@goodandready/dsh-approval-gate 0.1.23 → 0.1.25

package/lib/rules-hmr.js

@@ -0,0 +1,132 @@
+// lib/rules-hmr.js
+// Hot Module Reloading for Security Rules (#43).
+// Watches .dsh/rules.yaml and declarative rule definitions using Node.js stdlib fs watchers.
+// Recompiles rules in-memory atomically without dropping active sessions or restarting dsh.
+
+import fs from "node:fs";
+
+export const DEFAULT_HMR_DEBOUNCE_MS = 150;
+
+/**
+ * Manages atomic hot reload watchers for rule definitions (#43).
+ */
+export class RulesHmrWatcher {
+  /**
+   * @param {{ debounceMs?: number, logger?: any }} [options]
+   */
+  constructor(options = {}) {
+    this.debounceMs = options.debounceMs || DEFAULT_HMR_DEBOUNCE_MS;
+    this.logger = options.logger || null;
+    /** @type {Map<string, fs.FSWatcher>} */
+    this.watchers = new Map();
+    /** @type {NodeJS.Timeout | null} */
+    this.debounceTimer = null;
+    this.reloading = false;
+  }
+
+  /**
+   * Attaches file watchers for declarative rules files.
+   *
+   * @param {any} rulesEngine - Instance of DeclarativeRulesEngine
+   * @param {string[]} filePaths - Files or directories to watch
+   * @param {(info: { path: string, timestamp: number }) => void} [onReload]
+   * @returns {number} Count of successfully watched paths
+   */
+  watch(rulesEngine, filePaths = [], onReload = null) {
+    if (!rulesEngine || !Array.isArray(filePaths)) return 0;
+    let watchedCount = 0;
+
+    for (const targetPath of filePaths) {
+      if (!targetPath || typeof targetPath !== "string") continue;
+      if (this.watchers.has(targetPath)) continue;
+
+      try {
+        if (!fs.existsSync(targetPath)) continue;
+
+        const watcher = fs.watch(targetPath, { persistent: false }, (eventType, filename) => {
+          this._handleFileChange(rulesEngine, targetPath, onReload);
+        });
+
+        watcher.on("error", (err) => {
+          if (this.logger) this.logger.warn?.(`RulesHmrWatcher error on ${targetPath}:`, err);
+          this.unwatch(targetPath);
+        });
+
+        this.watchers.set(targetPath, watcher);
+        watchedCount += 1;
+      } catch (err) {
+        if (this.logger) this.logger.warn?.(`Failed to watch ${targetPath}:`, err);
+      }
+    }
+
+    return watchedCount;
+  }
+
+  /**
+   * Unwatches a specific file path.
+   * @param {string} targetPath
+   */
+  unwatch(targetPath) {
+    const watcher = this.watchers.get(targetPath);
+    if (watcher) {
+      try {
+        watcher.close();
+      } catch (_e) {}
+      this.watchers.delete(targetPath);
+    }
+  }
+
+  /**
+   * Closes all active file watchers.
+   */
+  close() {
+    if (this.debounceTimer) {
+      clearTimeout(this.debounceTimer);
+      this.debounceTimer = null;
+    }
+    for (const [p, watcher] of this.watchers.entries()) {
+      try {
+        watcher.close();
+      } catch (_e) {}
+    }
+    this.watchers.clear();
+  }
+
+  /**
+   * @private
+   */
+  _handleFileChange(rulesEngine, targetPath, onReload) {
+    if (this.debounceTimer) {
+      clearTimeout(this.debounceTimer);
+    }
+
+    this.debounceTimer = setTimeout(() => {
+      this.debounceTimer = null;
+      this._triggerReload(rulesEngine, targetPath, onReload);
+    }, this.debounceMs);
+  }
+
+  /**
+   * @private
+   */
+  _triggerReload(rulesEngine, targetPath, onReload) {
+    if (this.reloading) return;
+    this.reloading = true;
+
+    try {
+      if (typeof rulesEngine.reload === "function") {
+        rulesEngine.reload();
+      } else if (typeof rulesEngine.loadRules === "function") {
+        rulesEngine.loadRules();
+      }
+
+      if (typeof onReload === "function") {
+        onReload({ path: targetPath, timestamp: Date.now() });
+      }
+    } catch (err) {
+      if (this.logger) this.logger.error?.(`Failed to reload rules for ${targetPath}:`, err);
+    } finally {
+      this.reloading = false;
+    }
+  }
+}

