@goodandready/dsh-approval-gate 0.1.21 → 0.1.23

package/lib/messages.js

@@ -82,6 +82,12 @@ export const MESSAGES = Object.freeze({
     ruleAgentsMdProhibitedPath: "File modification prohibited by rules in AGENTS.md",
     askMajorVersionBump: "Package.json modification contains major dependency bump; review before allowing",
     ruleMajorVersionBump: "Unauthorized major dependency version bump",
+    askRedundantSandbox: "Redundant sandbox elevation requested for safe workspace operation; review or execute in sandboxed mode",
+    ruleRedundantSandbox: "Unnecessary sandbox elevation requested for workspace-internal task",
+    askMissingJustification: "Privilege escalation requires an explicit justification; review before allowing",
+    ruleMissingJustification: "System privilege escalation requested without justification",
+    askInsufficientJustification: "Privilege escalation justification is too brief or generic; review before allowing",
+    ruleInsufficientJustification: "Insufficient privilege escalation justification",
     hintRecursiveRm: "Specify exact target files instead of recursive deletion",
     hintPathTraversal: "Keep operations strictly within the project directory",
     hintSecretWrite: "Modify configuration via settings or environment variables, not raw file overwrite",
@@ -109,6 +115,9 @@ export const MESSAGES = Object.freeze({
     hintAgentsMdProhibited: "Review project-specific guidelines and constraints defined in AGENTS.md",
     hintMajorVersionBump: "Verify compatibility before bumping major dependency versions in package.json",
     hintUnmatchedAsk: "Unrecognized operations default to fail-closed approval under defaultVerdict='ask'",
+    hintRedundantSandbox: "Execute the command in standard sandbox mode without danger-full-access",
+    hintMissingJustification: "Provide a justification field with at least 10 non-placeholder characters",
+    hintInsufficientJustification: "Describe the specific operational reason for privilege escalation",
   },
   zh: {
     blockedPrefix: "dsh-approval-gate 规则已阻止",
@@ -190,6 +199,12 @@ export const MESSAGES = Object.freeze({
     ruleAgentsMdProhibitedPath: "文件修改被 AGENTS.md 中的规则明确禁止",
     askMajorVersionBump: "package.json 包含破坏性依赖主版本升级；请在允许前进行审查",
     ruleMajorVersionBump: "未授权的依赖包主版本升级",
+    askRedundantSandbox: "对安全的内部操作请求了冗余的沙箱提权；请在允许前审查或以标准沙箱模式执行",
+    ruleRedundantSandbox: "工作区内部任务请求了不必要的沙箱提权",
+    askMissingJustification: "特权提升需要明确的理由说明；请在允许前进行审查",
+    ruleMissingJustification: "未提供理由即请求系统提权",
+    askInsufficientJustification: "特权提升理由过短或为占位符；请在允许前进行审查",
+    ruleInsufficientJustification: "特权提升理由不充分",
     hintRecursiveRm: "请指定具体目标文件，避免递归删除",
     hintPathTraversal: "请将操作限制在项目根目录内",
     hintSecretWrite: "请通过设置或环境变量修改配置，不要直接覆盖敏感配置文件",
@@ -217,6 +232,9 @@ export const MESSAGES = Object.freeze({
     hintAgentsMdProhibited: "请核对项目根目录 AGENTS.md 中定义的安全约束和禁止指令",
     hintMajorVersionBump: "在升级 package.json 依赖主版本前请确认破坏性变更与兼容性",
     hintUnmatchedAsk: "在 defaultVerdict='ask' 模式下，未识别的操作默认需要人工审核确认",
+    hintRedundantSandbox: "在标准沙箱模式下重新执行该命令，无需申请 danger-full-access",
+    hintMissingJustification: "请提供至少10个字符的有效理由说明字段",
+    hintInsufficientJustification: "请详细说明提权操作的具体业务或技术原因",
   },
 });
 
@@ -291,6 +309,9 @@ const RULE_KEYS = Object.freeze({
   "agents-md-prohibited-command": "ruleAgentsMdProhibitedCommand",
   "agents-md-prohibited-path": "ruleAgentsMdProhibitedPath",
   "major-version-bump": "askMajorVersionBump",
+  "redundant-sandbox-privilege": "ruleRedundantSandbox",
+  "missing-escalation-justification": "ruleMissingJustification",
+  "insufficient-escalation-justification": "ruleInsufficientJustification",
 });
 
 const HINT_KEYS = Object.freeze({
@@ -322,6 +343,9 @@ const HINT_KEYS = Object.freeze({
   "agents-md-prohibited-path": "hintAgentsMdProhibited",
   "major-version-bump": "hintMajorVersionBump",
   "unmatched-ask": "hintUnmatchedAsk",
+  "redundant-sandbox-privilege": "hintRedundantSandbox",
+  "missing-escalation-justification": "hintMissingJustification",
+  "insufficient-escalation-justification": "hintInsufficientJustification",
 });
 
 const ASK_KEYS = Object.freeze({
@@ -329,6 +353,9 @@ const ASK_KEYS = Object.freeze({
   "unknown-format": "askUnknownFormat",
   "unknown-write-target": "askUnknownWriteTarget",
   "unmatched-ask": "askUnmatched",
+  "redundant-sandbox-privilege": "askRedundantSandbox",
+  "missing-escalation-justification": "askMissingJustification",
+  "insufficient-escalation-justification": "askInsufficientJustification",
   "dynamic-command": "askDynamicCommand",
   "dynamic-arguments": "askDynamicArguments",
   "dynamic-redirect": "askDynamicRedirect",

