dsh-codex-approval 0.3.0 → 0.4.0

package/README.md

@@ -126,6 +126,8 @@ dsh plugin --profile web add dsh-codex-approval
     fallback: ask                    # 无规则命中且 AI 关闭时：ask | deny | allow
     denyFeedback: true               # 拒绝后向主 agent 注入归因更正消息（默认 true）
     denyFeedbackMax: 3               # 未注入拒绝队列上限（1-10）
+    transcript: off                  # off | short：AI 审判是否带紧凑会话上下文（默认 off）
+    transcriptMaxChars: 4000         # 上下文骨架字符上限（100-16000）
     logFile: ~/.dsh/logs/approval.jsonl
 ```
 
@@ -141,10 +143,29 @@ dsh plugin --profile web add dsh-codex-approval
 
 ## AI 审判输入/输出
 
-**输入**：固定系统提示（审批员角色 + risk/authorization 定义 + 只输出 JSON 约束）+ `{"toolName", "command", "reason"}`（命令截断 2000 字符，无其他上下文）。
+**输入**：固定系统提示（审批员角色 + risk/authorization 定义 + **意图优先规则** + 只输出 JSON 约束）+ `{"toolName", "command", "reason"}`（命令截断 2000 字符）。
+
+开启 `transcript: "short"` 后追加 **Context 块**（紧凑会话骨架，≤`transcriptMaxChars` 字符）——两级窗口：短窗口（最近用户消息 + ≤3 条工具调用 → `[U]/[T]/[R]` 行）+ 长窗口（更早的真实用户消息意图线）+ 模式行 `[M]` + 最近拒绝 `[D]` + 工作区 `[W]`。超长消息头尾保留 + 省略计数（`…〔省略 N 字符〕…`）；plugin 注入消息与流式 chunk 一律不进骨架。**默认 off 时行为与 v0.3.0 完全一致。**
 
 **输出**：`{"risk":"low|medium|high","authorization":"allow|ask|deny","reason":"一句话"}`；解析策略：整体 JSON → ```json``` 代码块 → 平衡花括号扫描；枚举校验失败按 AI 故障处理。
 
+## 会话上下文（transcript，v0.4.0）
+
+`transcript: "off"`（默认）= 零上下文判定（仅命令本体）；`transcript: "short"` = AI 审判带紧凑上下文，可判断"用户明确要求的操作应放行"（意图优先）。实测口径成本：
+
+| 组成 | off | short |
+|---|---|---|
+| 系统提示 | ~380 token | ~420 token |
+| 上下文骨架（≤4000 字符） | — | ~1,600-1,800 token |
+| 请求体（实测） | ~100-200 token | 同左 |
+| **单次合计** | **~500 token** | **~2,100-2,400 token（≈4 倍）** |
+
+50 次审批的一天会话：off ≈ 25k token，short ≈ 110k token（前缀缓存命中后 ~84k）。绝对量由 `transcriptMaxChars` 硬闸封顶；缓存前缀（系统+模式+长窗口）占比 ~60-70%。实测本会话（5733 事件、含 12891 字符粘贴输出）骨架化后稳定在预算内。
+
+## PowerShell（Windows）规则
+
+默认规则含 `Bash(...)`（Linux/树莓派 toolName=bash 生效）与 `Pwsh(...)`（Windows toolName=pwsh 生效）两族**并存**——工具名大小写不敏感匹配，互不干扰：Windows 上只读命令（git status/diff/log、Get-ChildItem/ls、Get-Content/cat、Get-Location/pwd、Get-Command、Write-Output、Select-Object）自动放行；树莓派继续走 Bash 规则。如需整体替换规则，`cordis.patch.yml` 配 `rules` 即可（覆盖默认）。
+
 ## 安全注意事项
 
 - **deny 规则永远最先求值**，AI 无权覆盖显式拒绝

package/index.js

@@ -30,6 +30,7 @@ import z from "@deepseek-ai/schemastery";
 import { evaluateRules } from "./rules.js";
 import { findToolCallArgs, argsPreview } from "./enrich.js";
 import { judgeWith, decideAuthorization } from "./judge.js";
+import { buildTranscript } from "./transcript.js";
 import { MODES, parseMode, resolveMode, effectiveOnAsk } from "./modes.js";
 import { T, pickLocale, commandDescription, renderDenialNotice } from "./i18n.js";
 
@@ -75,7 +76,25 @@ export const DEFAULT_CONFIG = {
 		// publishing: never auto-decided — a human must confirm every publish
 		// (both bare `npm publish` and prefixed forms like `cd x && npm publish`)
 		{ match: "Bash(npm publish*)", action: "ask" },
-		{ match: "Bash(*npm publish*)", action: "ask" }
+		{ match: "Bash(*npm publish*)", action: "ask" },
+		// PowerShell (Windows) counterparts for the read-only allow family:
+		// dsh's shell tool is `pwsh` on Windows, so the Bash(...) rules above
+		// never match there and every request went to the AI judge. These
+		// Pwsh(...) rules match only pwsh tool calls (tool names are
+		// case-insensitive); the Bash rules stay effective on Linux/Raspberry
+		// Pi, where the tool is `bash`. Both families coexist in this array.
