dsh-escalation-review 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,33 @@
+# Changelog
+
+## 0.2.0 — 2026-09-29
+
+**What it is.** An escalation-only reviewer for DeepSeek Harness. Ordinary work keeps running on the native
+sandbox; the plugin wakes for exactly one thing — a call that asks to leave that sandbox — and returns a
+verdict for that call through the host's own plumbing.
+
+- **Codex-style policy.** Risk tier and authorization are scored separately and the pair decides
+  `allow` / `deny` / `ask`. `medium` means reversible *consequences*, not a reversible artifact. System and
+  security control state (`hosts`, DNS, firewall, services, certificates, `PATH`) is `high`. A safer
+  alternative downgrades the action; missing records are not permission; a post-hoc approval is high risk.
+  User instructions reach the reviewer as a bounded root projection (head 4 + tail 12, at most 16, dropped
+  whole rather than truncated, with an explicit "evidence incomplete" marker).
+- **Intervention switch, off by default.** A single segment control on the config page decides whether the
+  plugin takes part at all. It is independent of permission presets, so installing it does not require
+  editing a preset table.
+- **Audit card.** Every reviewed call gets a line in the transcript with its verdict and the reason behind
+  it, in semantic colours, expandable for the full text.
+- **Fail-closed.** A review that fails or times out denies by default; consecutive denials trip a circuit
+  breaker; the pending action is cross-checked against the session log before a verdict is accepted.
+- **Host-side behaviour.** An allow answers the escalation approval as `allowed-once`; a denial blocks the
+  tool body and returns the reason to the model. The plugin never writes session events.
+
+**Compatibility.** Verified with DSH `0.1.7-rc.2` and `0.2.0-rc.1` on Node 24. Peer requirements are given as
+ranges rather than exact pins, so a DSH upgrade does not fail the plugin compatibility check.
+
+**Relationship to the bundled `auto` preset.** The experimental auto-review plugin registers an `auto`
+permission preset, binds the session to `danger-full-access` and reviews every native call. This plugin takes
+the other side of that trade: it leaves the session's sandbox tier in force and reviews only the call that
+asks to escalate.
+
+**License.** MIT. See `LICENSE`; provenance and attribution are in `NOTICE.md`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-escalation-review contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE.md

@@ -0,0 +1,17 @@
+# NOTICE / 来源与致谢
+
+本插件的代码为独立实现。分档口径、授权评分思路与提示词结构参考了以下项目（均为其各自许可）：
+
+1. **OpenAI Codex** —— guardian 策略模板（`codex-rs/prompts/templates/guardian/policy_template.md`），
+   Apache License 2.0：<https://github.com/openai/codex>
+   参考内容：风险分档、用户授权评分、"缺失记录不等于许可"、事后批准视为高风险、
+   有更不危险的替代方案则降档等判据。**未复制其文本**（逐字重合度实测为 0）。
+2. **DeepSeek Harness 官方 auto-review 插件**（`@deepseek-ai/dsh-experimental-auto-review`），MIT License：
+   参考内容：五分区评审输入、结构化 JSON 决策（`{risk, authorization, outcome, reason?}`）、
+   "证据有歧义即失败"的 fail-closed 姿态、`tools/pre-execute` 三态契约。
+   逐字重合度实测为 1 处短句，已在本仓库改写为自有措辞。
+3. **DeepSeek Harness** 本体（MIT License）：本插件通过其公开扩展点工作
+   （`tools/pre-execute`、`approval/request`、`sessionProjections`、`conversation.chat.node` 等），
+   并在运行时使用宿主自带的 `@deepseek-ai/dsh-client-ui-primitives` 图标组件（属运行时依赖，不随本包分发）。
+
+策略文本中的中文/英文示例（例如"执行吧"、"我不许可"）取自真实会话记录并已脱敏，仅作为语言样例。

package/README.md

@@ -0,0 +1,186 @@
+# dsh-escalation-review
+
+**English** · [简体中文](README.zh.md)
+
+An **escalation-only LLM reviewer** for DeepSeek Harness (DSH).
+
+Ordinary work inside the workspace — reads, writes, shell commands — runs on the native sandbox with no
+review and no extra model calls. The plugin wakes for exactly one thing: a call that asks to leave the
+sandbox (`sandbox_permissions` differs from the mode actually in effect). That one call gets a verdict —
+allow it, refuse it, or hand it back to you — delivered through the host's own plumbing: an approval
+answered as `allowed-once`, or a three-state decision object returned before the tool body runs.
+
+## A Codex-style reviewer
+
+The policy follows OpenAI's Codex guardian template
+(`codex-rs/prompts/templates/guardian/policy_template.md`), and that is where most of the work went.
