@goodandready/dsh-github-ops 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -2,27 +2,27 @@
 
 Notable changes to `@goodandready/dsh-github-ops`.
 
-## 0.1.1
+## 0.1.2
 
-- Retries and rate-limit respect: a read (GET/HEAD) is retried on a network failure, a
-  timeout or a 5xx, and a 429 is honoured through `Retry-After` or the rate-limit reset.
-  A write is never retried automatically. `maxRetries` in settings.
-- A call may omit the repository inside a checkout: it is taken from the origin remote.
-  `owner/repo#12` and a bare `12` are understood.
-- Review findings are configuration now: glob paths, severities, the large-diff threshold
-  and whether tests are required (`reviewRulesJson`).
-- Tool results render as cards (links, branch pairs, verdicts, failing steps) instead of a
-  JSON blob.
-- Writes pass through the approval contour: every write maps to a named action, an action
-  outside `allowedActions` is denied, destructive actions always ask, and only
-  `DSH_GITHUB_OPS_UNATTENDED=1` with `autoApprove` can skip a prompt.
-- Background reviews: `gh_review_job` starts one and answers immediately;
-  `gh_review_job_status` reads it.
-- Slash commands: `/pr create [title]`, `/review [number]`, `/issue new|list|show`, `/gh`.
-  A command never writes itself — it hands the model an instruction, so the write still goes
-  through the approval gate.
-- Access can come from the DSH credential, the environment variable or the `gh` CLI session
-  (`tokenSource`), which is why a machine with `gh auth login` needs no extra configuration.
+- Removed the write-approval contour the plugin never should have had: no `tools/pre-execute`
+  listener, no `allowedActions`, `autoApprove` or `approvalMode`, no action map. Approvals are
+  the host's business (the permission policy and dsh-approval-gate); a GitHub tool plugin that
+  registers its own gate duplicates the contour and, in a session where prompts are disabled,
+  turns every agreed write into a rejection — which is exactly what happened on 20.09.2026.
+  The `confirm` flags and the outright refusals (deleting or transferring a repository,
+  deleting an organization) stay: those are this plugin's own contract.
+
+## 0.1.1 — released
+
+- `approvalMode` with "auto" as the default: an agreed, non-destructive write goes through
+  without a prompt, so a session whose host has approval prompts disabled is not blocked by a
+  question it cannot answer. Deleting a release, a tag, a secret, a variable, a ruleset,
+  cancelling a run or removing branch protection still asks, and where prompts are
+  unavailable that means it is refused — never automatic. "ask" prompts on every write;
+  "off" leaves the decision entirely to the host approval contour.
+- `allowedActions` is the fence in every mode: an action outside it is denied outright.
+- The setting is editable in the card (a three-option select) and documented in all three
+  READMEs.
 
 ## 0.1.0 — first release
 

package/README.md

@@ -1,4 +1,39 @@
-# dsh-github-ops
+# 📦 @goodandready/dsh-github-ops
+
+<div align="center">
+
+<h3>Advanced GitHub Operations, Releases, CI Runs, Secrets & Sanitized Mirrors for DeepSeek Harness</h3>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@goodandready/dsh-github-ops"><img src="https://img.shields.io/npm/v/@goodandready/dsh-github-ops.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/github/license/GooDAnDReaDY/dsh-github-ops.svg?style=for-the-badge&color=10b981&labelColor=064e3b" alt="license"></a>
+  <a href="https://github.com/topics/dsh-plugin"><img src="https://img.shields.io/badge/DSH-Plugin-8b5cf6.svg?style=for-the-badge&labelColor=2e1065" alt="DSH Plugin"></a>
+  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node-20%2B-f59e0b.svg?style=for-the-badge&labelColor=451a03" alt="Node version"></a>
+</p>
+
+<p align="center">
+  <a href="https://goodandready.app/"><img src="https://img.shields.io/badge/All_Author_Projects-goodandready.app-ff4500.svg?style=for-the-badge&logo=rocket&logoColor=white&labelColor=1a1a2e" alt="All Author Projects"></a>
+</p>
+
+<p align="center">
+  <a href="README.md"><b>🇬🇧 English</b></a> •
+  <a href="README.zh.md"><b>🇨🇳 中文说明</b></a> •
+  <a href="README.ru.md"><b>🇷🇺 Русский</b></a>
+</p>
+
+<table align="center">
+  <tr>
+    <td align="center">
+      ⭐ <strong>If you like this plugin, please star it on GitHub</strong> — it shows me that the plugin is useful to you and motivates me to keep developing it.
+      <br><br>
+      🐛 <strong>If you find a bug or would like to request a feature</strong>, open a GitHub issue in any language — I will review your proposal and implement useful suggestions in a future plugin version.
+    </td>
+  </tr>
+</table>
+
+</div>
+
+---
 
