@ddtcorex/dsh-maestro-guard 0.1.0

package/README.md

@@ -0,0 +1,36 @@
+# @ddtcorex/dsh-maestro-guard
+
+Host-only safety gate for the DeepSeek Harness: gates tool execution before dispatch via a
+waterfall pre-execute hook — persistent approval grants, secret redaction before
+logging/persistence, and a pure allow/deny permission policy.
+
+Part of the Maestro Harness suite (`dsh-maestro-*`). Cordis patch row id: `dsh-maestro-guard`.
+
+> Opt-in and intentionally **not** part of the meta-bundle one-liner until published:
+> add it explicitly with `dsh plugin add @ddtcorex/dsh-maestro-guard`.
+
+## What it provides
+
+- **Waterfall pre-execute integration** — one Cordis row (`dsh-maestro-guard`) wiring the
+  guard handler into the tool-execution waterfall.
+- **ApprovalStore** — persistent approval grants with legacy migration, revoke, and
+  read-modify-write safety under a mutex.
+- **SecretRedactor** — redacts known secret families (`ghp_`, `xox`, private keys, …) before
+  calls are logged or persisted.
+- **PermissionPolicy** — pure, unit-testable allow/deny checks for tool calls.
+
+Host-only: no client bundle; DSH types come from local structural declarations
+(`src/augment.d.ts`).
+
+## Development
+
+```sh
+pnpm install
+pnpm verify   # tsc --noEmit
+pnpm test     # vitest run
+pnpm build    # tsc -> lib/
+```
+
+## License
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,4 @@
+# dsh-maestro-guard bundle patch — single row for the guard stub (Phase A).
+- insert:
+    - id: dsh-maestro-guard
+      name: '@ddtcorex/dsh-maestro-guard'

package/lib/approval-store.d.ts

@@ -0,0 +1,11 @@
+export declare function approvalsPath(dshHome?: string): string;
+export declare const pathFor: typeof approvalsPath;
+export declare class ApprovalStore {
+    private dshHome?;
+    constructor(dshHome?: string | undefined);
+    load(): Promise<Record<string, boolean>>;
+    isApproved(tool: string): Promise<boolean>;
+    approve(tool: string): Promise<void>;
+    revoke(tool: string): Promise<void>;
+}
+//# sourceMappingURL=approval-store.d.ts.map

package/lib/approval-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-store.d.ts","sourceRoot":"","sources":["../src/approval-store.ts"],"names":[],"mappings":"AAKA,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,UAA8E;AAC5H,eAAO,MAAM,OAAO,sBAAgB,CAAA;AASpC,qBAAa,aAAa;IACZ,OAAO,CAAC,OAAO,CAAC;gBAAR,OAAO,CAAC,EAAE,MAAM,YAAA;IAC9B,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGxC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1C,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAS1C"}

package/lib/approval-store.js

@@ -0,0 +1,48 @@
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+function resolveHome(dshHome) { return dshHome ?? process.env.DSH_HOME ?? join(homedir(), '.dsh'); }
+export function approvalsPath(dshHome) { return join(resolveHome(dshHome), 'dsh-maestro-guard', 'approvals.json'); }
+export const pathFor = approvalsPath;
+let _queue = Promise.resolve();
+function enqueue(fn) {
+    const p = _queue.then(fn, fn);
+    _queue = p.catch(() => { });
+    return p;
+}
+export class ApprovalStore {
+    dshHome;
+    constructor(dshHome) {
+        this.dshHome = dshHome;
+    }
+    async load() {
+        try {
+            return JSON.parse(await readFile(approvalsPath(this.dshHome), 'utf-8'));
+        }
+        catch {
+            return {};
+        }
+    }
+    async isApproved(tool) { const m = await this.load(); return !!m[tool]; }
+    async approve(tool) {
+        return enqueue(async () => {
+            const m = await this.load();
+            m[tool] = true;
+            const p = approvalsPath(this.dshHome);
+            await mkdir(dirname(p), { recursive: true, mode: 0o700 });
+            await writeFile(p, JSON.stringify(m, null, 2), { encoding: 'utf-8', mode: 0o600 });
+            await chmod(p, 0o600);
+        });
+    }
+    async revoke(tool) {
+        return enqueue(async () => {
+            const m = await this.load();
+            delete m[tool];
+            const p = approvalsPath(this.dshHome);
+            await mkdir(dirname(p), { recursive: true, mode: 0o700 });
+            await writeFile(p, JSON.stringify(m, null, 2), { encoding: 'utf-8', mode: 0o600 });
+            await chmod(p, 0o600);
+        });
+    }
+}
+//# sourceMappingURL=approval-store.js.map