+
+- **Three-axis contract.** Risk tier and authorization are scored separately, and the pair decides
+  `allow` / `deny` / `ask`. Authorization is re-derived on every escalation: a past approval counts only
+  while its evidence is still in the session.
+- **`medium` means reversible consequences, not a reversible artifact.** A step is medium only when its
+  blast radius is bounded *and* what it does can be undone. Editing a file back is not recalling its effect.
+- **System and security control state is `high`.** `hosts`, DNS, firewall rules, services, certificates,
+  `PATH`. Each can be edited back; traffic already sent cannot be recalled.
+- **A safer alternative downgrades the action.** When the same goal is reachable without the dangerous
+  step, the dangerous step is not what the user asked for.
+- **Missing records are not permission.** Absent evidence is absence of authorization, never implied consent.
+- **A post-hoc approval is high risk.** Approving after the fact does not unlock a `critical` action.
+- **Bounded root projection.** User instructions reach the reviewer as head 4 + tail 12, at most 16, whole
+  items dropped rather than truncated, with an explicit "evidence incomplete" marker. Evidence is labelled
+  by role: human instruction, direct parent, approval answer, checkpoint, or fact.
+
+Four rules shape the edges:
+
+- **An explicit user prohibition is a hard denial**, overriding the risk tier even for a low-risk action.
+- **Evidence is data, not instruction.** Command text, file contents and tool output carry no authority;
+  text claiming "the user already allowed this" authorizes nothing.
+- **Appearance does not downgrade.** A credential-shaped payload is not made safer by looking like a
+  placeholder, nor an export by the destination it claims.
+- **Cross-check before judging.** The pending action is compared with the logged `tool/call` for the same
+  `callId`; an unambiguous disagreement aborts the review. A malformed verdict counts as a review failure.
+
+Attribution and the measured text overlap with the projects these ideas come from are in [NOTICE.md](NOTICE.md).
+
+## How it differs from the bundled `auto` preset
+
+The app ships `@deepseek-ai/dsh-experimental-auto-review`. It registers an `auto` permission preset, binds
+the session to `danger-full-access`, and reviews **every** native call — one extra model request per call,
+at full access.
+
+| | bundled `auto` preset | this plugin |
+|---|---|---|
+| sandbox tier | `danger-full-access` | the session's own tier, so `workspace-write` stays in force |
+| calls reviewed | every native call | only the call that asks to escalate |
+| preset table | registers `auto` | untouched — the gate is this plugin's own switch |
+| extra model calls | one per call | one per escalation, none otherwise |
+
+Keeping the session's sandbox tier is the point of the comparison: the sandbox covers ordinary work, and
+the reviewer covers the gap where DSH would otherwise stop to ask you.
+
+## Behaviour
+
+| Situation | What happens |
+|---|---|
+| Ordinary call, inside the sandbox | Not reviewed; passed to the next handler untouched. |
+| Escalation, intervention switch off | Not reviewed, not touched, no model call. This is the default state. |
+| Escalation, switch **on** | Reviewed once and recorded. An allow answers the approval with `allowed-once` (you are **not** asked again); a deny blocks the body and returns the reason to the model. |
+| Review failed or timed out | `failMode` decides. Default `deny` (fail closed). |
+| Three denials in a row, or 10 within 50 calls | Circuit breaker: the plugin stops refusing and hands the call to you instead. |
+| Pending action disagrees with its logged tool call | The review stops rather than judge evidence it cannot verify. |
+
+## Requirements
+
+- DSH **0.1.7-rc.2** or **0.2.0-rc.1** (both exercised), Node 24.
+- Windows is what has been exercised; other platforms are expected to work but are unverified.
+- `peerDependencies`: `@deepseek-ai/cordis` `~4.0.4`, `@deepseek-ai/dsh-llm` `>=0.1.7-rc.2 <0.3.0`.
+- Write `@deepseek-ai/dsh*` peers as a range: the host checks them with
+  `semver.satisfies(runtime, range, { includePrerelease: true })`, so an exact prerelease pin reports as
+  incompatible on the next DSH release.
+
+## Install
+
+From a local checkout, the GUI route is the cleanest: left sidebar **Plugins** (not Settings) → **Add
+plugin** → the absolute path of this directory, for example
+`D:\path\to\checkout\plugins\escalation-review`. It is registered as a `link:` dependency and appended to
+`dsh.profile.bundles`.
+
+```sh
+dsh plugin --profile <profile-name> add <package-or-path>
+```
+
+- `~/.dsh/profiles/web` and `~/.dsh/profiles/desktop` are **independent**: installing into one leaves the
+  other alone. Use `--profile web` to test against `dsh web`.
