dsh-codex-approval 0.3.0 → 0.4.2

package/client-model-picker.js

@@ -0,0 +1,122 @@
+/**
+ * dsh-codex-approval — client-model-picker.js
+ *
+ * Pure, JSX-free helpers for the settings card's judge-model picker: turn the
+ * host's model catalog into selectable options, order them so dead providers
+ * sink to the bottom, and validate the fallback chain before it is saved.
+ *
+ * Kept out of the .tsx so it can be unit-tested with `node --test` (the card
+ * itself needs a browser React runtime; this module needs nothing).
+ */
+
+/** Upper bound on the fallback chain — must match index.js `MAX_FALLBACKS`. */
+export const MAX_FALLBACKS = 4;
+
+/** Stable key for one provider/model pair (NUL-joined, matching the card's values). */
+export function optionKey(provider, model) {
+	return `${provider}\u0000${model}`;
+}
+
+/**
+ * The selectable judge models for a catalog snapshot.
+ *
+ * A provider is unavailable when its catalog lookup failed (`failures`) or the
+ * host does not list it as currently routable. Unavailable providers stay
+ * selectable — they are marked and sorted last, never hidden, so a route that
+ * is merely cooling down can still be picked deliberately.
+ *
+ * @param catalog - host `session.modelCatalog()` value, or null while loading
+ * @param fallbackModels - static list used when the catalog is empty/unavailable
+ * @returns Array<{ provider, model, label, available, note? }>
+ */
+export function buildModelOptions(catalog, fallbackModels = []) {
+	const groups = Array.isArray(catalog?.groups) ? catalog.groups : [];
+	const failures = new Map((Array.isArray(catalog?.failures) ? catalog.failures : []).map((failure) => [failure.id, failure.message]));
+	// The field is authoritative when present — an empty array means no provider
+	// can serve right now. A missing/`undefined` field states nothing, so no
+	// option is penalized for it.
+	const routable = Array.isArray(catalog?.routableProviders) ? new Set(catalog.routableProviders) : undefined;
+	const options = [];
+	for (const group of groups) {
+		if (group === null || typeof group !== "object") continue;
+		const failure = failures.get(group.id);
+		const available = failure === undefined && (routable === undefined || routable.has(group.id));
+		for (const model of Array.isArray(group.models) ? group.models : []) {
+			if (model === null || typeof model !== "object") continue;
+			options.push({
+				provider: group.id,
+				model: model.id,
+				label: `${group.name ?? group.id} / ${model.name ?? model.id}`,
+				available,
+				...failure === undefined ? {} : { note: failure }
+			});
+		}
+	}
+	if (options.length === 0) {
+		for (const item of fallbackModels) {
+			options.push({ provider: item.provider, model: item.model, label: `${item.provider} / ${item.model}`, available: true });
+		}
+	}
+	return options;
+}
+
+/** Available options first, unavailable ones last; catalog order preserved within each part. */
+export function splitByAvailability(options) {
+	return {
+		available: options.filter((option) => option.available),
+		unavailable: options.filter((option) => !option.available)
+	};
+}
+
+/** The option matching a provider/model pair, when the catalog has it. */
+export function findOption(options, provider, model) {
+	if (provider === undefined || model === undefined) return undefined;
+	return options.find((option) => option.provider === provider && option.model === model);
+}
+
+/**
+ * The fallback chain as stored in settings, tolerating hand-edited values:
+ * malformed entries are dropped and the list is capped.
+ */
+export function readChain(settings, max = MAX_FALLBACKS) {
+	if (!Array.isArray(settings)) return [];
+	const chain = [];
+	for (const entry of settings) {
+		if (entry === null || typeof entry !== "object") continue;
+		if (typeof entry.provider !== "string" || entry.provider === "") continue;
+		if (typeof entry.model !== "string" || entry.model === "") continue;
+		chain.push({ provider: entry.provider, model: entry.model });
+		if (chain.length === max) break;
+	}
+	return chain;
+}
+
+/**
+ * Why the chain cannot be saved, or "" when it can. The primary model is part
+ * of the duplicate check because an entry equal to it would never be reached.