 GitHub operations for [DeepSeek Harness](https://github.com/topics/dsh-plugin): releases,
 tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror
@@ -31,8 +66,6 @@ Requires a GitHub token in the DSH credential service. Store the token under a n
 | `timeoutMs` | `30000` | Per-request timeout. |
 | `maxRetries` | `2` | Retries for a failed read (never for a write). |
 | `reviewRulesJson` | *(empty)* | Review-rule overrides as JSON: `sensitivePaths`, `sensitiveSeverity`, `attentionPaths`, `migrationPaths`, `testsRequired`, `sourcePatterns`, `testPatterns`, `largeDiffLines`. |
-| `allowedActions` | *(all)* | Write actions the plugin may perform; anything else is denied. Each one still asks. |
-| `autoApprove` | *(empty)* | Actions an unattended run (`DSH_GITHUB_OPS_UNATTENDED=1`) may perform without asking. Destructive actions are never auto-approved. |
 | `reviewJobTimeoutMs` | `120000` | How long a background review job may run. |
 
 ## Tools
@@ -130,8 +163,10 @@ still passes through the approval gate.
 ## Safety
 
 - The token lives in the DSH credential service; settings hold only its name.
-- Read operations never change state; mutations are confirmed explicitly, and deleting a
-  repository, transferring one or deleting an organization is refused outright.
+- Read operations never change state. A state-changing tool needs an explicit `confirm`
+  flag, deleting a repository, transferring one or deleting an organization is refused
+  outright, and whether a prompt is shown is the host approval contour — the plugin does
+  not run an approval gate of its own.
 - The client never logs the token, and every failure is reported as a value
   (`ok: false` with `status`, `code`, `rateLimit`) instead of an exception.
 - Findings from `gh_review` are deterministic rules: they point at what needs attention

package/README.ru.md

@@ -1,4 +1,39 @@
-# dsh-github-ops
+# 📦 @goodandready/dsh-github-ops
+
+<div align="center">
+
+<h3>Комплексные операции GitHub, релизы, CI-запуски, секреты и санитизированные зеркала для DeepSeek Harness</h3>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@goodandready/dsh-github-ops"><img src="https://img.shields.io/npm/v/@goodandready/dsh-github-ops.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/github/license/GooDAnDReaDY/dsh-github-ops.svg?style=for-the-badge&color=10b981&labelColor=064e3b" alt="license"></a>
+  <a href="https://github.com/topics/dsh-plugin"><img src="https://img.shields.io/badge/DSH-Plugin-8b5cf6.svg?style=for-the-badge&labelColor=2e1065" alt="DSH Plugin"></a>
+  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node-20%2B-f59e0b.svg?style=for-the-badge&labelColor=451a03" alt="Node version"></a>
+</p>
+
+<p align="center">
+  <a href="https://goodandready.app/"><img src="https://img.shields.io/badge/Все_проекты_автора-goodandready.app-ff4500.svg?style=for-the-badge&logo=rocket&logoColor=white&labelColor=1a1a2e" alt="Все проекты автора"></a>
+</p>
+
+<p align="center">
+  <a href="README.md"><b>🇬🇧 English</b></a> •
+  <a href="README.zh.md"><b>🇨🇳 中文说明</b></a> •
+  <a href="README.ru.md"><b>🇷🇺 Русский</b></a>
+</p>
+
+<table align="center">
+  <tr>
+    <td align="center">
+      ⭐ <strong>Если вам нравится этот плагин, поставьте ему Star на GitHub</strong> — это покажет мне, что плагин полезен, и добавит мотивации продолжать его развитие.
+      <br><br>
+      🐛 <strong>Если вы нашли ошибку или хотите предложить новую функцию</strong>, откройте issue на GitHub на любом удобном языке — я регулярно просматриваю предложения и реализую полезные идеи в будущих версиях плагина.
+    </td>
+  </tr>
+</table>
+
+</div>
+
+---
 
