dsh-codex-approval 0.1.0 → 0.2.1

package/README.md

@@ -34,7 +34,29 @@ approval/request 到达（toolName + callId + reason）
 └─ 4. 兜底：fallback（默认 ask → GUI 弹窗）
 ```
 
-每次决策写入一行 JSONL 审计日志（默认 `~/.dsh/logs/approval.jsonl`）：工具名、命令预览、reason、判定来源（rule / ai / ai-error / fallback）、风险、AI 理由、耗时。
+每次决策写入一行 JSONL 审计日志（默认 `~/.dsh/logs/approval.jsonl`）：工具名、命令预览、reason、判定来源（rule / ai / ai-error / fallback）、**模式（mode）**、风险、AI 理由、耗时。
+
+## 审批模式（v0.2.0）
+
+插件提供一个与 dsh 沙箱模式**正交**的审批模式维度，三种模式按需切换：
+
+| 模式 | 名称 | 行为 | 场景 |
+|---|---|---|---|
+| 1 | `manual` | **完全旁路**：不决策、不写日志，审批全部交回人类弹窗 | 回归未装插件的原生体验 |
+| 2 | `ai`（默认） | 规则 → AI → ask 交人类 | 日常：低风险自动、高风险问人 |
+| 3 | `ai-auto` | 规则 → AI → **ask 永不交人类**，按 `mode3OnAsk`（默认 deny）处理 | 全自动操作但又不放心 full access：AI 全权把关，绝不弹窗 |
+
+**运行时切换**（GUI 斜杠命令，作用于当前会话，持久化到 settings）：
+
+```
+/approval-mode            显示当前模式（覆盖值 + 生效值）
+/approval-mode 3          切换为 ai-auto（也接受 ai-auto / 1 / 2 / manual 等）
+/approval-mode default    清除会话覆盖，回落到配置默认
+```
+
+**ai-auto 下 ask 的归宿**（`mode3OnAsk`，默认 `deny`）：规则 ask、AI 判 ask 且超容忍度、AI 故障 failOpen=ask、兜底 fallback=ask——全部按此处理，绝不弹窗。⚠️ 若设为 `allow`，AI 无法决定时也会放行高风险操作，**慎用**。
+
+**模式持久化**：会话覆盖存 `~/.dsh/settings.yaml` 的 `dsh-codex-approval` 命名空间（settings 服务不可用时降级为纯内存，重启丢失）。默认模式由配置 `mode` 字段决定。
 
 ## 安装
 
@@ -50,6 +72,8 @@ dsh plugin --profile web add dsh-codex-approval
 ```yaml
 - id: dsh-codex-approval
   config:
+    mode: ai                   # manual | ai | ai-auto（默认 ai）
+    mode3OnAsk: deny           # deny | allow（ai-auto 下 ask 的归宿；默认 deny 安全）
     rules:
       - match: 'Bash(git status*)'   # 命中即自动通过（Codex approve-always）
         action: allow

package/index.js

@@ -24,10 +24,12 @@ import { appendFile, mkdir } from "node:fs/promises";
 import { mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
+import z from "@deepseek-ai/schemastery";
 
 import { evaluateRules } from "./rules.js";
 import { findToolCallArgs, argsPreview } from "./enrich.js";
 import { judgeWith, decideAuthorization } from "./judge.js";
+import { MODES, parseMode, resolveMode, effectiveOnAsk } from "./modes.js";
 
 export const name = "dsh-codex-approval";
 
