@goodandready/dsh-github-ops 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 Notable changes to `@goodandready/dsh-github-ops`.
 
+## 0.1.2
+
+- Removed the write-approval contour the plugin never should have had: no `tools/pre-execute`
+  listener, no `allowedActions`, `autoApprove` or `approvalMode`, no action map. Approvals are
+  the host's business (the permission policy and dsh-approval-gate); a GitHub tool plugin that
+  registers its own gate duplicates the contour and, in a session where prompts are disabled,
+  turns every agreed write into a rejection — which is exactly what happened on 20.09.2026.
+  The `confirm` flags and the outright refusals (deleting or transferring a repository,
+  deleting an organization) stay: those are this plugin's own contract.
+
 ## 0.1.1 — released
 
 - `approvalMode` with "auto" as the default: an agreed, non-destructive write goes through

package/README.md

@@ -66,9 +66,6 @@ Requires a GitHub token in the DSH credential service. Store the token under a n
 | `timeoutMs` | `30000` | Per-request timeout. |
 | `maxRetries` | `2` | Retries for a failed read (never for a write). |
 | `reviewRulesJson` | *(empty)* | Review-rule overrides as JSON: `sensitivePaths`, `sensitiveSeverity`, `attentionPaths`, `migrationPaths`, `testsRequired`, `sourcePatterns`, `testPatterns`, `largeDiffLines`. |
-| `approvalMode` | `auto` | `auto` lets agreed non-destructive writes through without a prompt; deleting a release, tag, secret, variable, ruleset or branch protection, and cancelling a run, always ask. `ask` asks on every write; `off` leaves approvals to the host. |
-| `allowedActions` | *(all)* | Write actions the plugin may perform; anything else is denied. Each one still asks. |
-| `autoApprove` | *(empty)* | Actions an unattended run (`DSH_GITHUB_OPS_UNATTENDED=1`) may perform without asking. Destructive actions are never auto-approved. |
 | `reviewJobTimeoutMs` | `120000` | How long a background review job may run. |
 
 ## Tools
@@ -166,8 +163,10 @@ still passes through the approval gate.
 ## Safety
 
 - The token lives in the DSH credential service; settings hold only its name.
-- Read operations never change state; mutations are confirmed explicitly, and deleting a
-  repository, transferring one or deleting an organization is refused outright.
+- Read operations never change state. A state-changing tool needs an explicit `confirm`
+  flag, deleting a repository, transferring one or deleting an organization is refused
+  outright, and whether a prompt is shown is the host approval contour — the plugin does
+  not run an approval gate of its own.
 - The client never logs the token, and every failure is reported as a value
   (`ok: false` with `status`, `code`, `rateLimit`) instead of an exception.
 - Findings from `gh_review` are deterministic rules: they point at what needs attention

package/README.ru.md

@@ -66,9 +66,6 @@ dsh plugin --profile web add @goodandready/dsh-github-ops
 | `timeoutMs` | `30000` | Таймаут одного запроса. |
 | `maxRetries` | `2` | Повторы для неудачного чтения (запись не повторяется). |
 | `reviewRulesJson` | пусто | Переопределение правил ревью в JSON: `sensitivePaths`, `sensitiveSeverity`, `attentionPaths`, `migrationPaths`, `testsRequired`, `sourcePatterns`, `testPatterns`, `largeDiffLines`. |
-| `approvalMode` | `auto` | `auto` — согласованные неразрушительные записи проходят без вопроса; удаление релиза, тега, секрета, переменной, ruleset, защиты веток и отмена запуска спрашивают всегда. `ask` — спрашивать на каждую запись; `off` — решение целиком за штатным гейтом развёртывания. |
-| `allowedActions` | все | Разрешённые записи; всё остальное отклоняется, и каждая всё равно спрашивает подтверждение. |
-| `autoApprove` | пусто | Действия, которые неавтономный прогон (`DSH_GITHUB_OPS_UNATTENDED=1`) может выполнить без вопроса; разрушительные не автоутверждаются никогда. |
 | `reviewJobTimeoutMs` | `120000` | Сколько может работать фоновая задача ревью. |
 