+ */
+export function validateChain(chain, primary) {
+	if (chain.length > MAX_FALLBACKS) return `兜底最多 ${MAX_FALLBACKS} 项`;
+	const seen = new Set();
+	if (primary?.provider !== undefined && primary?.model !== undefined) seen.add(optionKey(primary.provider, primary.model));
+	for (const entry of chain) {
+		if (typeof entry?.provider !== "string" || entry.provider === "" || typeof entry?.model !== "string" || entry.model === "") {
+			return "每个兜底条目都要选 provider 与 model";
+		}
+		const key = optionKey(entry.provider, entry.model);
+		if (seen.has(key)) return `重复的候选：${entry.provider} / ${entry.model}`;
+		seen.add(key);
+	}
+	return "";
+}
+
+/** The effective judge order: primary first, then the chain (primary dropped). */
+export function buildChainSummary(primary, chain) {
+	const parts = [];
+	if (primary?.provider !== undefined && primary?.model !== undefined) parts.push(`${primary.provider} / ${primary.model}`);
+	for (const entry of chain) {
+		const label = `${entry.provider} / ${entry.model}`;
+		if (!parts.includes(label)) parts.push(label);
+	}
+	return parts;
+}

package/client-remote.js

@@ -0,0 +1,39 @@
+/**
+ * dsh-codex-approval — client-remote.js
+ *
+ * Resolve the host model-catalog call against the *owning plugin's* fiber.
+ *
+ * The client runtime hands out services through a cordis context proxy: a
+ * property that is not declared in the plugin's `inject` throws
+ * `cannot get property "remote.session" without inject`. The catalog lives on
+ * the dotted service `remote.session`, and slot rendering happens in the tab's
+ * fiber — not ours — so the card must never touch that proxy. This helper is
+ * called once inside our own `ctx.inject` callback and returns either a plain
+ * bound function or a safe no-op.
+ *
+ * Plain JS (no JSX/TS) so `node --test` can cover it.
+ */
+
+/**
+ * @param scope - the injected client context (declares `remote.session`)
+ * @returns a bound `modelCatalog()` call, or undefined when the service is absent
+ */
+export function resolveModelCatalogLoader(scope) {
+	const candidates = [
+		() => scope?.remote?.session,
+		() => scope?.["remote.session"]
+	];
+	for (const read of candidates) {
+		let namespace;
+		try {
+			namespace = read();
+		} catch {
+			// The proxy refuses undeclared services; try the next spelling.
+			continue;
+		}
+		if (namespace !== undefined && namespace !== null && typeof namespace.modelCatalog === "function") {
+			return () => namespace.modelCatalog();
+		}
+	}
+	return undefined;
+}

package/cordis.patch.yml

@@ -1,4 +1,4 @@
-# dsh-codex-approval bundle layer: insert the plugin row into the profile.
-- insert:
-    - id: dsh-codex-approval
-      name: dsh-codex-approval
+# dsh-codex-approval bundle layer: insert the host + browser plugin row.
+- insert:
+    - id: dsh-codex-approval
+      name: dsh-codex-approval

package/enrich.js

@@ -1,68 +1,89 @@
-/**
- * dsh-codex-approval — enrich.js
- *
- * Best-effort recovery of the full tool-call arguments behind an approval
- * request. The approval seam hands answerers only `{ toolName, callId,
- * reason }`, but the session log's latest `assistant/message` contains the
- * complete `tool-call` content part (id, name, arguments JSON) — so by
- * `callId` we can recover e.g. the exact bash command that triggered a
- * sandbox escalation, which is what rule matching and the AI judge see.
- *
- * Everything here is defensive: any shape drift or missing data returns
- * null / a degraded preview, never throws.
