@duke-dsh-plugins/dsh-agent-approval 1.3.5 → 1.4.0

package/client.js

@@ -6,7 +6,8 @@
  *   1. A "Agent 审批" page in the Settings panel (`settings.section`):
  *      - approval model picker (provider + model, or the harness default),
  *      - judge timeout setting (fail-closed),
- *      - the list of sessions with the mode enabled,
+ *      - the list of sessions with the mode enabled (session-list title +
+ *        workspace, so each chip is recognizable),
  *      - the latest approval audit records (verdict, risk, model, duration,
  *        rationale; hover for the full rationale + tool arguments).
  *
@@ -38,7 +39,9 @@ window.__ModuleLoader__.load({
 .aapr-muted{color:var(--dsw-alias-label-secondary);line-height:1.5}
 .aapr-row{display:flex;align-items:center;gap:8px;flex-wrap:wrap}
 .aapr-select,.aapr-input{background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border:1px solid var(--dsw-alias-border-l2);border-radius:6px;padding:4px 8px;font-size:12px;max-width:340px}
-.aapr-chip{display:inline-flex;align-items:center;gap:6px;border:1px solid var(--dsw-alias-border-l2);border-radius:999px;padding:2px 10px;background:var(--dsw-alias-bg-layer-2);font-family:monospace}
+.aapr-chip{display:inline-flex;align-items:center;gap:6px;border:1px solid var(--dsw-alias-border-l2);border-radius:999px;padding:2px 10px;background:var(--dsw-alias-bg-layer-2);max-width:100%}
+.aapr-chip-title{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:320px}
+.aapr-chip-id{color:var(--dsw-alias-label-secondary);font-family:monospace;font-size:11px}
 .aapr-chip button{background:none;border:none;color:var(--dsw-alias-state-error-primary);cursor:pointer;font-size:12px;padding:0 2px}
 .aapr-wrap{overflow-x:auto}
 .aapr-table{width:100%;border-collapse:collapse;font-size:12px}
@@ -47,6 +50,12 @@ window.__ModuleLoader__.load({
 .aapr-cell{max-width:280px;overflow:hidden;text-overflow:ellipsis;white-space:normal}
 .aapr-ok{color:var(--dsw-alias-state-success-primary);white-space:nowrap}
 .aapr-no{color:var(--dsw-alias-state-error-primary);white-space:nowrap}
+.aapr-input-wide{flex:1;min-width:220px;max-width:none}
+.aapr-rule-match{font-family:monospace;font-size:11px;color:var(--dsw-alias-label-secondary)}
+.aapr-rule-del,.aapr-whitelist{background:none;border:none;cursor:pointer;font-size:12px;padding:0 2px}
+.aapr-rule-del{color:var(--dsw-alias-state-error-primary)}
+.aapr-whitelist{color:var(--dsw-alias-label-secondary)}
+.aapr-whitelist:hover{color:var(--dsw-alias-label-primary)}
 
 /* Settings nav icon: DSH 0.1.x settings.section only projects id/order/
    label, and the settings shell paints a generic gear for every external
@@ -249,6 +258,24 @@ window.__ModuleLoader__.load({
           parameters: param("dsh-agent-approval#AgentApprovalToggleRequest"),
           result: result("dsh-agent-approval#AgentApprovalToggleResult"),
         },
+        {
+          id: "dsh-agent-approval#agentApproval/addRule",
+          service: "agentApproval",
+          namespace: "agentApproval",
+          method: "addRule",
+          invocation: { kind: "direct" },
+          parameters: param("dsh-agent-approval#AgentApprovalAddRuleRequest"),
+          result: result("dsh-agent-approval#AgentApprovalRulesResult"),
+        },
+        {
+          id: "dsh-agent-approval#agentApproval/removeRule",
+          service: "agentApproval",
+          namespace: "agentApproval",
+          method: "removeRule",
+          invocation: { kind: "direct" },
+          parameters: param("dsh-agent-approval#AgentApprovalRemoveRuleRequest"),
+          result: result("dsh-agent-approval#AgentApprovalRulesResult"),
+        },
         {
           id: "dsh-agent-approval#agentApproval/clearRecords",
           service: "agentApproval",
@@ -360,6 +387,11 @@ window.__ModuleLoader__.load({
         const noteSlot = React.useState("");
         const note = noteSlot[0];
         const setNote = noteSlot[1];
+        // Rule-add form drafts (the table itself comes from getState).
+        const ruleEffectSlot = React.useState("allow");
+        const ruleToolSlot = React.useState("");
+        const ruleMatchSlot = React.useState("");
+        const ruleNoteSlot = React.useState("");
 
         const refresh = () => {
           remote
@@ -425,6 +457,58 @@ window.__ModuleLoader__.load({
             .catch(() => {});
         };
 
