dsh-auto-review: Instructions file for Codex

AGENTS.md

Standalone DeepSeek Harness plugin repository (dsh-auto-review). Development follows the dsh-plugin-guide skill and the official plugin contract; this file records repo-local decisions.

Layout

• src/index.ts — function-plugin contract (name/inject/Config/apply; NO default export — the Loader unwraps exports.default ?? exports).
• src/config.ts — Schemastery schema + explicit resolveConfig (no hidden ?? default in run() paths).
• src/runtime.ts — approval/request answerer, tools/post-execute deny-reason injection, /auto-review command.
• src/review.ts — reviewer subagent orchestration, prompt, sanitization, verdict parsing.
• src/phocinae.ts — the optional local non-generative reviewer backend: the POST /v1/systemone client for Phocinae-Largha-150M-v1 (one measured harm question with described options, shell-command extraction, calibrated-confidence floor, protocol validation, veto/triage mapping: destructive denies, risky/unsure escalates, harmless+confidence allows). review.ts selects it from reviewerBackend and builds the redacted evidence.
• src/isolation.ts — the reviewer child's context firewall: the ReviewerChildren registry (prompt announcement before subagents.start, id latch afterwards — the child's first step races the start's resolution) and the agent/pre-step allow-list over message SOURCES that keeps workspace instruction files and third-party injections out of the reviewer's steps. The loop re-admits its own runtime-context snapshot AFTER this seam; the firewall does not remove it, and no doc may claim otherwise.
• src/events.ts — autoReview/state + autoReview/verdict + autoReview/circuit + autoReview/override + autoReview/rejection SessionEventMap members (declaration merging), pure folds, the StateAppend/VerdictAppend/CircuitAppend/OverrideAppend/RejectionAppend surfaces that request the envelope's ignorable: true marker, and the marker-free plain*ResultText builders for audit-disabled hosts.
• src/call-id.ts — dual-ruler call-id brand (ToolExecution['callId'] from dsh-tools): host master renamed the dsh-llm CallId brand to ToolCallId, so the package derives the brand locally instead of naming either line's brand.
• src/session-message.ts — the tool-result shape adapter: reads the V4 first-class role:'tool' message AND the released-V3 tool-result wrapper. Read-only compatibility — this package never WRITES the retired shape (the host produces tool/result rows), and the V4 admission path refuses a wrapper outright.
• src/message-source.ts — this package's producer-owned message source kind ('auto-review'), declared by module augmentation because the host's MessageSourceMap has no catch-all plugin kind and the durable-log admission path refuses one.
• src/audit.ts — host ignorable-marker capability detection (isMarkedAuditEvent, isUnmarkedHostVersion, peerSessionVersion), the shared seam every audit append gates on.
• src/messages.ts — /auto-review command strings in en/zh (the language config selects the table).
• src/projection.ts + src/projection-types.ts — the autoReview session-projection unit (host fold + wire schema) and its pure-type outlet (zero value imports, so client programs never drag the host chain). Registered in apply whenever the host provides the session-projection capability (feature-detected: the answerer must work without it).
• src/client/ — browser half: the session-header review panel (ReviewPanel.tsx), locale dictionaries, scoped stylesheet, and the client-plugin entry (contract: name = package name, inject, apply(ctx); the bundle follows the shell's window.__ModuleLoader__.load handshake).
• src/invariant.ts — invariant companion, exported as dsh-auto-review/invariant. Shipped commented-out in the bundle patch: it needs the invariants service, which spine compositions (headless/ACP) provide but the plain web profile does not.
• test/ — vitest; real Context + real Session/ApprovalService/InvariantRegistry from the pinned 0.2.1-rc.2 / 0.2.1-alpha.1 dev peers (the test suite's whole @deepseek-ai/dsh-* graph is pinned to the 0.2.1 line in pnpm-workspace.yaml; the node faces leave every @deepseek-ai/ specifier external, so the runtime resolves them from the host profile and carries no runtime dsh-* dependencies), scripted subagent/commands/tools mocks. Only direct dependencies can be pinned in package.json (pnpm 11 ignores a pnpm field there), and autoInstallPeers otherwise satisfies peer ranges from the graph.
• fixtures/ — replayable session logs (invariant specs) + config examples. Fixtures are FROZEN old-line artifacts on purpose: rewriting them to the current shape would stop them testing the upgrade path a real stored log takes.
• scripts/loader-runner.mjs re-throws the first FiberState.FAILED loader row's error. Under loader 1.0.4 + cordis 4.0.3 a rejected row no longer fails loader.await() (the tree uses Promise.allSettled and reports through ctx.logger.error, which an unequipped composition swallows), so without the re-throw the negative composition regressions pass on a downstream symptom instead of the real reason. DSH_LOADER_RUNNER_NO_RETHROW=1 disables it for re-measurement only.