@klarkxy/dsh-safe-auto 0.1.0-rc.3

package/src/config.js

@@ -0,0 +1,63 @@
+import { isAbsolute } from 'node:path';
+import { parseEscalationCandidates } from './escalation.js';
+import { validateModelConfig } from './model-route.js';
+
+const defaults = Object.freeze({
+  mode: 'shadow', workspaceRoots: [], shellCandidates: [], escalationCandidates: [],
+  escalationApprovalTtlMs: 30000, escalationMaxTimeoutMs: 30000,
+  endpoint: '', fastProvider: '', fastModel: '', deepProvider: '', deepModel: '', apiKeyEnv: 'DSH_SAFE_AUTO_API_KEY',
+  tokenField: 'max_tokens', timeoutMs: 8000, maxInputBytes: 8192,
+  fastOutputTokens: 64, deepOutputTokens: 256,
+  fastCallsPerTask: 20, deepCallsPerTask: 3, sessionBudgetUnits: 100000,
+  consecutiveDenials: 3, totalDenials: 20,
+});
+const limits = {
+  escalationApprovalTtlMs: [100, 120000], escalationMaxTimeoutMs: [100, 60000],
+  timeoutMs: [100, 60000], maxInputBytes: [512, 32768],
+  fastOutputTokens: [32, 512], deepOutputTokens: [64, 2048],
+  fastCallsPerTask: [1, 100], deepCallsPerTask: [0, 20],
+  sessionBudgetUnits: [1024, 10000000], consecutiveDenials: [1, 20], totalDenials: [1, 100],
+};
+
+/** Immutable, load-time policy. Unknown keys fail rather than silently disabling a control. */
+export function parseConfig(raw = {}) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('config must be an object');
+  for (const key of Object.keys(raw)) if (!Object.hasOwn(defaults, key)) throw new Error(`unknown config field: ${key}`);
+  const c = { ...defaults, ...raw };
+  if (!['off', 'shadow', 'smart', 'unattended'].includes(c.mode)) throw new Error('invalid mode');
+  for (const key of ['endpoint', 'fastProvider', 'fastModel', 'deepProvider', 'deepModel', 'apiKeyEnv', 'tokenField']) {
+    if (typeof c[key] !== 'string' || c[key].length > 4096) throw new Error(`${key} must be a string`);
+  }
+  for (const key of ['workspaceRoots', 'shellCandidates']) {
+    if (!Array.isArray(c[key]) || c[key].length > 100 || c[key].some(x => typeof x !== 'string' || !x || x.length > 4096)) {
+      throw new Error(`${key} must contain at most 100 nonempty strings`);
+    }
+    c[key] = Object.freeze([...new Set(c[key])]);
+  }
+  if (c.workspaceRoots.some(p => !isAbsolute(p))) throw new Error('workspaceRoots must be absolute local paths');
+  for (const [key, [min, max]] of Object.entries(limits)) {
+    if (!Number.isSafeInteger(c[key]) || c[key] < min || c[key] > max) throw new Error(`invalid ${key}`);
+  }
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(c.apiKeyEnv)) throw new Error('invalid apiKeyEnv');
+  if (!['max_tokens', 'max_completion_tokens'].includes(c.tokenField)) throw new Error('invalid tokenField');
+  validateModelConfig(c);
+  if (c.endpoint) {
+    const u = new URL(c.endpoint);
+    if (u.username || u.password || u.hash || u.search) throw new Error('endpoint must not contain credentials, query or fragment');
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname);
+    if (u.protocol !== 'https:' && !(u.protocol === 'http:' && loopback)) throw new Error('endpoint requires HTTPS or loopback HTTP');
+    c.endpoint = u.href;
+  }
+  c.escalationCandidates = parseEscalationCandidates(c.escalationCandidates, c.workspaceRoots);
+  return Object.freeze(c);
+}
+
+// Cordis accepts StandardSchemaV1. No runtime schema dependency or provider SDK is needed.
+// This schema intentionally has no volatile form metadata; edits require a plugin reload.
+export const Config = Object.freeze({ '~standard': Object.freeze({
+  version: 1, vendor: 'dsh-safe-auto',
+  validate(value) {
+    try { return { value: parseConfig(value) }; }
+    catch (error) { return { issues: [{ message: error instanceof Error ? error.message : 'invalid configuration' }] }; }
+  },
+}) });