+- The host half is loaded from disk at startup, so **restart DSH** after installing, and again after
+  changing any file under `lib/`. The client half of an open session needs that restart too; a page reload
+  does not pick it up in the desktop app.
+
+Uninstall from the same Plugins page, or drop the entry from `dsh.profile.bundles`.
+
+## Configuration
+
+`enabled` is the gate, and it ships **off**: while it is off the plugin runs no review and makes no model
+calls. With it on, it answers **every** sandbox-escalation approval. The gate belongs to the plugin rather
+than to your permission table, so installing it leaves your presets as they are, independent of whichever
+preset a session happens to use. Set it from the config page — the two-position control on the first row
+of the card, Off / On — or with `"enabled": true` in a config file (the GUI writes the textual form
+`"enabledText": "true"`).
+
+Lowest to highest priority: the package's `config.json` → `~/.dsh/escalation-review.config.json` →
+`configPath` if you pass one → the host config block of the plugin entry → the settings layer the config
+page writes (with its own `*.ui.json` companion). File layers are re-read on every escalation and the
+settings layer is polled about every two seconds, so edits take effect without a restart; changing the
+plugin's **code** needs one.
+
+`config.json` accepts `//` and `/* */` comments. `cordis.patch.yml` is YAML: comments there need `#`, and a
+parse failure makes the loader skip the whole bundle silently.
+
+| Key | Default | Meaning |
+|---|---|---|
+| `enabled` | `false` | The intervention switch. |
+| `enabledText` | `""` | Text form of the switch (`"true"` / `"false"`) written by the config page; non-empty overrides `enabled`. |
+| `provider` / `model` | `""` | Which provider and model review; empty follows the session. |
+| `reasoningEffort` | `""` | Reviewer thinking effort: `off`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`, or empty to follow the session. |
+| `failMode` | `deny` | What a failed or timed-out review means: `deny` or `ask`. |
+| `denyMode` | `deny` | What a deny verdict means: `deny` outright, or `ask` the user. |
+| `probeRunner` | `inproc` | Read-only probes: `inproc` (no process spawned) or `shell` (a read-only command inside the sandbox). |
+| `policyExtra` | `""` | Free-form rules appended to the reviewer policy. |
+| `allowedHosts` | `[]` | Hosts whose ordinary network access counts as low risk. An empty array in a user file **overrides** the package list, so write the full list if you write the key at all. |
+| `timeoutMs` | `100000` | Total budget for one review, retries included. |
+| `attemptTimeoutMs` | `30000` | Cap for a single request; a timeout is retried. |
+| `retryDelayMs` | `5000` | Wait between attempts. |
+| `minAttemptMs` | `2000` | Skip a retry when the remaining budget after the delay is below this. |
+
+## What it does, and what it does not do
+
+**It answers escalations for you.** With the switch on, an allow verdict is delivered as an approval
+answered `allowed-once`: that one call runs outside the sandbox with no prompt. This is the capability and
+the risk in one — you are trading "I read this one myself" for "a model read it".
+
+**It sends evidence to your model provider.** The pending action, the session context, the bounded
+instruction projection and the local facts go into one review request through the provider configured in
+DSH (or the one you pick in the card). Reviews cost tokens.
+
+**It keeps a local log.** `~/.dsh/escalation-review.log` holds one JSON object per line, including the
+command text and the verdict with its reason. Treat it as sensitive as the sessions it summarises.
+
+**It never writes session events.** Verdicts and reasons are delivered in memory and to the audit card, so
+session history stays exactly as the host wrote it.
+
+**Failures close, and repeated denials break the loop.** Timeout, malformed JSON, a provider error or a
+failed cross-check end in `deny` by default; three denials in a row, or ten within fifty calls, trip the
+breaker and the call goes to you.
+
+**Every decision is cross-checked** against the logged tool call, so a verdict is only issued on evidence
+the plugin can tie to the call it is about.
+
+## Logging and evidence
+
+- Internal packages resolve from the running app first (`app.asar/dsh`) and the profile second, so an app
+  upgrade keeps the plugin on the app's own copies. The root used is recorded in the `assembler-resolved`
+  log line.
+- Read-only probes run in-process by default (nothing spawned). With `probeRunner: shell` they run as a
+  read-only command inside the sandbox, roughly 650–700 ms each; the budget is at most 4 probes, 3 seconds
+  in total, 1.2 seconds each, 2 KB of output. Without `pwsh`, the in-process channel is used.