- */
-
-/**
- * Find the parsed tool-call arguments for a callId in a session event list.
- * @param events - session.events (or any event array)
- * @param callId - the approval request's callId
- * @returns the parsed arguments object, or null when unrecoverable.
- */
-export function findToolCallArgs(events, callId) {
-	if (!Array.isArray(events) || callId === undefined) return null;
-	for (let i = events.length - 1; i >= 0; i -= 1) {
-		const event = events[i];
-		if (event === null || typeof event !== "object" || event.type !== "assistant/message") continue;
-		const content = event.data?.message?.content;
-		if (!Array.isArray(content)) continue;
-		for (let j = content.length - 1; j >= 0; j -= 1) {
-			const part = content[j];
-			if (part === null || typeof part !== "object" || part.type !== "tool-call") continue;
-			if (part.id !== callId) continue;
-			try {
-				return JSON.parse(part.arguments ?? "null");
-			} catch {
-				return null;
-			}
-		}
-	}
-	return null;
-}
-
-/**
- * Build the Codex-style args preview used for rule matching and the AI
- * prompt: the raw command for bash/pwsh, compact JSON otherwise.
- * @param args - parsed tool arguments (or null)
- * @param toolName - the tool that was called
- * @param maxChars - preview length cap
- */
-export function argsPreview(args, toolName, maxChars) {
-	let preview;
-	if (args !== null && typeof args === "object") {
-		if ((toolName === "bash" || toolName === "pwsh") && typeof args.command === "string") {
-			preview = args.command;
-		} else {
-			try {
-				preview = JSON.stringify(args);
-			} catch {
-				preview = String(args);
-			}
-		}
-	} else if (args === undefined || args === null) {
-		preview = "";
-	} else {
-		preview = String(args);
-	}
-	if (preview.length > maxChars) preview = `${preview.slice(0, maxChars)}…`;
-	return preview;
-}
+/**
+ * dsh-codex-approval — enrich.js
+ *
+ * Best-effort recovery of the full tool-call arguments behind an approval
+ * request. The approval seam hands answerers only `{ toolName, callId,
+ * reason }`, but the session log's latest `assistant/message` contains the
+ * complete `tool-call` content part (id, name, arguments JSON) — so by
+ * `callId` we can recover e.g. the exact bash command that triggered a
+ * sandbox escalation, which is what rule matching and the AI judge see.
+ *
+ * Everything here is defensive: any shape drift or missing data returns
+ * null / a degraded preview, never throws.
+ */
+
+/**
+ * Find the parsed tool-call arguments for a callId in a session event list.
+ * @param events - a Session-like object (`snapshotEvents()`/`ownEvents()`) or any event array
+ * @param callId - the approval request's callId
+ * @returns the parsed arguments object, or null when unrecoverable.
+ */
+/**
+ * Read session events across the legacy and current DSH Session APIs.
+ * @param sessionOrEvents - a Session-like object or an event array
+ * @returns an event array; never throws
+ */
+export function getSessionEvents(sessionOrEvents) {
+	try {
+		if (Array.isArray(sessionOrEvents)) return sessionOrEvents;
+		const candidate = typeof sessionOrEvents?.snapshotEvents === "function"
+			? sessionOrEvents.snapshotEvents()
+			: typeof sessionOrEvents?.ownEvents === "function"
+				? sessionOrEvents.ownEvents()
+				: sessionOrEvents?.events;
+		return Array.isArray(candidate) ? candidate : [];
+	} catch {
+		return [];
+	}
+}
+
+export function findToolCallArgs(events, callId) {
+	if (callId === undefined || callId === null) return null;
+	const list = getSessionEvents(events);
+	if (list.length === 0) return null;
+	for (let i = list.length - 1; i >= 0; i -= 1) {
+		const event = list[i];
+		if (event === null || typeof event !== "object" || event.type !== "assistant/message") continue;
+		const content = event.data?.message?.content;
+		if (!Array.isArray(content)) continue;
+		for (let j = content.length - 1; j >= 0; j -= 1) {
+			const part = content[j];
+			if (part === null || typeof part !== "object" || part.type !== "tool-call") continue;
+			if (part.id !== callId) continue;
+			try {
+				return JSON.parse(part.arguments ?? "null");
+			} catch {
+				return null;
+			}
+		}
+	}
+	return null;
+}
+
+/**
+ * Build the Codex-style args preview used for rule matching and the AI
+ * prompt: the raw command for bash/pwsh, compact JSON otherwise.