 ## Инструменты
@@ -166,8 +163,7 @@ Allowlist — состав `package.json → files` плюс `.gitignore`, `LICE
 ## Безопасность
 
 - Токен живёт в сервисе учётных данных DSH; в настройках только его имя.
-- Чтение не меняет состояние; изменения подтверждаются явно; удаление репозитория, его
-  перенос и удаление организации отклоняются сразу.
+- Чтение не меняет состояние. Изменяющий инструмент требует явного флага `confirm`, удаление репозитория, его перенос и удаление организации отклоняются сразу, а показывать ли подтверждение — решает штатный контур развёртывания: своего гейта подтверждений плагин не запускает.
 - Клиент никогда не печатает токен, а любая ошибка возвращается значением
   (`ok: false` с `status`, `code`, `rateLimit`), а не исключением.
 

package/README.zh.md

@@ -63,9 +63,6 @@ dsh plugin --profile web add @goodandready/dsh-github-ops
 | `timeoutMs` | `30000` | 单次请求超时。 |
 | `maxRetries` | `2` | 读取失败时的重试次数（写入不重试）。 |
 | `reviewRulesJson` | 空 | 以 JSON 覆盖评审规则：`sensitivePaths`、`sensitiveSeverity`、`attentionPaths`、`migrationPaths`、`testsRequired`、`sourcePatterns`、`testPatterns`、`largeDiffLines`。 |
-| `approvalMode` | `auto` | `auto` 允许已同意的非破坏性写入免询问；删除 release、tag、secret、变量、ruleset、分支保护或取消运行仍会询问。`ask` 每次询问；`off` 交由宿主决定。 |
-| `allowedActions` | 全部 | 允许执行的写操作；其余一律拒绝，且每个都会询问确认。 |
-| `autoApprove` | 空 | 非交互运行（`DSH_GITHUB_OPS_UNATTENDED=1`）可免除询问的操作；破坏性操作永远不会被自动批准。 |
 | `reviewJobTimeoutMs` | `120000` | 后台评审任务的最长运行时间。 |
 
 ## 工具
@@ -158,7 +155,7 @@ dsh plugin --profile web add @goodandready/dsh-github-ops
 ## 安全边界
 
 - token 只存在于 DSH 凭据服务，设置中只有名称；
-- 读取操作不改变状态，写入必须显式确认；删除仓库、转移仓库、删除组织会被直接拒绝；
+- 读取操作不改变状态；写入需要显式 `confirm` 参数，删除仓库、转移仓库、删除组织会被直接拒绝。是否显示确认提示由宿主的审批机制决定——本插件不自行运行审批关卡；
 - 客户端不会输出 token，失败以返回值形式报告（`ok: false` 及 `status`、`code`、`rateLimit`），
   不会中断整个回合；
 - `gh_review` 的发现是确定性规则：指出需要关注的地方，绝不冒充正确性结论。

