@goodandready/dsh-approval-gate 0.1.11 → 0.1.13

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.1.13
+
+- Architecture: выделение `CommandDispatcher` (`lib/dispatcher.js`) для полной изоляции синтаксического разбора аргументов и классификации типов инструментов от движка принятия решений `SecurityEngine` (Refs: #133).
+- Git: специализированный парсер семантики команд Git (`lib/parsers/git.js`) с разграничением безопасных операций чтения (`status`, `log`, `diff`, `rev-parse`), локальных мутаций (`commit`, `checkout -b`, `add`, `branch`) и деструктивных действий (`reset --hard`, `clean -f`, `branch -D`) (Refs: #125).
+- Git: разделение локальных операций и сетевой публикации — автоматическое разрешение локальных коммитов и веток при обязательном запросе подтверждения (`git-remote-push`) для `git push` в удаленный репозиторий (Refs: #103).
+- Shell: специализированный парсер конструкций оболочки (`lib/parsers/shell-cmds.js`) для детекции опасных перенаправлений в системные блочные устройства (`/dev/sd*`), защищенные файлы секретов и предотвращения обхода через traversal (Refs: #126).
+- Security: `SilentErrorGuard` — детекция маскировки критических ошибок компиляции и сбоев команд через подавление потока stderr (`2>/dev/null`, `&>/dev/null`), принудительный нулевой код возврата (`|| true`, `|| :`, `|| exit 0`) и отключение проверки ошибок (`set +e`) (Refs: #90).
+- Security: строгая изоляция агента-ревьюера (`Reviewer`) в режиме read-only без возможности запуска shell-процессов или записи/модификации файлов (Refs: #65).
+- Security: предотвращение рекурсивной или системной модификации прав и владельцев (`chmod -R`, `chown -R`, манипуляции над `/`, `/etc`, `/var`, `/usr`, `/root`) (Refs: #65).
+- Network: безопасный loopback bypass (`lib/loopback.js`) с нулевой задержкой и автоматическим разрешением запросов к `localhost`, `127.0.0.1`, `::1`, `0.0.0.0` для локальных dev-серверов и тестов (Refs: #40).
+
+## 0.1.12
+
+- Fix: корректная регистрация сервиса `approvalGate` в Cordis через `ctx.provide('approvalGate', ...)` и экспорт `export const provide = ['approvalGate']`, устраняющая ошибку `cannot set property "approvalGate" without provide` при старте хоста DSH.
+- Policy: надежное определение режима «Полный доступ» (`danger-full-access` / `never`) в `readKnobs` и `isUnattended` даже при отсутствии предварительного события `approval/policy` в сессии (приоритет пресета и sandbox режима над дефолтным `ask` от `ApprovalService`), предотвращающая ложный отказ `the user rejected tool` на всех командах агента.
+- Localization: удаление захардкоженного русского словаря из `lib/messages.js` в строгом соответствии со стандартом разработки DSH плагинов (только `en` и `zh`, русская локализация централизованно обслуживается `dsh-russian-lang`) с защитной обработкой `locale.register` в `apply` (Refs: #153, #162).
+- Bands: динамическое расширение списка read-only инструментов из хостового `toolRegistry` (`options.toolRegistry`) с поддержкой аннотаций `readOnly` / `readonly` (Refs: #156).
+- Engine: настраиваемый дефолтный вердикт для нераспознанных команд `defaultVerdict` (`allow` по умолчанию, опциональный fail-closed `ask`) с добавлением в схему `Config` (Refs: #163).
+- Session: гарантированное извлечение строкового `sessionId` в `resolveSessionId` для любых структур объекта `agent` / `session`.
+
 ## 0.1.11
 
 - Security: проверка абсолютных путей перенаправлений shell на выход за пределы рабочего каталога `workspaceDir` с исключением canonical устройств (`/dev/null`) и временных каталогов (`/tmp`) (Refs: #143).