 Операции с GitHub для [DeepSeek Harness](https://github.com/topics/dsh-plugin): релизы,
 теги, защищённый универсальный доступ к API, запуски workflow, секреты и публикация
@@ -31,8 +66,6 @@ dsh plugin --profile web add @goodandready/dsh-github-ops
 | `timeoutMs` | `30000` | Таймаут одного запроса. |
 | `maxRetries` | `2` | Повторы для неудачного чтения (запись не повторяется). |
 | `reviewRulesJson` | пусто | Переопределение правил ревью в JSON: `sensitivePaths`, `sensitiveSeverity`, `attentionPaths`, `migrationPaths`, `testsRequired`, `sourcePatterns`, `testPatterns`, `largeDiffLines`. |
-| `allowedActions` | все | Разрешённые записи; всё остальное отклоняется, и каждая всё равно спрашивает подтверждение. |
-| `autoApprove` | пусто | Действия, которые неавтономный прогон (`DSH_GITHUB_OPS_UNATTENDED=1`) может выполнить без вопроса; разрушительные не автоутверждаются никогда. |
 | `reviewJobTimeoutMs` | `120000` | Сколько может работать фоновая задача ревью. |
 
 ## Инструменты
@@ -130,8 +163,7 @@ Allowlist — состав `package.json → files` плюс `.gitignore`, `LICE
 ## Безопасность
 
 - Токен живёт в сервисе учётных данных DSH; в настройках только его имя.
-- Чтение не меняет состояние; изменения подтверждаются явно; удаление репозитория, его
-  перенос и удаление организации отклоняются сразу.
+- Чтение не меняет состояние. Изменяющий инструмент требует явного флага `confirm`, удаление репозитория, его перенос и удаление организации отклоняются сразу, а показывать ли подтверждение — решает штатный контур развёртывания: своего гейта подтверждений плагин не запускает.
 - Клиент никогда не печатает токен, а любая ошибка возвращается значением
   (`ok: false` с `status`, `code`, `rateLimit`), а не исключением.
 

package/README.zh.md

@@ -1,4 +1,39 @@
-# dsh-github-ops
+# 📦 @goodandready/dsh-github-ops
+
+<div align="center">
+
+<h3>面向 DeepSeek Harness 的高级 GitHub 操作、发布、CI 运行、密钥与净化镜像套件</h3>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@goodandready/dsh-github-ops"><img src="https://img.shields.io/npm/v/@goodandready/dsh-github-ops.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/github/license/GooDAnDReaDY/dsh-github-ops.svg?style=for-the-badge&color=10b981&labelColor=064e3b" alt="license"></a>
+  <a href="https://github.com/topics/dsh-plugin"><img src="https://img.shields.io/badge/DSH-Plugin-8b5cf6.svg?style=for-the-badge&labelColor=2e1065" alt="DSH Plugin"></a>
+  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node-20%2B-f59e0b.svg?style=for-the-badge&labelColor=451a03" alt="Node version"></a>
+</p>
+
+<p align="center">
+  <a href="https://goodandready.app/"><img src="https://img.shields.io/badge/作者全部项目-goodandready.app-ff4500.svg?style=for-the-badge&logo=rocket&logoColor=white&labelColor=1a1a2e" alt="作者全部项目"></a>
+</p>
+
+<p align="center">
+  <a href="README.md"><b>🇬🇧 English</b></a> •
+  <a href="README.zh.md"><b>🇨🇳 中文说明</b></a> •
+  <a href="README.ru.md"><b>🇷🇺 Русский</b></a>
+</p>
+
+<table align="center">
+  <tr>
+    <td align="center">
+      ⭐ <strong>如果您喜欢这个插件，请在 GitHub 上为它点亮 Star</strong> — 这能让我知道插件对您有用，并鼓励我继续开发和维护它。
+      <br><br>
+      🐛 <strong>如果您发现 Bug 或希望增加功能</strong>，请使用任意语言在 GitHub 上提交 Issue — 我会评估您的建议，并在后续版本中实现有价值的改进。
+    </td>
+  </tr>
+</table>
+
+</div>
+
+---
 