package/lib/similarity.js

@@ -0,0 +1,134 @@
+// lib/similarity.js
+// Semantic Command Similarity & Fast Validation (#85).
+// Normalizes and validates syntactic variations of commands (e.g. pnpm test vs npm run test vs npm test).
+// Provides canonical command normalization and optional fast Flash-model validator with deterministic fallback.
+
+const PKG_MGR_REGEX = /^(?:pnpm|npm|yarn|bun)\b/;
+
+/**
+ * Normalizes common command variants into canonical representation (#85).
+ *
+ * @param {string} command
+ * @returns {string}
+ */
+export function canonicalizeCommand(command) {
+  if (!command || typeof command !== "string") return "";
+  let cmd = command.trim().replace(/\s+/g, " ");
+
+  // 1. Package manager scripts normalization
+  // pnpm test / npm run test / yarn test / bun test -> npm test
+  if (/^(?:pnpm|npm\s+run|yarn|bun)\s+test\b/.test(cmd)) {
+    return cmd.replace(/^(?:pnpm|npm\s+run|yarn|bun)\s+test/, "npm test");
+  }
+  // pnpm run <script> / yarn <script> / bun run <script> -> npm run <script>
+  if (/^(?:pnpm\s+run|yarn\s+run|bun\s+run)\s+([a-zA-Z0-9_:.-]+)/.test(cmd)) {
+    return cmd.replace(/^(?:pnpm\s+run|yarn\s+run|bun\s+run)/, "npm run");
+  }
+  if (/^(?:pnpm|yarn|bun)\s+(build|lint|check|start|dev)\b/.test(cmd)) {
+    return cmd.replace(/^(?:pnpm|yarn|bun)\s+/, "npm run ");
+  }
+
+  // 2. Python testing tools
+  // python -m pytest / python3 -m pytest -> pytest
+  if (/^python[23]?\s+-m\s+pytest\b/.test(cmd)) {
+    return cmd.replace(/^python[23]?\s+-m\s+pytest/, "pytest");
+  }
+
+  // 3. Git status / diff flags
+  if (/^git\s+status\s+(?:-s|--short)\b/.test(cmd)) {
+    return "git status";
+  }
+  if (/^git\s+diff\s+HEAD\b/.test(cmd)) {
+    return "git diff";
+  }
+
+  return cmd;
+}
+
+/**
+ * Checks whether two commands are semantically equivalent (#85).
+ *
+ * @param {string} cmdA
+ * @param {string} cmdB
+ * @returns {{ equivalent: boolean, confidence: number, method: string }}
+ */
+export function isSemanticallyEquivalent(cmdA, cmdB) {
+  if (!cmdA || !cmdB) return { equivalent: false, confidence: 0, method: "none" };
+  const a = String(cmdA).trim();
+  const b = String(cmdB).trim();
+  if (a === b) {
+    return { equivalent: true, confidence: 1.0, method: "exact" };
+  }
+
+  const normA = canonicalizeCommand(a);
+  const normB = canonicalizeCommand(b);
+
+  if (normA && normA === normB) {
+    return { equivalent: true, confidence: 0.98, method: "canonical" };
+  }
+
+  return { equivalent: false, confidence: 0, method: "mismatch" };
+}
+
+/**
+ * Searches a list of learned rules for a semantically equivalent match (#85).
+ *
+ * @param {string} command
+ * @param {Array<{ command?: string, key?: string }>} learnedRules
+ * @returns {{ matched: boolean, matchedRule?: any, method?: string }}
+ */
+export function findSemanticallyEquivalentRule(command, learnedRules = []) {
+  if (!command || !Array.isArray(learnedRules) || learnedRules.length === 0) {
+    return { matched: false };
+  }
+
+  for (const rule of learnedRules) {
+    const ruleCmd = rule.command || (rule.key && rule.key.includes(":") ? rule.key.slice(rule.key.indexOf(":") + 1) : "");
+    if (!ruleCmd) continue;
+
+    const check = isSemanticallyEquivalent(command, ruleCmd);
+    if (check.equivalent) {
+      return { matched: true, matchedRule: rule, method: check.method };
+    }
+  }
+
+  return { matched: false };
+}
+
+/**
+ * Validates semantic similarity with optional Flash-model LLM client (#85).
+ * Falls back safely to deterministic canonical matching on error or absence.
+ *
+ * @param {string} cmdA
+ * @param {string} cmdB
+ * @param {{ classify?: Function, model?: string }} [llmClient]
+ * @returns {Promise<{ equivalent: boolean, confidence: number, method: string }>}
+ */
+export async function validateSemanticSimilarity(cmdA, cmdB, llmClient = null) {
+  // 1. Fast deterministic check
+  const det = isSemanticallyEquivalent(cmdA, cmdB);
+  if (det.equivalent) {
+    return det;
+  }
+
+  // 2. If no LLM client, return deterministic result
+  if (!llmClient || typeof llmClient.classify !== "function") {
+    return det;
+  }
+
+  try {
+    const prompt = `Are these two terminal commands semantically equivalent in purpose and safety?\nCommand 1: ${cmdA}\nCommand 2: ${cmdB}\nRespond with JSON: {"equivalent": true|false, "confidence": number}`;
+    const res = await llmClient.classify({ name: "semantic_check", prompt });
+    if (res && typeof res.equivalent === "boolean") {
+      return {
+        equivalent: res.equivalent,
+        confidence: typeof res.confidence === "number" ? res.confidence : 0.9,
+        method: "flash-model",
+      };
+    }
+  } catch (_err) {
+    // Fail closed to deterministic fallback
+  }
+
+  return det;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-approval-gate",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "Host-only command safety gate for DeepSeek Harness: blocks recognized dangerous operations and requests DSH approval when a command cannot be inspected.",
   "type": "module",
   "main": "lib/index.js",
@@ -17,7 +17,8 @@
     "README.zh.md",
     "README.ru.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "bin"
   ],
   "dsh": {
     "bundle": {
@@ -38,7 +39,8 @@
     "url": "https://github.com/GooDAnDReaDY/dsh-approval-gate/issues"
   },
   "scripts": {
-    "test": "node --test test/*.test.mjs"
+    "test": "node --test test/*.test.mjs",
+    "eval": "node bin/eval.mjs"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -51,5 +53,8 @@
     "security",
     "approval-gate",
     "safety"
-  ]
+  ],
+  "bin": {
+    "dsh-approval-eval": "./bin/eval.mjs"
+  }
 }