+        const ruleEffect = ruleEffectSlot[0];
+        const ruleTool = ruleToolSlot[0];
+        const ruleMatch = ruleMatchSlot[0];
+        const ruleNote = ruleNoteSlot[0];
+        const setRuleEffect = ruleEffectSlot[1];
+        const setRuleTool = ruleToolSlot[1];
+        const setRuleMatch = ruleMatchSlot[1];
+        const setRuleNote = ruleNoteSlot[1];
+        const rules = state !== null && Array.isArray(state.rules) ? state.rules : [];
+
+        const addRule = (draft) => {
+          remote
+            .addRule(draft)
+            .then((res) => {
+              const v = pick(res);
+              setState((prev) => (prev ? Object.assign({}, prev, { rules: v.rules }) : prev));
+              setRuleTool("");
+              setRuleMatch("");
+              setRuleNote("");
+              setNote("规则已保存（deny 优先于 allow；命中即不再经过审批模型）");
+            })
+            .catch((e) => setNote("保存失败：" + (e && e.message ? e.message : String(e))));
+        };
+        const submitRule = () => {
+          if (ruleTool.trim() === "") {
+            setNote("工具名必填（* 匹配所有工具）");
+            return;
+          }
+          addRule({ effect: ruleEffect, tool: ruleTool.trim(), match: ruleMatch, note: ruleNote.trim() });
+        };
+        const removeRule = (id) => {
+          remote
+            .removeRule({ id: id })
+            .then((res) => {
+              const v = pick(res);
+              setState((prev) => (prev ? Object.assign({}, prev, { rules: v.rules }) : prev));
+            })
+            .catch(() => {});
+        };
+        // One-click whitelist from an audit row: the recorded args are a
+        // PREFIX of the real arguments JSON (the Host truncates at 2000
+        // chars), so stripping the truncation marker keeps a valid substring.
+        const whitelistRecord = (r) => {
+          const args = String(r.args || "").replace(/…\[truncated\]$/, "");
+          addRule({
+            effect: "allow",
+            tool: String(r.toolName),
+            match: args,
+            note: "来自审计 " + fmtTime(r.at),
+          });
+        };
+
         const providerOptions = [{ id: "", name: "默认（Harness 默认模型）" }].concat(
           dir ? dir.providers : [],
         );
@@ -529,15 +613,81 @@ window.__ModuleLoader__.load({
                 : h(
                     "div",
                     { className: "aapr-row" },
-                    state.enabledSessions.map((sid) =>
-                      h(
+                    state.enabledSessions.map((raw) => {
+                      // New hosts send { id, title, cwd }; a not-yet-restarted
+                      // old host still sends bare id strings — render both.
+                      const info =
+                        typeof raw === "string" ? { id: raw, title: "", cwd: "" } : raw;
+                      const sid = String(info.id);
+                      const title =
+                        typeof info.title === "string" && info.title !== "" ? info.title : "";
+                      const cwd = typeof info.cwd === "string" && info.cwd !== "" ? info.cwd : "";
+                      const tip =
+                        "会话 ID：" + sid + (cwd !== "" ? "\n工作区：" + cwd : "");
+                      return h(
                         "span",
-                        { key: sid, className: "aapr-chip" },
-                        String(sid).slice(0, 8),
-                        h("button", { onClick: () => disableSession(sid), title: "关闭该会话的 Agent 审批" }, "✕"),
-                      ),
+                        { key: sid, className: "aapr-chip", title: tip },
+                        h(
+                          "span",
+                          { className: "aapr-chip-title" },
+                          title !== "" ? title : sid.slice(0, 8),
+                        ),
+                        title !== ""
+                          ? h("span", { className: "aapr-chip-id" }, sid.slice(0, 8))
+                          : null,
+                        h(
+                          "button",
+                          { onClick: () => disableSession(sid), title: "关闭该会话的 Agent 审批" },
+                          "✕",
+                        ),
+                      );
+                    }),
+                  ),
+          ),
+          h(
+            "div",
+            { className: "aapr-card" },
+            h("h3", null, "放行 / 拒绝规则"),
+            h(
+              "div",
+              { className: "aapr-muted" },
+              "命中规则的提权不再经过审批模型：拒绝规则直接拒、放行规则直接过（拒绝优先于放行）。match 留空 = 该工具全部调用；否则是参数 JSON 的子串，或 /正则/flags 形式。另：模型批准后，同一会话内参数完全相同的再次提权直接放行（会话内信任，不跨会话、不泛化）。",
+            ),
+            rules.length === 0
+              ? h("div", { className: "aapr-muted" }, "暂无规则。")
+              : rules.map((rule) =>
+                  h(
+                    "div",
+                    { key: rule.id, className: "aapr-row" },
+                    h(
+                      "span",
+                      { className: rule.effect === "allow" ? "aapr-ok" : "aapr-no" },
+                      rule.effect === "allow" ? "放行" : "拒绝",
                     ),
+                    h("span", { className: "aapr-chip-id" }, String(rule.tool)),
+                    rule.match !== ""
+                      ? h("span", { className: "aapr-rule-match", title: String(rule.match) }, truncText(rule.match, 60))
+                      : h("span", { className: "aapr-muted" }, "（全部调用）"),
+                    rule.note !== ""
+                      ? h("span", { className: "aapr-muted" }, truncText(rule.note, 40))
+                      : null,
+                    h("button", { className: "aapr-rule-del", onClick: () => removeRule(rule.id), title: "删除该规则" }, "✕"),
                   ),
+                ),
+            h(
+              "div",
+              { className: "aapr-row" },
+              h(
+                "select",
+                { className: "aapr-select", value: ruleEffect, onChange: (e) => setRuleEffect(e.target.value) },
+                h("option", { value: "allow" }, "放行"),
+                h("option", { value: "deny" }, "拒绝"),
+              ),
+              h("input", { className: "aapr-input", placeholder: "工具名（* = 所有工具）", value: ruleTool, onChange: (e) => setRuleTool(e.target.value) }),
+              h("input", { className: "aapr-input aapr-input-wide", placeholder: "match：留空 = 全部；子串或 /正则/flags", value: ruleMatch, onChange: (e) => setRuleMatch(e.target.value) }),
+              h("input", { className: "aapr-input", placeholder: "备注（可选）", value: ruleNote, onChange: (e) => setRuleNote(e.target.value) }),
+              h(ui.Button, { variant: "primary", size: "sm", onClick: submitRule }, "添加"),
+            ),
           ),
           h(
             "div",
@@ -562,7 +712,7 @@ window.__ModuleLoader__.load({
                   h(
                     "tr",
                     null,
-                    ["时间", "会话", "工具", "结果", "风险", "模型", "耗时", "审批理由"].map((t) => h("th", { key: t }, t)),
+                    ["时间", "会话", "工具", "结果", "风险", "模型", "耗时", "审批理由", "规则"].map((t) => h("th", { key: t }, t)),
                   ),
                 ),
                 h(
@@ -591,16 +741,31 @@ window.__ModuleLoader__.load({
                             },
                             truncText(r.rationale, 110),
                           ),
+                          h(
+                            "td",
+                            null,
+                            r.outcome === "allowed-once" && r.args && r.model !== "rule"
+                              ? h(
+                                  "button",
+                                  {
+                                    className: "aapr-whitelist",
+                                    onClick: () => whitelistRecord(r),
+                                    title: "把该操作存为放行规则（工具 + 参数子串）：今后直接放行，不再经过审批模型",
+                                  },
+                                  "加白",
+                                )
+                              : null,
+                          ),
                         ),
                       )
-                    : h("tr", null, h("td", { colSpan: 8 }, h("span", { className: "aapr-muted" }, "暂无记录"))),
+                    : h("tr", null, h("td", { colSpan: 9 }, h("span", { className: "aapr-muted" }, "暂无记录"))),
                 ),
               ),
             ),
             h(
               "div",
               { className: "aapr-muted" },
-              "悬停“审批理由”可查看完整理由与工具参数；“审批会话”前缀可在会话列表中找到审批 Agent 的完整会话记录。",
+              "悬停“审批理由”可查看完整理由与工具参数；“审批会话”前缀可在会话列表中找到审批 Agent 的完整会话记录。「加白」把一条已批准的操作存为放行规则（模型列显示 rule/trust 的行分别来自规则命中与会话内信任缓存）。",
             ),
           ),
         );