 面向 [DeepSeek Harness](https://github.com/topics/dsh-plugin) 的 GitHub 操作插件：发布（release）、
 标签（tag）、受保护的通用 API 直通、工作流运行、密钥，以及经过净化的镜像发布。
@@ -28,8 +63,6 @@ dsh plugin --profile web add @goodandready/dsh-github-ops
 | `timeoutMs` | `30000` | 单次请求超时。 |
 | `maxRetries` | `2` | 读取失败时的重试次数（写入不重试）。 |
 | `reviewRulesJson` | 空 | 以 JSON 覆盖评审规则：`sensitivePaths`、`sensitiveSeverity`、`attentionPaths`、`migrationPaths`、`testsRequired`、`sourcePatterns`、`testPatterns`、`largeDiffLines`。 |
-| `allowedActions` | 全部 | 允许执行的写操作；其余一律拒绝，且每个都会询问确认。 |
-| `autoApprove` | 空 | 非交互运行（`DSH_GITHUB_OPS_UNATTENDED=1`）可免除询问的操作；破坏性操作永远不会被自动批准。 |
 | `reviewJobTimeoutMs` | `120000` | 后台评审任务的最长运行时间。 |
 
 ## 工具
@@ -122,7 +155,7 @@ dsh plugin --profile web add @goodandready/dsh-github-ops
 ## 安全边界
 
 - token 只存在于 DSH 凭据服务，设置中只有名称；
-- 读取操作不改变状态，写入必须显式确认；删除仓库、转移仓库、删除组织会被直接拒绝；
+- 读取操作不改变状态；写入需要显式 `confirm` 参数，删除仓库、转移仓库、删除组织会被直接拒绝。是否显示确认提示由宿主的审批机制决定——本插件不自行运行审批关卡；
 - 客户端不会输出 token，失败以返回值形式报告（`ok: false` 及 `status`、`code`、`rateLimit`），
   不会中断整个回合；
 - `gh_review` 的发现是确定性规则：指出需要关注的地方，绝不冒充正确性结论。

package/lib/index.js

@@ -21,7 +21,6 @@ import { presentationFor } from './present.js'
 import { createRecords, startReviewJob } from './jobs.js'
 import { registerCommands } from './commands.js'
 import { registerJobTools } from './tools/register-jobs.js'
-import { registerApprovalGate, ALL_ACTIONS } from './approval.js'
 import { registerCoreTools } from './tools/register-core.js'
 import { registerCollabTools } from './tools/register-collab.js'
 import { registerMirrorTools } from './tools/register-mirror.js'
@@ -67,9 +66,6 @@ export const OUTPUT_SCHEMA = {
 
 const MAX_RENDER_CHARS = 20000
 
-/** Actions this plugin can be asked to perform; exposed for settings validation. */
-export const KNOWN_ACTIONS = ALL_ACTIONS
-
 /** Render a tool result for the model: readable text, bounded so one call cannot flood the turn. */
 export function renderToolResult(toolName, value) {
   if (!value || value.ok !== true) {
@@ -108,10 +104,6 @@ export const Config = Schema.object({
     .description('Retries for a read (GET/HEAD) on a network failure, a timeout or a 5xx. Writes are never retried automatically.'),
   reviewRulesJson: Schema.string().default('')
     .description('Optional review-rule overrides as JSON: sensitivePaths, sensitiveSeverity, attentionPaths, migrationPaths, testsRequired, sourcePatterns, testPatterns, largeDiffLines.'),
-  allowedActions: Schema.array(Schema.string()).default([])
-    .description('Write actions this plugin may perform; anything else is denied. Empty means every known action is allowed, and each one still asks for confirmation.'),
-  autoApprove: Schema.array(Schema.string()).default([])
-    .description('Actions an unattended run (DSH_GITHUB_OPS_UNATTENDED=1) may perform without asking. Destructive actions are never auto-approved.'),
   reviewJobTimeoutMs: Schema.number().default(120000)
     .description('How long a background review job may run before it is cancelled.'),
 })
@@ -292,7 +284,7 @@ export function apply(ctx, rawConfig) {
   })
 
   // Slash commands are a fast path for a human: they only hand the model an instruction, so
-  // the write still goes through the approval gate.
+  // the write still passes through the host approval contour.
   ctx.inject(['commands'], (cctx) => {
     try {
       const git = makeGitRunner()
@@ -315,13 +307,6 @@ export function apply(ctx, rawConfig) {
     }
   })
 