+ * @param args - parsed tool arguments (or null)
+ * @param toolName - the tool that was called
+ * @param maxChars - preview length cap
+ */
+export function argsPreview(args, toolName, maxChars) {
+	let preview;
+	if (args !== null && typeof args === "object") {
+		if ((toolName === "bash" || toolName === "pwsh") && typeof args.command === "string") {
+			preview = args.command;
+		} else {
+			try {
+				preview = JSON.stringify(args);
+			} catch {
+				preview = String(args);
+			}
+		}
+	} else if (args === undefined || args === null) {
+		preview = "";
+	} else {
+		preview = String(args);
+	}
+	if (preview.length > maxChars) preview = `${preview.slice(0, maxChars)}…`;
+	return preview;
+}

package/i18n.js

@@ -1,140 +1,144 @@
-/**
- * dsh-codex-approval — i18n.js
- *
- * zh/en copy for the /approval-mode command. The host reads the user's
- * locale preference from the dsh settings service (`locale.preference`,
- * owned by dsh-client-locale, persisted in settings.yaml); without a value
- * (or without settings at all) the copy falls back to English.
- *
- * Pure functions only: pick the locale, render command texts.
- */
-
-export const LOCALES = ["zh", "en"];
-
-/**
- * The full message table. Keys are identical across locales so a missing
- * translation fails loudly in tests rather than silently at runtime.
- */
-export const T = {
-	zh: {
-		showWithOverride: (effective, override, configDefault) =>
-			`当前模式：${effective}（会话覆盖：${override}，配置默认：${configDefault}）`,
-		showNoOverride: (effective, configDefault) =>
-			`当前模式：${effective}（配置默认：${configDefault}，无会话覆盖）`,
-		cleared: (configDefault) => `已清除会话覆盖 → 回落 ${configDefault}（配置默认）`,
-		clearedMemoryOnly: (configDefault) => `已清除会话覆盖 → 回落 ${configDefault}（配置默认；settings 不可用，仅内存）`,
-		switched: (mode) => `已切换 → ${mode}（本会话）`,
-		switchedMemoryOnly: (mode) => `已切换 → ${mode}（本会话；settings 不可用，重启后丢失）`,
-		unknown: (input) => `未知模式 "${input}" — 用 manual | ai | ai-auto（或 1/2/3），或用 default 清除覆盖`
-	},
-	en: {
-		showWithOverride: (effective, override, configDefault) =>
-			`mode: ${effective} (session override: ${override}, config default: ${configDefault})`,
-		showNoOverride: (effective, configDefault) =>
-			`mode: ${effective} (config default: ${configDefault}, no session override)`,
-		cleared: (configDefault) => `override cleared → ${configDefault} (config default)`,
-		clearedMemoryOnly: (configDefault) => `override cleared → ${configDefault} (config default; memory-only: settings unavailable)`,
-		switched: (mode) => `switched → ${mode} (this session)`,
-		switchedMemoryOnly: (mode) => `switched → ${mode} (this session; memory-only: settings unavailable, lost on restart)`,
-		unknown: (input) => `unknown mode "${input}" — use manual | ai | ai-auto (or 1/2/3), or "default" to clear the override`
-	}
-};
-
-/**
- * Pick the command copy locale from a raw preference value.