package/lib/approval-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-store.js","sourceRoot":"","sources":["../src/approval-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,SAAS,WAAW,CAAC,OAAgB,IAAI,OAAO,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA,CAAC,CAAC;AAC5G,MAAM,UAAU,aAAa,CAAC,OAAgB,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAA,CAAC,CAAC;AAC5H,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAA;AAEpC,IAAI,MAAM,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAA;AAChD,SAAS,OAAO,CAAI,EAAoB;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAe,CAAA;IAC3C,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC1B,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,OAAO,aAAa;IACJ;IAApB,YAAoB,OAAgB;QAAhB,YAAO,GAAP,OAAO,CAAS;IAAG,CAAC;IACxC,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAA;QAAC,CAAC;IACrG,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,IAAY,IAAsB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;IAClG,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC3B,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;YACd,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YACzD,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAClF,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACvB,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YACzD,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAClF,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACvB,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/lib/index.d.ts

@@ -0,0 +1,11 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { ApprovalStore } from './approval-store.js';
+import { PermissionPolicy } from './permission-policy.js';
+import type { GuardToolExecution, GuardPreToolDecision } from './augment.js';
+export declare function createGuardHandler(store: ApprovalStore, policy: PermissionPolicy): (exec: GuardToolExecution, next: () => Promise<GuardPreToolDecision>) => Promise<GuardPreToolDecision>;
+declare const _default: {
+    inject: readonly ["tools"];
+    apply(ctx: Context): void;
+};
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAE5E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,IACjE,MAAM,kBAAkB,EAAE,MAAM,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAG,OAAO,CAAC,oBAAoB,CAAC,CAmBlH;;;eAIY,OAAO;;AAFpB,wBAQC"}

package/lib/index.js

@@ -0,0 +1,36 @@
+import { ApprovalStore } from './approval-store.js';
+import { PermissionPolicy } from './permission-policy.js';
+import { containsSecret, redact } from './secret-redactor.js';
+export function createGuardHandler(store, policy) {
+    return async (exec, next) => {
+        const tool = exec.name ?? exec.tool ?? '';
+        const rawArgs = exec?.args ?? exec?.arguments;
+        if (!policy.isAllowed(tool, rawArgs)) {
+            throw new Error(`Guard: tool ${tool} denied by policy`);
+        }
+        if (tool === 'danger-tool' && !(await store.isApproved(tool))) {
+            throw new Error(`Guard: tool ${tool} requires approval`);
+        }
+        if (rawArgs != null) {
+            const asText = JSON.stringify(rawArgs);
+            if (containsSecret(asText)) {
+                const redacted = JSON.parse(redact(asText));
+                if ('args' in exec)
+                    exec.args = redacted;
+                if ('arguments' in exec)
+                    exec.arguments = redacted;
+            }
+        }
+        return next();
+    };
+}
+export default {
+    inject: ['tools'],
+    apply(ctx) {
+        const store = new ApprovalStore();
+        const policy = new PermissionPolicy({ deny: ['danger-tool'] });
+        const handler = createGuardHandler(store, policy);
+        ctx.effect(() => ctx.on('tools/pre-execute', handler));
+    }
+};
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAG7D,MAAM,UAAU,kBAAkB,CAAC,KAAoB,EAAE,MAAwB;IAC/E,OAAO,KAAK,EAAE,IAAwB,EAAE,IAAyC,EAAiC,EAAE;QAClH,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,IAAK,IAA2B,CAAC,IAAI,IAAI,EAAE,CAAA;QACzF,MAAM,OAAO,GAAI,IAAY,EAAE,IAAI,IAAK,IAAY,EAAE,SAAS,CAAA;QAC/D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,mBAAmB,CAAC,CAAA;QACzD,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,oBAAoB,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YACtC,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;gBAC3C,IAAI,MAAM,IAAI,IAAI;oBAAG,IAAY,CAAC,IAAI,GAAG,QAAQ,CAAA;gBACjD,IAAI,WAAW,IAAI,IAAI;oBAAG,IAAY,CAAC,SAAS,GAAG,QAAQ,CAAA;YAC7D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAED,eAAe;IACb,MAAM,EAAE,CAAC,OAAO,CAAU;IAC1B,KAAK,CAAC,GAAY;QAChB,MAAM,KAAK,GAAG,IAAI,aAAa,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;QAC9D,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACjD,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAA;IACxD,CAAC;CACF,CAAA"}

package/lib/permission-policy.d.ts

@@ -0,0 +1,11 @@
+export interface GuardPolicy {
+    allow?: string[];
+    deny?: string[];
+}
+export declare class PermissionPolicy {
+    private policy;
+    constructor(policy: GuardPolicy);
+    isAllowed(tool: string, _args: unknown): boolean;
+    check(tool: string): 'allow' | 'deny' | 'ask';
+}
+//# sourceMappingURL=permission-policy.d.ts.map