-  // Writes go through the approval contour: a named action, a reason a human can decide
-  // on, and no auto-approval for anything destructive.
-  try {
-    registerApprovalGate(ctx, () => liveConfig())
-  } catch (err) {
-    ctx.logger?.warn?.('[dsh-github-ops] approval gate not registered:', err && err.message)
-  }
 
   if (skippedTools.length) {
     ctx.logger?.warn?.(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",

package/lib/approval.js

@@ -1,168 +0,0 @@
-// Who approves a GitHub write, and why.
-//
-// Every state-changing tool maps to a named action. The action must be in `allowedActions`
-// (otherwise it is denied outright), a destructive action is always asked even in an
-// unattended run, and anything else asks the human with a sentence that says what is about
-// to happen — not just "perform a GitHub write".
-//
-// `decide()` is pure: the policy is a function of the call and the settings, so it is fully
-// testable and the listener stays trivial.
-
-/** Tool → action name. A tool absent from this map is not a write. */
-export const ACTION_BY_TOOL = {
-  gh_release_create: 'release-create',
-  gh_release_edit: 'release-edit',
-  gh_release_delete: 'release-delete',
-  gh_tag_create: 'tag-create',
-  gh_tag_delete: 'tag-delete',
-  gh_repo_create: 'repo-create',
-  gh_repo_edit: 'repo-edit',
-  issue_open: 'issue-open',
-  issue_comment: 'issue-comment',
-  issue_close: 'issue-close',
-  pr_create: 'pr-create',
-  pr_update: 'pr-update',
-  pr_merge: 'pr-merge',
-  review_post: 'review-post',
-  gh_variable_set: 'variable-set',
-  gh_variable_delete: 'variable-delete',
-  gh_secret_set: 'secret-set',
-  gh_secret_delete: 'secret-delete',
-  gh_ruleset_apply: 'ruleset-apply',
-  gh_ruleset_delete: 'ruleset-delete',
-  gh_branch_protection_set: 'branch-protection-set',
-  gh_branch_protection_delete: 'branch-protection-delete',
-  gh_run_rerun: 'run-rerun',
-  gh_run_cancel: 'run-cancel',
-  gh_mirror_publish: 'mirror-publish',
-}
-
-/** Actions a single confirmation cannot make safe: always asked, never auto-approved. */
-export const DESTRUCTIVE_ACTIONS = new Set([
-  'release-delete', 'tag-delete', 'variable-delete', 'secret-delete',
-  'ruleset-delete', 'branch-protection-delete', 'run-cancel',
-])
-
-export const ALL_ACTIONS = Object.freeze([...new Set(Object.values(ACTION_BY_TOOL))])
-
-const MUTATING_METHODS = new Set(['POST', 'PATCH', 'PUT', 'DELETE'])
-
-/** Which action a call is, or null when it changes nothing. */
-export function actionFor(exec) {
-  const name = exec && exec.name
-  if (!name) return null
-  if (name === 'gh_api') {
-    const args = (exec && exec.arguments) || {}
-    if (args.graphql) return null // a query may still mutate; the GraphQL text cannot be judged here
-    const method = String(args.method || 'GET').toUpperCase()
-    return MUTATING_METHODS.has(method) ? 'api-call' : null
-  }
-  return ACTION_BY_TOOL[name] || null
-}
-
-/** A sentence a human can decide on. */
-export function askReason(exec) {
-  const args = (exec && exec.arguments) || {}
-  const repo = args.repository || 'the default repository'
-  const name = exec && exec.name
-  switch (name) {
-    case 'gh_release_create':
-      return `create GitHub release ${args.tag}${args.draft ? ' (draft)' : ''} in ${repo}`
-    case 'gh_release_edit':
-      return `edit GitHub release ${args.tag || args.releaseId} in ${repo}${args.makeLatest ? ' and mark it latest' : ''}`
-    case 'gh_release_delete':
-      return `delete GitHub release ${args.tag || args.releaseId} in ${repo} (the git tag stays)`
-    case 'gh_tag_create':
-      return `create tag ${args.tag} in ${repo}`
-    case 'gh_tag_delete':
-      return `delete tag ${args.tag} in ${repo}`
-    case 'gh_repo_create':
-      return `create repository ${args.name}${args.org ? ` in ${args.org}` : ''}${args.private === false ? ' as PUBLIC' : ' (private)'}`
-    case 'gh_repo_edit':