package/lib/client.js

@@ -35,8 +35,6 @@ window.__ModuleLoader__.load({
       timeoutMs: 'Request timeout, ms',
       maxRetries: 'Retries for a failed read',
       maxRetriesHint: 'A read (GET/HEAD) is retried on a network failure, a timeout or a 5xx. Writes are never retried automatically.',
-      approvalMode: 'Write approval',
-      approvalModeHint: '"auto" lets agreed non-destructive writes through without a prompt; deleting a release, tag, secret, variable, ruleset, branch protection or cancelling a run always asks. "ask" asks for every write; "off" leaves approvals to the host.',
       reviewRules: 'Review rule overrides (JSON)',
       reviewRulesHint: 'Optional. sensitivePaths, sensitiveSeverity, attentionPaths, migrationPaths, testsRequired, sourcePatterns, testPatterns, largeDiffLines. Example: {"largeDiffLines": 400, "sensitivePaths": [".env", "private/**"]}',
       timeoutMsHint: 'How long one GitHub request may take before it is aborted.',
@@ -66,8 +64,6 @@ window.__ModuleLoader__.load({
       timeoutMs: '请求超时（毫秒）',
       maxRetries: '读取失败重试次数',
       maxRetriesHint: '读取（GET/HEAD）在网络故障、超时或 5xx 时重试；写入不会自动重试。',
-      approvalMode: '写入审批',
-      approvalModeHint: '"auto" 允许已同意的非破坏性写入免询问；删除 release、tag、secret、变量、ruleset、分支保护或取消运行仍会询问。"ask" 每次写入都询问；"off" 交由宿主决定。',
       reviewRules: '评审规则覆盖（JSON）',
       reviewRulesHint: '可选。sensitivePaths、sensitiveSeverity、attentionPaths、migrationPaths、testsRequired、sourcePatterns、testPatterns、largeDiffLines。',
       timeoutMsHint: '单个 GitHub 请求在被中断前允许的时长。',
@@ -185,7 +181,7 @@ window.__ModuleLoader__.load({
         if (!scope || typeof scope.set !== 'function') return
         setSaving(true)
         const failed = []
-        const keys = ['tokenEnv', 'tokenSource', 'defaultRepository', 'baseUrl', 'timeoutMs', 'maxRetries', 'reviewRulesJson', 'approvalMode']
+        const keys = ['tokenEnv', 'tokenSource', 'defaultRepository', 'baseUrl', 'timeoutMs', 'maxRetries', 'reviewRulesJson']
         for (const key of keys) {
           if (current[key] === value[key]) continue
           let next = current[key]
@@ -241,17 +237,6 @@ window.__ModuleLoader__.load({
         field('baseUrl', 'baseUrl', 'baseUrlHint'),
         field('timeoutMs', 'timeoutMs', 'timeoutMsHint', 'number'),
         field('maxRetries', 'maxRetries', 'maxRetriesHint', 'number'),
-        React.createElement('div', { className: 'gho-field' },
-          React.createElement('label', { className: 'gho-label', htmlFor: `${NS}-approvalMode` }, t('approvalMode')),
-          React.createElement('div', { className: 'gho-hint' }, t('approvalModeHint')),
-          React.createElement('select', {
-            id: `${NS}-approvalMode`,
-            className: 'gho-input',
-            value: current.approvalMode || 'auto',
-            disabled: !writable,
-            onChange: (event) => change('approvalMode', event.target.value),
-          }, ['auto', 'ask', 'off'].map((option) => React.createElement('option', { key: option, value: option }, option))),
-        ),
         field('reviewRulesJson', 'reviewRules', 'reviewRulesHint', 'json'),
         React.createElement('div', { className: 'gho-foot' },
           React.createElement('span', { className: 'gho-note' }, message),

package/lib/index.js

@@ -21,7 +21,6 @@ import { presentationFor } from './present.js'
 import { createRecords, startReviewJob } from './jobs.js'
 import { registerCommands } from './commands.js'
 import { registerJobTools } from './tools/register-jobs.js'
-import { registerApprovalGate, ALL_ACTIONS } from './approval.js'
 import { registerCoreTools } from './tools/register-core.js'
 import { registerCollabTools } from './tools/register-collab.js'
 import { registerMirrorTools } from './tools/register-mirror.js'
@@ -67,9 +66,6 @@ export const OUTPUT_SCHEMA = {
 
