@goodandready/dsh-approval-gate 0.1.3 → 0.1.4

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 0.1.4
+
+- The gate no longer raises an ask it knows cannot be answered. It reads the effective
+  approval policy (`ctx.approval.config.policy`) and, when that policy is in
+  `unattendedPolicies` (default `["never"]`, i.e. the full-access preset), an allowed command
+  proceeds instead of dying as a rejection nobody could consent to. On 20.09.2026 exactly that
+  turned every agreed write in such a session into `the user rejected tool`.
+- Denials never depend on the policy: dangerous shell commands and writes to secret files are
+  still blocked unconditionally, and the uncertain-syntax case stays denied where no
+  pre-execute hook exists.
+- New settings: `unattendedPolicies` and an explicit `unattended` flag for deployments where
+  the policy is not visible. An unknown policy keeps the safe direction and still asks.
+- 8 tests for the new behaviour (23 in total).
+
 # Changelog
 
 ## 0.1.3

package/lib/index.js

@@ -4,7 +4,10 @@
 // commands and writes to secret files even when sandbox mode would allow
 // them. A guard return value (non-undefined) denies execution, so the
 // dangerous call never runs on its own - it needs an explicit owner
-// Approval is handled by DSH's native flow; no separate word is implemented.
+// Approval is handled by DSH's native flow; no separate word is implemented. When the
+// effective approval policy cannot be answered ("never", i.e. the full-access preset),
+// the gate does not raise an ask at all: an allowed command proceeds instead of dying as
+// a rejection nobody could consent to. Denials never depend on the policy.
 //
 // Only the agent tool calls pass through the guard (cron/systemd scripts
 // do not), so legitimate unattended operations are unaffected.
@@ -22,11 +25,50 @@ import { LOCALE_NS, MESSAGES } from "./messages.js";
 export const name = "dsh-approval-gate";
 export const inject = ["tools"];
 
+/** Policies under which a prompt cannot be answered, so raising one is a silent denial. */
+export const DEFAULT_UNATTENDED_POLICIES = ["never"];
+
+/**
+ * Whether a raised ask would be answerable in this session.
+ *
+ * `policy` comes from the approval service (`ctx.approval.config.policy`); an empty value
+ * means the knob is unknown and the gate keeps asking, which is the safe direction.
+ * @param {{policy?: string, unattendedPolicies?: string[]}} knobs
+ * @returns {boolean}
+ */
+export function isUnattended(knobs) {
+  const policy = knobs && knobs.policy;
+  const policies = (knobs && knobs.unattendedPolicies) || DEFAULT_UNATTENDED_POLICIES;
+  if (typeof policy !== "string" || policy === "") return false;
+  return policies.includes(policy);
+}
+
+/** Effective permission knobs, as the harness exposes them. */
+function readKnobs(ctx) {
+  const read = (name) => {
+    try {
+      return ctx && typeof ctx.get === "function" ? ctx.get(name) : undefined;
+    } catch {
+      return undefined;
+    }
+  };
+  const approval = read("approval");
+  const shell = read("shell");
+  return {
+    policy: (approval && approval.config && approval.config.policy) || "",
+    sandbox: (shell && shell.sandboxMode) || "",
+  };
+}
+
 export const Config = Schema.object({
   /** Name of the tool whose `command` arg is inspected (the DSH bash tool). */
   toolName: Schema.string().default(DEFAULT_BASH_TOOL),
   /** Extra tool names treated as file writes; paths are matched against secret files. */
   fileWriteTools: Schema.array(Schema.string()).default(DEFAULT_FILE_WRITE_TOOLS.slice()),
+  /** Approval policies under which an ask could not be answered, so it is not raised. */
+  unattendedPolicies: Schema.array(Schema.string()).default(DEFAULT_UNATTENDED_POLICIES.slice()),
+  /** Force unattended behaviour where the approval policy is not visible. */
+  unattended: Schema.boolean().default(false),
 });
 
 function logBlocked(ctx, hit, who) {
@@ -54,12 +96,20 @@ export function apply(ctx, config) {
     if (locale && typeof locale.bind === "function") return locale.bind(LOCALE_NS)(key);
     return key;
   };
+  const unattendedPolicies = cfg.unattendedPolicies || DEFAULT_UNATTENDED_POLICIES.slice();
+  const forcedUnattended = cfg.unattended === true;
   const hasPreExecute = ctx && typeof ctx.on === "function";
   if (hasPreExecute) {
     ctx.on("tools/pre-execute", function (execution, next) {
       const hit = inspectExecution(execution, { toolName: toolName, fileWriteTools: fileWriteTools });
-      if (hit.ask) return { kind: "ask", reason: askMessage(hit, sessionTag(execution), translate, ctx && ctx.logger) };
-      return next();
+      if (!hit.ask) return next();
+      const knobs = readKnobs(ctx);
+      if (forcedUnattended || isUnattended({ policy: knobs.policy, unattendedPolicies })) {
+        // No one can answer here: an allowed command proceeds. Denials are the guard's job
+        // and do not depend on this decision.
+        return next();
+      }
+      return { kind: "ask", reason: askMessage(hit, sessionTag(execution), translate, ctx && ctx.logger) };
     });
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-approval-gate",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Host-only command safety gate for DeepSeek Harness: blocks recognized dangerous operations and requests DSH approval when a command cannot be inspected.",
   "type": "module",
   "main": "lib/index.js",
@@ -42,5 +42,13 @@
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "access": "public"
-  }
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "security",
+    "approval-gate",
+    "safety"
+  ]
 }