-      return `change settings of ${repo}${args.private !== undefined ? ` (visibility: ${args.private ? 'private' : 'PUBLIC'})` : ''}`
-    case 'issue_open':
-      return `open issue "${args.title}" in ${repo}`
-    case 'issue_comment':
-      return `comment on #${args.number} in ${repo}`
-    case 'issue_close':
-      return `close #${args.number} in ${repo}`
-    case 'pr_create':
-      return `open pull request "${args.title}" (${args.head} → ${args.base || 'main'}) in ${repo}`
-    case 'pr_update':
-      return `update pull request #${args.number} in ${repo}`
-    case 'pr_merge':
-      return `MERGE pull request #${args.number} in ${repo} (${args.method || 'merge'})`
-    case 'review_post':
-      return `post a review on #${args.number} in ${repo}`
-    case 'gh_variable_set':
-      return `set variable ${args.name} in ${repo}`
-    case 'gh_variable_delete':
-      return `delete variable ${args.name} in ${repo}`
-    case 'gh_secret_set':
-      return `set secret ${args.name} in ${repo}`
-    case 'gh_secret_delete':
-      return `delete secret ${args.name} in ${repo}`
-    case 'gh_ruleset_apply':
-      return `apply ruleset ${args.name || args.rulesetId} to ${repo}`
-    case 'gh_ruleset_delete':
-      return `delete ruleset ${args.rulesetId} from ${repo}`
-    case 'gh_branch_protection_set':
-      return `replace branch protection on ${args.branch} in ${repo}`
-    case 'gh_branch_protection_delete':
-      return `remove branch protection from ${args.branch} in ${repo}`
-    case 'gh_run_rerun':
-      return `re-run workflow run ${args.runId} in ${repo}`
-    case 'gh_run_cancel':
-      return `cancel workflow run ${args.runId} in ${repo}`
-    case 'gh_mirror_publish':
-      return `publish a sanitized tree to the mirror of ${args.cwd || 'the checkout'} (${args.mirror || 'github'}/${args.branch || 'main'})`
-    case 'gh_api':
-      return `call the GitHub API: ${String(args.method || 'GET').toUpperCase()} ${args.path}`
-    default:
-      return `perform a GitHub write action (${name})`
-  }
-}
-
-/** Whether an unattended run may proceed without a human. */
-export function isUnattended(env = process.env) {
-  return String((env && env.DSH_GITHUB_OPS_UNATTENDED) || '') === '1'
-}
-
-/**
- * The policy, as a pure function.
- *
- * @returns {{kind: 'allow'|'ask'|'deny'|'continue', reason?: string, action?: string|null}}
- */
-export function decide({ exec, allowedActions, autoApprove, unattended = false } = {}) {
-  const action = actionFor(exec)
-  if (!action) return { kind: 'continue', action: null }
-
-  const allowed = Array.isArray(allowedActions) && allowedActions.length ? allowedActions : ALL_ACTIONS
-  if (!allowed.includes(action)) {
-    return { kind: 'deny', action, reason: `dsh-github-ops: action "${action}" is not in allowedActions` }
-  }
-  if (unattended && !DESTRUCTIVE_ACTIONS.has(action) && Array.isArray(autoApprove) && autoApprove.includes(action)) {
-    return { kind: 'allow', action }
-  }
-  const destructive = DESTRUCTIVE_ACTIONS.has(action) ? ' This cannot be undone here.' : ''
-  return { kind: 'ask', action, reason: `dsh-github-ops: ${askReason(exec)}.${destructive}` }
-}
-
-/**
- * Register the gate. Registration is an effect: disposing the plugin removes the listener.
- */
-export function registerApprovalGate(ctx, getConfig) {
-  return ctx.on('tools/pre-execute', async (exec, next) => {
-    const cfg = (typeof getConfig === 'function' ? getConfig() : getConfig) || {}
-    const decision = decide({
-      exec,
-      allowedActions: cfg.allowedActions,
-      autoApprove: cfg.autoApprove,
-      unattended: cfg.unattended !== undefined ? cfg.unattended : isUnattended(),
-    })
-    if (decision.kind === 'continue') return next()
-    if (decision.kind === 'allow') return { kind: 'allow' }
-    if (decision.kind === 'deny') return { kind: 'deny', reason: decision.reason }
-    return { kind: 'ask', reason: decision.reason }
-  })
-}