package/index.js

@@ -18,15 +18,19 @@
  *   2. JUDGE      — this service claims the `approval/request` waterfall with
  *      `{ prepend: true }`, so it runs BEFORE the interactive UI answerer:
  *      an enabled session never pops a human prompt. Every escalation ask is
- *      routed to a ONE-SHOT `spawn` subagent (own session, zero parent
+ *      first checked against the deterministic rule table (persisted
+ *      allow/deny rules; deny wins) and then the per-session trust cache (a
+ *      judge-approved, byte-identical call is not re-judged) — both
+ *      short-circuit with zero model cost. Only a miss on both is routed to
+ *      a ONE-SHOT `spawn` subagent (own session, zero parent
  *      context, approval policy pinned to `never` by the delegation itself,
  *      every global tool blanked via `toolFilter: { allow: [] }`) that must
  *      answer through a structured-output schema:
  *          { decision: approve|reject, riskLevel, rationale }
  *      The judge sees the exact tool arguments (read from the session log by
- *      `callId`) plus the asker's stated reason, and is instructed to fail
- *      closed: destructive / irreversible / out-of-scope / dishonest requests
- *      are rejected.
+ *      `callId`) plus the asker's stated reason. A rejection must name the
+ *      concrete, credible risk the operation creates (destructive /
+ *      irreversible / out-of-scope / dishonest); vague unease is approved.
  *
  *   3. FAIL CLOSED — any infrastructure fault, timeout, malformed verdict, or
  *      cancellation maps to the fail-closed approval outcomes
@@ -105,7 +109,7 @@ const VERDICT_SCHEMA = {
 const APPROVER_PERSONA = [
   "You are an independent security approval agent inside a coding harness.",
   "Your only job is to judge ONE request for wider sandbox access and report the verdict through the structured_output tool.",
-  "You are conservative and fail closed: when uncertain, when the operation is destructive or irreversible, when it reaches outside its stated purpose, or when the stated justification does not match the actual arguments, you REJECT.",
+  "You reject what is concretely dangerous — destructive or irreversible operations, ones that reach outside their stated purpose, or requests whose stated justification does not match the actual arguments. Mere uncertainty, an unfamiliar command, or a terse justification is never enough: every rejection must name the concrete risk the operation creates.",
   "Your own judging session is deliberately sandboxed: approvals are disabled for YOU and your permission scope is fixed. That describes only your own environment — never cite your own constraints (or anything your runtime context says about YOUR permissions) as a property of the requesting session or as grounds for rejection.",
   "You never ask questions, never attempt the operation yourself, and never finish with a plain-text answer.",
 ].join(" ");
@@ -184,6 +188,8 @@ export class AgentApprovalService extends TypertRemoteService {
     markRemoteMethod(this, "setModel", "setModel");
     markRemoteMethod(this, "setApprovalTimeout", "setApprovalTimeout");
     markRemoteMethod(this, "toggle", "toggle");
+    markRemoteMethod(this, "addRule", "addRule");
+    markRemoteMethod(this, "removeRule", "removeRule");
     markRemoteMethod(this, "clearRecords", "clearRecords");
     markRemoteMethod(this, "directory", "directory");
 