package/lib/bands.js

@@ -134,6 +134,22 @@ export class BandsEngine {
       typeof g === "string" ? compileGlob(g) : g
     );
     this.readOnlyTools = new Set(options.readOnlyTools || DEFAULT_READ_ONLY_TOOLS);
+
+    // Derive read-only tools dynamically from host tool registry if provided (#156)
+    if (options.toolRegistry) {
+      try {
+        const tools = typeof options.toolRegistry.getTools === "function"
+          ? options.toolRegistry.getTools()
+          : (Array.isArray(options.toolRegistry) ? options.toolRegistry : []);
+        for (const t of tools) {
+          if (t && (t.readOnly || t.readonly || t.isReadOnly) && typeof t.name === "string") {
+            this.readOnlyTools.add(t.name);
+          }
+        }
+      } catch {
+        // ignore
+      }
+    }
   }
 
   /**

package/lib/dispatcher.js

@@ -0,0 +1,208 @@
+// lib/dispatcher.js
+// Command Dispatcher: architectural isolation of command parsing and syntactic dispatch
+// from the safety evaluation engine.
+// Resolves: #133, #65
+
+import { tokenize, splitSubcommands } from "./tokenizer.js";
+import { parseGitArgv, classifyGitOperation } from "./parsers/git.js";
+import { extractRedirects, inspectRedirectSecurity, inspectSilentErrors, inspectPipelines } from "./parsers/shell-cmds.js";
+import { isLoopbackCommand, isLoopbackUrl } from "./loopback.js";
+import { resolveSafePath, isPathTraversal, isProtectedConfigPath } from "./paths.js";
+
+export const TOOL_KIND_SHELL = "shell";
+export const TOOL_KIND_FILE_WRITE = "file_write";
+export const TOOL_KIND_FILE_READ = "file_read";
+export const TOOL_KIND_NETWORK = "network";
+export const TOOL_KIND_GENERIC = "generic";
+
+export const DEFAULT_BASH_TOOL = "bash";
+export const DEFAULT_FILE_WRITE_TOOLS = Object.freeze([
+  "write",
+  "edit",
+  "Write",
+  "Edit",
+  "str_replace_editor",
+  "str_replace",
+  "apply_patch",
+]);
+
+export const DEFAULT_READ_ONLY_TOOLS = Object.freeze([
+  "read_file",
+  "view_file",
+  "read_url_content",
+  "search_web",
+  "list_dir",
+  "glob",
+  "grep",
+]);
+
+export const DEFAULT_NETWORK_TOOLS = Object.freeze([
+  "fetch",
+  "web_fetch",
+  "http_request",
+  "read_url_content",
+]);
+
+/**
+ * Extracts target file path from various tool argument schemas.
+ *
+ * @param {any} args
+ * @returns {string | null}
+ */
+export function extractFilePath(args) {
+  if (typeof args === "string") return args;
+  if (!args || typeof args !== "object") return null;
+  const keys = [
+    "path",
+    "file_path",
+    "filePath",
+    "file",
+    "filename",
+    "target",
+    "to",
+    "TargetFile",
+    "AbsolutePath",
+  ];
+  for (const k of keys) {
+    if (typeof args[k] === "string" && args[k].trim()) {
+      return args[k].trim();
+    }
+  }
+  return null;
+}
+
+/**
+ * Checks whether an execution originates from a designated read-only reviewer agent.
+ * Resolves: #65 (strict read-only reviewer subagent isolation).
+ *
+ * @param {any} execution
+ * @param {any} [options]
+ * @returns {boolean}
+ */
+export function isReviewerAgent(execution, options = {}) {
+  if (options && options.reviewerMode === true) return true;
+  const agent = execution && execution.agent;
+  if (!agent) return false;
+
+  const role = typeof agent.role === "string" ? agent.role.toLowerCase() : "";
+  const name = typeof agent.name === "string" ? agent.name.toLowerCase() : "";
+  const type = typeof agent.type === "string" ? agent.type.toLowerCase() : "";
+
+  return role.includes("review") || name.includes("review") || type.includes("review");
+}
+
+export class CommandDispatcher {
+  /**
+   * @param {{
+   *   toolName?: string,
+   *   fileWriteTools?: string[] | Set<string>,
+   *   readOnlyTools?: string[] | Set<string>,
+   *   networkTools?: string[] | Set<string>,
+   *   workspaceDir?: string
+   * }} [options]
+   */
+  constructor(options = {}) {
+    this.toolName = options.toolName || DEFAULT_BASH_TOOL;
+    this.fileWriteTools = new Set(options.fileWriteTools || DEFAULT_FILE_WRITE_TOOLS);
