@amaster.ai/dsh-policy 0.1.33 → 0.1.35

package/README.md

@@ -73,9 +73,9 @@ Plugin-level fields: `enabled` (master switch) and `commandKeys` (argument keys
 ### Matching semantics
 
 - **Every condition on a rule must hold** for the rule to match (AND). A rule with no conditions beyond `tool` matches every call of that tool.
-- **Shell commands are checked segment by segment.** Compound commands (`a && b | c`, newlines, background `&`) are split, quote-aware, and `$( )` / backtick substitutions are extracted as their own segments — `cd /tmp && npm install` and `echo "$(npm install)"` both hit the `npm` rule.
+- **Shell commands are checked segment by segment.** Compound commands (`a && b | c`, newlines, background `&`) are split, quote-aware, and the executable command word is normalized through quotes, escapes and line continuations. Bash `$( )`, backtick and `<()` / `>()` substitutions are extracted as their own segments; here-doc bodies are data, except for real substitutions in unquoted bodies. PowerShell backticks are escapes, not Bash-style substitutions.
 - **Priority resolves competition within one segment**; across segments the aggregation is conservative: any segment's `deny` denies the whole call, then any `ask` escalates, and `allow` requires every segment decided allow. A broad deny is still overridable by a specific allow because both compete on the same segment (`bun run lint` at 300 vs `bun run` at 200).
-- **No rule matches → the call passes through** to the rest of the `tools/pre-execute` chain (`next()`), so dsh's own gates and other plugins keep their say. Invalid regexes are config errors and fail the plugin load; a runtime evaluation failure is logged with the `[dsh-policy]` prefix and delegates onward — the gate never breaks the agent loop.
+- **No rule matches → the call passes through** to the rest of the `tools/pre-execute` chain (`next()`), so dsh's own gates and other plugins keep their say. Invalid regexes are config errors and fail the plugin load; a runtime evaluation failure is logged with the `[dsh-policy]` prefix and denied (fail-closed) without breaking the agent loop.
 
 ### What the gate covers
 
@@ -111,7 +111,7 @@ A policy plugin is advisory gating, not containment: deny rules keep a well-beha
 
 | @amaster.ai/dsh-policy | dsh | cordis |
 | --- | --- | --- |
-| 0.1.x | `>=0.1.5-rc.1 || >=0.1.6-alpha.1 || >=0.1.7-alpha.1 || >=0.2.0-rc.1 || >=0.2.1-rc.1` (tested `0.2.1-rc.4`) | `^4.0.1` (tested `4.0.5`) |
+| 0.1.x | `>=0.1.5-rc.1 || >=0.1.6-alpha.1 || >=0.1.7-alpha.1 || >=0.2.0-rc.1 || >=0.2.1-rc.1` (tested `0.2.1-rc.5`) | `^4.0.1` (tested `4.0.5`) |
 
 Peer dependency: `@deepseek-ai/dsh-tools` (the `tools/pre-execute` gate). The approval seam (`@deepseek-ai/dsh-user-approval`) is optional and only involved in `ask` decisions.
 

package/lib/index.js

@@ -73,10 +73,9 @@ export function apply(ctx, config) {
             }
         }
         catch (error) {
-            // A policy gate must never break the agent loop: a broken evaluation
-            // delegates to the rest of the chain (dsh's own gates keep their say).
+            // Keep the agent loop alive without turning a broken policy into an allow.
             console.error('[dsh-policy] evaluation failed:', error);
-            return next();
+            return { kind: 'deny', reason: 'policy evaluation failed' };
         }
     });
 }

