dsh-auto-review 0.14.1 → 0.15.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [0.15.1] - 2026-11-13
+
+### Fixed
+
+- **A PTC session's tool-call arguments were invisible to the reviewer, so every `ai`-routed escalation from one was denied (issue #83).** `renderCallContext` → `sanitizedArgumentsText()` looked the pending call up by an exact `callId` match against `tool/call` rows only — but a PTC approval carries the INNER id `<outer>:ptc:<n>` while the logged `tool/call` carries `<outer>` (name `run_code`), so the id never matched and the transcript rendered "not found or unparseable". The "insufficient evidence ⇒ DENY" rule then fired on the evidence gap for exactly the calls where human oversight matters most, and the verdict cache was skipped for the same reason. The lookup now reads the PTC sub-dispatch record first (`tool/ptc-dispatch-start`, and its settled `tool/ptc-dispatch` pair, keyed by `subCallId`), and only when the child record is missing walks the `:ptc:` prefix out to the nearest enclosing `tool/call`; the prompt names which record the reviewer is seeing and states explicitly when the arguments belong to the enclosing call rather than the pending one. The same lookup feeds the `arguments` risk-rule field and the verdict fingerprint (still skipped for an enclosing-only row, which every sub-call of one program shares). Deny evidence is now diagnosable from the prompt alone: a record with no parseable arguments payload reads differently from a call id that could not be resolved at all, instead of both reading as "arguments missing". Regression tests synthesize an `<outer>:ptc:1` approval, assert the reviewer prompt carries the inner tool's own arguments, and assert the enclosing-call and unresolved fallbacks stay visibly distinct.
+
 ## [0.14.1] - 2026-10-26
 
 ### Security
@@ -30,6 +36,11 @@
 - **The request wording is the measured one, not an improvised prompt.** State is exactly `The agent is about to run the shell command "<command>" in its workspace.`, and the harm options carry the descriptions the model was trained on as `criteria` (the HTTP contract has no `criteria` field). On 89 labelled commands (2026-10-25, CPU fp32, released weights) **0 of 53 destructive commands were allowed at 0.4** — 26 denied, 27 escalated — while 5 of 36 routine commands were allowed; the same measurement at 0.35 let two destructive Windows commands through. The other measured formulations (bare option names, a boolean question, `safe` / `must not run` wording) were rejected because they either collapse to deny-everything or clear destructive commands. **Correction (0.14.1):** this 89-command set did not include system-file commands; the expanded 91-command audit found `cat /etc/shadow` and `cp /dev/null /etc/passwd` allowed at 0.4, so 0.14.1 raises the default floor and adds the path/operator guards.
 - **Privacy and egress.** Only the redacted shell command is sent to the decision service — the approval reason, transcript and workspace path are not — and the command passes the same key-level and inline-secret redaction as the generative prompt. `phocinae.allowRemoteEndpoint` must be set explicitly to send it off-host.
 - **Observability and docs.** `/auto-review status` names the reviewer backend and model, and `autoReview/verdict` records `provider: phocinae` (instead of claiming a subagent ran). Full config documentation, an annotated example in `fixtures/config/config-full.yaml`, and the service setup instructions in all five READMEs.
+## [0.15.0] - 2026-10-28
+
+### Added
+
+- Opt-in `answerDetailed()` with exported request-local receipt types, including correlation, fallback/delegation and isolated circuit snapshots. Existing `answer()` and approval-chain behavior are unchanged; the detailed API catches exceptions and rejects final results after disposal without promising immediate cancellation.
 
 ## [0.13.8] - 2026-10-22
 

package/PRIVACY.md

@@ -0,0 +1,11 @@
+# Privacy
+
+`dsh-auto-review` is a local DeepSeek Harness plugin.
+
+- It reads only the workspace files, configuration and tool inputs needed for its documented features.
+- It does not add telemetry, analytics, advertising or a hosted account, and it sends no data to PerryLink.
+- Any network access or external service used by the plugin is documented in its README and is controlled by the user's own configuration.
+- It writes no data outside the DSH profile, the workspace, and the host's own session/log storage. The host controls that storage and its retention.
+- Removing the package removes its code; it does not delete host logs, workspace files or documents you already created.
+
+This statement covers the npm package, not the DSH host or any other plugin in the profile.