+- Review log: `$DSH_HOME/escalation-review.log`, one JSON object per line. `tools/review-report.mjs`
+  renders it plus the matching session context into Markdown. Key events: `ready`,
+  `intervention-gate`, `config-effective`, `assembler-resolved`, `reviewed`, `reviewer-failed`,
+  `review-retry`, `approval-granted`, `circuit-breaker`, `projection-registered`.
+
+## The audit card
+
+An escalation appears in the transcript as a review card carrying the status (reviewing, awaiting
+approval, allowed, denied, executed with a tool error) and the reason. Clicking it expands the detail.
+Status colours come from the official theme tokens.
+
+Known limitation: an **allow** reason travels through an in-memory session projection, because approval
+outcomes have no reason field of their own. After a session is reloaded, older calls keep their status and
+lose that reason; new reviews are unaffected.
+
+Everything runs through documented extension points: `tools/pre-execute`, `approval/request`,
+`sessionProjections`, `conversation.chat.node`, `configForms`.
+
+## License
+
+MIT. See [LICENSE](LICENSE). Third-party attributions, and the measured text overlap with the projects this
+policy borrows from, are recorded in [NOTICE.md](NOTICE.md).

package/README.zh.md

@@ -0,0 +1,162 @@
+# dsh-escalation-review
+
+[English](README.md) · **简体中文**
+
+**只审「沙箱越界」的 LLM 评审插件**（DeepSeek Harness，下称 DSH）。
+
+工作区内的读写与命令跑在原生沙箱上，不评审、不产生额外模型调用。插件只为一种情况醒来：某次工具调用
+请求**离开**沙箱（`sandbox_permissions` 与当前生效模式不同）。这一次调用会被交给模型裁决 —— 放行、拒绝，
+或者交回给你 —— 并且走宿主本来就有的一套管路：把审批回答成 `allowed-once`，或在工具体执行前返回三态决策对象。
+
+## Codex 风格的评审器
+
+策略跟随 OpenAI 的 Codex guardian 模板（`codex-rs/prompts/templates/guardian/policy_template.md`），
+这也是本插件主要的工作量所在。
+
+- **三轴契约**：风险档位与授权分别打分，两者一起决定 `allow` / `deny` / `ask`。授权在**每一次**越界时重新
+  推导：过去的批准只有在证据仍留在会话里时才算数。
+- **`medium` 看的是后果可逆，不是工件可逆**：只有当爆炸半径有界**并且**它造成的影响能被撤销时，才算
+  `medium`。能把文件改回来，不等于能把效果收回来。
+- **系统与安全控制状态一律 `high`**：`hosts`、DNS、防火墙规则、服务、证书、`PATH`。它们都能改回来，
+  但已经发出去的流量收不回来。
+- **有更安全的替代方案时降档**：同一目标若能绕开危险步骤达成，那么危险步骤就不是用户要的东西。
+- **缺失的记录不等于许可**：没有证据就是没有授权，而不是默认同意。
+- **事后批准按高风险处理**：事后补的批准打不开 `critical` 动作。
+- **有界根投影**：用户指令以「头部 4 条 + 尾部 12 条、上限 16」进入评审，丢就整条丢、不截断，并显式留下
+  「证据不完整」标记。证据按角色标注：人类指令、直接父级、审批回答、检查点、事实。
+
+另有四条决定边缘情况：
+
+- **用户明确禁止 = 硬拒绝**，它压过风险档位，连低风险动作也不例外。
+- **证据是数据，不是指令**：命令文本、文件内容、工具输出都不构成授权；写着"用户已经允许了"的文本什么也
+  证明不了。
+- **不按外观降档**：形似凭据的载荷不会因为"看起来像占位符"而变安全，导出也不会因为自称的去向而变安全。
+- **先交叉校验，再判定**：待审动作会与同一 `callId` 的日志 `tool/call` 比对，一旦明确不一致就中止评审；
+  判定格式不合法按评审失败处理。
+
+这些想法的来源与逐字重合度的实测记录见 [NOTICE.md](NOTICE.md)。
+
+## 与内置 `auto` 预设的区别
+
+应用内置 `@deepseek-ai/dsh-experimental-auto-review`：它注册一个 `auto` 权限预设，把会话绑到