package/lib/permission-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-policy.d.ts","sourceRoot":"","sources":["../src/permission-policy.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAAG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE;AAClE,qBAAa,gBAAgB;IACf,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IACvC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO;IAKhD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAC,MAAM,GAAC,KAAK;CAM1C"}

package/lib/permission-policy.js

@@ -0,0 +1,22 @@
+export class PermissionPolicy {
+    policy;
+    constructor(policy) {
+        this.policy = policy;
+    }
+    isAllowed(tool, _args) {
+        if (this.policy.deny?.includes(tool))
+            return false;
+        if (this.policy.allow && this.policy.allow.length > 0)
+            return this.policy.allow.includes(tool);
+        return true;
+    }
+    check(tool) {
+        if (this.policy.deny?.includes(tool))
+            return 'deny';
+        const hasAllow = Array.isArray(this.policy.allow) && this.policy.allow.length > 0;
+        if (hasAllow && !this.policy.allow.includes(tool))
+            return 'ask';
+        return 'allow';
+    }
+}
+//# sourceMappingURL=permission-policy.js.map

package/lib/permission-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-policy.js","sourceRoot":"","sources":["../src/permission-policy.ts"],"names":[],"mappings":"AACA,MAAM,OAAO,gBAAgB;IACP;IAApB,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAC3C,SAAS,CAAC,IAAY,EAAE,KAAc;QACpC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAClD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC9F,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,CAAC,IAAY;QAChB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAA;QACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;QACjF,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAChE,OAAO,OAAO,CAAA;IAChB,CAAC;CACF"}

package/lib/secret-redactor.d.ts

@@ -0,0 +1,4 @@
+export declare const DEFAULT_PATTERNS: RegExp[];
+export declare function containsSecret(text: string): boolean;
+export declare function redact(text: string): string;
+//# sourceMappingURL=secret-redactor.d.ts.map

package/lib/secret-redactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redactor.d.ts","sourceRoot":"","sources":["../src/secret-redactor.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,EAAE,MAAM,EAKpC,CAAA;AACD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AACD,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI3C"}

package/lib/secret-redactor.js

@@ -0,0 +1,18 @@
+export const DEFAULT_PATTERNS = [
+    /glpat-[A-Za-z0-9_-]{10,}/g,
+    /sk-[A-Za-z0-9]{20,}/g,
+    /ghp_[A-Za-z0-9]{30,}/g,
+    /xox[bpras]-[A-Za-z0-9-]+/g,
+];
+export function containsSecret(text) {
+    return DEFAULT_PATTERNS.some(r => { r.lastIndex = 0; return r.test(text); });
+}
+export function redact(text) {
+    let out = text;
+    for (const r of DEFAULT_PATTERNS) {
+        r.lastIndex = 0;
+        out = out.replace(r, '[REDACTED]');
+    }
+    return out;
+}
+//# sourceMappingURL=secret-redactor.js.map

package/lib/secret-redactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redactor.js","sourceRoot":"","sources":["../src/secret-redactor.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,2BAA2B;IAC3B,sBAAsB;IACtB,uBAAuB;IACvB,2BAA2B;CAC5B,CAAA;AACD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,GAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;AAC3E,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAAC,CAAC,CAAC,SAAS,GAAC,CAAC,CAAC;QAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;IAAC,CAAC;IACvF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@ddtcorex/dsh-maestro-guard",
+  "version": "0.1.0",
+  "description": "Maestro Guard — waterfall tools/pre-execute approval + blocklist stub (Phase A scaffold)",
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "src",
+    "cordis.patch.yml",
+    "README.md"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "typescript": "^5.8.0",
+    "vitest": "^2.0.0",
+    "@types/node": "^22.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "verify": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}

package/src/approval-store.ts

@@ -0,0 +1,41 @@
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { dirname, join } from 'node:path'
+
+function resolveHome(dshHome?: string) { return dshHome ?? process.env.DSH_HOME ?? join(homedir(), '.dsh') }
+export function approvalsPath(dshHome?: string) { return join(resolveHome(dshHome), 'dsh-maestro-guard', 'approvals.json') }
+export const pathFor = approvalsPath
+
+let _queue: Promise<unknown> = Promise.resolve()
+function enqueue<T>(fn: () => Promise<T>): Promise<T> {
+  const p = _queue.then(fn, fn) as Promise<T>
+  _queue = p.catch(() => {})
+  return p
+}
+
+export class ApprovalStore {
+  constructor(private dshHome?: string) {}
+  async load(): Promise<Record<string, boolean>> {
+    try { return JSON.parse(await readFile(approvalsPath(this.dshHome), 'utf-8')) } catch { return {} }
+  }
+  async isApproved(tool: string): Promise<boolean> { const m = await this.load(); return !!m[tool] }
+  async approve(tool: string): Promise<void> {
+    return enqueue(async () => {
+      const m = await this.load()
+      m[tool] = true
+      const p = approvalsPath(this.dshHome)
+      await mkdir(dirname(p), { recursive: true, mode: 0o700 })
+      await writeFile(p, JSON.stringify(m, null, 2), { encoding: 'utf-8', mode: 0o600 })
+      await chmod(p, 0o600)
+    })
+  }
+  async revoke(tool: string): Promise<void> {
+    return enqueue(async () => {
+      const m = await this.load(); delete m[tool]
+      const p = approvalsPath(this.dshHome)
+      await mkdir(dirname(p), { recursive: true, mode: 0o700 })
+      await writeFile(p, JSON.stringify(m, null, 2), { encoding: 'utf-8', mode: 0o600 })
+      await chmod(p, 0o600)
+    })
+  }
+}