package/lib/rule.js

@@ -17,7 +17,7 @@
  * - No matching rule at all → `undefined` → the plugin delegates to the rest
  *   of the `tools/pre-execute` chain (dsh's own gates keep their say).
  */
-import { matchesPrefix, splitSegments } from './shell.js';
+import { matchesPrefix, normalizeCommandWord, splitSegments } from './shell.js';
 /** Fail-closed tie-break within one priority tier. */
 const SEVERITY = { allow: 0, ask: 1, deny: 2 };
 const prefer = (a, b) => {
@@ -101,13 +101,13 @@ function argsMatch(rule, args, argsJson) {
         return cond.res.some((re) => re.test(text));
     });
 }
-function matchesSegment(rule, segment) {
+function matchesSegment(rule, segment, dialect) {
     const hasCommandCondition = rule.commandPrefixes !== undefined || rule.commandRes !== undefined;
     // No command string on this call: command conditions cannot be satisfied.
     if (segment === undefined)
         return !hasCommandCondition;
-    return (anyMatch(rule.commandPrefixes, (prefix) => matchesPrefix(segment, prefix)) &&
-        anyMatch(rule.commandRes, (re) => re.test(segment)));
+    return (anyMatch(rule.commandPrefixes, (prefix) => matchesPrefix(segment, prefix, dialect)) &&
+        anyMatch(rule.commandRes, (re) => re.test(normalizeCommandWord(segment, dialect))));
 }
 export function evaluate(rules, toolName, args, commandKeys) {
     const candidates = rules.filter((rule) => rule.tools.includes('*') || rule.tools.includes(toolName));
@@ -117,7 +117,8 @@ export function evaluate(rules, toolName, args, commandKeys) {
     const command = extractCommand(args, commandKeys);
     // A call without a shell command is one virtual whole-call segment — only
     // rules without command conditions can match it.
-    const segments = command === undefined ? [undefined] : splitSegments(command);
+    const dialect = toolName === 'pwsh' ? 'pwsh' : 'bash';
+    const segments = command === undefined ? [undefined] : splitSegments(command, dialect);
     let undecided = false;
     const best = {};
     for (const segment of segments) {
@@ -125,7 +126,7 @@ export function evaluate(rules, toolName, args, commandKeys) {
         for (const rule of candidates) {
             if (!argsMatch(rule, args, argsJson))
                 continue;
-            if (!matchesSegment(rule, segment))
+            if (!matchesSegment(rule, segment, dialect))
                 continue;
             winner = winner === undefined ? rule : prefer(winner, rule);
         }