+		{ match: "Pwsh(git status*)", action: "allow" },
+		{ match: "Pwsh(git diff*)", action: "allow" },
+		{ match: "Pwsh(git log*)", action: "allow" },
+		{ match: "Pwsh(Get-ChildItem *)", action: "allow" },
+		{ match: "Pwsh(ls *)", action: "allow" },
+		{ match: "Pwsh(Get-Content *)", action: "allow" },
+		{ match: "Pwsh(cat *)", action: "allow" },
+		{ match: "Pwsh(Get-Location)", action: "allow" },
+		{ match: "Pwsh(pwd)", action: "allow" },
+		{ match: "Pwsh(Get-Command *)", action: "allow" },
+		{ match: "Pwsh(Write-Output *)", action: "allow" },
+		{ match: "Pwsh(Select-Object *)", action: "allow" }
 	],
 	ai: {
 		enabled: true,
@@ -96,6 +115,12 @@ export const DEFAULT_CONFIG = {
 	denyFeedback: true,
 	// Pending-denial queue cap per session: older entries are dropped first.
 	denyFeedbackMax: 3,
+	// Compact session transcript for the AI judge: "off" (default) keeps the
+	// v0.3.0 zero-context input; "short" adds a bounded two-level window
+	// skeleton (see transcript.js) so the judge sees user intent and the
+	// surrounding tool chain. Absolute size is capped by transcriptMaxChars.
+	transcript: "off",
+	transcriptMaxChars: 4000,
 	logFile: join(homedir(), ".dsh", "logs", "approval.jsonl")
 };
 
@@ -122,6 +147,10 @@ function assertConfig(cfg) {
 	if (!Number.isSafeInteger(cfg.denyFeedbackMax) || cfg.denyFeedbackMax < 1 || cfg.denyFeedbackMax > 10) {
 		throw new TypeError("dsh-codex-approval: config.denyFeedbackMax must be an integer in 1..10");
 	}
+	if (!["off", "short"].includes(cfg.transcript)) throw new TypeError("dsh-codex-approval: config.transcript must be off/short");
+	if (!Number.isSafeInteger(cfg.transcriptMaxChars) || cfg.transcriptMaxChars < 100 || cfg.transcriptMaxChars > 16000) {
+		throw new TypeError("dsh-codex-approval: config.transcriptMaxChars must be an integer in 100..16000");
+	}
 	if (typeof cfg.logFile !== "string" || cfg.logFile === "") throw new TypeError("dsh-codex-approval: config.logFile must be a non-empty path");
 }
 
@@ -145,13 +174,17 @@ function outcomeFor(action) {
 
 /** The real LLM runner: ctx.llm.prepareCall + stream, bounded by timeout. */
 export function makeLlmRunner(llm, { provider, model, timeoutMs, maxTokens }) {
-	return async (messages, { signal } = {}) => {
+	return async (messages, { signal, sessionId } = {}) => {
 		const timeoutSignal = AbortSignal.timeout(timeoutMs);
 		const combined = signal !== undefined ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
 		try {
 			const prepared = await llm.prepareCall({ provider, model, temperature: 0, maxTokens }, combined);
 			let text = "";
-			for await (const chunk of prepared.stream({ ...prepared.config, messages })) {
+			for await (const chunk of prepared.stream({
+				...prepared.config,
+				messages,
+				...sessionId === undefined ? {} : { sessionId }
+			})) {
 				if (chunk.type === "text-delta") text += chunk.text;
 				else if (chunk.type === "finish" && (chunk.reason?.kind === "error" || chunk.reason?.kind === "aborted")) {
 					return { ok: false, error: `judge stream finished with ${chunk.reason.kind}` };
@@ -167,21 +200,30 @@ export function makeLlmRunner(llm, { provider, model, timeoutMs, maxTokens }) {
 /**
  * Create the approval/request handler with injected dependencies
  * (unit-testable without a cordis ctx).
