ];
+        const disposers = events.map((event) =>
+          ctx.remote.$on(event, () => {
+            void card.refreshCatalog();
+          }),
+        );
+        return () => {
+          for (const dispose of disposers) {
+            if (typeof dispose === "function") dispose();
+          }
+        };
+      }, "dsh-auto-check: model catalog refresh");
+
       ctx.effect(
         () =>
           ctx.configForms.whileServed([ENTRY_ID], () =>
@@ -363,6 +530,7 @@ window.__ModuleLoader__.load({
                   locale: NS,
                   inject: () => ({
                     ...card.inject(),
+                    refreshCatalog: () => card.refreshCatalog(),
                     retryCatalog: () => card.refreshCatalog(),
                     selectRoute: (route) => card.selectRoute(route),
                   }),

package/lib/index.js

@@ -1,17 +1,30 @@
 import { Service } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
 import { routeReview } from "./review-route.js";
+import {
+  createReviewChoiceListener,
+  keepOutermost,
+  withReviewDeadline,
+} from "./review-choice.js";
 
 /**
  * Owns the reviewer route and rewrites Auto review requests before they reach
  * the adapter. An empty provider or model keeps the shipped behaviour: the
  * reviewer follows the main model selected for the session.
+ *
+ * It also wraps the Auto review gate so a reviewer denial or a reviewer that
+ * does not answer becomes a question to the user instead of a hard denial
+ * (`onBlock: "ask"`, the default). `onBlock: "deny"` keeps the shipped
+ * behaviour.
  */
 class AutoCheckReviewer extends Service {
   static Config = z.object({
     provider: z.string().default("").volatile(),
     model: z.string().default("").volatile(),
     protocol: z.string().default("auto").volatile(),
+    maxInputChars: z.number().default(64000).volatile(),
+    onBlock: z.string().default("ask").volatile(),
+    reviewTimeoutMs: z.number().default(60000).volatile(),
   });
 
   constructor(ctx, config) {
@@ -26,20 +39,41 @@ class AutoCheckReviewer extends Service {
       child.effect(() =>
         child.on(
           "llm/stream",
-          (options, next) =>
-            routeReview(
+          (options, next) => {
+            const deadline = new AbortController();
+            const stream = routeReview(
               options,
               {
                 provider: this.config.provider.get(),
                 model: this.config.model.get(),
                 protocol: this.config.protocol.get(),
+                maxInputChars: this.config.maxInputChars.get(),
+                signal: deadline.signal,
               },
               (request) => child.llm.stream(request),
-            ) ?? next(),
+            );
+            if (stream === undefined) return next();
+            return withReviewDeadline(
+              stream,
+              Number(this.config.reviewTimeoutMs.get()),
+              () => deadline.abort(new Error("auto-check: reviewer timed out")),
+            );
+          },
           { global: true, prepend: true },
         ),
       );
     });
+
+    // Services are looked up per call, so a missing `userQuestions` service
+    // simply keeps the original denial (the same as `onBlock: "deny"`).
+    // `keepOutermost` documents why this listener must wrap the gate and how
+    // it stays at index 0 regardless of plugin load order.
+    const listener = createReviewChoiceListener({
+      onBlock: () => this.config.onBlock.get(),
+      userQuestions: () => ctx.get("userQuestions"),
+      approval: () => ctx.get("approval"),
+    });
+    ctx.effect(() => keepOutermost(ctx, "tools/pre-execute", listener));
   }
 }
 