package/lib/shell.js

@@ -3,18 +3,76 @@
  *
  * dsh's bash/pwsh tools receive one raw command string, so a prefix rule that
  * only examined the whole string would miss `cd /tmp && npm install`. The
- * splitter is quote-aware and pulls `$( )` / backtick substitutions out as
- * their own segments (recursively) — `echo "$(npm install)"` must still hit an
- * npm rule. Over-splitting is safe (every piece is checked on its own);
- * `commandPrefix` / `commandRegex` rules match against these segments.
+ * splitter is quote-aware, normalizes the executable command word, and pulls
+ * command/process substitutions out as their own segments (recursively).
+ * Here-doc bodies stay data except for real substitutions in unquoted bodies;
+ * `commandPrefix` / `commandRegex` rules match against the resulting segments.
  */
 const isWordBoundary = (ch) => ch === undefined || /\s/.test(ch);
+/** Remove shell quoting and escapes from the first word, leaving its arguments untouched. */
+export function normalizeCommandWord(segment, dialect = 'bash') {
+    let i = 0;
+    while (/\s/.test(segment[i] ?? ''))
+        i += 1;
+    const start = i;
+    let word = '';
+    let quote;
+    while (i < segment.length) {
+        const ch = segment[i];
+        if (quote === undefined && /\s/.test(ch))
+            break;
+        if (quote !== undefined) {
+            if (ch === quote) {
+                quote = undefined;
+                i += 1;
+            }
+            else if (dialect === 'pwsh' && ch === '`' && quote !== "'" && i + 1 < segment.length) {
+                word += segment[i + 1];
+                i += 2;
+            }
+            else if (dialect === 'bash' && ch === '\\' && quote !== "'" && i + 1 < segment.length) {
+                const next = segment[i + 1];
+                if (next === '\n')
+                    i += 2;
+                else {
+                    if ('$`"\\'.includes(next))
+                        word += next;
+                    else
+                        word += ch + next;
+                    i += 2;
+                }
+            }
+            else {
+                word += ch;
+                i += 1;
+            }
+        }
+        else if (ch === "'" || ch === '"') {
+            quote = ch;
+            i += 1;
+        }
+        else if (dialect === 'pwsh' && ch === '`' && i + 1 < segment.length) {
+            word += segment[i + 1];
+            i += 2;
+        }
+        else if (dialect === 'bash' && ch === '\\' && i + 1 < segment.length) {
+            if (segment[i + 1] !== '\n')
+                word += segment[i + 1];
+            i += 2;
+        }
+        else {
+            word += ch;
+            i += 1;
+        }
+    }
+    return segment.slice(0, start) + word + segment.slice(i);
+}
 /**
  * A prefix matches a segment only at a word boundary: `npm` matches
  * `npm install` and `npm` itself, never `npmx` or `npm-cache`.
  */
-export function matchesPrefix(segment, prefix) {
-    const trimmed = segment.trimStart();
+export function matchesPrefix(segment, prefix, dialect = 'bash') {
+    const trimmed = normalizeCommandWord(segment, dialect).trimStart();
     return trimmed.startsWith(prefix) && isWordBoundary(trimmed[prefix.length]);
 }
 /** Read a `$(`...`)` body starting just after the opening paren. */
@@ -45,13 +103,122 @@ function readParenSubshell(text, start) {
     }
     return { body: text.slice(start), end: text.length }; // unbalanced: take the rest
 }
+/** Read a simple here-doc, including a shell-chain tail on its declaration line. */
+function readHereDoc(text, start) {
+    // Bash here-strings (<<<) are ordinary input, not here-doc declarations.
+    // Check both sides because the splitter also offers the second '<' as a start.
+    if (text[start + 2] === '<' || (start > 0 && text[start - 1] === '<'))
+        return;
+    const match = /^<<(-)?[ \t]*(?:'([^']*)'|"([^"]*)"|([^\s]+))/.exec(text.slice(start));
+    if (!match)
+        return;
+    const rawDelimiter = match[0].replace(/^<<-?[ \t]*/, '');
+    const delimiter = normalizeCommandWord(rawDelimiter);
+    // Any quote/escape in the delimiter suppresses body expansion, including mixed forms.
+    const quoted = delimiter !== rawDelimiter;
+    let cursor = start + match[0].length;
+    while (text[cursor] === ' ' || text[cursor] === '\t')
+        cursor += 1;
+    const tailStart = cursor;
+    const declarationEnd = text.indexOf('\n', cursor);
+    if (declarationEnd === -1)
+        return;
+    const rawTail = text.slice(tailStart, declarationEnd).replace(/\r$/, '');
+    const outputRedirect = /^\s*>>?\s+\S+\s*$/.test(rawTail);
+    // Keep unsupported declaration tails conservative instead of guessing shell grammar.
+    if (rawTail.trim() && !outputRedirect && !/^(?:&&|\|\||[;|&])/.test(rawTail.trimStart()))
+        return;
+    const declaration = text
+        .slice(start, outputRedirect ? declarationEnd : tailStart)
+        .replace(/\r$/, '');
+    const tail = rawTail;
+    const bodyStart = declarationEnd + 1;
+    let lineStart = bodyStart;
+    for (;;) {
+        const newline = text.indexOf('\n', lineStart);
+        const lineEnd = newline === -1 ? text.length : newline;
+        let line = text.slice(lineStart, lineEnd);
+        if (line.endsWith('\r'))
+            line = line.slice(0, -1);
+        const candidate = match[1] ? line.replace(/^\t+/, '') : line;
+        if (candidate === delimiter) {
+            return {
+                declaration,