- * @param deps - { config, record, llmRunner, getSessionMode, denialFeed }
+ * @param deps - { config, record, llmRunner, getSessionMode, denialFeed, denialHistory, getCwd }
  *   `denialFeed` is an optional Map<sessionId, Array<DenialRecord>> used to
  *   stage plugin-originated denials for the `agent/pre-step` injector; when
  *   omitted the handler creates its own (shared only if the caller passes it).
+ *   `denialHistory` is an optional Map<sessionId, Array<DenialRecord>>
+ *   accumulating the last few denials of each session for the transcript
+ *   context ([D] lines) — created internally when omitted.
+ *   `getCwd` optionally returns the workspace path for the transcript [W] line.
  * @returns async (req, next) => ApprovalOutcome
  */
-export function createHandler({ config, record, llmRunner, getSessionMode, denialFeed }) {
+export function createHandler({ config, record, llmRunner, getSessionMode, denialFeed, denialHistory, getCwd }) {
 	const cfg = config;
 	const feed = denialFeed ?? new Map();
+	const history = denialHistory ?? new Map();
 	const stageDenial = (sessionId, denial) => {
 		if (sessionId === undefined || sessionId === null) return;
 		const queue = feed.get(sessionId) ?? [];
 		queue.push(denial);
 		if (queue.length > cfg.denyFeedbackMax) queue.shift();
 		feed.set(sessionId, queue);
+		const hq = history.get(sessionId) ?? [];
+		hq.push(denial);
+		if (hq.length > 5) hq.shift();
+		history.set(sessionId, hq);
 	};
 	return async (req, next) => {
 		const started = Date.now();
@@ -200,14 +242,28 @@ export function createHandler({ config, record, llmRunner, getSessionMode, denia
 		const matchReq = { toolName: req.toolName, argsText, reason: req.reason ?? "" };
 
 		let verdict;
+		let context = "";
 		const rule = evaluateRules(cfg.rules, matchReq);
 		if (rule !== null) {
 			verdict = { kind: "rule", action: rule.action, outcome: outcomeFor(rule.action), match: rule.match };
 		} else if (cfg.ai.enabled) {
+			context = cfg.transcript === "short"
+				? buildTranscript({
+					events: req.agent?.session?.events,
+					cfg,
+					denialHistory: history,
+					sessionId,
+					mode,
+					tolerance: cfg.ai.riskTolerance,
+					mode3OnAsk: cfg.mode3OnAsk,
+					cwd: getCwd !== undefined ? getCwd(req.agent) : undefined
+				})
+				: "";
 			const judged = await judgeWith({
 				runner: llmRunner,
-				input: { toolName: req.toolName, argsText, reason: req.reason ?? "" },
-				allowAsk: mode !== "ai-auto"
+				input: { toolName: req.toolName, argsText, reason: req.reason ?? "", context },
+				allowAsk: mode !== "ai-auto",
+				sessionId
 			});
 			if (judged.ok) {
 				const authorization = decideAuthorization(judged.verdict, cfg.ai.riskTolerance);
@@ -247,6 +303,7 @@ export function createHandler({ config, record, llmRunner, getSessionMode, denia
 			callId: req.callId,
 			argsPreview: argsText.slice(0, 300),
 			reason: (req.reason ?? "").slice(0, 500),
+			transcriptChars: context.length,
 			...verdict,
 			ms: Date.now() - started
 		});
@@ -444,13 +501,16 @@ export async function apply(ctx, userConfig) {
 	const store = makeModeStore(ctx, ctx.logger);
 	const getLocale = makeGetLocale(cfg, ctx);
 	const denialFeed = new Map();
+	const denialHistory = new Map();
