@goodandready/dsh-approval-gate 0.1.3

package/lib/messages.js

@@ -0,0 +1,94 @@
+export const LOCALE_NS = "dsh-approval-gate";
+
+export const MESSAGES = Object.freeze({
+  en: {
+    blockedPrefix: "Blocked by dsh-approval-gate rule",
+    detectedLabel: "Detected",
+    commandLabel: "Command",
+    parseReasonLabel: "Parse reason",
+    detailProcessSubstitution: "process substitution needs confirmation",
+    detailUnclosedProcessSubstitution: "unclosed process substitution",
+    detailUnclosedCommandSubstitution: "unclosed command substitution",
+    detailUnclosedBacktick: "unclosed backtick substitution",
+    detailUnclosedParameterExpansion: "unclosed parameter expansion",
+    detailUnclosedSingleQuote: "unclosed single quote",
+    detailUnclosedDoubleQuote: "unclosed double quote",
+    detailDanglingEscape: "unfinished escape",
+    detailInvalidHeredoc: "invalid here-document delimiter",
+    detailUnterminatedHeredoc: "here-document terminator was not found",
+    detailUnsupportedGrouping: "shell grouping syntax is not supported by the analyzer",
+    detailUnsupported: "unsupported shell syntax",
+    approvalRequired: "Approval required",
+    askUnknown: "The command could not be fully inspected; review it before allowing",
+    askUnparseable: "Shell syntax could not be fully inspected; review it before allowing",
+    askUnknownFormat: "The tool call format could not be inspected; review it before allowing",
+    askUnknownWriteTarget: "The file write target could not be identified; review it before allowing",
+    askDynamicCommand: "The expanded command name cannot be verified; review it before allowing",
+    askDynamicArguments: "Expanded arguments to a sensitive command cannot be verified; review it before allowing",
+    askDynamicRedirect: "The expanded redirect target cannot be verified; review it before allowing",
+    askScriptFile: "The script file contents are not available to the guard; review it before allowing",
+    askShellStdin: "Shell input is not fully available to the guard; review it before allowing",
+    askInterpreterPayload: "Interpreter side effects are not fully analyzed; review it before allowing",
+    askCredentialInArgv: "Expanded authorization values become process arguments; use a credential-safe API helper or review before allowing",
+    ruleUnknown: "A blocking safety rule matched",
+    ruleRecursiveRm: "Recursive file deletion",
+    ruleProcessSignal: "Process termination",
+    ruleServiceControl: "Service state change",
+    ruleGitClean: "Destructive git clean",
+    ruleGitResetHard: "Destructive git reset --hard",
+    ruleFindDelete: "find -delete",
+    ruleDestructiveSql: "Destructive SQL",
+    ruleSecretWrite: "Write to a protected secret file",
+    ruleDeviceWrite: "Write to a device or protected file",
+    ruleMkfsDevice: "Filesystem formatting",
+    ruleCurlPipe: "Downloaded content piped to a shell",
+    ruleEval: "Dynamic shell evaluation",
+    ruleNestedShell: "Nested shell depth limit",
+    ruleInterpreterPayload: "Unsafe interpreter payload",
+  },
+  zh: {
+    blockedPrefix: "dsh-approval-gate 规则已阻止",
+    detectedLabel: "检测到",
+    commandLabel: "命令",
+    parseReasonLabel: "解析原因",
+    detailProcessSubstitution: "进程替换需要确认",
+    detailUnclosedProcessSubstitution: "进程替换未闭合",
+    detailUnclosedCommandSubstitution: "命令替换未闭合",
+    detailUnclosedBacktick: "反引号命令替换未闭合",
+    detailUnclosedParameterExpansion: "参数展开未闭合",
+    detailUnclosedSingleQuote: "单引号未闭合",
+    detailUnclosedDoubleQuote: "双引号未闭合",
+    detailDanglingEscape: "转义符不完整",
+    detailInvalidHeredoc: "here-document 定界符无效",
+    detailUnterminatedHeredoc: "未找到 here-document 结束标记",
+    detailUnsupportedGrouping: "分析器不支持此 shell 分组语法",
+    detailUnsupported: "不支持的 shell 语法",
+    approvalRequired: "需要审批",
+    askUnknown: "无法完整检查此命令；允许前请先检查",
+    askUnparseable: "无法完整检查 shell 语法；允许前请先检查",
+    askUnknownFormat: "无法检查此工具调用格式；允许前请先检查",
+    askUnknownWriteTarget: "无法识别文件写入目标；允许前请先检查",
+    askDynamicCommand: "无法验证展开后的命令名称；允许前请先检查",
+    askDynamicArguments: "无法验证敏感命令展开后的参数；允许前请先检查",
+    askDynamicRedirect: "无法验证展开后的重定向目标；允许前请先检查",
+    askScriptFile: "守卫无法读取脚本内容；允许前请先检查",
+    askShellStdin: "守卫无法完整检查 shell 输入；允许前请先检查",
+    askInterpreterPayload: "未能完整分析解释器的副作用；允许前请先检查",
+    askCredentialInArgv: "展开后的授权凭据会成为进程参数；请使用安全的凭据 API 帮助程序或在允许前检查",
+    ruleUnknown: "命中安全阻止规则",
+    ruleRecursiveRm: "递归删除文件",
+    ruleProcessSignal: "终止进程",
+    ruleServiceControl: "更改服务状态",
+    ruleGitClean: "破坏性 git clean",
+    ruleGitResetHard: "破坏性 git reset --hard",
+    ruleFindDelete: "find -delete",
+    ruleDestructiveSql: "破坏性 SQL",
+    ruleSecretWrite: "写入受保护的敏感文件",
+    ruleDeviceWrite: "写入设备或受保护文件",
+    ruleMkfsDevice: "格式化文件系统",
+    ruleCurlPipe: "将下载内容传递给 shell",
+    ruleEval: "动态 shell 求值",
+    ruleNestedShell: "嵌套 shell 超出检查深度",
+    ruleInterpreterPayload: "不安全的解释器代码",
+  },
+});

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@goodandready/dsh-approval-gate",
+  "version": "0.1.3",
+  "description": "Host-only command safety gate for DeepSeek Harness: blocks recognized dangerous operations and requests DSH approval when a command cannot be inspected.",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./package.json": "./package.json",
+    "./cordis.patch.yml": "./cordis.patch.yml"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "README.zh.md",
+    "README.ru.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "license": "MIT",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/schemastery": "^3.18.1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/GooDAnDReaDY/dsh-approval-gate.git"
+  },
+  "homepage": "https://github.com/GooDAnDReaDY/dsh-approval-gate#readme",
+  "bugs": {
+    "url": "https://github.com/GooDAnDReaDY/dsh-approval-gate/issues"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  }
+}