package/lib/review-choice.js

@@ -0,0 +1,336 @@
+/**
+ * Hand Auto review denials back to the user.
+ *
+ * The shipped Auto review gate (`dsh-experimental-auto-review`) ends a tool
+ * call in one of three ways when its reviewer does not allow it:
+ *
+ * - `denied()`: `{kind:"deny", info:{code:"AUTO_REVIEW_DENIED"}}`, returned
+ *   when the session approval override is `never`. Final, no prompt.
+ * - `failed()`: `{kind:"deny", reason:'Auto review of tool "X" failed; ...'}`,
+ *   returned when the reviewer threw, errored or (with our deadline) timed out.
+ * - `askUser()`: `{kind:"ask", displayReason}`, which `dsh-tools` forwards to
+ *   the approval service. Under the `never` policy that service rejects it
+ *   without asking anybody.
+ *
+ * This module turns those outcomes into a `userQuestions` prompt so the user
+ * picks "allow once" or "keep denied". Every failure to ask, a cancelled or
+ * skipped prompt, and any answer other than the explicit allow option keep the
+ * original gate result: nothing is ever allowed silently.
+ */
+
+/** Must match `AUTO_REVIEW_DENIED_CODE` in dsh-experimental-auto-review. */
+export const AUTO_REVIEW_DENIED_CODE = "AUTO_REVIEW_DENIED";
+
+/** Code of the synthetic finish chunk emitted when the reviewer is too slow. */
+export const REVIEWER_TIMEOUT_CODE = "REVIEWER_TIMEOUT";
+
+/** Question id used for the single review-choice question. */
+export const REVIEW_CHOICE_QUESTION_ID = "dsh-auto-check-review-choice";
+
+/** Labels are bilingual because the host side has no viewer locale. */
+export const KEEP_DENIED_LABEL = "Keep denied / 维持拒绝 (recommended)";
+export const ALLOW_ONCE_LABEL = "Allow once / 仍要执行（放行一次）";
+
+const FAILED_REASON = /^Auto review of tool "/;
+
+/**
+ * Classify one `tools/pre-execute` gate result.
+ *
+ * `ask` is matched purely by shape; whether it would be auto-rejected depends
+ * on the approval policy, which the caller checks.
+ *
+ * @param {unknown} gate
+ * @returns {"denied" | "failed" | "ask" | undefined}
+ */
+export function reviewDenialKind(gate) {
+  if (gate === null || typeof gate !== "object") return undefined;
+  if (gate.kind === "deny") {
+    if (gate.info?.code === AUTO_REVIEW_DENIED_CODE) return "denied";
+    if (typeof gate.reason === "string" && FAILED_REASON.test(gate.reason)) {
+      return "failed";
+    }
+    return undefined;
+  }
+  if (gate.kind === "ask" && typeof gate.reason === "string" && /^Auto review denied tool "/.test(gate.reason)) {
+    return "ask";
+  }
+  return undefined;
+}
+
+/**
+ * Whether a gate result is one of the three Auto review denial shapes.
+ * @param {unknown} gate
+ * @returns {boolean}
+ */
+export function isReviewDenial(gate) {
+  return reviewDenialKind(gate) !== undefined;
+}
+
+/**
+ * The most specific human-readable reason carried by a gate result.
+ * @param {any} gate
+ * @returns {string}
+ */
+export function denialReason(gate) {
+  if (typeof gate?.info?.reason === "string" && gate.info.reason !== "") {
+    return gate.info.reason;
+  }
+  const display = gate?.displayReason;
+  if (display !== undefined && display !== null && typeof display === "object") {
+    const zh = typeof display.zh === "string" ? display.zh : "";
+    const en = typeof display.en === "string" ? display.en : "";
+    if (zh !== "" || en !== "") return [en, zh].filter(Boolean).join("\n\n");
+  }
+  if (typeof display === "string" && display !== "") return display;
+  return typeof gate?.reason === "string" ? gate.reason : "";
+}
+
+/** Indent text as a Markdown blockquote so reviewer output cannot restyle the card. */
+function quote(text) {
+  return text
+    .split(/\r?\n/)
+    .map((line) => `> ${line}`)
+    .join("\n");
+}
+
+/**
+ * Build the `userQuestions.ask` request for one blocked tool call.
+ *
+ * `options[0]` is the recommended "keep denied" option: the client preselects
+ * it, so allowing always takes an explicit click. No `intent` is sent.
+ *
+ * @param {{ name?: unknown, agent?: unknown }} exec