 	const llmRunner = makeLlmRunner(ctx.llm, cfg.ai);
 	const handler = createHandler({
 		config: cfg,
 		record: makeRecorder(cfg.logFile),
 		llmRunner,
 		getSessionMode: (sessionId) => store.get(sessionId),
-		denialFeed
+		denialFeed,
+		denialHistory,
+		getCwd: (agent) => agent?.session?.policy?.workspaceRoot ?? agent?.cwd
 	});
 	ctx.on("approval/request", handler);
 	// Rejection-attribution feedback: inject staged denials into the next
@@ -472,7 +532,9 @@ export async function apply(ctx, userConfig) {
 		tolerance: cfg.ai.riskTolerance,
 		fallback: cfg.fallback,
 		denyFeedback: cfg.denyFeedback,
-		denyFeedbackMax: cfg.denyFeedbackMax
+		denyFeedbackMax: cfg.denyFeedbackMax,
+		transcript: cfg.transcript,
+		transcriptMaxChars: cfg.transcriptMaxChars
 	});
 	ctx.logger?.info?.("[dsh-codex-approval] answerer registered — mode=%s rules=%d ai=%s tolerance=%s log=%s",
 		cfg.mode, cfg.rules.length, cfg.ai.enabled ? "on" : "off", cfg.ai.riskTolerance, cfg.logFile);

package/judge.js

@@ -23,8 +23,11 @@ Rules of thumb:
 - Reading files, git status/diff/log, listing, help output: low.
 - Writes inside a project, installs, network fetches: medium.
 - Deleting data, overwriting configs, exposing secrets, privilege changes, formatting disks, anything touching credentials: high.
+- User intent matters: an action the user explicitly requested in the recent conversation is "allow"-eligible even if nominally medium-risk; never "ask"/"deny" a command the user just asked for unless it is clearly high-risk.
 - When uncertain, prefer "ask". Prefer "deny" for destructive or credential-exposing actions.
 
+An optional "Context:" block may follow the request JSON — it is a compact, truncated session transcript ([U] user messages, [T] tool calls, [R] results, [D] recent denials, [M] mode). Use it to judge intent; ignore unrelated lines.
+
 Reply with ONLY one JSON object, no prose, no markdown fences:
 {"risk":"low|medium|high","authorization":"allow|ask|deny","reason":"one short sentence"}`;
 
@@ -42,19 +45,25 @@ const SYSTEM_PROMPT_NO_ASK = SYSTEM_PROMPT.replace(
 
 /**
  * Build the messages array for the judge call.
+ * @param opts - { toolName, argsText, reason, context }
+ *   `context` is an optional compact session transcript (transcript.js);
+ *   when present it is appended as a "Context:" block after the request JSON.
  * @param allowAsk - when false (ai-auto mode), the prompt forbids "ask":
  *   the judge must commit to allow or deny.
  */
-export function buildJudgeMessages({ toolName, argsText, reason }, { allowAsk = true } = {}) {
+export function buildJudgeMessages({ toolName, argsText, reason, context }, { allowAsk = true } = {}) {
 	const user = JSON.stringify({
 		toolName,
 		command: argsText === "" ? null : argsText,
 		reason: reason ?? null
 	});
 	const system = allowAsk ? SYSTEM_PROMPT : SYSTEM_PROMPT_NO_ASK;
+	const body = context !== undefined && context !== ""
+		? `${user}\n\nContext:\n${context}`
+		: user;
 	return [{
 		role: "user",
-		content: [{ type: "text", text: `${system}\n\n${user}` }]
+		content: [{ type: "text", text: `${system}\n\n${body}` }]
 	}];
 }
 
@@ -140,16 +149,19 @@ export function decideAuthorization(verdict, tolerance) {
 
 /**
  * Run the judge through an injected runner.