- * @param pref - settings `locale.preference` (e.g. "zh", "en", or undefined)
- * @returns "zh" | "en" — valid values pass through; anything else → "en"
- */
-export function pickLocale(pref) {
-	return pref === "zh" ? "zh" : "en";
-}
-
-/** The command description for the given locale (registered once at boot). */
-export function commandDescription(locale) {
-	return locale === "zh"
-		? "显示或切换审批模式（manual | ai | ai-auto，或 1/2/3）"
-		: "Show or switch the approval mode (manual | ai | ai-auto, or 1/2/3)";
-}
-
-/**
- * Human-readable denial-source labels, keyed per locale. Every source the
- * plugin can stage in a denial record must have a label in both locales
- * (rule / ai / ai-error / fallback) so renderDenialNotice never leaks a raw
- * internal kind to the model.
- */
-const SOURCE_LABELS = {
-	zh: {
-		rule: "确定性规则",
-		ai: "AI 评审",
-		"ai-error": "AI 评审故障兜底（failOpen）",
-		fallback: "兜底策略"
-	},
-	en: {
-		rule: "deterministic rule",
-		ai: "AI judge",
-		"ai-error": "AI judge failure fallback (failOpen)",
-		fallback: "fallback policy"
-	}
-};
-
-/**
- * The denial-feedback copy table. Renders one staged denial into the exact
- * corrective message the `agent/pre-step` injector appends to the next model
- * request. Keys are identical across locales so a missing translation fails
- * loudly in tests rather than silently at runtime.
- */
-const NOTICE = {
-	zh: {
-		deniedByReviewer: (cmd) => `[auto-review] 上一个操作 ${cmd} 被自动审批评审拒绝——这不是用户的拒绝。`,
-		unknownCommand: "（未知命令）",
-		sourceLine: (src, risk) => `来源：${src}${risk !== void 0 ? `；风险：${risk}` : ""}`,
-		viaAsk: "（全自动模式下 \"ask\" 被解析为 \"deny\"，未经过人类确认）",
-		rationale: (text) => `评审理由：${text}`,
-		rationaleMissing: "未提供评审理由。",
-		directive: "不要通过变通手段或间接执行绕开该操作；请改用实质更安全的替代方案，或停下来询问用户。"
-	},
-	en: {
-		deniedByReviewer: (cmd) => `[auto-review] The previous action ${cmd} was denied by the automatic approval reviewer — this was NOT a user rejection.`,
-		unknownCommand: "(unknown command)",
-		sourceLine: (src, risk) => `Source: ${src}${risk !== void 0 ? `; risk: ${risk}` : ""}`,
-		viaAsk: " (denied by the auto mode default: \"ask\" resolved to \"deny\" without a human)",
-		rationale: (text) => `Review rationale: ${text}`,
-		rationaleMissing: "No rationale was provided.",
-		directive: "Do not pursue this action via workaround or indirect execution. Continue with a materially safer alternative, or stop and ask the user."
-	}
-};
-
-/**
- * Render one staged denial record into a corrective paragraph.
- * @param record - { command, source, match?, risk?, aiReason?, viaAsk? }
- * @param t - the locale's NOTICE table
- * @returns the paragraph text (no trailing newline).
- */
-function renderNoticeOne(record, t, locale) {
-	const command = record.command === undefined || record.command === ""
-		? t.unknownCommand
-		: `\`${record.command}\``;
-	const src = (SOURCE_LABELS[locale] ?? {})[record.source] ?? record.source;
-	const lines = [
-		t.deniedByReviewer(command),
-		t.sourceLine(src, record.risk) + (record.viaAsk === true ? t.viaAsk : ""),
-		record.aiReason !== undefined
-			? t.rationale(record.aiReason)
-			: t.rationaleMissing
-	];
-	return lines.join("\n");
-}
-
-/**
- * Render staged denials into the single corrective message injected before
- * the next model step. Multiple denials render in order, separated by a blank
- * line, each prefixed; the closing directive is emitted once at the end.
- * @param queue - staged denial records (1..denyFeedbackMax).