+                tail,
+                outputRedirect,
+                body: text.slice(bodyStart, lineStart),
+                quoted,
+                end: newline === -1 ? text.length : lineEnd + 1,
+            };
+        }
+        if (newline === -1) {
+            return {
+                declaration,
+                tail,
+                outputRedirect,
+                body: text.slice(bodyStart),
+                quoted,
+                end: text.length,
+            };
+        }
+        lineStart = lineEnd + 1;
+    }
+}
+/** Extract real substitutions; shell command-line tails optionally honor single/double quotes. */
+function hereDocCommands(body, respectQuotes = false) {
+    const commands = [];
+    let quote;
+    let i = 0;
+    while (i < body.length) {
+        const ch = body[i];
+        if (respectQuotes && quote === "'") {
+            if (ch === "'")
+                quote = undefined;
+            i += 1;
+            continue;
+        }
+        if (ch === '\\' && i + 1 < body.length) {
+            i += 2;
+            continue;
+        }
+        if (respectQuotes) {
+            if (ch === quote) {
+                quote = undefined;
+                i += 1;
+                continue;
+            }
+            if (quote === undefined && (ch === "'" || ch === '"')) {
+                quote = ch;
+                i += 1;
+                continue;
+            }
+        }
+        if (ch === '$' && body[i + 1] === '(') {
+            const { body: inner, end } = readParenSubshell(body, i + 2);
+            commands.push(...splitSegments(inner));
+            i = end;
+            continue;
+        }
+        if (ch === '`') {
+            let close = i + 1;
+            while (close < body.length && body[close] !== '`') {
+                close += body[close] === '\\' ? 2 : 1;
+            }
+            commands.push(...splitSegments(body.slice(i + 1, close)));
+            i = close < body.length ? close + 1 : body.length;
+            continue;
+        }
+        i += 1;
+    }
+    return commands;
+}
 /**
  * Split a compound command into the segments a shell would run: pipelines,
  * `&&`/`||`/`;`/newline chains, background `&`, plus the interiors of
  * `$( )` and backtick substitutions (which execute even inside double
  * quotes). Quoted operator characters stay literal.
  */
-export function splitSegments(command) {
+export function splitSegments(command, dialect = 'bash') {
     const segments = [];
     let buf = '';
     let quote;
@@ -64,25 +231,54 @@ export function splitSegments(command) {
     let i = 0;
     while (i < command.length) {
         const ch = command[i];
+        if (dialect === 'pwsh' && ch === '`' && quote !== "'" && i + 1 < command.length) {
+            buf += ch + command[i + 1];
+            i += 2;
+            continue;
+        }
+        if (dialect === 'bash' && quote === undefined && ch === '<' && command[i + 1] === '<') {
+            const doc = readHereDoc(command, i);
+            if (doc) {
+                buf += doc.declaration;
+                push();
+                if (!doc.quoted)
+                    segments.push(...hereDocCommands(doc.body));
+                segments.push(...(doc.outputRedirect
+                    ? hereDocCommands(doc.tail, true)
+                    : splitSegments(doc.tail, dialect)));
+                i = doc.end;
+                continue;
+            }
+        }
+        // Process substitution is unquoted Bash syntax; its interior executes too.
+        if (dialect === 'bash' &&
+            quote === undefined &&
+            (ch === '<' || ch === '>') &&
+            command[i + 1] === '(') {
+            const { body, end } = readParenSubshell(command, i + 2);
+            segments.push(...splitSegments(body, dialect));
+            i = end;
+            continue;
+        }
         // Substitution contents execute inside double quotes but are literal in
         // single quotes — extract them from everywhere except '...'.
         if (quote !== "'") {
             if (ch === '$' && command[i + 1] === '(') {
                 const { body, end } = readParenSubshell(command, i + 2);
-                segments.push(...splitSegments(body));
+                segments.push(...splitSegments(body, dialect));
                 i = end;
                 continue;
             }
-            if (ch === '`') {
+            if (dialect === 'bash' && ch === '`') {
                 const close = command.indexOf('`', i + 1);
-                segments.push(...splitSegments(close === -1 ? command.slice(i + 1) : command.slice(i + 1, close)));
+                segments.push(...splitSegments(close === -1 ? command.slice(i + 1) : command.slice(i + 1, close), dialect));
                 i = close === -1 ? command.length : close + 1;
                 continue;
             }
         }
         if (quote !== undefined) {
             buf += ch;
-            if (ch === '\\' && quote !== "'" && i + 1 < command.length) {
+            if (dialect === 'bash' && ch === '\\' && quote !== "'" && i + 1 < command.length) {
                 buf += command[i + 1];
                 i += 2;
                 continue;
@@ -98,7 +294,7 @@ export function splitSegments(command) {
             i += 1;
             continue;
         }
-        if (ch === '\\' && i + 1 < command.length) {
+        if (dialect === 'bash' && ch === '\\' && i + 1 < command.length) {
             buf += ch + command[i + 1];
             i += 2;
             continue;