package/lib/session-modes.js

@@ -0,0 +1,146 @@
+// lib/session-modes.js
+// Session-level Gate Mode Switching (#61).
+// Allows per-session mode switching between auto-approval, hybrid, manual, and strict modes.
+
+export const GATE_MODES = Object.freeze({
+  AUTO: "auto-approval",
+  MANUAL: "manual",
+  HYBRID: "hybrid",
+  STRICT: "strict",
+});
+
+export const PRESET_MODE_MAP = Object.freeze({
+  sandbox: GATE_MODES.AUTO,
+  test: GATE_MODES.AUTO,
+  auto: GATE_MODES.AUTO,
+  "auto-approval": GATE_MODES.AUTO,
+  prod: GATE_MODES.STRICT,
+  production: GATE_MODES.STRICT,
+  strict: GATE_MODES.STRICT,
+  manual: GATE_MODES.MANUAL,
+  dev: GATE_MODES.HYBRID,
+  development: GATE_MODES.HYBRID,
+  hybrid: GATE_MODES.HYBRID,
+  standard: GATE_MODES.HYBRID,
+});
+
+/**
+ * Resolves active gate mode for a session based on presets, context, or defaults.
+ *
+ * @param {string} [sessionId]
+ * @param {string} [sessionPreset]
+ * @param {Record<string, any>} [options]
+ * @returns {string}
+ */
+export function resolveSessionGateMode(sessionId, sessionPreset, options = {}) {
+  // 1. Explicit mode in options or context
+  if (options.mode && Object.values(GATE_MODES).includes(options.mode)) {
+    return options.mode;
+  }
+  if (options.sessionMode && Object.values(GATE_MODES).includes(options.sessionMode)) {
+    return options.sessionMode;
+  }
+
+  // 2. Preset mapping
+  const presetKey = String(sessionPreset || options.preset || "").toLowerCase().trim();
+  if (presetKey && PRESET_MODE_MAP[presetKey]) {
+    return PRESET_MODE_MAP[presetKey];
+  }
+
+  // 3. Fallback default
+  return options.defaultMode || GATE_MODES.HYBRID;
+}
+
+/**
+ * Applies session gate mode policy to a verdict decision (#61).
+ *
+ * @param {string} mode - Gate mode
+ * @param {Record<string, any>} decision - Original verdict decision
+ * @param {{ track?: string, riskBucket?: string, lockedAsk?: boolean, isRead?: boolean }} [meta]
+ * @returns {Record<string, any>}
+ */
+export function applySessionModePolicy(mode, decision, meta = {}) {
+  if (!decision) return decision;
+
+  const currentMode = mode || GATE_MODES.HYBRID;
+  const isLocked = Boolean(decision.lockedAsk || meta.lockedAsk);
+  const track = meta.track || decision.track || "external";
+  const riskBucket = meta.riskBucket || decision.riskBucket || "medium";
+
+  // Auto-approval mode: relaxes low-risk or internal chores that would otherwise ask
+  if (currentMode === GATE_MODES.AUTO && decision.verdict === "ask" && !isLocked) {
+    const isInternal = track === "internal";
+    const isLowRisk = riskBucket === "low" || riskBucket === "minimal";
+    if (isInternal || isLowRisk) {
+      return {
+        ...decision,
+        verdict: "allow",
+        autoApproved: true,
+        originalVerdict: "ask",
+        sessionMode: currentMode,
+        stage: "session-mode-auto",
+        autoReason: isInternal ? "auto-approve-internal-track" : "auto-approve-low-risk",
+      };
+    }
+  }
+
+  // Manual or strict mode: requires manual confirmation for external mutations or higher risk
+  if ((currentMode === GATE_MODES.MANUAL || currentMode === GATE_MODES.STRICT) && decision.verdict === "allow") {
+    const isSafeRead = Boolean(meta.isRead);
+    const isInternalSafe = track === "internal" && (riskBucket === "low" || riskBucket === "minimal");
+    if (!isSafeRead && !isInternalSafe) {
+      return {
+        ...decision,
+        verdict: "ask",
+        manualRequired: true,
+        originalVerdict: "allow",
+        sessionMode: currentMode,
+        stage: "session-mode-manual",
+        manualReason: currentMode === GATE_MODES.STRICT ? "strict-mode-enforcement" : "manual-mode-enforcement",
+      };
+    }
+  }
+
+  return {
+    ...decision,
+    sessionMode: currentMode,
+  };
+}
+
+/**
+ * Registry for maintaining per-session gate modes (#61).
+ */
+export class SessionModeRegistry {
+  constructor(defaultMode = GATE_MODES.HYBRID) {
+    this.defaultMode = defaultMode;
+    /** @type {Map<string, string>} */
+    this.sessionModes = new Map();
+  }
+
+  setMode(sessionId, mode) {
+    const key = sessionId || "default";
+    const resolved = PRESET_MODE_MAP[String(mode).toLowerCase().trim()] || mode;
+    if (Object.values(GATE_MODES).includes(resolved)) {
+      this.sessionModes.set(key, resolved);
+      return resolved;
+    }
+    return this.defaultMode;
+  }
+
+  getMode(sessionId, preset) {
+    const key = sessionId || "default";
+    if (this.sessionModes.has(key)) {
+      return this.sessionModes.get(key);
+    }
+    return resolveSessionGateMode(sessionId, preset, { defaultMode: this.defaultMode });
+  }
+
+  clearSession(sessionId) {
+    const key = sessionId || "default";
+    this.sessionModes.delete(key);
+  }
+
+  reset() {
+    this.sessionModes.clear();
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-approval-gate",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "Host-only command safety gate for DeepSeek Harness: blocks recognized dangerous operations and requests DSH approval when a command cannot be inspected.",
   "type": "module",
   "main": "lib/index.js",
@@ -52,4 +52,4 @@
     "approval-gate",
     "safety"
   ]
-}
+}