feat(plugins): ship Auto review as an optional bundle

The installation lists @deepseek-ai/dsh-experimental-auto-review beside
the two Agent Teams layers under dsh.optionalBundles, so a blank Web
profile offers it in the built-in group switched off. The bundle gets a
display title and one-liner, and its README says where it is switched on.

.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md
-2026-09-15-shipped-optional-bundles.md: cbacff975118f2b8e6187cb5c80d1ec702d64fde
-2026-09-15-shipped-optional-bundles.zh.md: d0d2dc24f27697883d96934f473ff35db2e2ace7
+2026-09-15-shipped-optional-bundles.md: 9377eff36b90bda261abcf640fa8ff50efb3a6a9
+2026-09-15-shipped-optional-bundles.zh.md: bf1afeb127ad0d0998c975e08758208416bf9332

.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.md

@@ -14,7 +14,7 @@ The installation's manifest, `apps/cli/package.json`, lists under `dsh.optionalB
 
 Default-product isolation keeps its rules with one declared exception: an optional bundle's dependency graph is outside the default product. The static gate skips the `dependencies` edge from `@deepseek-ai/dsh` to a listed bundle and still rejects a runtime import, a shipped composition, a preset, or a default template that names it, an experimental dependency the list does not name, and a listed name that is not a runtime dependency or not a bundle. The workspace-constraints check accepts the same `dependencies` edges and no other runtime section, and the packed-install release check skips them from the installed entry package while requiring each listed bundle to be installed.
 
-Agent Teams ships this way first, as `@deepseek-ai/dsh-experimental-agent-team-profile` and `@deepseek-ai/dsh-experimental-agent-team-web-profile`.
+Agent Teams and Auto review ship this way first, as `@deepseek-ai/dsh-experimental-agent-team-profile`, `@deepseek-ai/dsh-experimental-agent-team-web-profile`, and `@deepseek-ai/dsh-experimental-auto-review`.
 
 ## Alternatives considered
 

.agents/notes/implemented/process/2026-09-15-shipped-optional-bundles.zh.md

@@ -14,7 +14,7 @@ Web 插件页只管理用户装进 profile 的组合包。像 Agent Teams 这样
 
 默认产品隔离的规则保持不变，只声明一个例外：可选组合包的依赖图在默认产品之外。静态门禁跳过从 `@deepseek-ai/dsh` 到列表中组合包的 `dependencies` 边，仍然拒绝运行时 import、随附组合、preset 或默认模板对它的引用，拒绝列表没有点名的实验依赖，也拒绝不是运行时依赖或不是组合包的列表项。workspace 约束检查接受同样的 `dependencies` 边而不接受其他运行时依赖段；发布时的 packed-install 检查对已安装入口包跳过这些边，并要求列表中的每个组合包都已安装。
 
-Agent Teams 首先以这种方式交付，即 `@deepseek-ai/dsh-experimental-agent-team-profile` 与 `@deepseek-ai/dsh-experimental-agent-team-web-profile`。
+Agent Teams 与 Auto review 首先以这种方式交付，即 `@deepseek-ai/dsh-experimental-agent-team-profile`、`@deepseek-ai/dsh-experimental-agent-team-web-profile` 与 `@deepseek-ai/dsh-experimental-auto-review`。
 
 ## 考虑过的替代方案
 

apps/cli/package.json

@@ -28,7 +28,8 @@
     ],
     "optionalBundles": [
       "@deepseek-ai/dsh-experimental-agent-team-profile",
-      "@deepseek-ai/dsh-experimental-agent-team-web-profile"
+      "@deepseek-ai/dsh-experimental-agent-team-web-profile",
+      "@deepseek-ai/dsh-experimental-auto-review"
     ]
   },
   "license": "MIT",
@@ -53,6 +54,7 @@
     "@deepseek-ai/dsh-cordis-client-runner": "workspace:^",
     "@deepseek-ai/dsh-experimental-agent-team-profile": "workspace:^",
     "@deepseek-ai/dsh-experimental-agent-team-web-profile": "workspace:^",
+    "@deepseek-ai/dsh-experimental-auto-review": "workspace:^",
     "@deepseek-ai/dsh-fs-local": "workspace:^",
     "@deepseek-ai/dsh-goal": "workspace:^",
     "@deepseek-ai/dsh-goal-round-driver": "workspace:^",