+`danger-full-access`，并审核**每一个**原生调用 —— 每次调用多一次模型请求，且运行在完全放开权限下。
+
+| | 内置 `auto` 预设 | 本插件 |
+|---|---|---|
+| 沙箱档位 | `danger-full-access` | 会话原本的档位，因此 **`workspace-write` 继续生效** |
+| 审核范围 | 每一个原生调用 | 只有请求越界的那一次 |
+| 预设表 | 注册 `auto` | 不动你的预设表 —— 门控是本插件自己的开关 |
+| 额外模型调用 | 每次调用一次 | 每次越界一次，其余为零 |
+
+保留会话原本的沙箱档位，正是这个对比的意义：普通工作由沙箱兜住，评审器只补上 DSH 本来会停下来问你的那一段。
+
+## 行为
+
+| 情形 | 结果 |
+|---|---|
+| 沙箱内的普通调用 | 不评审，原样交给下游处理者。 |
+| 越界调用，介入开关**关闭** | 不评审、不干预、不花模型调用。这是默认状态。 |
+| 越界调用，开关**打开** | 评审一次并记日志。判定放行则审批被回答成 `allowed-once`（你**不会被问第二次**）；判定拒绝则工具不执行、理由回传模型。 |
+| 评审失败 / 超时 | 由 `failMode` 决定，默认 `deny`（失败即拒）。 |
+| 连续三次拒绝，或 50 次窗口内 10 次 | 熔断：不再拒绝，改为交回人工，避免把整个任务卡死。 |
+| 待审动作与会话日志里的工具调用明确不一致 | 停止评审，而不是拿无法核对的证据下结论。 |
+
+## 运行前提
+
+- DSH **0.1.7-rc.2** 或 **0.2.0-rc.1**（两者都实测过），Node 24。
+- 只实测过 Windows；其它平台预期可用，但未验证。
+- `peerDependencies`：`@deepseek-ai/cordis` `~4.0.4`、`@deepseek-ai/dsh-llm` `>=0.1.7-rc.2 <0.3.0`。
+- `@deepseek-ai/dsh*` 的 peer 要写**版本区间**：宿主用
+  `semver.satisfies(runtime, range, { includePrerelease: true })` 判定，写死精确预发布版本会在 DSH
+  升级后被判为不兼容。
+
+## 安装
+
+从本地目录安装，用 GUI 最干净：左侧边栏「**插件**」（不是"设置"）→ 「添加插件」→ 填这个目录的绝对路径，
+例如 `D:\path\to\checkout\plugins\escalation-review`。它会以 `link:` 依赖登记，并追加到
+`dsh.profile.bundles`。
+
+```sh
+dsh plugin --profile <profile 名> add <包名或路径>
+```
+
+- `~/.dsh/profiles/web` 与 `~/.dsh/profiles/desktop` **互相独立**，装进一个不影响另一个。想用 `dsh web`
+  测，就加 `--profile web`。
+- 宿主半边是启动时从磁盘加载的，所以**装完要重启 DSH**；改了 `lib/` 下任何文件也要重启一次。会话里的
+  客户端半边同样需要重启才重载，桌面版里单纯刷新页面不够。
+
+卸载在同一张插件页上做，或者从 `dsh.profile.bundles` 里删掉那一条。
+
+## 配置
+
+`enabled` 是总门控，随包**关闭**：关闭时插件不评审、不产生模型调用；打开后它接管**所有**沙箱越界的审批。
+门控属于插件本身，而不是你的权限表 —— 所以安装它不会改写你的预设，也与某个会话恰好选中哪个预设无关。
+可以在配置页上设（卡片**第一行**的两档控件：关闭 / 打开），也可以写 `"enabled": true`，或 GUI 写入的
+文本形式 `"enabledText": "true"`。
+
+优先级（低 → 高）：包内 `config.json` → `~/.dsh/escalation-review.config.json` → 传了 `configPath` 就用它
+→ 插件条目里的 `config:` 段 → 配置页写入的设置层（有它自己的 `*.ui.json` 伴生文件）。文件层每次越界时重读，
+设置层约每 2 秒轮询一次，所以改动不需要重启；只有改插件**代码**才必须重启。
+
+本包的 `config.json` 容忍 `//` 与 `/* */` 注释；`cordis.patch.yml` 是 YAML，注释只能用 `#`，解析失败会让
+加载器**静默跳过整个 bundle**。
+
+| 键 | 默认值 | 含义 |
+|---|---|---|
+| `enabled` | `false` | 介入开关（总门控）。 |
+| `enabledText` | `""` | 开关的文本形式（`"true"` / `"false"`），由配置页写入；非空时覆盖 `enabled`。 |
+| `provider` / `model` | `""` | 用哪个 provider 与模型评审；留空跟随当前会话。 |
+| `reasoningEffort` | `""` | 评审思考强度：`off`、`minimal`、`low`、`medium`、`high`、`xhigh`、`max`，留空跟随会话。 |
+| `failMode` | `deny` | 评审失败或超时的含义：`deny` 或 `ask`。 |
+| `denyMode` | `deny` | 评审判定为拒绝的含义：`deny` 直接拒绝，`ask` 交回人工。 |
+| `probeRunner` | `inproc` | 只读探针：`inproc`（不 spawn 进程）或 `shell`（沙箱内只读命令）。 |
+| `policyExtra` | `""` | 追加到评审策略末尾的自定义规则（自然语言）。 |