+    this.readOnlyTools = new Set(options.readOnlyTools || DEFAULT_READ_ONLY_TOOLS);
+    this.networkTools = new Set(options.networkTools || DEFAULT_NETWORK_TOOLS);
+    this.workspaceDir = options.workspaceDir || process.cwd();
+  }
+
+  /**
+   * Categorizes the tool name into functional kind.
+   *
+   * @param {string} name
+   * @returns {"shell" | "file_write" | "file_read" | "network" | "generic"}
+   */
+  classifyTool(name) {
+    if (!name) return TOOL_KIND_GENERIC;
+    if (name === this.toolName) return TOOL_KIND_SHELL;
+    if (this.fileWriteTools.has(name)) return TOOL_KIND_FILE_WRITE;
+    if (this.readOnlyTools.has(name)) return TOOL_KIND_FILE_READ;
+    if (this.networkTools.has(name)) return TOOL_KIND_NETWORK;
+    return TOOL_KIND_GENERIC;
+  }
+
+  /**
+   * Dispatches and normalizes a tool execution request into a structured descriptor.
+   *
+   * @param {any} execution - The tool execution event carrying name, arguments, agent, session
+   * @param {any} [options] - Dynamic context overrides
+   * @returns {{
+   *   tool: string,
+   *   kind: "shell" | "file_write" | "file_read" | "network" | "generic",
+   *   isMutating: boolean,
+   *   reviewerViolation: boolean,
+   *   command?: string,
+   *   tokens?: any[],
+   *   subcommands?: string[],
+   *   git?: any,
+   *   silentError?: any,
+   *   loopback?: any,
+   *   filePath?: string,
+   *   pathSafety?: any
+   * }}
+   */
+  dispatch(execution, options = {}) {
+    const name = execution && execution.name ? String(execution.name).trim() : "";
+    const args = execution ? execution.arguments : undefined;
+    const kind = this.classifyTool(name);
+    const isReviewer = isReviewerAgent(execution, options);
+
+    const isMutating = kind === TOOL_KIND_SHELL || kind === TOOL_KIND_FILE_WRITE;
+    const reviewerViolation = isReviewer && isMutating;
+
+    const descriptor = {
+      tool: name,
+      kind,
+      isMutating,
+      reviewerViolation,
+    };
+
+    if (kind === TOOL_KIND_SHELL) {
+      const rawCommand = args && typeof args === "object" ? args.command : (typeof args === "string" ? args : "");
+      descriptor.command = typeof rawCommand === "string" ? rawCommand : "";
+
+      if (descriptor.command) {
+        const tokenized = tokenize(descriptor.command);
+        descriptor.tokens = tokenized.tokens || [];
+        descriptor.tokenizerOk = tokenized.ok;
+        descriptor.tokenizerReason = tokenized.reason;
+
+        // Subcommands breakdown
+        descriptor.subcommands = splitSubcommands(descriptor.command);
+
+        // Silent errors inspection (#90)
+        descriptor.silentError = inspectSilentErrors(descriptor.command);
+
+        // Git inspection (#125, #103)
+        if (/\bgit\b/.test(descriptor.command)) {
+          const firstWords = descriptor.command.trim().split(/\s+/);
+          descriptor.git = parseGitArgv(firstWords);
+          descriptor.gitClassification = classifyGitOperation(descriptor.git.verb, descriptor.git.args);
+        }
+
+        // Loopback detection (#40)
+        descriptor.loopback = isLoopbackCommand(descriptor.command.trim().split(/\s+/));
+      }
+    } else if (kind === TOOL_KIND_FILE_WRITE) {
+      const filePath = extractFilePath(args);
+      descriptor.filePath = filePath;
+      if (filePath) {
+        const ws = options.workspaceDir || this.workspaceDir;
+        descriptor.pathSafety = resolveSafePath(filePath, ws);
+        descriptor.isProtected = isProtectedConfigPath(descriptor.pathSafety.canonical || filePath);
+        descriptor.isTraversal = !descriptor.pathSafety.safe;
+      }
+    } else if (kind === TOOL_KIND_NETWORK) {
+      const url = args && typeof args === "object" ? (args.url || args.Url || args.uri || args.Uri) : "";
+      descriptor.url = typeof url === "string" ? url : "";
+      if (descriptor.url) {
+        descriptor.isLoopback = isLoopbackUrl(descriptor.url);
+      }
+    }
+
+    return descriptor;
+  }
+}