apps/web/tests/expected/plugin-manager/live-enabled.expected.md

@@ -5,7 +5,7 @@
   - img
   - text: 添加插件
 - heading "内置" [level=3]
-- text: "2"
+- text: "3"
 - list:
   - listitem:
     - button "查看 Agent Teams": Agent Teams
@@ -15,6 +15,10 @@
     - button "查看 Agent Teams Web 面板": Agent Teams Web 面板
     - text: 官方 实验功能：在浏览器里显示 Agent Teams 的团队名单、任务板和成员导航，需先开启 Agent Teams。
     - switch "启用 Agent Teams Web 面板"
+  - listitem:
+    - button "查看 Auto review": Auto review
+    - text: 官方 实验功能：为当前会话的权限选择器增加 Auto review，每次工具调用前由模型评估风险再执行；可能误放行或误拒绝，并消耗额外 token。
+    - switch "启用 Auto review"
 - heading "已安装" [level=3]
 - text: "1"
 - list:

apps/web/tests/expected/plugin-manager/manager.expected.md

@@ -5,7 +5,7 @@
   - img
   - text: 添加插件
 - heading "内置" [level=3]
-- text: "2"
+- text: "3"
 - list:
   - listitem:
     - button "查看 Agent Teams": Agent Teams
@@ -15,6 +15,10 @@
     - button "查看 Agent Teams Web 面板": Agent Teams Web 面板
     - text: 官方 实验功能：在浏览器里显示 Agent Teams 的团队名单、任务板和成员导航，需先开启 Agent Teams。
     - switch "启用 Agent Teams Web 面板"
+  - listitem:
+    - button "查看 Auto review": Auto review
+    - text: 官方 实验功能：为当前会话的权限选择器增加 Auto review，每次工具调用前由模型评估风险再执行；可能误放行或误拒绝，并消耗额外 token。
+    - switch "启用 Auto review"
 - heading "已安装" [level=3]
 - text: "1"
 - list:

apps/web/tests/plugin-manager.e2e.ts

@@ -74,7 +74,7 @@ describe('web e2e: plugin manager', () => {
     // The profile's own group holds its one bundle; the installation's optional bundles form the built-in
     // group, and its other bundles stay off the page.
     expect(await panel.locator('[data-plugin-group="bundles"] [data-plugin-package]').count()).toBe(1)
-    expect(await panel.locator('[data-plugin-group="builtin"] [data-plugin-package]').count()).toBe(2)
+    expect(await panel.locator('[data-plugin-group="builtin"] [data-plugin-package]').count()).toBe(3)
     // A bundle that is off still shows the rows its patch declares, without switches.
     await panel.getByRole('button', { name: '查看 示例组合包' }).click()
     await panel.locator('[data-plugin-row]', { hasText: 'fixture-row' }).waitFor({ timeout: 10_000 })

packages/experimental/auto-review/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/experimental/auto-review/README.md
-README.md: 857ea568577e5071d2ea282849cf4b817a26a1b4
-README.zh.md: e05e81b0765743e444912c98b0170fc1bb746503
+README.md: db4d1d3c5a8ace23f41b3d522824b3163156fc7a
+README.zh.md: c4fd7e59b25f22adb4b1947fc0b27ff844c3ebf2

packages/experimental/auto-review/README.md

@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-Add Auto review to the current-session permission pickers in a Web profile. Before each native or PTC inner tool call, the current agent's provider and model assess the pending action; an allowed call executes with Full access. Default Web keeps its three permission modes until this layer is explicitly installed. Auto review is experimental: it can allow unsafe actions, deny useful work, and spend additional tokens.
+Add Auto review to the current-session permission pickers in a Web profile. Before each native or PTC inner tool call, the current agent's provider and model assess the pending action; an allowed call executes with Full access. The dsh installation ships this layer switched off; default Web keeps its three permission modes until it is switched on from the Web sidebar's Plugins page or installed explicitly. Auto review is experimental: it can allow unsafe actions, deny useful work, and spend additional tokens.
 