+| `allowedHosts` | `[]` | 命中这些主机的常规网络操作按 low 处理。注意：在用户配置里写空数组会**覆盖**包内清单，要写就写全量。 |
+| `timeoutMs` | `100000` | 一次评审的总预算（含重试）。 |
+| `attemptTimeoutMs` | `30000` | 单次请求上限；超时后可以重试。 |
+| `retryDelayMs` | `5000` | 两次尝试之间的等待。 |
+| `minAttemptMs` | `2000` | 扣掉等待后剩余预算低于此值就不再重试。 |
+
+## 它做什么，不做什么
+
+**它替你回答越界审批。** 开关打开时，放行判定会以 `allowed-once` 的形式交付：那一次调用在沙箱之外执行，
+过程中不弹窗。能力与风险都在这里 —— 你把"这一次我自己看一眼"换成了"模型看过一眼"。
+
+**它把证据发给你的模型提供方。** 待审动作、会话上下文、有界指令投影与本地事实，会组成一次评审请求，
+走 DSH 里配置的 provider（或你在卡片里选的那个）。评审消耗 token。
+
+**它留一份本地日志。** `~/.dsh/escalation-review.log` 每行一个 JSON 对象，含命令文本与判定结论、理由。
+请把它当作和它所概括的会话同等敏感的东西。
+
+**它从不写会话事件。** 判定与理由在内存里交付、并呈现到审核卡片上，所以会话历史仍是宿主写下的样子。
+
+**失败即拒，反复被拒会熔断。** 超时、JSON 不合法、provider 报错、交叉校验失败，默认都以 `deny` 收场；
+连续三次、或 50 次窗口内 10 次，熔断触发，这一次交给你。
+
+**每个判定都经过交叉校验**，与日志里的工具调用比对，因此结论只建立在能对上号的那次调用上。
+
+## 日志与证据
+
+- 插件解析 DSH 内部包时**先取运行中的应用自带那份**（`app.asar/dsh`），再退到 profile，这样升级应用后
+  仍用应用自带的那份。实际命中的解析根记在 `assembler-resolved` 日志行里。
+- 只读探针默认走进程内（不 spawn 任何进程）；`probeRunner: shell` 时走沙箱内的只读命令，单条约 650–700 ms。
+  额度上限：最多 4 条、总预算 3 秒、单条 1.2 秒、输出 2 KB。拿不到 `pwsh` 时走进程内通道。
+- 评审日志：`$DSH_HOME/escalation-review.log`，每行一个 JSON 对象；`tools/review-report.mjs` 会把它与
+  会话上下文（按 `callId` 关联）渲染成 Markdown。主要事件：`ready`、`intervention-gate`、
+  `config-effective`、`assembler-resolved`、`reviewed`、`reviewer-failed`、`review-retry`、
+  `approval-granted`、`circuit-breaker`、`projection-registered`。
+
+## 审核卡片
+
+越界调用会在对话里出现一张审核卡片，显示状态（评审中、待审批、已放行、已拒绝、已执行但工具报错）与理由，
+点击可展开细节。状态颜色取自官方主题 token。
+
+已知限制：**放行的理由**是靠会话内存里的投影带过去的 —— 审批结论本身没有理由字段。会话重新加载后，
+旧调用的状态还在，但那条理由会丢；新发生的评审不受影响。
+
+全部通过有文档的扩展点工作：`tools/pre-execute`、`approval/request`、`sessionProjections`、
+`conversation.chat.node`、`configForms`。
+
+## 许可
+
+MIT，见 [LICENSE](LICENSE)。第三方来源与逐字重合度的实测记录见 [NOTICE.md](NOTICE.md)。

package/config.json

@@ -0,0 +1,72 @@
+{
+  // ─────────────────────────────────────────────────────────────────────────────
+  // escalation-review 配置文件
+  //
+  // 优先级（低 → 高）：
+  //   1) 本文件（插件目录内的默认值）
+  //   2) ~/.dsh/escalation-review.config.json      ← 建议改这个，好找
+  //   3) cordis.patch.yml 里该插件条目的 config    ← 宿主/我代管时用
+  // 每次发生越界时重新读取，所以改完**即时生效，不需要重启 DSH**。
+  // 支持 `//` 与 `/* */` 注释（字符串内的注释符不会被误伤）。
+  // ─────────────────────────────────────────────────────────────────────────────
+
+  // observe = 只评审并记录，不干预（你照旧被问）；enforce = 按评审结果放行/拒绝。
+  // 注意：这一项现在是**调试项**，配置页默认不显示（本机要看就在 ~/.dsh/escalation-review.config.json 里写 "devMode": true）。
+  // 随包默认 enforce；但因为总开关 enabled 默认关，装着不动时插件仍然零介入。
+  // 想在接入前先观察，就把下面这行改成 "observe"。
+  "enabled": false,
+  "enabledText": "",
+  "mode": "enforce",
+
+  // true：第一次越界之后，用**伪造的待审动作**（假的 rm -rf、假的凭据上传…）跑一遍策略自检。
+  // 同一套 reviewer、同一策略、同一段真实上下文，但**绝不执行任何工具**，只记录判定。