package/lib/engine.js

@@ -28,6 +28,7 @@ export class SecurityEngine {
     this.inspectConfig = options.inspectConfig || {};
     this.classifier = options.classifier || null;
     this.grantRegistry = options.grantRegistry || new SessionGrantStore(options);
+    this.defaultVerdict = options.defaultVerdict || "allow";
   }
 
   /**
@@ -114,7 +115,11 @@ export class SecurityEngine {
       }
     }
 
-    // Safe default for unclassified commands
+    // Default verdict for unclassified commands (#163)
+    if (this.defaultVerdict === "ask") {
+      const askHit = { ask: true, reason: "unmatched-ask", snippet: command || toolName };
+      return { verdict: "ask", stage: "P4", reason: "unmatched-ask", hit: askHit };
+    }
     return { verdict: "allow", stage: "P2", reason: "unmatched-allow", hit };
     } catch (err) {
       return {

package/lib/index.js

@@ -1,17 +1,5 @@
 import { SecurityEngine } from "./engine.js";
-// dsh-approval-gate - approval gate for DeepSeek Harness.
-//
-// Registers tools.guard on the tool runtime and denies dangerous bash
-// commands and writes to secret files even when sandbox mode would allow
-// them. A guard return value (non-undefined) denies execution, so the
-// dangerous call never runs on its own - it needs an explicit owner
-// Approval is handled by DSH's native flow; no separate word is implemented. When the
-// effective approval policy cannot be answered ("never", i.e. the full-access preset),
-// the gate does not raise an ask at all: an allowed command proceeds instead of dying as
-// a rejection nobody could consent to. Denials never depend on the policy.
-//
-// Only the agent tool calls pass through the guard (cron/systemd scripts
-// do not), so legitimate unattended operations are unaffected.
+import { BandsEngine } from "./bands.js";
 import Schema from "@deepseek-ai/schemastery";
 
 if (typeof Schema.prototype?.volatile !== "function") {
@@ -45,6 +33,7 @@ import { LOCALE_NS, MESSAGES } from "./messages.js";
 
 export const name = "dsh-approval-gate";
 export const inject = ["tools"];
+export const provide = ["approvalGate"];
 