- * @param locale - "zh" | "en".
- * @returns the full message text.
- */
-export function renderDenialNotice(queue, locale) {
-	const t = NOTICE[locale] ?? NOTICE.en;
-	const body = queue.map((record) => renderNoticeOne(record, t, locale)).join("\n\n");
-	return `${body}\n${t.directive}`;
-}
+/**
+ * dsh-codex-approval — i18n.js
+ *
+ * zh/en copy for the /approval-mode command. The host reads the user's
+ * locale preference from the dsh settings service (`locale.preference`,
+ * owned by dsh-client-locale, persisted in settings.yaml); without a value
+ * (or without settings at all) the copy falls back to English.
+ *
+ * Pure functions only: pick the locale, render command texts.
+ */
+
+export const LOCALES = ["zh", "en"];
+
+/**
+ * The full message table. Keys are identical across locales so a missing
+ * translation fails loudly in tests rather than silently at runtime.
+ */
+export const T = {
+	zh: {
+		showWithOverride: (effective, override, configDefault) =>
+			`当前模式：${effective}（会话覆盖：${override}，配置默认：${configDefault}）`,
+		showNoOverride: (effective, configDefault) =>
+			`当前模式：${effective}（配置默认：${configDefault}，无会话覆盖）`,
+		cleared: (configDefault) => `已清除会话覆盖 → 回落 ${configDefault}（配置默认）`,
+		clearedMemoryOnly: (configDefault) => `已清除会话覆盖 → 回落 ${configDefault}（配置默认；settings 不可用，仅内存）`,
+		switched: (mode) => `已切换 → ${mode}（本会话）`,
+		switchedMemoryOnly: (mode) => `已切换 → ${mode}（本会话；settings 不可用，重启后丢失）`,
+		unknown: (input) => `未知模式 "${input}" — 用 manual | ai | ai-auto（或 1/2/3），或用 default 清除覆盖`
+	},
+	en: {
+		showWithOverride: (effective, override, configDefault) =>
+			`mode: ${effective} (session override: ${override}, config default: ${configDefault})`,
+		showNoOverride: (effective, configDefault) =>
+			`mode: ${effective} (config default: ${configDefault}, no session override)`,
+		cleared: (configDefault) => `override cleared → ${configDefault} (config default)`,
+		clearedMemoryOnly: (configDefault) => `override cleared → ${configDefault} (config default; memory-only: settings unavailable)`,
+		switched: (mode) => `switched → ${mode} (this session)`,
+		switchedMemoryOnly: (mode) => `switched → ${mode} (this session; memory-only: settings unavailable, lost on restart)`,
+		unknown: (input) => `unknown mode "${input}" — use manual | ai | ai-auto (or 1/2/3), or "default" to clear the override`
+	}
+};
+
+/**
+ * Pick the command copy locale from a raw preference value.
+ * @param pref - settings `locale.preference` (e.g. "zh", "en", or undefined)
+ * @returns "zh" | "en" — valid values pass through; anything else → "en"
+ */
+export function pickLocale(pref) {
+	return pref === "zh" ? "zh" : "en";
+}
+
+/** The command description for the given locale (registered once at boot). */
+export function commandDescription(locale) {
+	return locale === "zh"
+		? "显示或切换审批模式（manual | ai | ai-auto，或 1/2/3）"
+		: "Show or switch the approval mode (manual | ai | ai-auto, or 1/2/3)";
+}
+
+/**
+ * Human-readable denial-source labels, keyed per locale. Every source the
+ * plugin can stage in a denial record must have a label in both locales
+ * (rule / ai / ai-error / fallback) so renderDenialNotice never leaks a raw
+ * internal kind to the model.