@@ -43,6 +45,8 @@ export const inject = ["approval", "llm"];
 /** Default configuration — tune via the profile patch id-targeted config. */
 export const DEFAULT_CONFIG = {
 	enabled: true,
+	mode: "ai",
+	mode3OnAsk: "deny",
 	rules: [
 		// read-only / harmless commands: auto-approve
 		{ match: "Bash(git status*)", action: "allow" },
@@ -86,6 +90,8 @@ const TOLERANCES = ["low", "medium", "high"];
 function assertConfig(cfg) {
 	if (typeof cfg !== "object" || cfg === null) throw new TypeError("dsh-codex-approval: config must be an object");
 	if (typeof cfg.enabled !== "boolean") throw new TypeError("dsh-codex-approval: config.enabled must be a boolean");
+	if (!MODES.includes(cfg.mode)) throw new TypeError(`dsh-codex-approval: config.mode must be one of ${MODES.join("/")}`);
+	if (!["deny", "allow"].includes(cfg.mode3OnAsk)) throw new TypeError("dsh-codex-approval: config.mode3OnAsk must be deny/allow");
 	if (!Array.isArray(cfg.rules)) throw new TypeError("dsh-codex-approval: config.rules must be an array");
 	for (const rule of cfg.rules) {
 		if (typeof rule.match !== "string" || rule.match === "") throw new TypeError("dsh-codex-approval: each rule needs a non-empty match");
@@ -141,16 +147,23 @@ export function makeLlmRunner(llm, { provider, model, timeoutMs, maxTokens }) {
 /**
  * Create the approval/request handler with injected dependencies
  * (unit-testable without a cordis ctx).
- * @param deps - { config, record, llmRunner }
+ * @param deps - { config, record, llmRunner, getSessionMode }
  * @returns async (req, next) => ApprovalOutcome
  */
-export function createHandler({ config, record, llmRunner }) {
+export function createHandler({ config, record, llmRunner, getSessionMode }) {
 	const cfg = config;
 	return async (req, next) => {
 		const started = Date.now();
 		if (req.signal?.aborted === true) return "cancelled";
 		if (!cfg.enabled) return next();
 
+		const sessionId = req.agent?.session?.id ?? req.agent?.id;
+		const override = await getSessionMode?.(sessionId);
+		const mode = resolveMode(override, cfg.mode);
+
+		// mode 1: fully bypassed — the pre-plugin experience (no decision, no audit)
+		if (mode === "manual") return next();
+
 		const args = findToolCallArgs(req.agent?.session?.events, req.callId);
 		const argsText = argsPreview(args, req.toolName, cfg.ai.maxPromptChars);
 		const matchReq = { toolName: req.toolName, argsText, reason: req.reason ?? "" };
@@ -162,7 +175,8 @@ export function createHandler({ config, record, llmRunner }) {
 		} else if (cfg.ai.enabled) {
 			const judged = await judgeWith({
 				runner: llmRunner,
-				input: { toolName: req.toolName, argsText, reason: req.reason ?? "" }
+				input: { toolName: req.toolName, argsText, reason: req.reason ?? "" },
+				allowAsk: mode !== "ai-auto"
 			});
 			if (judged.ok) {
 				const authorization = decideAuthorization(judged.verdict, cfg.ai.riskTolerance);
@@ -186,9 +200,18 @@ export function createHandler({ config, record, llmRunner }) {
 			verdict = { kind: "fallback", action: cfg.fallback, outcome: outcomeFor(cfg.fallback) };
 		}
 
+		// mode 3 (ai-auto): an "ask" is never routed to a human — resolve it
+		// through mode3OnAsk (default deny), regardless of its source
+		// (rule ask, AI ask over tolerance, failOpen=ask, fallback=ask).
+		if (mode === "ai-auto" && verdict.action === "ask") {
+			const resolved = effectiveOnAsk(mode, cfg.mode3OnAsk);
+			verdict = { ...verdict, action: resolved, outcome: outcomeFor(resolved), viaAskResolution: true };
+		}
+
 		await record({
 			ts: new Date().toISOString(),
-			sessionId: req.agent?.session?.id ?? req.agent?.id ?? "?",
+			sessionId: sessionId ?? "?",
+			mode,
 			toolName: req.toolName,
 			callId: req.callId,
 			argsPreview: argsText.slice(0, 300),
@@ -217,12 +240,106 @@ export function makeRecorder(logFile) {
 	};
 }
 