- * @param runner - async (messages, { signal }) => Promise<{ ok: boolean, text: string }>
- * @param input - { toolName, argsText, reason }
+ * @param runner - async (messages, { signal, sessionId }) => Promise<{ ok: boolean, text: string }>
+ * @param input - { toolName, argsText, reason, context }
  * @param config - { maxPromptChars } (unused here; kept for symmetry)
+ * @param sessionId - optional stable per-conversation id forwarded to the LLM
+ *   call so the provider can optimize prompt caching (e.g. OpenCode Go's
+ *   `x-opencode-session` header).
  * @returns { ok: true, verdict } | { ok: false, error }
  */
-export async function judgeWith({ runner, input, signal, allowAsk = true }) {
+export async function judgeWith({ runner, input, signal, allowAsk = true, sessionId }) {
 	const messages = buildJudgeMessages(input, { allowAsk });
 	let result;
 	try {
-		result = await runner(messages, { signal });
+		result = await runner(messages, { signal, sessionId });
 	} catch (error) {
 		return { ok: false, error: String(error?.message ?? error) };
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-codex-approval",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Codex-style approval autopilot for DeepSeek Harness: ordered glob rules (allow/ask/deny) plus an AI risk judge (low/medium/high) mapped through a risk tolerance, as an approval answerer.",
   "type": "module",
   "main": "index.js",
@@ -11,6 +11,7 @@
     "i18n.js",
     "judge.js",
     "modes.js",
+    "transcript.js",
     "cordis.patch.yml",
     "README.md",
     "LICENSE"

package/transcript.js

@@ -0,0 +1,225 @@
+/**
+ * dsh-codex-approval — transcript.js
+ *
+ * Compact-session-transcript builder (`transcript: "short"`). Turns the live
+ * session event stream into a bounded, skeletonized context block for the AI
+ * approval judge, so the judge can see user intent and the surrounding tool
+ * chain — not just the bare command.
+ *
+ * Pipeline:
+ *   1. semantic filter   — keep only user/message, tool-calls, tool/results,
+ *                          turn markers; drop streaming chunks and plugin-
+ *                          sourced user messages (denyFeedback / time-context
+ *                          injections must never be fed back to the judge).
+ *   2. two-level window  — short window (recent user message + ≤3 tool
+ *                          calls) rendered in full skeleton; long window
+ *                          (older user messages only) as an intent line.
+ *   3. head/tail truncation — overlong messages keep head + tail with an
+ *                          elision counter (error-report pastes: head =
+ *                          action, tail = crux, middle = noise).
+ *   4. budget tiers      — total bounded by transcriptMaxChars; overflow
+ *                          drops lowest-priority items first (denial history
+ *                          → cwd → oldest long-window entries).
+ *
+ * Pure functions only; everything defensive, never throws into the
+ * approval path.
+ */
+
+/** Head/tail caps per item class, in chars. */
+const CAPS = {
+	shortUser: { head: 600, tail: 600 },   // the most recent user message (P0)
+	longUser: { head: 120, tail: 80 },     // older intent-line entries (P2)
+	tool: { head: 200, tail: 0 }           // tool-call arguments (P1)
+};
+
+/** Elide the middle of an over-long text: `head…〔省略 N 字符〕…tail`. */
+export function truncateMiddle(text, headChars, tailChars) {
+	if (typeof text !== "string" || text.length <= headChars + tailChars) return text;
+	const head = text.slice(0, headChars);
+	const tail = tailChars > 0 ? text.slice(text.length - tailChars) : "";
+	const omitted = text.length - headChars - tailChars;
+	return omitted > 0
+		? `${head}…〔省略 ${omitted} 字符〕…${tail}`
+		: text;
+}
+
+/**
+ * Extract the text of a user/message event. Returns "" for non-text shapes.