 /** Policies under which a prompt cannot be answered, so raising one is a silent denial. */
 export const DEFAULT_UNATTENDED_POLICIES = ["never"];
@@ -52,25 +41,48 @@ export const DEFAULT_UNATTENDED_POLICIES = ["never"];
 /**
  * Whether a raised ask would be answerable in this session.
  *
- * `policy` comes from the approval service (`ctx.approval.config.policy`); an empty value
- * means the knob is unknown and the gate keeps asking, which is the safe direction.
- * @param {{policy?: string, unattendedPolicies?: string[]}} knobs
+ * Checks explicit unattended policies, as well as preset and sandbox modes.
+ * In 'danger-full-access' mode, approval prompts are disabled by host design.
+ * @param {{policy?: string, preset?: string, sandbox?: string, unattendedPolicies?: string[]}} knobs
  * @returns {boolean}
  */
 export function isUnattended(knobs) {
-  const policy = knobs && knobs.policy;
+  if (!knobs) return false;
+  if (knobs.preset === "danger-full-access" || knobs.sandbox === "danger-full-access") return true;
+  const policy = knobs.policy;
   const policies = (knobs && knobs.unattendedPolicies) || DEFAULT_UNATTENDED_POLICIES;
   if (typeof policy !== "string" || policy === "") return false;
   return policies.includes(policy);
 }
 
+/**
+ * Extracts a clean string session identifier from an execution object.
+ * @param {any} execution
+ * @returns {string}
+ */
+export function resolveSessionId(execution) {
+  const agent = execution && execution.agent;
+  const session = agent && agent.session;
+  if (session) {
+    if (typeof session === "string") return session;
+    if (typeof session.id === "string") return session.id;
+    if (typeof session.sessionId === "string") return session.sessionId;
+    if (typeof session.sessionKey === "string") return session.sessionKey;
+  }
+  if (agent) {
+    if (typeof agent === "string") return agent;
+    if (typeof agent.id === "string") return agent.id;
+  }
+  return "default";
+}
+
 /**
  * Effective permission knobs, as the harness exposes them.
- * Resolves session-level approval policy if an active execution carrying a session is provided.
+ * Resolves session-level approval policy, preset, and sandbox mode.
  *
  * @param {any} ctx - Cordis context
  * @param {any} [execution] - Optional tool execution carrying agent/session
- * @returns {{ policy: string, sandbox: string }}
+ * @returns {{ policy: string, sandbox: string, preset: string }}
  */
 export function readKnobs(ctx, execution) {
   const read = (name) => {
@@ -87,75 +99,96 @@ export function readKnobs(ctx, execution) {
   const session = agent && (agent.session || (typeof agent === "object" && typeof agent.eventAt === "function" ? agent : undefined));
 
   let policy = "";
+  let preset = "";
+  let sessionSandbox = "";
 
-  // 1. Live approval service effectivePolicy(session)
-  if (approval && session && typeof approval.effectivePolicy === "function") {
-    try {
-      policy = approval.effectivePolicy(session) || "";
-    } catch {
-      // ignore
-    }
-  }
-
-  // 2. Direct session property fallback
-  if (!policy && session && typeof session.approvalPolicy === "string") {
-    policy = session.approvalPolicy;
-  }
-
-  // 3. Fallback: inspect session events backwards for approval/policy and danger-full-access
-  if (!policy && session && typeof session.eventAt === "function" && typeof session.seq === "number") {
+  // 1. Inspect session events backwards (bounded to last 100 events) with sequence caching
+  if (session && typeof session.eventAt === "function" && typeof session.seq === "number") {
     if (session._gateCachedSeq === session.seq && session._gateCachedPolicy !== undefined) {
       policy = session._gateCachedPolicy;
+      preset = session._gateCachedPreset || "";
+      sessionSandbox = session._gateCachedSandbox || "";
     } else {
       try {
         const minSeq = Math.max(0, session.seq - 100);
         for (let seq = session.seq - 1; seq >= minSeq; seq -= 1) {
           const event = session.eventAt(seq);
-          if (event && event.type === "approval/policy" && event.data && event.data.policy) {
+          if (!policy && event && event.type === "approval/policy" && event.data && event.data.policy) {
             policy = event.data.policy;
-            break;
           }
-          if (event && event.type === "permission/preset" && event.data && event.data.preset === "danger-full-access") {
-            policy = "never";
-            break;
+          if (!preset && event && event.type === "permission/preset" && event.data && event.data.preset) {
+            preset = event.data.preset;
+          }
+          if (!sessionSandbox && event && event.type === "sandbox/mode" && event.data && event.data.mode) {
+            sessionSandbox = event.data.mode;
           }
+          if (policy && preset && sessionSandbox) break;
         }
         session._gateCachedSeq = session.seq;
         session._gateCachedPolicy = policy || "";
+        session._gateCachedPreset = preset || "";
+        session._gateCachedSandbox = sessionSandbox || "";
       } catch {
         // ignore
       }
     }
   }
 