+/**
+ * Per-session approval-mode store. Persists through the dsh settings service
+ * under the `dsh-codex-approval` namespace when available; falls back to
+ * memory only (survives nothing) otherwise. All writes go through `replace`
+ * so the whole `sessionOverrides` map stays authoritative in one place.
+ */
+export function makeModeStore(ctx, logger) {
+	const memory = new Map();
+	let settings = null;
+	ctx.inject(["settings"], (sctx) => {
+		settings = sctx.settings;
+		try {
+			sctx.settings.register("dsh-codex-approval", z.object({
+				sessionOverrides: z.dict(z.union(MODES)).default({})
+			}), { base: {} });
+			const resolved = sctx.settings.get("dsh-codex-approval");
+			const overrides = resolved?.sessionOverrides;
+			if (overrides !== null && typeof overrides === "object") {
+				for (const [key, value] of Object.entries(overrides)) memory.set(key, value);
+			}
+		} catch (error) {
+			logger?.warn?.("[dsh-codex-approval] settings init failed (%s) — session overrides are memory-only", String(error?.message ?? error));
+		}
+	});
+	const persist = async () => {
+		if (settings === null) return "memory-only";
+		try {
+			const next = {};
+			for (const [key, value] of memory) next[key] = value;
+			await settings.replace("dsh-codex-approval", { sessionOverrides: next });
+			return "persisted";
+		} catch {
+			return "memory-only";
+		}
+	};
+	return {
+		async get(sessionId) {
+			if (sessionId === undefined || sessionId === null) return undefined;
+			return memory.get(sessionId);
+		},
+		async set(sessionId, mode) {
+			if (sessionId === undefined || sessionId === null) return "memory-only";
+			memory.set(sessionId, mode);
+			return persist();
+		},
+		async clear(sessionId) {
+			if (sessionId !== undefined && sessionId !== null) memory.delete(sessionId);
+			return persist();
+		}
+	};
+}
+
+/** Register the /approval-mode command (mirrors dsh-plan-mode's /plan). */
+export function registerModeCommand(ctx, cfg, store) {
+	ctx.inject(["commands"], (commandCtx) => {
+		commandCtx.commands.register({
+			name: "approval-mode",
+			description: "Show or switch the approval mode (manual | ai | ai-auto, or 1/2/3)",
+			input: { hint: "[manual|ai|ai-auto|default]" },
+			handler: async ({ agent, rawInput }) => {
+				const sessionId = agent?.session?.id ?? agent?.id;
+				const input = rawInput.trim();
+				if (input === "") {
+					const override = await store.get(sessionId);
+					const effective = resolveMode(override, cfg.mode);
+					const base = override === void 0
+						? `approval mode: ${effective} (config default: ${cfg.mode}, no session override)`
+						: `approval mode: ${effective} (session override: ${override}, config default: ${cfg.mode})`;
+					return { kind: "success", text: base };
+				}
+				if (input === "default" || input === "off" || input === "reset") {
+					const persisted = await store.clear(sessionId);
+					const note = persisted === "persisted" ? "" : " (memory-only: settings unavailable)";
+					return { kind: "success", text: `approval mode: session override cleared — effective ${cfg.mode} (config default)${note}` };
+				}
+				const mode = parseMode(input);
+				if (mode === null) {
+					return { kind: "success", text: `unknown approval mode "${input}" — use manual | ai | ai-auto (or 1/2/3), or "default" to clear the override` };
+				}
+				const persisted = await store.set(sessionId, mode);
+				const note = persisted === "persisted" ? "" : " (memory-only: settings unavailable, lost on restart)";
+				return { kind: "success", text: `approval mode → ${mode} for this session${note}` };
+			}
+		});
+	});
+}
+
 /** Cordis plugin entry: register the answerer when approval is composed. */
 export async function apply(ctx, userConfig) {
 	const cfg = normalizeConfig(userConfig);
+	const store = makeModeStore(ctx, ctx.logger);
 	const llmRunner = makeLlmRunner(ctx.llm, cfg.ai);
-	const handler = createHandler({ config: cfg, record: makeRecorder(cfg.logFile), llmRunner });
+	const handler = createHandler({
+		config: cfg,
+		record: makeRecorder(cfg.logFile),
+		llmRunner,
+		getSessionMode: (sessionId) => store.get(sessionId)
+	});
 	ctx.on("approval/request", handler);
+	registerModeCommand(ctx, cfg, store);
 	// Self-proving startup record: this line in the log after a restart proves
 	// the plugin loaded (decision records follow it). Awaited so a boot that
 	// cannot even write its own log fails loud instead of silently degrading.
@@ -230,11 +347,13 @@ export async function apply(ctx, userConfig) {
 		ts: new Date().toISOString(),
 		event: "plugin-loaded",
 		sessionId: "boot",
+		mode: cfg.mode,
+		mode3OnAsk: cfg.mode3OnAsk,
 		rules: cfg.rules.length,
 		ai: cfg.ai.enabled,
 		tolerance: cfg.ai.riskTolerance,
 		fallback: cfg.fallback
 	});
-	ctx.logger?.info?.("[dsh-codex-approval] answerer registered — rules=%d ai=%s tolerance=%s log=%s",
-		cfg.rules.length, cfg.ai.enabled ? "on" : "off", cfg.ai.riskTolerance, cfg.logFile);
+	ctx.logger?.info?.("[dsh-codex-approval] answerer registered — mode=%s rules=%d ai=%s tolerance=%s log=%s",
+		cfg.mode, cfg.rules.length, cfg.ai.enabled ? "on" : "off", cfg.ai.riskTolerance, cfg.logFile);
 }