 const MAX_RENDER_CHARS = 20000
 
-/** Actions this plugin can be asked to perform; exposed for settings validation. */
-export const KNOWN_ACTIONS = ALL_ACTIONS
-
 /** Render a tool result for the model: readable text, bounded so one call cannot flood the turn. */
 export function renderToolResult(toolName, value) {
   if (!value || value.ok !== true) {
@@ -108,12 +104,6 @@ export const Config = Schema.object({
     .description('Retries for a read (GET/HEAD) on a network failure, a timeout or a 5xx. Writes are never retried automatically.'),
   reviewRulesJson: Schema.string().default('')
     .description('Optional review-rule overrides as JSON: sensitivePaths, sensitiveSeverity, attentionPaths, migrationPaths, testsRequired, sourcePatterns, testPatterns, largeDiffLines.'),
-  approvalMode: Schema.string().default('auto')
-    .description('"auto" (default): an agreed, non-destructive write goes through without a prompt, while deleting a release, tag, secret, variable, ruleset, branch protection or cancelling a run always asks. "ask": every write asks. "off": the plugin has no opinion and the host approval contour decides.'),
-  allowedActions: Schema.array(Schema.string()).default([])
-    .description('Write actions this plugin may perform; anything else is denied. Empty means every known action is allowed, and each one still asks for confirmation.'),
-  autoApprove: Schema.array(Schema.string()).default([])
-    .description('Actions an unattended run (DSH_GITHUB_OPS_UNATTENDED=1) may perform without asking. Destructive actions are never auto-approved.'),
   reviewJobTimeoutMs: Schema.number().default(120000)
     .description('How long a background review job may run before it is cancelled.'),
 })
@@ -294,7 +284,7 @@ export function apply(ctx, rawConfig) {
   })
 
   // Slash commands are a fast path for a human: they only hand the model an instruction, so
-  // the write still goes through the approval gate.
+  // the write still passes through the host approval contour.
   ctx.inject(['commands'], (cctx) => {
     try {
       const git = makeGitRunner()
@@ -317,13 +307,6 @@ export function apply(ctx, rawConfig) {
     }
   })
 
-  // Writes go through the approval contour: a named action, a reason a human can decide
-  // on, and no auto-approval for anything destructive.
-  try {
-    registerApprovalGate(ctx, () => liveConfig())
-  } catch (err) {
-    ctx.logger?.warn?.('[dsh-github-ops] approval gate not registered:', err && err.message)
-  }
 
   if (skippedTools.length) {
     ctx.logger?.warn?.(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",

