@goodandready/dsh-approval-gate 0.1.17 → 0.1.18

package/lib/index.js

@@ -230,6 +230,14 @@ export const Config = Schema.object({
   classifierTimeoutPolicy: Schema.union(["strict", "permissive"]).default("strict").volatile(),
   /** Maximum context characters for classifier prompt (#117). */
   classifierMaxContext: Schema.number().default(1000).volatile(),
+  /** Maximum payload bytes for tool arguments (#71). */
+  maxPayloadBytes: Schema.number().default(65536).volatile(),
+  /** Isolate temporary directories to workspace/.dsh/tmp (#102). */
+  isolateTempRoots: Schema.boolean().default(true).volatile(),
+  /** Maximum allowed created files per session to prevent overengineering (#89). */
+  maxFilesPerSession: Schema.number().default(10).volatile(),
+  /** Task contract boundary rules (#87). */
+  taskContract: Schema.any().volatile(),
   /** Security engine instance (internal/testing). */
   engine: Schema.any().hidden(),
 });
@@ -281,7 +289,15 @@ export function apply(ctx, config) {
     : null;
 
   const engine = (config && config.engine) || cfg.engine || new SecurityEngine({
-    inspectConfig: { toolName: toolName, fileWriteTools: fileWriteTools, workspaceDir: cfg.workspaceDir || "" },
+    inspectConfig: {
+      toolName: toolName,
+      fileWriteTools: fileWriteTools,
+      workspaceDir: cfg.workspaceDir || "",
+      maxPayloadBytes: cfg.maxPayloadBytes !== undefined ? cfg.maxPayloadBytes : 65536,
+      isolateTempRoots: cfg.isolateTempRoots !== false,
+    },
+    taskContract: cfg.taskContract || undefined,
+    maxFilesPerSession: cfg.maxFilesPerSession !== undefined ? cfg.maxFilesPerSession : 10,
     bands: new BandsEngine({ toolRegistry: ctx && ctx.tools }),
     classifier,
     timeoutPolicy: cfg.classifierTimeoutPolicy || "strict",
@@ -555,3 +571,7 @@ export {
   isLowRiskExecution,
   LlmClassifier,
 } from "./classifier.js";
+export { ContractGuard } from "./contract-guard.js";
+export { OverengineeringGuard, DEFAULT_MAX_FILES_PER_SESSION } from "./overengineering.js";
+export { resolveTempRoot, isGlobalTempPath, checkTempIsolation } from "./paths.js";
+export { computePayloadSize, scanPromptInjection } from "./inspect.js";