@@ -195,6 +201,19 @@ export class AgentApprovalService extends TypertRemoteService {
     this._enabled = new Map();
     /** Audit records, oldest first, capped at MAX_RECORDS. */
     this._records = [];
+    /**
+     * Deterministic rules judged BEFORE the model (persisted in config.json):
+     * [{ id, effect: "allow"|"deny", tool, match, note, createdAt }]. A hit
+     * short-circuits the judge entirely — no subagent, no latency.
+     */
+    this._rules = [];
+    /**
+     * sessionId -> Set of "toolName\nargsJson" fingerprints the judge already
+     * approved in that session. Re-judging a byte-identical call is pure
+     * latency; the cache never crosses sessions and never generalizes to
+     * merely-similar arguments. Dropped with the session's enable entry.
+     */
+    this._trusted = new Map();
 
     // Claim escalations BEFORE the interactive answerer. The host apiproxy
     // answerer registered earlier (composition load order); `{ prepend: true }`
@@ -222,6 +241,7 @@ export class AgentApprovalService extends TypertRemoteService {
           this._enableCore(session, agent);
         } else if (this._enabled.has(session.id)) {
           this._enabled.delete(session.id);
+          this._trusted.delete(session.id);
         }
       } catch (e) {
         /* an emit listener must never throw */
@@ -248,7 +268,10 @@ export class AgentApprovalService extends TypertRemoteService {
     // A disposed session's bookkeeping entry is dead weight — drop it.
     this.ctx.on("session/disposed", (session) => {
       try {
-        if (session) this._enabled.delete(session.id);
+        if (session) {
+          this._enabled.delete(session.id);
+          this._trusted.delete(session.id);
+        }
       } catch (e) {
         /* cleanup only */
       }
@@ -410,6 +433,7 @@ export class AgentApprovalService extends TypertRemoteService {
     const prev = this._enabled.get(session.id);
     if (prev === undefined) return "agent-approval is not ON for this session";
     this._enabled.delete(session.id);
+    this._trusted.delete(session.id);
     if (!restoreKnobs) return "agent-approval OFF: previous permission knobs restored";
     if (
       typeof prev.prevSandbox === "string" &&
@@ -457,6 +481,64 @@ export class AgentApprovalService extends TypertRemoteService {
     }
   }
 
+  // ---- deterministic rules + session trust ----------------------------------
+
+  /**
+   * Compile a rule's `match`: "" matches every call of the tool;
+   * "/pattern/flags" is a regex; anything else is a plain substring tested
+   * against the raw arguments JSON. Returns undefined for the substring form,
+   * null for an invalid regex (rejected at add time; a corrupt persisted rule
+   * simply never matches).
+   */
+  _ruleRegex(match) {
+    if (match.length < 2 || match[0] !== "/") return undefined;
+    const last = match.lastIndexOf("/");
+    if (last <= 0) return undefined;
+    try {
+      return new RegExp(match.slice(1, last), match.slice(last + 1));
+    } catch (e) {
+      return null;
+    }
+  }
+
+  /** Whether one rule hits this exact call. */
+  _ruleMatches(rule, toolName, argsRaw) {
+    if (rule.tool !== "*" && rule.tool !== toolName) return false;
+    if (rule.match === "") return true;
+    const args = typeof argsRaw === "string" ? argsRaw : "";
+    const re = this._ruleRegex(rule.match);
+    if (re === null) return false;
+    if (re !== undefined) return re.test(args);
+    return args.indexOf(rule.match) !== -1;
+  }
+
+  /**
+   * First hitting rule — every deny rule is evaluated before any allow rule
+   * may win, so a later-added deny always overrides an earlier allow.
+   * Undefined when nothing hits.
+   */
+  _matchRules(toolName, argsRaw) {
+    let allowHit;
+    for (const rule of this._rules) {
+      if (!this._ruleMatches(rule, toolName, argsRaw)) continue;
+      if (rule.effect === "deny") return rule;
+      if (allowHit === undefined) allowHit = rule;
+    }
+    return allowHit;
+  }
+
+  /** Owned plain copies for the wire (strict result schema). */
+  _rulesSnapshot() {
+    return this._rules.map((r) => ({
+      id: String(r.id),
+      effect: r.effect === "deny" ? "deny" : "allow",
+      tool: String(r.tool),
+      match: String(r.match),
+      note: String(r.note),
+      createdAt: String(r.createdAt),
+    }));
+  }
+
   // ---- audit ----------------------------------------------------------------
 