package/lib/approval.js

@@ -1,193 +0,0 @@
-// Who approves a GitHub write, and why.
-//
-// Every state-changing tool maps to a named action. The action must be in `allowedActions`
-// (otherwise it is denied outright), a destructive action is always asked even in an
-// unattended run, and anything else asks the human with a sentence that says what is about
-// to happen — not just "perform a GitHub write".
-//
-// `decide()` is pure: the policy is a function of the call and the settings, so it is fully
-// testable and the listener stays trivial.
-
-/** Tool → action name. A tool absent from this map is not a write. */
-export const ACTION_BY_TOOL = {
-  gh_release_create: 'release-create',
-  gh_release_edit: 'release-edit',
-  gh_release_delete: 'release-delete',
-  gh_tag_create: 'tag-create',
-  gh_tag_delete: 'tag-delete',
-  gh_repo_create: 'repo-create',
-  gh_repo_edit: 'repo-edit',
-  issue_open: 'issue-open',
-  issue_comment: 'issue-comment',
-  issue_close: 'issue-close',
-  pr_create: 'pr-create',
-  pr_update: 'pr-update',
-  pr_merge: 'pr-merge',
-  review_post: 'review-post',
-  gh_variable_set: 'variable-set',
-  gh_variable_delete: 'variable-delete',
-  gh_secret_set: 'secret-set',
-  gh_secret_delete: 'secret-delete',
-  gh_ruleset_apply: 'ruleset-apply',
-  gh_ruleset_delete: 'ruleset-delete',
-  gh_branch_protection_set: 'branch-protection-set',
-  gh_branch_protection_delete: 'branch-protection-delete',
-  gh_run_rerun: 'run-rerun',
-  gh_run_cancel: 'run-cancel',
-  gh_mirror_publish: 'mirror-publish',
-}
-
-/** Actions a single confirmation cannot make safe: always asked, never auto-approved. */
-export const DESTRUCTIVE_ACTIONS = new Set([
-  'release-delete', 'tag-delete', 'variable-delete', 'secret-delete',
-  'ruleset-delete', 'branch-protection-delete', 'run-cancel',
-])
-
-export const ALL_ACTIONS = Object.freeze([...new Set(Object.values(ACTION_BY_TOOL))])
-
-const MUTATING_METHODS = new Set(['POST', 'PATCH', 'PUT', 'DELETE'])
-
-/** Which action a call is, or null when it changes nothing. */
-export function actionFor(exec) {
-  const name = exec && exec.name
-  if (!name) return null
-  if (name === 'gh_api') {
-    const args = (exec && exec.arguments) || {}
-    if (args.graphql) return null // a query may still mutate; the GraphQL text cannot be judged here
-    const method = String(args.method || 'GET').toUpperCase()
-    return MUTATING_METHODS.has(method) ? 'api-call' : null
-  }
-  return ACTION_BY_TOOL[name] || null
-}
-
-/** A sentence a human can decide on. */
-export function askReason(exec) {
-  const args = (exec && exec.arguments) || {}
-  const repo = args.repository || 'the default repository'
-  const name = exec && exec.name
-  switch (name) {
-    case 'gh_release_create':
-      return `create GitHub release ${args.tag}${args.draft ? ' (draft)' : ''} in ${repo}`
-    case 'gh_release_edit':
-      return `edit GitHub release ${args.tag || args.releaseId} in ${repo}${args.makeLatest ? ' and mark it latest' : ''}`
-    case 'gh_release_delete':
-      return `delete GitHub release ${args.tag || args.releaseId} in ${repo} (the git tag stays)`
-    case 'gh_tag_create':
-      return `create tag ${args.tag} in ${repo}`
-    case 'gh_tag_delete':
-      return `delete tag ${args.tag} in ${repo}`
-    case 'gh_repo_create':
-      return `create repository ${args.name}${args.org ? ` in ${args.org}` : ''}${args.private === false ? ' as PUBLIC' : ' (private)'}`
-    case 'gh_repo_edit':
-      return `change settings of ${repo}${args.private !== undefined ? ` (visibility: ${args.private ? 'private' : 'PUBLIC'})` : ''}`
-    case 'issue_open':
-      return `open issue "${args.title}" in ${repo}`
-    case 'issue_comment':
-      return `comment on #${args.number} in ${repo}`
-    case 'issue_close':
-      return `close #${args.number} in ${repo}`
-    case 'pr_create':
-      return `open pull request "${args.title}" (${args.head} → ${args.base || 'main'}) in ${repo}`
-    case 'pr_update':
-      return `update pull request #${args.number} in ${repo}`
-    case 'pr_merge':
-      return `MERGE pull request #${args.number} in ${repo} (${args.method || 'merge'})`
-    case 'review_post':
-      return `post a review on #${args.number} in ${repo}`
-    case 'gh_variable_set':