-  // 4. In-memory session.events array fallback (common in mocks / tests)
-  if (!policy && session && Array.isArray(session.events)) {
+  // 2. In-memory session.events array fallback (common in mocks / tests)
+  if (session && Array.isArray(session.events)) {
     try {
       const minIdx = Math.max(0, session.events.length - 100);
       for (let i = session.events.length - 1; i >= minIdx; i -= 1) {
         const event = session.events[i];
-        if (event && event.type === "approval/policy" && event.data && event.data.policy) {
+        if (!policy && event && event.type === "approval/policy" && event.data && event.data.policy) {
           policy = event.data.policy;
-          break;
         }
-        if (event && event.type === "permission/preset" && event.data && event.data.preset === "danger-full-access") {
-          policy = "never";
-          break;
+        if (!preset && event && event.type === "permission/preset" && event.data && event.data.preset) {
+          preset = event.data.preset;
+        }
+        if (!sessionSandbox && event && event.type === "sandbox/mode" && event.data && event.data.mode) {
+          sessionSandbox = event.data.mode;
         }
+        if (policy && preset && sessionSandbox) break;
       }
     } catch {
       // ignore
     }
   }
 
+  // 3. Preset / sandbox direct values: danger-full-access implies "never" approval
+  if (preset === "danger-full-access" || sessionSandbox === "danger-full-access") {
+    policy = "never";
+  }
+
+  // 4. Direct session property fallback
+  if (!policy && session && typeof session.approvalPolicy === "string") {
+    policy = session.approvalPolicy;
+  }
+
+  // 5. Live approval service effectivePolicy(session)
+  if (!policy && approval && session && typeof approval.effectivePolicy === "function") {
+    try {
+      policy = approval.effectivePolicy(session) || "";
+    } catch {
+      // ignore
+    }
+  }
+
   // 6. Global static fallback from approval service config
   if (!policy && approval && approval.config && approval.config.policy) {
     policy = approval.config.policy;
   }
 
+  const sandbox = sessionSandbox || (shell && shell.sandboxMode) || "";
+  if (sandbox === "danger-full-access" && !policy) {
+    policy = "never";
+  }
+
   return {
     policy: policy || "",
-    sandbox: (shell && shell.sandboxMode) || "",
+    sandbox: sandbox || "",
+    preset: preset || "",
   };
 }
 
@@ -170,6 +203,8 @@ export const Config = Schema.object({
   unattended: Schema.boolean().default(false).volatile(),
   /** Workspace directory for path traversal boundary checks. */
   workspaceDir: Schema.string().default("").volatile(),
+  /** Default verdict for unclassified commands: 'allow' (default) or 'ask' (fail-closed) (#163). */
+  defaultVerdict: Schema.union(["allow", "ask"]).default("allow").volatile(),
   /** Security engine instance (internal/testing). */
   engine: Schema.any().hidden(),
 });
@@ -189,7 +224,15 @@ export function apply(ctx, config) {
   };
   const registerLocale = function () {
     const locale = getLocale();
-    if (locale && typeof locale.register === "function") return locale.register(LOCALE_NS, MESSAGES);
+    if (locale && typeof locale.register === "function") {
+      try {
+        return locale.register(LOCALE_NS, MESSAGES);
+      } catch (err) {
+        if (ctx && ctx.logger && typeof ctx.logger.warn === "function") {
+          ctx.logger.warn("[dsh-approval-gate] locale registration skipped: " + (err && err.message || err));
+        }
+      }
+    }
   };
   if (ctx && typeof ctx.effect === "function") ctx.effect(registerLocale, "dsh-approval-gate: dictionaries");
   else registerLocale();
@@ -203,13 +246,21 @@ export function apply(ctx, config) {
   const forcedUnattended = cfg.unattended === true;
   const engine = (config && config.engine) || cfg.engine || new SecurityEngine({
     inspectConfig: { toolName: toolName, fileWriteTools: fileWriteTools, workspaceDir: cfg.workspaceDir || "" },
+    bands: new BandsEngine({ toolRegistry: ctx && ctx.tools }),
+    defaultVerdict: cfg.defaultVerdict || "allow",
   });
+
+  const gateService = {
+    engine,
+    addGrant: (options) => engine.addGrant(options),
+    resume: (sessionId, reason) => engine.resume(sessionId, reason),
+  };
   if (ctx && typeof ctx === "object") {
-    ctx.approvalGate = {
-      engine,
-      addGrant: (options) => engine.addGrant(options),
-      resume: (sessionId, reason) => engine.resume(sessionId, reason),
-    };
+    if (typeof ctx.provide === "function") {
+      ctx.provide("approvalGate", gateService);
+    } else {
+      ctx.approvalGate = gateService;
+    }
   }
 