+ * @param {object} gate
+ * @param {AbortSignal} [signal]
+ * @returns {object}
+ */
+export function reviewQuestion(exec, gate, signal) {
+  const kind = reviewDenialKind(gate);
+  const name = typeof exec?.name === "string" ? exec.name : "unknown";
+  const reason = denialReason(gate);
+  const headline =
+    kind === "failed"
+      ? "The reviewer model did not answer (error or timeout). / 审查模型没有响应（出错或超时）。"
+      : "The reviewer model blocked this tool call. / 审查模型拒绝了此工具调用。";
+  const detail = [
+    headline,
+    "",
+    `**Tool / 工具:** \`${name.replace(/`/g, "'")}\``,
+    "",
+    "**Reason / 原因:**",
+    "",
+    quote(reason === "" ? "(no reason given / 未给出原因)" : reason),
+    "",
+    "Allowing runs this one call now with full access; nothing else is approved. / 放行只执行这一次调用，不会放行其他调用。",
+  ].join("\n");
+
+  return {
+    questions: [
+      {
+        id: REVIEW_CHOICE_QUESTION_ID,
+        header: "Auto review",
+        question: `Run tool "${name}" anyway? / 仍要执行工具 "${name}" 吗？`,
+        detail,
+        options: [
+          {
+            label: KEEP_DENIED_LABEL,
+            description: "Do not run it; the agent sees the original denial. / 不执行，代理收到原拒绝结果。",
+          },
+          {
+            label: ALLOW_ONCE_LABEL,
+            description: "Run this call once, overriding the reviewer. / 越过审查，只执行这一次。",
+          },
+        ],
+        multiSelect: false,
+      },
+    ],
+    ...(exec?.agent !== undefined ? { agent: exec.agent } : {}),
+    ...(signal !== undefined ? { signal } : {}),
+  };
+}
+
+/**
+ * Map a `userQuestions` answer to a decision. Only the exact allow option
+ * allows; skipped, custom text, unknown labels and malformed answers deny.
+ *
+ * @param {unknown} answer - `{answers:[{id, selected:[label], custom?}]}`.
+ * @param {string} [allowLabel]
+ * @returns {"allow" | "deny"}
+ */
+export function resolveChoice(answer, allowLabel = ALLOW_ONCE_LABEL) {
+  const answers = Array.isArray(answer?.answers) ? answer.answers : [];
+  const entry =
+    answers.find((item) => item?.id === REVIEW_CHOICE_QUESTION_ID) ??
+    (answers.length === 1 ? answers[0] : undefined);
+  const selected = Array.isArray(entry?.selected) ? entry.selected : [];
+  if (selected.length !== 1) return "deny";
+  return selected[0] === allowLabel ? "allow" : "deny";
+}
+
+/**
+ * Build the outermost `tools/pre-execute` listener.
+ *
+ * @param {object} deps
+ * @param {() => string} deps.onBlock - `"ask"` (default) or `"deny"`.
+ * @param {() => any} deps.userQuestions - current userQuestions service or undefined.
+ * @param {() => any} deps.approval - current approval service or undefined.
+ * @param {(error: unknown) => void} [deps.onAskError] - diagnostics hook.
+ * @returns {(exec: any, next: () => Promise<any>) => Promise<any>}
+ */
+export function createReviewChoiceListener(deps) {
+  return async function reviewChoice(exec, next) {
+    const gate = await next();
+    try {
+      if (String(deps.onBlock() ?? "ask").trim().toLowerCase() === "deny") return gate;
+      const kind = reviewDenialKind(gate);
+      if (kind === undefined) return gate;
+      const agent = exec?.agent;
+      if (agent === undefined) return gate;
+      if (kind === "ask") {
+        // Under the `ask` policy the approval card already asks the user.
+        const approval = deps.approval();
+        const policy = approval?.effectivePolicy?.(agent.session);
+        if (policy !== "never") return gate;
+      }
+      const questions = deps.userQuestions();
+      if (typeof questions?.ask !== "function") return gate;
+
+      const signal = exec.signal instanceof AbortSignal ? exec.signal : undefined;
+      const answer = await questions.ask(reviewQuestion(exec, gate, signal));
+      if (signal?.aborted) return gate;
+      return resolveChoice(answer) === "allow" ? { kind: "allow" } : gate;
+    } catch (error) {
+      // NO_PROVIDER, ASK_CANCELLED, ASK_ABORTED, CALLER_NOT_LIVE, ... all
+      // keep the original denial. Never fall through to allow.