-      return `set variable ${args.name} in ${repo}`
-    case 'gh_variable_delete':
-      return `delete variable ${args.name} in ${repo}`
-    case 'gh_secret_set':
-      return `set secret ${args.name} in ${repo}`
-    case 'gh_secret_delete':
-      return `delete secret ${args.name} in ${repo}`
-    case 'gh_ruleset_apply':
-      return `apply ruleset ${args.name || args.rulesetId} to ${repo}`
-    case 'gh_ruleset_delete':
-      return `delete ruleset ${args.rulesetId} from ${repo}`
-    case 'gh_branch_protection_set':
-      return `replace branch protection on ${args.branch} in ${repo}`
-    case 'gh_branch_protection_delete':
-      return `remove branch protection from ${args.branch} in ${repo}`
-    case 'gh_run_rerun':
-      return `re-run workflow run ${args.runId} in ${repo}`
-    case 'gh_run_cancel':
-      return `cancel workflow run ${args.runId} in ${repo}`
-    case 'gh_mirror_publish':
-      return `publish a sanitized tree to the mirror of ${args.cwd || 'the checkout'} (${args.mirror || 'github'}/${args.branch || 'main'})`
-    case 'gh_api':
-      return `call the GitHub API: ${String(args.method || 'GET').toUpperCase()} ${args.path}`
-    default:
-      return `perform a GitHub write action (${name})`
-  }
-}
-
-/** Whether an unattended run may proceed without a human. */
-export function isUnattended(env = process.env) {
-  return String((env && env.DSH_GITHUB_OPS_UNATTENDED) || '') === '1'
-}
-
-/** How the plugin treats a write. */
-export const APPROVAL_MODES = ['auto', 'ask', 'off']
-
-/**
- * The policy, as a pure function.
- *
- * - `auto` (default): an agreed, non-destructive write goes through without a prompt, so a
- *   session whose host has approvals disabled is not blocked by a question it cannot answer.
- *   A destructive action still asks — and where prompts are unavailable that means it is
- *   refused, which is the intent: deleting a release, a tag, a secret, a ruleset or branch
- *   protection is never automatic.
- * - `ask`: every write asks.
- * - `off`: the plugin has no opinion; the host's own approval contour decides everything.
- *
- * `allowedActions` is the fence in every mode: an action outside it is denied outright.
- *
- * @returns {{kind: 'allow'|'ask'|'deny'|'continue', reason?: string, action?: string|null}}
- */
-export function decide({ exec, allowedActions, autoApprove, unattended = false, mode = 'auto' } = {}) {
-  const action = actionFor(exec)
-  if (!action) return { kind: 'continue', action: null }
-  if (mode === 'off') return { kind: 'continue', action }
-
-  const allowed = Array.isArray(allowedActions) && allowedActions.length ? allowedActions : ALL_ACTIONS
-  if (!allowed.includes(action)) {
-    return { kind: 'deny', action, reason: `dsh-github-ops: action "${action}" is not in allowedActions` }
-  }
-
-  const destructive = DESTRUCTIVE_ACTIONS.has(action)
-  if (destructive) {
-    return {
-      kind: 'ask',
-      action,
-      reason: `dsh-github-ops: ${askReason(exec)}. This cannot be undone here, so it is never automatic.`,
-    }
-  }
-
-  if (mode === 'auto') return { kind: 'allow', action }
-  if (unattended && Array.isArray(autoApprove) && autoApprove.includes(action)) return { kind: 'allow', action }
-  return { kind: 'ask', action, reason: `dsh-github-ops: ${askReason(exec)}.` }
-}
-
-/**
- * Register the gate. Registration is an effect: disposing the plugin removes the listener.
- */
-export function registerApprovalGate(ctx, getConfig) {
-  const first = (typeof getConfig === 'function' ? getConfig() : getConfig) || {}
-  if (first.approvalMode === 'off') return () => {}
-  return ctx.on('tools/pre-execute', async (exec, next) => {
-    const cfg = (typeof getConfig === 'function' ? getConfig() : getConfig) || {}
-    const decision = decide({
-      exec,
-      allowedActions: cfg.allowedActions,
-      autoApprove: cfg.autoApprove,
-      mode: cfg.approvalMode || 'auto',
-      unattended: cfg.unattended !== undefined ? cfg.unattended : isUnattended(),
-    })
-    if (decision.kind === 'continue') return next()
-    if (decision.kind === 'allow') return { kind: 'allow' }
-    if (decision.kind === 'deny') return { kind: 'deny', reason: decision.reason }
-    return { kind: 'ask', reason: decision.reason }
-  })
-}