   /** Coerce one entry to the strict wire shape (typert result schema). */
@@ -501,11 +583,12 @@ export class AgentApprovalService extends TypertRemoteService {
     }
   }
 
-  /** Persist the judge settings (model override + timeout) to config.json. */
+  /** Persist the judge settings (model override + timeout + rules) to config.json. */
   _persistConfig() {
     const body = JSON.stringify({
       model: { provider: this._model.provider, model: this._model.model },
       timeoutMs: this._timeoutMs,
+      rules: this._rules,
     });
     mkdir(DATA_DIR, { recursive: true })
       .then(() => writeFile(CONFIG_FILE, body, "utf8"))
@@ -533,6 +616,27 @@ export class AgentApprovalService extends TypertRemoteService {
         if (typeof cfg.timeoutMs === "number" && Number.isFinite(cfg.timeoutMs)) {
           this._timeoutMs = Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.floor(cfg.timeoutMs)));
         }
+        if (Array.isArray(cfg.rules)) {
+          const rules = [];
+          for (const raw of cfg.rules) {
+            if (!raw || typeof raw !== "object") continue;
+            if (raw.effect !== "allow" && raw.effect !== "deny") continue;
+            if (typeof raw.tool !== "string" || raw.tool === "") continue;
+            if (typeof raw.match !== "string") continue;
+            rules.push({
+              id:
+                typeof raw.id === "string" && raw.id !== ""
+                  ? raw.id
+                  : Date.now().toString(36) + Math.random().toString(36).slice(2, 8),
+              effect: raw.effect,
+              tool: raw.tool,
+              match: raw.match,
+              note: typeof raw.note === "string" ? raw.note : "",
+              createdAt: typeof raw.createdAt === "string" ? raw.createdAt : new Date().toISOString(),
+            });
+          }
+          this._rules = rules;
+        }
       }
     } catch (e) {
       /* first run or unreadable config — keep the defaults */
@@ -651,7 +755,7 @@ export class AgentApprovalService extends TypertRemoteService {
       "- reading tool-owned config or logs needed to debug the task at hand.",
       "REJECT when the operation is destructive (mass deletion, disk formatting, registry/service/system-wide changes), exfiltrates credentials or secrets, touches resources unrelated to the task, modifies the operating system or OTHER applications' data, hides intent behind encoded or obfuscated content, or the reason does not match the arguments.",
       "Your own judging session is deliberately sandboxed: approvals are disabled for YOU and your permission scope is fixed by design. Anything your own runtime context says about YOUR permissions describes only you — it says nothing about the requesting session, and must never be cited as a property of that session or as grounds for rejection.",
-      "When uncertain, REJECT. Report the verdict via the structured_output tool only.",
+      "REJECT only when you can name a concrete, credible risk THIS specific operation creates — what it would destroy, leak, or change beyond the user's task. Vague unease, an unfamiliar command, or a terse stated reason is NOT a concrete risk: when no concrete risk exists and the operation fits the task, APPROVE. Report the verdict via the structured_output tool only.",
     );
     return lines.join("\n");
   }
@@ -733,18 +837,47 @@ export class AgentApprovalService extends TypertRemoteService {
     const startedAt = new Date().toISOString();
     const t0 = Date.now();
     const argsRaw = this._callArgsOf(session, req.callId);
-    const route = this._judgeRoute();
+    const toolName = String(req.toolName);
     const base = {
       at: startedAt,
       sessionId: shortId(session.id),
-      toolName: String(req.toolName),
+      toolName: toolName,
       reason: trunc(req.reason, 300),
       args: trunc(argsRaw, 2000),
-      model: route.label,
       durationMs: 0,
       childSessionId: "",
     };
 