   const hasPreExecute = ctx && typeof ctx.on === "function";
@@ -217,7 +268,7 @@ export function apply(ctx, config) {
     ctx.on("tools/pre-execute", function (execution, next) {
       const knobs = readKnobs(ctx, execution);
       const who = sessionTag(execution);
-      const sessionId = (execution && execution.agent && (execution.agent.session || execution.agent)) || "default";
+      const sessionId = resolveSessionId(execution);
       let decision;
       try {
         decision = engine.decide(execution, { sessionId, knobs });
@@ -242,7 +293,7 @@ export function apply(ctx, config) {
           logBlocked(ctx, hit, who);
           return denyMessage(hit, who, translate, ctx && ctx.logger);
         }
-        if (forcedUnattended || isUnattended({ policy: knobs.policy, unattendedPolicies })) {
+        if (forcedUnattended || isUnattended({ policy: knobs.policy, preset: knobs.preset, sandbox: knobs.sandbox, unattendedPolicies })) {
           return next();
         }
         const hit = decision.hit || {
@@ -259,7 +310,7 @@ export function apply(ctx, config) {
 
   const guard = function (execution) {
     const who = sessionTag(execution);
-    const sessionId = (execution && execution.agent && (execution.agent.session || execution.agent)) || "default";
+    const sessionId = resolveSessionId(execution);
     let decision;
     try {
       decision = engine.decide(execution, { sessionId });
@@ -318,6 +369,35 @@ export {
 } from "./canonical.js";
 export { expandHome, resolveSafePath, isPathTraversal, canonicalizeFsPath } from "./paths.js";
 export { splitSubcommands } from "./tokenizer.js";
-
-
 export { redactCredentials, redactUrl } from "./redact.js";
+export {
+  CommandDispatcher,
+  isReviewerAgent,
+  extractFilePath,
+  TOOL_KIND_SHELL,
+  TOOL_KIND_FILE_WRITE,
+  TOOL_KIND_FILE_READ,
+  TOOL_KIND_NETWORK,
+  TOOL_KIND_GENERIC,
+} from "./dispatcher.js";
+export {
+  parseGitArgv,
+  classifyGitOperation,
+  inspectGitCommand,
+  GIT_CATEGORY_READ,
+  GIT_CATEGORY_MUTATE_LOCAL,
+  GIT_CATEGORY_REMOTE,
+  GIT_CATEGORY_DESTRUCTIVE,
+} from "./parsers/git.js";
+export {
+  isDevicePath,
+  extractRedirects,
+  inspectRedirectSecurity,
+  inspectSilentErrors,
+  inspectPipelines,
+} from "./parsers/shell-cmds.js";
+export {
+  isLoopbackHost,
+  isLoopbackUrl,
+  isLoopbackCommand,
+} from "./loopback.js";