+      try {
+        deps.onAskError?.(error);
+      } catch {
+        // Diagnostics must never change the decision.
+      }
+      return gate;
+    }
+  };
+}
+
+/**
+ * Bound how long a reviewer stream may take to reach its terminal finish.
+ *
+ * When the deadline passes first, `onTimeout` runs (the caller aborts the
+ * underlying request) and a synthetic error finish is emitted. Auto review's
+ * `readDecision` turns it into `failed()`, which the choice listener then
+ * hands to the user. `timeoutMs <= 0` or non-finite disables the deadline.
+ *
+ * @param {AsyncIterable<object>} stream
+ * @param {number} timeoutMs
+ * @param {() => void} [onTimeout]
+ * @returns {AsyncGenerator<object>}
+ */
+export async function* withReviewDeadline(stream, timeoutMs, onTimeout) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    yield* stream;
+    return;
+  }
+  const iterator = stream[Symbol.asyncIterator]();
+  let timer;
+  const expired = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(TIMED_OUT), timeoutMs);
+  });
+  let finished = false;
+  let done = false;
+  try {
+    while (true) {
+      const step = finished ? await iterator.next() : await Promise.race([iterator.next(), expired]);
+      if (step === TIMED_OUT) {
+        try {
+          onTimeout?.();
+        } catch {
+          // Aborting is best effort; the synthetic finish is what matters.
+        }
+        Promise.resolve()
+          .then(() => iterator.return?.())
+          .catch(() => {});
+        done = true;
+        yield {
+          type: "finish",
+          reason: {
+            kind: "error",
+            failure: {
+              code: REVIEWER_TIMEOUT_CODE,
+              message: `reviewer did not finish within ${timeoutMs} ms`,
+            },
+          },
+        };
+        return;
+      }
+      if (step.done) {
+        done = true;
+        return;
+      }
+      if (step.value?.type === "finish") {
+        finished = true;
+        clearTimeout(timer);
+      }
+      yield step.value;
+    }
+  } finally {
+    clearTimeout(timer);
+    if (!done) await iterator.return?.();
+  }
+}
+
+const TIMED_OUT = Symbol("timed-out");
+
+/**
+ * Keep one `tools/pre-execute` listener outermost in the cordis waterfall.
+ *
+ * cordis `register()` uses `unshift` for `prepend`, and `waterfall()` runs
+ * index 0 first, so the most recently registered prepend listener is the
+ * outermost one. The Auto review gate registers itself with `prepend: true`
+ * inside its own lifecycle effect, which may run before or after this plugin
+ * depending on service availability. To see the gate's result we must wrap it,
+ * so whenever another prepend listener for the same event registers, this
+ * re-registers ours on the next microtask, putting it back at index 0.
+ *
+ * @param {any} ctx - cordis context.
+ * @param {string} name - event name.
+ * @param {Function} listener
+ * @param {(error: unknown) => void} [onError]
+ * @returns {() => void} disposer.
+ */
+export function keepOutermost(ctx, name, listener, onError) {
+  const options = { global: true, prepend: true };
+  let disposed = false;
+  let moving = false;
+  let pending = false;
+  let dispose = ctx.on(name, listener, options);
+
+  const disposeWatch = ctx.on(
+    "internal/listener",
+    (event, _listener, listenerOptions) => {
+      if (event !== name || moving || pending || disposed) return undefined;
+      if (listenerOptions !== true && !listenerOptions?.prepend) return undefined;
+      pending = true;
+      queueMicrotask(() => {
+        pending = false;
+        if (disposed) return;
+        moving = true;
+        try {
+          dispose();
+          dispose = ctx.on(name, listener, options);
+        } catch (error) {
+          onError?.(error);
+        } finally {
+          moving = false;
+        }
+      });
+      return undefined;
+    },
+    { global: true },
+  );
+
+  return () => {
+    disposed = true;
+    disposeWatch();
+    dispose();
+  };
+}