+    // 1. Deterministic rules run BEFORE the model — zero latency, zero cost.
+    //    Deny beats allow (see _matchRules); both are recorded for audit.
+    const rule = this._matchRules(toolName, argsRaw);
+    if (rule !== undefined) {
+      const text =
+        (rule.effect === "deny" ? "matched deny rule" : "matched allow rule") +
+        " [tool=" + rule.tool + (rule.match !== "" ? " match=" + rule.match : "") + "]" +
+        (rule.note !== "" ? " — " + rule.note : "");
+      base.durationMs = Date.now() - t0;
+      if (rule.effect === "deny") {
+        this._record({ ...base, outcome: "rejected", riskLevel: "-", model: "rule", rationale: trunc(text, 600) });
+        return "rejected";
+      }
+      this._record({ ...base, outcome: "allowed-once", riskLevel: "-", model: "rule", rationale: trunc(text, 600) });
+      return "allowed-once";
+    }
+
+    // 2. Session trust: a byte-identical call (same tool, same arguments JSON)
+    //    the judge already approved in this session is not re-judged.
+    const trustKey = typeof argsRaw === "string" ? toolName + "\n" + argsRaw : undefined;
+    const trusted = this._trusted.get(session.id);
+    if (trustKey !== undefined && trusted !== undefined && trusted.has(trustKey)) {
+      base.durationMs = Date.now() - t0;
+      this._record({ ...base, outcome: "allowed-once", riskLevel: "-", model: "trust", rationale: "trusted: an identical operation was already approved in this session" });
+      return "allowed-once";
+    }
+
+    // 3. The model judge.
+    const route = this._judgeRoute();
+
     let run;
     try {
       run = await this.ctx.subagents.start("spawn", {
@@ -760,7 +893,7 @@ export class AgentApprovalService extends TypertRemoteService {
         persona: APPROVER_PERSONA,
       });
     } catch (error) {
-      this._record({ ...base, outcome: "unavailable", riskLevel: "-", rationale: "approval agent failed to start: " + errText(error) });
+      this._record({ ...base, outcome: "unavailable", riskLevel: "-", model: route.label, rationale: "approval agent failed to start: " + errText(error) });
       return "unavailable";
     }
     base.childSessionId = shortId(run.id);
@@ -801,21 +934,33 @@ export class AgentApprovalService extends TypertRemoteService {
           ...base,
           outcome: approved ? "allowed-once" : "rejected",
           riskLevel: String(verdict.riskLevel || "-"),
+          model: route.label,
           rationale: trunc(verdict.rationale, 600),
         });
+        // Trust one approved fingerprint for the rest of the session: the
+        // next byte-identical call short-circuits before the model.
+        if (approved && trustKey !== undefined) {
+          let set = this._trusted.get(session.id);
+          if (set === undefined) {
+            set = new Set();
+            this._trusted.set(session.id, set);
+          }
+          set.add(trustKey);
+        }
         return approved ? "allowed-once" : "rejected";
       }
       this._record({
         ...base,
         outcome: "unavailable",
         riskLevel: "-",
+        model: route.label,
         rationale:
           "approval agent returned no valid verdict (stopReason: " + String(result.stopReason) + ")",
       });
       return "unavailable";
     }
     if (winner.kind === "aborted") {
-      this._record({ ...base, outcome: "cancelled", riskLevel: "-", rationale: "request cancelled while the approval agent was judging" });
+      this._record({ ...base, outcome: "cancelled", riskLevel: "-", model: route.label, rationale: "request cancelled while the approval agent was judging" });
       return "cancelled";
     }
     if (winner.kind === "timeout") {
@@ -823,16 +968,50 @@ export class AgentApprovalService extends TypertRemoteService {
         ...base,
         outcome: "unavailable",
         riskLevel: "-",
+        model: route.label,
         rationale: "approval agent timed out after " + String(this._timeoutMs) + "ms (fail closed)",
       });
       return "unavailable";
     }
-    this._record({ ...base, outcome: "unavailable", riskLevel: "-", rationale: "approval agent infrastructure fault: " + errText(winner.error) });
+    this._record({ ...base, outcome: "unavailable", riskLevel: "-", model: route.label, rationale: "approval agent infrastructure fault: " + errText(winner.error) });
     return "unavailable";
   }
 
   // ---- Remote API ------------------------------------------------------------
 
+  /**
+   * Display info for every enabled session: the same log-backed title the
+   * session list shows (via the optional `sessionTitle` service) plus the
+   * workspace cwd, so the Settings chips are recognizable. Every read is a
+   * best-effort leaf read on owned plain objects; a disposed agent, an absent
+   * title service, or a missing header field degrades to "".
+   */
+  _sessionInfos() {
+    const titles = this.ctx.get("sessionTitle");
+    const out = [];
+    for (const sid of this._enabled.keys()) {
+      let title = "";
+      let cwd = "";
+      const agent = this.ctx.agents.get(sid);
+      const session = agent === undefined ? undefined : agent.session;
+      if (session !== undefined) {
+        try {
+          const snap = titles === undefined ? undefined : titles.get(session);
+          if (snap && typeof snap.title === "string") title = snap.title;
+        } catch (e) {
+          /* title read is best-effort */
+        }
+        try {
+          if (session.header && typeof session.header.cwd === "string") cwd = session.header.cwd;
+        } catch (e) {
+          /* header access is best-effort */
+        }
+      }
+      out.push({ id: String(sid), title: title, cwd: cwd });
+    }
+    return out;
+  }
+
   /** Snapshot for the Settings page. */
   async getState() {
     return {
@@ -840,7 +1019,8 @@ export class AgentApprovalService extends TypertRemoteService {
       value: {
         model: { provider: this._model.provider, model: this._model.model },
         timeoutMs: this._timeoutMs,
-        enabledSessions: Array.from(this._enabled.keys()).map(String),
+        enabledSessions: this._sessionInfos(),
+        rules: this._rulesSnapshot(),
         records: this._records.slice(-50).reverse(),
       },
     };
@@ -885,6 +1065,47 @@ export class AgentApprovalService extends TypertRemoteService {
     return { ok: true, value: { message: this._setEnabled(agent, want) } };
   }
 