 ## Table of Contents
 
@@ -112,7 +112,7 @@ The denial appends an ordinary tool result; it does not rewrite earlier context
 
 <a id="known-limitations-and-deferred-work"></a>
 
-- Auto requires an explicitly installed Web layer; it is absent from default Web, Headless, General settings, and new-session defaults.
+- Auto requires this Web layer switched on; it is absent from default Web, Headless, General settings, and new-session defaults.
 - Auto provides no file sandbox. The outer `run_code` transport and direct Node effects inside a PTC program do not pass through inner-tool review.
 - Model classification can be wrong. There are no deterministic tool exemptions, persistent grants, manual fallback, configurable policy, or retry layer.
 - In-process Auto children review their own calls. Out-of-process children retain their native permission systems after the parent delegation call is allowed.

packages/experimental/auto-review/README.zh.md

@@ -9,7 +9,7 @@ kind: "package-bundle"
 
 ## 概述
 
-为 Web profile 当前会话权限选择器添加 Auto review。每次原生或 PTC inner 工具调用前，当前 agent 的 provider 与模型会评估待执行动作；获准调用以 Full access 执行。在显式安装此层之前，默认 Web 保持三种权限模式。Auto review 是实验功能：它可能误放行不安全动作、误拒绝有用操作，并消耗额外 token。
+为 Web profile 当前会话权限选择器添加 Auto review。每次原生或 PTC inner 工具调用前，当前 agent 的 provider 与模型会评估待执行动作；获准调用以 Full access 执行。dsh 安装随附此层但默认关闭；在 Web 侧栏插件页开启或显式安装之前，默认 Web 保持三种权限模式。Auto review 是实验功能：它可能误放行不安全动作、误拒绝有用操作，并消耗额外 token。
 
 ## 目录
 
@@ -112,7 +112,7 @@ Reviewer 使用最新 `request/header.config` 的 provider 与模型，并沿用
 
 <a id="known-limitations-and-deferred-work"></a>
 
-- Auto 需要显式安装 Web 层；默认 Web、Headless、通用设置与新会话默认值都不包含它。
+- Auto 需要开启此 Web 层；默认 Web、Headless、通用设置与新会话默认值都不包含它。
 - Auto 不提供文件沙箱。外层 `run_code` transport 及PTC 程序内直接 Node 效果不经过 inner-tool review。
 - 模型分类可能出错。不提供确定性工具豁免、持久 grant、人工 fallback、可配置策略或重试层。
 - 进程内 Auto child 独立审查自身调用。进程外 child 在父委派调用获准后保留原生权限系统。

packages/experimental/auto-review/package.json

@@ -71,6 +71,8 @@
     "access": "public"
   },
   "dsh": {
+    "title": "Auto review",
+    "description": "实验功能：为当前会话的权限选择器增加 Auto review，每次工具调用前由模型评估风险再执行；可能误放行或误拒绝，并消耗额外 token。",
     "bundle": {
       "patch": "./cordis.patch.yml"
     }

pnpm-lock.yaml

@@ -218,6 +218,9 @@ importers:
       '@deepseek-ai/dsh-experimental-agent-team-web-profile':
         specifier: workspace:^
         version: link:../../packages/experimental/agent-team-web-profile
+      '@deepseek-ai/dsh-experimental-auto-review':
+        specifier: workspace:^
+        version: link:../../packages/experimental/auto-review
       '@deepseek-ai/dsh-fs-local':
         specifier: workspace:^
         version: link:../../packages/fs/fs-local