@elinpf/dsh-ops-access-gate 0.3.0 → 0.4.0

package/lib/index.js

@@ -322,7 +322,15 @@ export function apply(ctx, config) {
     // never issued without a session to key the grant on); approval-required
     // kinds deny outright — their credential is effectively rw (there is no
     // read-only shell), so an untracked caller must not get it at all.
-    const broker = (kind, profileName, agent) => {
+    //
+    // Per-call tier declaration (request.tier):
+    // - 'ro' = deliberate downgrade: the session may hold an rw grant, but this
+    //   call only reads. Serve ro; the grant is not exercised and no rw-issue
+    //   is audited. (Lockdown still refuses even this.)
+    // - 'rw' = explicit elevation: without a grant this denies LOUDLY with
+    //   request_access guidance — silently serving ro would leave the agent
+    //   believing it wrote when it only read.
+    const broker = (kind, profileName, agent, request) => {
         // Deny (ticket 12) outranks every other state: a locked profile refuses
         // even ro, for session and internal callers alike.
         if (gate.isDenied(kind, profileName)) {
@@ -337,14 +345,25 @@ export function apply(ctx, config) {
         }
         const authorized = gate.isAuthorized(agent.id, kind, profileName);
         // Approval-required kinds (ssh): the credential lives in the ro registry —
-        // the grant is a timed pass to use it at all.
+        // the grant is a timed pass to use it at all. There IS no rw tier, so an
+        // explicit rw request is a category error worth teaching.
         if (config.approvalRequiredKinds.includes(kind)) {
+            if (request?.tier === 'rw') {
+                return { deny: kind + ' has no rw tier — its single credential is effectively rw already, and the grant IS the access. Request timed access via the ' + REQUEST_ACCESS + ' tool (profile "' + kind + '/' + profileName + '", with a reason) and call WITHOUT a tier' };
+            }
             if (authorized) {
                 audit({ event: 'gated-issue', session: agent.id, parentSession: parentSessionOf(agent), kind, name: profileName });
                 return 'ro';
             }
             return { deny: kind + ' has no read-only tier; request timed access via the ' + REQUEST_ACCESS + ' tool (profile "' + kind + '/' + profileName + '", with a reason)' };
         }
+        // Deliberate downgrade: serve ro without touching the grant.
+        if (request?.tier === 'ro')
+            return 'ro';
+        if (request?.tier === 'rw' && !authorized) {
+            audit({ event: 'rw-denied', session: agent.id, parentSession: parentSessionOf(agent), kind, name: profileName });
+            return { deny: 'explicit rw requested for ' + kind + '/' + profileName + ' but this session holds no grant — request timed access via the ' + REQUEST_ACCESS + ' tool (with a reason), or drop the tier to use the read-only credential' };
+        }
         if (authorized) {
             audit({ event: 'rw-issue', session: agent.id, parentSession: parentSessionOf(agent), kind, name: profileName });
             return 'rw';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elinpf/dsh-ops-access-gate",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Ops access gate — per-session credential brokering. Owns an in-process grant ledger keyed by agent.id and registers a pure-decision broker (ro/rw) into the ops-access seam. Never touches credential fields.",
   "type": "module",
   "main": "lib/index.js",
@@ -34,14 +34,14 @@
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@elinpf/dsh-ops-panel": "^0.3.0"
+    "@elinpf/dsh-ops-panel": "^0.4.0"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/dsh-invariants": "^0.1.0-rc.8",
     "@deepseek-ai/dsh-llm": "^0.1.0-rc.8",
     "@deepseek-ai/dsh-tools": "^0.1.0-rc.8",
-    "@elinpf/dsh-ops-access": "^0.3.0"
+    "@elinpf/dsh-ops-access": "^0.4.0"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.1",
@@ -51,8 +51,8 @@
     "typescript": "^5.4.0",
     "vitest": "^4.1.11",
     "zod": "^4.4.3",
-    "@elinpf/dsh-ops-panel": "0.3.0",
-    "@elinpf/dsh-ops-access": "0.3.0"
+    "@elinpf/dsh-ops-access": "0.4.0",
+    "@elinpf/dsh-ops-panel": "0.4.0"
   },
   "license": "MIT",
   "publishConfig": {