+  /**
+   * Add one deterministic rule and persist the table. `tool` is an exact tool
+   * name or "*" for every tool; `match` is "" (every call of that tool), a
+   * plain substring, or "/pattern/flags" tested against the raw arguments
+   * JSON. Returns the full table.
+   */
+  async addRule(request) {
+    const effect = request && request.effect === "deny" ? "deny" : "allow";
+    const tool = request && typeof request.tool === "string" ? request.tool.trim() : "";
+    const match = request && typeof request.match === "string" ? request.match : "";
+    const note = request && typeof request.note === "string" ? trunc(request.note, 200) : "";
+    if (tool === "") {
+      return { ok: false, error: { code: "invalid-rule", message: 'tool is required ("*" matches every tool)' } };
+    }
+    if (this._ruleRegex(match) === null) {
+      return { ok: false, error: { code: "invalid-rule", message: "invalid /regex/flags match expression" } };
+    }
+    this._rules.push({
+      id: Date.now().toString(36) + Math.random().toString(36).slice(2, 8),
+      effect: effect,
+      tool: tool,
+      match: match,
+      note: note,
+      createdAt: new Date().toISOString(),
+    });
+    this._persistConfig();
+    return { ok: true, value: { rules: this._rulesSnapshot() } };
+  }
+
+  /** Remove one rule by id and persist the table. Returns the full table. */
+  async removeRule(request) {
+    const id = request && typeof request.id === "string" ? request.id : "";
+    const before = this._rules.length;
+    this._rules = this._rules.filter((r) => r.id !== id);
+    if (this._rules.length === before) {
+      return { ok: false, error: { code: "rule-not-found", message: "no rule with that id" } };
+    }
+    this._persistConfig();
+    return { ok: true, value: { rules: this._rulesSnapshot() } };
+  }
+
   /** Clear the audit records (memory + persisted file). */
   async clearRecords() {
     this._records = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@duke-dsh-plugins/dsh-agent-approval",
-  "version": "1.3.5",
+  "version": "1.4.0",
   "description": "Agent-decided approvals for DeepSeek Harness: a workspace-write base permission mode where an independent approval subagent judges every sandbox escalation (risky operations are rejected), with a configurable approval model and an audit log in Settings.",
   "repository": {
     "type": "git",

package/typert.host.js

@@ -41,11 +41,31 @@ const modelRouteSchema = z
   })
   .readonly();
 
+const enabledSessionSchema = z
+  .object({
+    id: z.string(),
+    title: z.string(),
+    cwd: z.string(),
+  })
+  .readonly();
+
+const ruleSchema = z
+  .object({
+    id: z.string(),
+    effect: z.enum(["allow", "deny"]),
+    tool: z.string(),
+    match: z.string(),
+    note: z.string(),
+    createdAt: z.string(),
+  })
+  .readonly();
+
 const stateValueSchema = z
   .object({
     model: modelRouteSchema,
     timeoutMs: z.number(),
-    enabledSessions: z.array(z.string()).readonly(),
+    enabledSessions: z.array(enabledSessionSchema).readonly(),
+    rules: z.array(ruleSchema).readonly(),
     records: z.array(recordSchema).readonly(),
   })
   .readonly();
@@ -68,6 +88,12 @@ const toggleValueSchema = z
   })
   .readonly();
 
+const rulesValueSchema = z
+  .object({
+    rules: z.array(ruleSchema).readonly(),
+  })
+  .readonly();
+
 const clearRecordsValueSchema = z
   .object({
     cleared: z.boolean(),
@@ -128,6 +154,8 @@ const stateResultSchema = okResult(stateValueSchema);
 const setModelResultSchema = okResult(setModelValueSchema);
 const setTimeoutResultSchema = okResult(setTimeoutValueSchema);
 const toggleResultSchema = okResult(toggleValueSchema);
+const addRuleResultSchema = okResult(rulesValueSchema);
+const removeRuleResultSchema = okResult(rulesValueSchema);
 const clearRecordsResultSchema = okResult(clearRecordsValueSchema);
 const directoryResultSchema = okResult(directoryValueSchema);
 
@@ -147,6 +175,17 @@ const _agentApproval_toggle_parameter_0$schema = z.object({
   on: z.boolean(),
 });
 