package/lib/types/shell.d.ts

@@ -3,20 +3,23 @@
  *
  * dsh's bash/pwsh tools receive one raw command string, so a prefix rule that
  * only examined the whole string would miss `cd /tmp && npm install`. The
- * splitter is quote-aware and pulls `$( )` / backtick substitutions out as
- * their own segments (recursively) — `echo "$(npm install)"` must still hit an
- * npm rule. Over-splitting is safe (every piece is checked on its own);
- * `commandPrefix` / `commandRegex` rules match against these segments.
+ * splitter is quote-aware, normalizes the executable command word, and pulls
+ * command/process substitutions out as their own segments (recursively).
+ * Here-doc bodies stay data except for real substitutions in unquoted bodies;
+ * `commandPrefix` / `commandRegex` rules match against the resulting segments.
  */
+export type ShellDialect = 'bash' | 'pwsh';
+/** Remove shell quoting and escapes from the first word, leaving its arguments untouched. */
+export declare function normalizeCommandWord(segment: string, dialect?: ShellDialect): string;
 /**
  * A prefix matches a segment only at a word boundary: `npm` matches
  * `npm install` and `npm` itself, never `npmx` or `npm-cache`.
  */
-export declare function matchesPrefix(segment: string, prefix: string): boolean;
+export declare function matchesPrefix(segment: string, prefix: string, dialect?: ShellDialect): boolean;
 /**
  * Split a compound command into the segments a shell would run: pipelines,
  * `&&`/`||`/`;`/newline chains, background `&`, plus the interiors of
  * `$( )` and backtick substitutions (which execute even inside double
  * quotes). Quoted operator characters stay literal.
  */
-export declare function splitSegments(command: string): string[];
+export declare function splitSegments(command: string, dialect?: ShellDialect): string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/dsh-policy",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "description": "Declarative tool-call policy for DeepSeek Harness: config-driven allow/deny/ask rules (tool name, args pattern, shell command prefix/regex, priority) on the tools/pre-execute gate — Gemini CLI-style policy files expressed as plain plugin config.",
   "type": "module",
   "main": "lib/index.js",
@@ -32,7 +32,7 @@
     }
   },
   "dependencies": {
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/schemastery": "^3.18.5"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
@@ -40,23 +40,23 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.5",
-    "@deepseek-ai/dsh-agent": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-home-paths": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-http-proxy": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-jobs": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-llm": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-ptc-runtime": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-scope": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-session-projection": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-shell": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-shell-env": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-tool-bash": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-tools": "0.2.1-rc.4",
-    "@deepseek-ai/dsh-user-approval": "0.2.1-rc.4",
+    "@deepseek-ai/dsh-agent": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-home-paths": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-http-proxy": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-jobs": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-ptc-runtime": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-scope": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-shell": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-shell-env": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tool-bash": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-rc.5",
     "@types/node": "^22.0.0",
     "typescript": "^5.6.3",
     "vitest": "^4.1.11"