+ */
+function userText(data) {
+	const content = data?.content;
+	if (Array.isArray(content)) {
+		return content
+			.filter((part) => part?.type === "text" && typeof part.text === "string")
+			.map((part) => part.text)
+			.join(" ");
+	}
+	if (content && content.type === "text" && typeof content.text === "string") return content.text;
+	return "";
+}
+
+/**
+ * Collect semantic items from the raw event stream, newest first.
+ * Plugin-sourced user messages and streaming chunks are excluded here.
+ * @param events - session.events
+ * @returns array of { seq, kind, ... } with seq counting only semantic items
+ *   (newest first, so index 0 is the most recent).
+ */
+export function collectSemanticItems(events) {
+	if (!Array.isArray(events)) return [];
+	const items = [];
+	for (let i = events.length - 1; i >= 0; i -= 1) {
+		const event = events[i];
+		if (event === null || typeof event !== "object") continue;
+		const type = event.type;
+		if (type === "user/message") {
+			const source = event.data?.source;
+			if (source?.kind === "plugin") continue; // never feed injections back
+			const text = userText(event.data);
+			if (text === "") continue;
+			items.push({ seq: items.length, kind: "user", text, time: event.time });
+		} else if (type === "assistant/message") {
+			const content = event.data?.message?.content;
+			if (!Array.isArray(content)) continue;
+			for (const part of content) {
+				if (part?.type !== "tool-call") continue;
+				const args = typeof part.arguments === "string" ? part.arguments : "";
+				items.push({ seq: items.length, kind: "tool", name: part.name, args, time: event.time });
+			}
+		} else if (type === "tool/result") {
+			const msg = event.data?.message;
+			const error = event.data?.error;
+			const text = typeof msg?.text === "string" ? msg.text
+				: Array.isArray(msg?.content)
+					? msg.content.filter((p) => p?.type === "text" && typeof p.text === "string").map((p) => p.text).join(" ")
+					: "";
+			items.push({
+				seq: items.length,
+				kind: "result",
+				ok: error === undefined,
+				errorCode: error?.code,
+				text: text === "" ? "" : truncateMiddle(text, 120, 60),
+				time: event.time
+			});
+		}
+	}
+	return items;
+}
+
+/**
+ * Render a semantic item to one skeleton line.
+ */
+export function renderItem(item) {
+	if (item.kind === "user") {
+		const elided = truncateMiddle(item.text, CAPS.shortUser.head, CAPS.shortUser.tail);
+		return `[U] 用户: ${elided}`;
+	}
+	if (item.kind === "tool") {
+		const args = truncateMiddle(item.args ?? "", CAPS.tool.head, CAPS.tool.tail);
+		return `[T] ${item.name}(${args})`;
+	}
+	if (item.kind === "result") {
+		const marker = item.ok ? "→ ok" : `→ error${item.errorCode ? ` (${item.errorCode})` : ""}`;
+		const extra = item.text === "" ? "" : ` ${truncateMiddle(item.text, 80, 40)}`;
+		return `[R] ${marker}${extra}`;
+	}
+	return "";
+}
+
+/**
+ * Build the compact transcript for the judge.
+ *
+ * @param opts - {
+ *   events,            session.events
+ *   cfg,               plugin config (uses transcriptMaxChars)
+ *   denialHistory,     Map<sessionId, Array<...>> — recent denials (≤5 kept)
+ *   sessionId,         for denial history lookup
+ *   mode, tolerance,   effective mode / risk tolerance lines
+ *   mode3OnAsk, cwd,   optional context lines
+ * }
+ * @returns the bounded transcript text; "" when there is nothing to show.
+ */
+export function buildTranscript({ events, cfg, denialHistory, sessionId, mode, tolerance, mode3OnAsk, cwd } = {}) {
+	const maxChars = cfg?.transcriptMaxChars ?? 4000;
+	const items = collectSemanticItems(events);
+	if (items.length === 0) return "";
+
+	// Two-level window split (items are newest-first).