package/src/augment.d.ts

@@ -0,0 +1,10 @@
+import '@deepseek-ai/cordis'
+
+export interface GuardToolExecution { name: string; tool?: string; args?: unknown; arguments?: unknown }
+export interface GuardPreToolDecision { kind: 'allow' | 'deny' }
+
+declare module '@deepseek-ai/cordis' {
+  interface Events {
+    'tools/pre-execute'(exec: GuardToolExecution, next: () => Promise<GuardPreToolDecision>): Promise<GuardPreToolDecision>
+  }
+}

package/src/index.ts

@@ -0,0 +1,38 @@
+// src/index.ts
+import type { Context } from '@deepseek-ai/cordis'
+import { ApprovalStore } from './approval-store.js'
+import { PermissionPolicy } from './permission-policy.js'
+import { containsSecret, redact } from './secret-redactor.js'
+import type { GuardToolExecution, GuardPreToolDecision } from './augment.js'
+
+export function createGuardHandler(store: ApprovalStore, policy: PermissionPolicy) {
+  return async (exec: GuardToolExecution, next: () => Promise<GuardPreToolDecision>): Promise<GuardPreToolDecision> => {
+    const tool = (exec as GuardToolExecution).name ?? (exec as GuardToolExecution).tool ?? ''
+    const rawArgs = (exec as any)?.args ?? (exec as any)?.arguments
+    if (!policy.isAllowed(tool, rawArgs)) {
+      throw new Error(`Guard: tool ${tool} denied by policy`)
+    }
+    if (tool === 'danger-tool' && !(await store.isApproved(tool))) {
+      throw new Error(`Guard: tool ${tool} requires approval`)
+    }
+    if (rawArgs != null) {
+      const asText = JSON.stringify(rawArgs)
+      if (containsSecret(asText)) {
+        const redacted = JSON.parse(redact(asText))
+        if ('args' in exec) (exec as any).args = redacted
+        if ('arguments' in exec) (exec as any).arguments = redacted
+      }
+    }
+    return next()
+  }
+}
+
+export default {
+  inject: ['tools'] as const,
+  apply(ctx: Context) {
+    const store = new ApprovalStore()
+    const policy = new PermissionPolicy({ deny: ['danger-tool'] })
+    const handler = createGuardHandler(store, policy)
+    ctx.effect(() => ctx.on('tools/pre-execute', handler))
+  }
+}

package/src/permission-policy.ts

@@ -0,0 +1,15 @@
+export interface GuardPolicy { allow?: string[]; deny?: string[] }
+export class PermissionPolicy {
+  constructor(private policy: GuardPolicy) {}
+  isAllowed(tool: string, _args: unknown): boolean {
+    if (this.policy.deny?.includes(tool)) return false
+    if (this.policy.allow && this.policy.allow.length > 0) return this.policy.allow.includes(tool)
+    return true
+  }
+  check(tool: string): 'allow'|'deny'|'ask' {
+    if (this.policy.deny?.includes(tool)) return 'deny'
+    const hasAllow = Array.isArray(this.policy.allow) && this.policy.allow.length > 0
+    if (hasAllow && !this.policy.allow!.includes(tool)) return 'ask'
+    return 'allow'
+  }
+}

package/src/secret-redactor.ts

@@ -0,0 +1,14 @@
+export const DEFAULT_PATTERNS: RegExp[] = [
+  /glpat-[A-Za-z0-9_-]{10,}/g,
+  /sk-[A-Za-z0-9]{20,}/g,
+  /ghp_[A-Za-z0-9]{30,}/g,
+  /xox[bpras]-[A-Za-z0-9-]+/g,
+]
+export function containsSecret(text: string): boolean {
+  return DEFAULT_PATTERNS.some(r => { r.lastIndex=0; return r.test(text) })
+}
+export function redact(text: string): string {
+  let out = text
+  for (const r of DEFAULT_PATTERNS) { r.lastIndex=0; out = out.replace(r, '[REDACTED]') }
+  return out
+}