+const _agentApproval_addRule_parameter_0$schema = z.object({
+  effect: z.enum(["allow", "deny"]),
+  tool: z.string(),
+  match: z.string(),
+  note: z.string(),
+});
+
+const _agentApproval_removeRule_parameter_0$schema = z.object({
+  id: z.string(),
+});
+
 export const TYPERT = {
   package: "@duke-dsh-plugins/dsh-agent-approval",
   face: "host",
@@ -241,6 +280,56 @@ export const TYPERT = {
       },
       sourceLocation: { file: "index.js", line: 1, column: 1 },
     },
+    {
+      id: "dsh-agent-approval#agentApproval/addRule",
+      service: "agentApproval",
+      namespace: "agentApproval",
+      method: "addRule",
+      invocation: { kind: "direct" },
+      parameters: [
+        {
+          name: "request",
+          wire: "request",
+          source: "json",
+          codec: {
+            mode: "strict",
+            typeSymbol: "dsh-agent-approval#AgentApprovalAddRuleRequest",
+            schema: _agentApproval_addRule_parameter_0$schema,
+          },
+        },
+      ],
+      result: {
+        mode: "strict",
+        typeSymbol: "dsh-agent-approval#AgentApprovalRulesResult",
+        schema: addRuleResultSchema,
+      },
+      sourceLocation: { file: "index.js", line: 1, column: 1 },
+    },
+    {
+      id: "dsh-agent-approval#agentApproval/removeRule",
+      service: "agentApproval",
+      namespace: "agentApproval",
+      method: "removeRule",
+      invocation: { kind: "direct" },
+      parameters: [
+        {
+          name: "request",
+          wire: "request",
+          source: "json",
+          codec: {
+            mode: "strict",
+            typeSymbol: "dsh-agent-approval#AgentApprovalRemoveRuleRequest",
+            schema: _agentApproval_removeRule_parameter_0$schema,
+          },
+        },
+      ],
+      result: {
+        mode: "strict",
+        typeSymbol: "dsh-agent-approval#AgentApprovalRulesResult",
+        schema: removeRuleResultSchema,
+      },
+      sourceLocation: { file: "index.js", line: 1, column: 1 },
+    },
     {
       id: "dsh-agent-approval#agentApproval/clearRecords",
       service: "agentApproval",
@@ -288,7 +377,7 @@ export const TYPERT = {
             signature: "@Remote('getState') async getState(): Promise<AgentApprovalStateResult>",
             summary: "Snapshot for the Settings page and the composer toggle.",
             jsDoc:
-              "/**\n * Return the judge model route, timeout, enabled session ids, and the latest audit records.\n * @returns success or a business failure.\n */",
+              "/**\n * Return the judge model route, timeout, enabled sessions (id + session-list title + workspace cwd), and the latest audit records.\n * @returns success or a business failure.\n */",
           },
           {
             kind: "method",
@@ -314,6 +403,22 @@ export const TYPERT = {
             jsDoc:
               "/**\n * Enable (workspace-write base + judged escalations) or disable (restore prior knobs) for one live session.\n * @param request - { sessionId, on }.\n * @returns a human-readable message, or session-not-live.\n */",
           },
+          {
+            kind: "method",
+            name: "addRule",
+            signature: "@Remote('addRule') async addRule(request: AgentApprovalAddRuleRequest): Promise<AgentApprovalRulesResult>",
+            summary: "Add a deterministic allow/deny rule judged before the model (persisted).",
+            jsDoc:
+              "/**\n * Add one rule: tool = exact name or \"*\"; match = \"\" (every call), substring, or /regex/flags over the raw arguments JSON. Deny is evaluated before allow.\n * @param request - { effect, tool, match, note }.\n * @returns the full rule table.\n */",
+          },
+          {
+            kind: "method",
+            name: "removeRule",
+            signature: "@Remote('removeRule') async removeRule(request: AgentApprovalRemoveRuleRequest): Promise<AgentApprovalRulesResult>",
+            summary: "Remove one rule by id (persisted).",
+            jsDoc:
+              "/**\n * Remove one rule by id.\n * @param request - { id }.\n * @returns the full rule table.\n */",
+          },
           {
             kind: "method",
             name: "clearRecords",
@@ -342,10 +447,25 @@ export const TYPERT = {
             declaration:
               "export interface AgentApprovalModelRoute {\n    readonly provider: string;\n    readonly model: string;\n}",
           },
+          {
+            name: "AgentApprovalEnabledSession",
+            declaration:
+              "export interface AgentApprovalEnabledSession {\n    readonly id: string;\n    readonly title: string;\n    readonly cwd: string;\n}",
+          },
+          {
+            name: "AgentApprovalRule",
+            declaration:
+              "export interface AgentApprovalRule {\n    readonly id: string;\n    readonly effect: 'allow' | 'deny';\n    readonly tool: string;\n    readonly match: string;\n    readonly note: string;\n    readonly createdAt: string;\n}",
+          },
+          {
+            name: "AgentApprovalRulesResult",
+            declaration:
+              "export type AgentApprovalRulesResult = { ok: true; value: { readonly rules: readonly AgentApprovalRule[] } } | { ok: false; error: { code: string; message?: string } };",
+          },
           {
             name: "AgentApprovalStateValue",
             declaration:
-              "export interface AgentApprovalStateValue {\n    readonly model: AgentApprovalModelRoute;\n    readonly timeoutMs: number;\n    readonly enabledSessions: readonly string[];\n    readonly records: readonly AgentApprovalRecord[];\n}",
+              "export interface AgentApprovalStateValue {\n    readonly model: AgentApprovalModelRoute;\n    readonly timeoutMs: number;\n    readonly enabledSessions: readonly AgentApprovalEnabledSession[];\n    readonly rules: readonly AgentApprovalRule[];\n    readonly records: readonly AgentApprovalRecord[];\n}",
           },
           {
             name: "AgentApprovalStateResult",