+	const firstUserIdx = items.findIndex((item) => item.kind === "user");
+	const shortItems = [];
+	const longUsers = [];
+	let userBudget = 0;
+	if (firstUserIdx !== -1) {
+		// Short window: the newest user message + up to 3 tool items around it.
+		shortItems.push(items[firstUserIdx]);
+		let tools = 0;
+		for (let i = firstUserIdx - 1; i >= 0 && tools < 3; i -= 1) {
+			if (items[i].kind === "tool") {
+				shortItems.push(items[i]);
+				tools += 1;
+			}
+		}
+		// Long window: every older user message (intent line), capped per entry.
+		for (let i = items.length - 1; i > firstUserIdx; i -= 1) {
+			if (items[i].kind === "user") {
+				longUsers.push(truncateMiddle(items[i].text, CAPS.longUser.head, CAPS.longUser.tail));
+			}
+		}
+	}
+	// Fallback: no user message at all (e.g. fresh session) — keep recent tools.
+	const fallbackTools = firstUserIdx === -1
+		? items.filter((item) => item.kind === "tool" || item.kind === "result").slice(0, 4)
+		: [];
+
+	// Build sections in stable-prefix order (oldest first) for prefix caching.
+	const sections = [];
+	if (mode !== undefined) {
+		const modeLine = `mode: ${mode}${tolerance !== undefined ? `, tolerance: ${tolerance}` : ""}${mode3OnAsk !== undefined ? `, mode3OnAsk: ${mode3OnAsk}` : ""}`;
+		sections.push(`[M] ${modeLine}`);
+	}
+	if (cwd !== undefined && cwd !== "") sections.push(`[W] ${cwd}`);
+	for (const line of longUsers) sections.push(`[U] 用户: ${line}`);
+	for (const item of [...fallbackTools].reverse()) sections.push(renderItem(item));
+	for (const item of [...shortItems].reverse()) sections.push(renderItem(item));
+
+	// Denial history (P2, dropped first on overflow).
+	const denials = denialHistory?.get(sessionId) ?? [];
+	const denialLines = denials.slice(-3).map((d) => {
+		const src = d.source ?? "?";
+		const risk = d.risk !== undefined ? `, risk: ${d.risk}` : "";
+		const cmd = truncateMiddle(d.command ?? "", 80, 0);
+		return `[D] deny ${cmd} (${src}${risk})`;
+	});
+
+	// Budget: assemble; on overflow drop denial history, then oldest
+	// long-window entries, then oldest tool lines; final hard cut keeps the
+	// head and tail (mode line / newest user message are protected).
+	const joinLen = (lines) => lines.reduce((sum, line) => sum + line.length + 1, 0) - (lines.length > 0 ? 1 : 0);
+	let lines = [...sections, ...denialLines];
+	let text;
+	if (joinLen(lines) <= maxChars) {
+		text = lines.join("\n");
+	} else {
+		// 1) drop denial history entirely
+		lines = [...sections];
+		// 2) drop droppable lines from the oldest (top), protecting the first
+		//    two lines ([M] mode / [W] cwd) and the last line (newest user).
+		while (joinLen(lines) > maxChars && lines.length > 3) {
+			lines.splice(2, 1);
+		}
+		text = lines.join("\n");
+		// 3) final hard cut — the elision marker costs ~12 chars itself, so
+		//    shrink head/tail until the cut truly fits inside the cap.
+		let headChars = Math.floor(maxChars * 0.6);
+		let tailChars = Math.floor(maxChars * 0.3);
+		let cut = truncateMiddle(text, headChars, tailChars);
+		while (cut.length > maxChars && (headChars > 8 || tailChars > 4)) {
+			headChars = Math.floor(headChars * 0.8);
+			tailChars = Math.floor(tailChars * 0.8);
+			cut = truncateMiddle(text, headChars, tailChars);
+		}
+		if (cut.length > maxChars) cut = `${text.slice(0, Math.max(8, maxChars - 4))}…`;
+		text = cut;
+	}
+	return text.trim();
+}