package/judge.js

@@ -28,16 +28,33 @@ Rules of thumb:
 Reply with ONLY one JSON object, no prose, no markdown fences:
 {"risk":"low|medium|high","authorization":"allow|ask|deny","reason":"one short sentence"}`;
 
-/** Build the messages array for the judge call. */
-export function buildJudgeMessages({ toolName, argsText, reason }) {
+/** Variant used in ai-auto mode: the judge must decide itself, no human is available. */
+const SYSTEM_PROMPT_NO_ASK = SYSTEM_PROMPT.replace(
+	'2. authorization: "allow" (proceed without asking) | "ask" (a human must confirm) | "deny" (must not run).',
+	'2. authorization: "allow" (proceed without asking) | "deny" (must not run). "ask" is NOT available — no human will review this request, you MUST decide between allow and deny yourself.'
+).replace(
+	'- When uncertain, prefer "ask". Prefer "deny" for destructive or credential-exposing actions.',
+	'- When uncertain, prefer "deny". Prefer "deny" for destructive or credential-exposing actions.'
+).replace(
+	'{"risk":"low|medium|high","authorization":"allow|ask|deny","reason":"one short sentence"}',
+	'{"risk":"low|medium|high","authorization":"allow|deny","reason":"one short sentence"}'
+);
+
+/**
+ * Build the messages array for the judge call.
+ * @param allowAsk - when false (ai-auto mode), the prompt forbids "ask":
+ *   the judge must commit to allow or deny.
+ */
+export function buildJudgeMessages({ toolName, argsText, reason }, { allowAsk = true } = {}) {
 	const user = JSON.stringify({
 		toolName,
 		command: argsText === "" ? null : argsText,
 		reason: reason ?? null
 	});
+	const system = allowAsk ? SYSTEM_PROMPT : SYSTEM_PROMPT_NO_ASK;
 	return [{
 		role: "user",
-		content: [{ type: "text", text: `${SYSTEM_PROMPT}\n\n${user}` }]
+		content: [{ type: "text", text: `${system}\n\n${user}` }]
 	}];
 }
 