+ */
+const SOURCE_LABELS = {
+	zh: {
+		rule: "确定性规则",
+		ai: "AI 评审",
+		"ai-error": "AI 评审故障兜底（failOpen）",
+		fallback: "兜底策略"
+	},
+	en: {
+		rule: "deterministic rule",
+		ai: "AI judge",
+		"ai-error": "AI judge failure fallback (failOpen)",
+		fallback: "fallback policy"
+	}
+};
+
+/**
+ * The denial-feedback copy table. Renders one staged denial into the exact
+ * corrective message the `agent/pre-step` injector appends to the next model
+ * request. Keys are identical across locales so a missing translation fails
+ * loudly in tests rather than silently at runtime.
+ */
+const NOTICE = {
+	zh: {
+		deniedByReviewer: (cmd) => `[auto-review] 上一个操作 ${cmd} 被自动审批评审拒绝——这不是用户的拒绝。`,
+		unknownCommand: "（未知命令）",
+		sourceLine: (src, risk) => `来源：${src}${risk !== void 0 ? `；风险：${risk}` : ""}`,
+		viaAsk: "（全自动模式下 \"ask\" 被解析为 \"deny\"，未经过人类确认）",
+		failure: (kind, failure) => `评审调用失败：${kind ?? "unknown"}${failure?.code !== undefined ? `（${failure.code}）` : ""}${failure?.message !== undefined ? `：${failure.message}` : ""}`,
+		rationale: (text) => `评审理由：${text}`,
+		rationaleMissing: "未提供评审理由。",
+		directive: "不要通过变通手段或间接执行绕开该操作；请改用实质更安全的替代方案，或停下来询问用户。"
+	},
+	en: {
+		deniedByReviewer: (cmd) => `[auto-review] The previous action ${cmd} was denied by the automatic approval reviewer — this was NOT a user rejection.`,
+		unknownCommand: "(unknown command)",
+		sourceLine: (src, risk) => `Source: ${src}${risk !== void 0 ? `; risk: ${risk}` : ""}`,
+		viaAsk: " (denied by the auto mode default: \"ask\" resolved to \"deny\" without a human)",
+		failure: (kind, failure) => `Review call failed: ${kind ?? "unknown"}${failure?.code !== undefined ? ` (${failure.code})` : ""}${failure?.message !== undefined ? `: ${failure.message}` : ""}`,
+		rationale: (text) => `Review rationale: ${text}`,
+		rationaleMissing: "No rationale was provided.",
+		directive: "Do not pursue this action via workaround or indirect execution. Continue with a materially safer alternative, or stop and ask the user."
+	}
+};
+
+/**
+ * Render one staged denial record into a corrective paragraph.
+ * @param record - { command, source, match?, risk?, aiReason?, finishKind?, failure?, viaAsk? }
+ * @param t - the locale's NOTICE table
+ * @returns the paragraph text (no trailing newline).
+ */
+function renderNoticeOne(record, t, locale) {
+	const command = record.command === undefined || record.command === ""
+		? t.unknownCommand
+		: `\`${record.command}\``;
+	const src = (SOURCE_LABELS[locale] ?? {})[record.source] ?? record.source;
+	const lines = [
+		t.deniedByReviewer(command),
+		t.sourceLine(src, record.risk) + (record.viaAsk === true ? t.viaAsk : ""),
+		record.failure !== undefined
+			? t.failure(record.finishKind, record.failure)
+			: record.aiReason !== undefined
+				? t.rationale(record.aiReason)
+				: t.rationaleMissing
+	];
+	return lines.join("\n");
+}
+
+/**
+ * Render staged denials into the single corrective message injected before
+ * the next model step. Multiple denials render in order, separated by a blank
+ * line, each prefixed; the closing directive is emitted once at the end.
+ * @param queue - staged denial records (1..denyFeedbackMax).
+ * @param locale - "zh" | "en".
+ * @returns the full message text.
+ */
+export function renderDenialNotice(queue, locale) {
+	const t = NOTICE[locale] ?? NOTICE.en;
+	const body = queue.map((record) => renderNoticeOne(record, t, locale)).join("\n\n");
+	return `${body}\n${t.directive}`;
+}