+  // 想看"危险动作会不会被拒"时打开它，比真的冒险安全得多。
+  "selfTest": false,
+
+  // 评审超时三档（2026-09-27）：单次 30s / 总 100s / 间隔 5s → 3×30 + 2×5 = 100s，正好被总预算兜住
+  // 单次尝试上限：有了它，"本次超时"不再等于"预算花光"，所以超时**可以重试**
+  "attemptTimeoutMs": 30000,
+  // 两次尝试之间的等待（毫秒）
+  "retryDelayMs": 5000,
+  // 最小重试预算：扣掉等待后剩余不足这个数，就不白打一次注定失败的请求
+  "minAttemptMs": 2000,
+  // 整个评审的总预算（毫秒）。调用方在审批路径里等着，总等待必须有界
+  "timeoutMs": 100000,
+
+  // 评审失败/超时时怎么办：deny = 直接拒绝（对齐 Codex 的 strict 档）；ask = 交回人工
+  "failMode": "deny",
+
+  // 覆盖 reviewer 使用的模型；留空则跟随当前会话的 provider/model
+  // 例：想省钱可以用一个更便宜快的模型专做三分类
+  "provider": "",
+  "model": "",
+
+  // low 风险白名单主机（按你机器上的**真实**证据推导：git 远端 + 包镜像）
+  // 命中这些主机的常规网络操作按 low 处理；上传密钥/隐私数据仍按 high 拒绝
+  "allowedHosts": [
+    "registry.npmmirror.com",     // .npmrc 里的 registry
+    "github.com",                 // 37 个项目的远端
+    "codeload.github.com",
+    "api.github.com",
+    "raw.githubusercontent.com",
+    "objects.githubusercontent.com",
+    "gitee.com",
+    "gitlab.com",
+    "bitbucket.org",
+    "gitcafe.com",
+    "gitgud.io",
+    "git.oschina.net"
+  ],
+
+  // 追加到固定策略末尾的自定义规则（自然语言，随便写）
+  "policyExtra": "",
+
+  // 评审日志（每次越界一行 JSON）。observe 模式下主要看这个
+  "logPath": "",
+
+  // 证据预算：只影响喂给 reviewer 的上下文大小
+  "historyLimit": 12,        // 保留的「用户指令」条数
+  "transcriptLimit": 40,     // transcript 事件条数
+  "textLimit": 900           // 单条文本截断长度
+}
+

package/cordis.patch.yml

@@ -0,0 +1,11 @@
+# 本包被 dsh.profile.bundles 引用时应用的插入补丁。
+#
+# ⚠️ 必须是合法 YAML：注释只能用 `#`。曾经用 `//` 当注释 → 解析失败 →
+#    加载器把整个 bundle **静默跳过**（原因只写 stderr，GUI 应用看不到）→ 插件毫无痕迹地不工作。
+#
+# 说明（2026-09-27 更正）：entry 由**本 bundle 的 patch** 插入即可，不需要挪到 profile 的 patch 层。
+# 之前以为"设置页只对 profile patch 层创建的条目生成"是错的 —— 真正的门槛是**客户端半边**：
+# 官方 `plugins.bundle.config` / `plugins.item` 槽位由客户端插件注册，宿主 `Config` 只负责校验与落盘。
+- insert:
+    - id: escalation-review
+      name: dsh-escalation-review

package/icon.svg

@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" width="48" height="48" role="img" aria-label="沙箱越界评审">
+  <title>沙箱越界评审</title>
+  <defs>
+    <linearGradient id="er-g" x1="0.1" y1="0" x2="0.9" y2="1">
+      <stop offset="0" stop-color="#3B82F6" />
+      <stop offset="0.55" stop-color="#4C6EF5" />
+      <stop offset="1" stop-color="#7C4DFF" />
+    </linearGradient>
+  </defs>
+  <path d="M24 6.5l13 4.6v11.2c0 7.6-5.4 14.6-13 16.7-7.6-2.1-13-9.1-13-16.7V11.1z"
+        fill="none" stroke="url(#er-g)" stroke-width="3.2" stroke-linejoin="round" stroke-linecap="round" />
+  <path d="M17.8 23.4l4.3 4.4 8-9.6" fill="none" stroke="url(#er-g)" stroke-width="3.4"
+        stroke-linecap="round" stroke-linejoin="round" />
+</svg>

package/lib/breaker.js