package/lib/review-route.js

@@ -80,6 +80,33 @@ export function reviewText(options) {
   return typeof options.messages === "string" ? options.messages : "";
 }
 
+const TRUNCATION_MARKER =
+  "\n\n[... auto-review input truncated to fit the reviewer context window ...]\n\n";
+
+/**
+ * Trim a review prompt while preserving both ends.
+ *
+ * Auto review renders `ENVIRONMENT`, `PROJECT_INSTRUCTIONS`, `FILTERED_HISTORY`
+ * and `PENDING_ACTION` in that order. A 32k-token local model cannot hold a long
+ * session's full history, but dropping the tail would also drop the pending
+ * tool call that is being judged. Keep the head (environment/instructions) and
+ * the tail (recent history and the pending action), and mark the cut.
+ *
+ * @param {string} text
+ * @param {number} maxChars - 0 or a non-finite value keeps the text unchanged.
+ * @returns {string}
+ */
+export function truncateReviewText(text, maxChars) {
+  if (!Number.isFinite(maxChars) || maxChars <= 0) return text;
+  if (text.length <= maxChars) return text;
+  if (maxChars <= TRUNCATION_MARKER.length) return text.slice(-maxChars);
+
+  const budget = maxChars - TRUNCATION_MARKER.length;
+  const head = Math.floor(budget * 0.25);
+  const tail = budget - head;
+  return text.slice(0, head) + TRUNCATION_MARKER + text.slice(-tail);
+}
+
 /**
  * Build the request Qwen3Guard expects.
  *
@@ -87,15 +114,18 @@ export function reviewText(options) {
  * not follow auto-review's JSON policy. Sending the policy as a system message
  * would be classified as part of the content, so only the pending-action text
  * is forwarded as the user turn. The output is short (`Safety:` plus
- * `Categories:`), so 128 tokens is ample.
+ * `Categories:`), so 128 tokens is ample. `store` is stripped because some
+ * OpenAI-compatible gateways reject it outright.
  *
  * @param {object} options - immutable Auto review request.
  * @param {string} provider
  * @param {string} model
+ * @param {number} [maxInputChars] - 0 disables truncation.
  * @returns {object}
  */
-export function qwen3GuardRequest(options, provider, model) {
-  const { system: _system, messages: _messages, ...rest } = options;
+export function qwen3GuardRequest(options, provider, model, maxInputChars = 0) {
+  const { system: _system, messages: _messages, store: _store, ...rest } = options;
+  const text = truncateReviewText(reviewText(options), maxInputChars);
   return {
     ...rest,
     provider,
@@ -103,7 +133,7 @@ export function qwen3GuardRequest(options, provider, model) {
     messages: [
       {
         role: "user",
-        content: [{ type: "text", text: reviewText(options) }],
+        content: [{ type: "text", text }],
       },
     ],
     maxTokens: 128,
@@ -213,7 +243,8 @@ export async function* adaptQwen3GuardStream(stream) {
  * re-entered copy created by this function.
  *
  * @param {object} options - immutable LLM request.
- * @param {{ provider?: unknown, model?: unknown, protocol?: unknown }} route - configured route.
+ * @param {{ provider?: unknown, model?: unknown, protocol?: unknown, maxInputChars?: unknown, signal?: AbortSignal }} route
+ *   - configured route; `signal` (the reviewer deadline) also aborts the dispatched request.
  * @param {(request: object) => unknown} dispatch - sends a request to the LLM service.
  * @returns the dispatched stream for a rewritten request, otherwise `undefined`.
  */
@@ -242,8 +273,21 @@ export function routeReview(options, route, dispatch) {
 
   const next =
     protocol === "qwen3guard"
-      ? qwen3GuardRequest(options, targetProvider, targetModel)
+      ? qwen3GuardRequest(
+          options,
+          targetProvider,
+          targetModel,
+          Number(route.maxInputChars ?? 0),
+        )
       : { ...options, provider: targetProvider, model: targetModel };
+  // An optional route signal (the reviewer deadline) also cancels the
+  // dispatched request, alongside the caller's own signal.
+  if (route.signal instanceof AbortSignal) {
+    next.signal =
+      options.signal instanceof AbortSignal
+        ? AbortSignal.any([options.signal, route.signal])
+        : route.signal;
+  }
   rewritten.add(next);
   const stream = dispatch(next);
   return protocol === "qwen3guard" ? adaptQwen3GuardStream(stream) : stream;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-auto-check",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Give DeepSeek Harness Auto review its own reviewer model instead of following the main model.",
   "type": "module",
   "main": "lib/index.js",
@@ -30,7 +30,7 @@
     "url": "https://github.com/ltzXiaoYanMo/dsh-auto-check/issues"
   },
   "scripts": {
-    "test": "node --test test/review-route.test.mjs"
+    "test": "node --test \"test/*.test.mjs\""
   },
   "dsh": {
     "bundle": {
@@ -45,8 +45,5 @@
         "@deepseek-ai/dsh-api-remotes"
       ]
     }
-  },
-  "dependencies": {
-    "dsh-auto-check": "^0.1.0"
   }
 }