@@ -128,8 +145,8 @@ export function decideAuthorization(verdict, tolerance) {
  * @param config - { maxPromptChars } (unused here; kept for symmetry)
  * @returns { ok: true, verdict } | { ok: false, error }
  */
-export async function judgeWith({ runner, input, signal }) {
-	const messages = buildJudgeMessages(input);
+export async function judgeWith({ runner, input, signal, allowAsk = true }) {
+	const messages = buildJudgeMessages(input, { allowAsk });
 	let result;
 	try {
 		result = await runner(messages, { signal });

package/modes.js

@@ -0,0 +1,62 @@
+/**
+ * dsh-codex-approval — modes.js
+ *
+ * The approval-mode dimension, orthogonal to the dsh sandbox mode:
+ *
+ *   manual   — plugin fully bypassed (next() straight through, no decision,
+ *              no audit): the pre-plugin experience.
+ *   ai       — rules, then AI judge, then human fallback for every "ask"
+ *              outcome (the default / v0.1.x behavior).
+ *   ai-auto  — rules, then AI judge; "ask" is never routed to a human —
+ *              it resolves through mode3OnAsk (default deny).
+ *
+ * Pure functions only: parse/validate mode names, resolve the effective mode
+ * (per-session override wins over the config default), and map an "ask"
+ * outcome onto its effective action under the active mode.
+ */
+
+/** The three approval modes. */
+export const MODES = ["manual", "ai", "ai-auto"];
+/** Numeric aliases mirroring the user-facing 1/2/3 choice. */
+export const MODE_ALIASES = { "1": "manual", "2": "ai", "3": "ai-auto" };
+/** Actions an "ask" may resolve to. */
+export const ASK_ACTIONS = ["ask", "deny", "allow"];
+
+/**
+ * Parse and validate a mode name (or numeric alias).
+ * @param input - "manual" | "ai" | "ai-auto" | "1" | "2" | "3"
+ * @returns the canonical mode name, or null when invalid.
+ */
+export function parseMode(input) {
+	if (typeof input !== "string") return null;
+	const trimmed = input.trim().toLowerCase();
+	if (MODES.includes(trimmed)) return trimmed;
+	if (MODE_ALIASES[trimmed] !== void 0) return MODE_ALIASES[trimmed];
+	return null;
+}
+
+/**
+ * Resolve the effective mode for one request: per-session override wins,
+ * else the config default.
+ * @param sessionOverride - mode from the per-session store (or undefined)
+ * @param configDefault - the configured default mode
+ * @returns a canonical mode name (never null when configDefault is valid).
+ */
+export function resolveMode(sessionOverride, configDefault) {
+	return parseMode(sessionOverride) ?? parseMode(configDefault) ?? "ai";
+}
+
+/**
+ * Map an "ask" outcome onto its effective action under the active mode.
+ * - manual: unreachable (handler bypasses); defensive "ask".
+ * - ai: "ask" — route to the human (next()).
+ * - ai-auto: mode3OnAsk — the human is never asked; default deny.
+ * @param mode - effective mode
+ * @param mode3OnAsk - "deny" | "allow" (validated config; anything else
+ *   falls back to "deny")
+ * @returns "ask" | "deny" | "allow"
+ */
+export function effectiveOnAsk(mode, mode3OnAsk) {
+	if (mode === "ai-auto") return mode3OnAsk === "allow" ? "allow" : "deny";
+	return "ask";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-codex-approval",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Codex-style approval autopilot for DeepSeek Harness: ordered glob rules (allow/ask/deny) plus an AI risk judge (low/medium/high) mapped through a risk tolerance, as an approval answerer.",
   "type": "module",
   "main": "index.js",
@@ -9,6 +9,7 @@
     "rules.js",
     "enrich.js",
     "judge.js",
+    "modes.js",
     "cordis.patch.yml",
     "README.md",
     "LICENSE"
@@ -33,5 +34,8 @@
   },
   "engines": {
     "node": ">=22.19"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.1"
   }
 }