@@ -0,0 +1,76 @@
+/**
+ * breaker.js —— 连续拒绝熔断（照抄 Codex `ext/guardian-reviewer/src/circuit_breaker.rs`）
+ *
+ * 为什么要它：评审器不停拒绝会把整个任务卡死。Codex 的做法是按 **turn** 计数：
+ *   · consecutive_denials 连续拒绝数；recent_denials 为长度 50 的窗口
+ *   · 标准档阈值：连续 ≥ 3 或窗口内 ≥ 10 → 触发一次 "interrupt"（`interrupt_triggered` 只触发一次）
+ *   · 任何非拒绝（allow / 交回人工之外的正常通过）把连续计数清零
+ *
+ * 我们这边没有"打断 turn"的权限，等价动作是：**停止拒绝，改为交回人工（ask）**，
+ * 并写一条 `circuit-breaker` 日志——任务不再被无限卡住，人仍然在场。
+ */
+export const MAX_CONSECUTIVE_DENIALS = 3
+export const MAX_RECENT_DENIALS = 10
+export const DENIAL_WINDOW_SIZE = 50
+
+/** 每个会话一条记录；turnId 变化即视为新 turn（与 Codex 的 clear_turn 等价）。 */
+const sessions = new Map()
+
+function bucketFor(sessionKey, turnId) {
+  const key = String(sessionKey ?? 'unknown')
+  let bucket = sessions.get(key)
+  if (bucket === undefined || bucket.turnId !== turnId) {
+    bucket = { turnId, consecutive: 0, recent: [], interruptTriggered: false }
+    sessions.set(key, bucket)
+  }
+  return bucket
+}
+
+/**
+ * 记一次"拒绝"（deny 或 ask 都算评审器没有放行）。
+ * @returns {{ interrupt: boolean, consecutive: number, recent: number }}
+ */
+export function recordDenial(sessionKey, turnId, limits = {}) {
+  const maxConsecutive = limits.maxConsecutive ?? MAX_CONSECUTIVE_DENIALS
+  const maxRecent = limits.maxRecent ?? MAX_RECENT_DENIALS
+  const bucket = bucketFor(sessionKey, turnId)
+  bucket.consecutive += 1
+  bucket.recent.push(true)
+  if (bucket.recent.length > DENIAL_WINDOW_SIZE) bucket.recent.shift()
+  const recent = bucket.recent.filter(Boolean).length
+  if (!bucket.interruptTriggered && (bucket.consecutive >= maxConsecutive || recent >= maxRecent)) {
+    bucket.interruptTriggered = true
+    return { interrupt: true, consecutive: bucket.consecutive, recent }
+  }
+  return { interrupt: false, consecutive: bucket.consecutive, recent }
+}
+
+/** 记一次"没有拒绝"（评审通过或未介入）→ 连续计数清零。 */
+export function recordNonDenial(sessionKey, turnId) {
+  const bucket = bucketFor(sessionKey, turnId)
+  bucket.consecutive = 0
+  bucket.recent.push(false)
+  if (bucket.recent.length > DENIAL_WINDOW_SIZE) bucket.recent.shift()
+}
+
+/** 会话结束时清掉（对应 Codex 的 clear_turn）。 */
+export function clearSession(sessionKey) {
+  sessions.delete(String(sessionKey ?? 'unknown'))
+}
+
+/** 诊断用：读当前计数。 */
+export function peek(sessionKey) {
+  const bucket = sessions.get(String(sessionKey ?? 'unknown'))
+  if (bucket === undefined) return undefined
+  return {
+    turnId: bucket.turnId,
+    consecutive: bucket.consecutive,
+    recent: bucket.recent.filter(Boolean).length,
+    interruptTriggered: bucket.interruptTriggered,
+  }
+}
+
+/** 诊断用：整体重置。 */
+export function resetAll() {
+  sessions.clear()
+}