package/src/escalation.js

@@ -0,0 +1,118 @@
+import { createHash } from 'node:crypto';
+import { lstatSync, realpathSync } from 'node:fs';
+import { dirname, isAbsolute, resolve, sep } from 'node:path';
+import { containsSecret, hardRisk, inspectPath, simpleCommand } from './policy.js';
+
+const verdict = (kind, code, extra = {}) => ({ kind, code, ...extra });
+const TOOLS = new Set(['bash', 'write', 'edit']);
+const SYSTEM_PATH = /^\/(?:etc|proc|sys|dev|boot|root|usr|bin|sbin|lib|lib64|run)(?:\/|$)/;
+
+/** This adapter recognizes only the native, pinned DSH widening vocabulary. */
+export function isNativeEscalation(call) {
+  return TOOLS.has(call.tool) && call.args?.sandbox_permissions === 'danger-full-access';
+}
+
+/** Load-time envelopes are exact, not command prefixes, globs, or directory grants. */
+export function parseEscalationCandidates(value, workspaces) {
+  if (!Array.isArray(value) || value.length > 100) throw new Error('invalid escalationCandidates');
+  return Object.freeze(value.map(rule => {
+    if (!rule || typeof rule !== 'object' || Array.isArray(rule) || !TOOLS.has(rule.tool)) throw new Error('invalid escalation candidate tool');
+    const targetKey = rule.tool === 'bash' ? 'command' : 'filePath';
+    const keys = ['tool', 'cwd', 'mode', targetKey];
+    if (Object.keys(rule).length !== keys.length || Object.keys(rule).some(key => !keys.includes(key))) throw new Error('escalation candidate requires exactly tool, cwd, mode and target');
+    if (rule.mode !== 'danger-full-access' || !workspaces.includes(rule.cwd)) throw new Error('escalation candidate requires an enrolled cwd and explicit danger-full-access mode');
+    if (rule.tool === 'bash') {
+      if (!simpleCommand(rule.command)) throw new Error('escalation command must use the supported simple grammar');
+    } else if (typeof rule.filePath !== 'string' || !isAbsolute(rule.filePath) || resolve(rule.filePath) !== rule.filePath || /[\x00-\x1f\x7f\\:*?]/.test(rule.filePath)) {
+      throw new Error('escalation filePath must be an exact absolute local path');
+    }
+    return Object.freeze({ ...rule });
+  }));
+}
+
+/** Include filesystem identity in the pending decision; do not cache authorization across calls. */
+function fileStamp(path) {
+  const parent = lstatSync(dirname(path));
+  let target;
+  try { target = lstatSync(path); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
+  const stamp = s => s ? [s.dev, s.ino, s.mode, s.nlink, s.size, s.mtimeMs, s.ctimeMs] : null;
+  return [stamp(parent), stamp(target)];
+}
+
+/** Does not grant anything: a review result must still pass the native approval seam. */
+export function assessEscalation(call, config) {
+  const args = call.args;
+  if (!args || typeof args !== 'object' || Array.isArray(args)) return verdict('ask', 'INVALID_ARGUMENTS');
+  const hard = hardRisk(call);
+  if (hard) return hard;
+  if (call.sandbox?.mode !== 'workspace-write') return verdict('deny', 'WORKSPACE_SANDBOX_REQUIRED');
+  if (!isNativeEscalation(call)) return verdict('ask', 'UNSUPPORTED_ESCALATION');
+  if (typeof args.justification !== 'string' || !args.justification.trim() || args.justification.length > 4096) return verdict('ask', 'INVALID_JUSTIFICATION');
+  const root = call.sandbox.workspaceRoot;
+  if (!config.workspaceRoots.includes(root) || call.cwd !== root) return verdict('ask', 'UNTRUSTED_WORKSPACE');
+  if (!call.session || call.subagent || call.nested) return verdict('ask', 'NO_DIRECT_USER_AUTHORITY');
+  if (!call.localExecution) return verdict('ask', 'LOCAL_EXECUTION_UNVERIFIED');
+  if (sep !== '/') return verdict('ask', 'UNSUPPORTED_PLATFORM');
+  try {
+    if (realpathSync(root) !== root || !lstatSync(root).isDirectory()) return verdict('ask', 'NONCANONICAL_ROOT');
+  } catch { return verdict('ask', 'PATH_UNAVAILABLE'); }
+  // Full arguments, including file contents, are reviewed verbatim, or refused; never truncate into another action.
+  const serialized = JSON.stringify(args);
+  if (Buffer.byteLength(serialized) > config.maxInputBytes) return verdict('ask', 'REVIEW_INPUT_TOO_LARGE');
+  if (containsSecret(serialized)) return verdict('deny', 'SENSITIVE_ARGUMENTS');
+  let target;
+  let stamp;
+  if (call.tool === 'bash') {
+    if (!simpleCommand(args.command)) return verdict('ask', 'UNSUPPORTED_SHELL');
+    const allowed = ['command', 'description', 'timeoutMs', 'workdir', 'run_in_background', 'sandbox_permissions', 'justification'];
+    if (Object.keys(args).some(k => !allowed.includes(k))) return verdict('ask', 'UNREVIEWED_ARGUMENTS');
+    if (typeof args.description !== 'string' || !args.description.trim()) return verdict('ask', 'INVALID_DESCRIPTION');
+    if (args.workdir !== undefined && args.workdir !== root) return verdict('ask', 'UNREVIEWED_WORKDIR');
+    if (args.run_in_background !== undefined && args.run_in_background !== false) return verdict('ask', 'BACKGROUND_ESCALATION');
+    // The native bash tool can promote even a foreground call when jobs is composed.
+    if (call.jobsAvailable !== false || call.shellConfined !== true) return verdict('ask', 'PROCESS_LIFETIME_UNVERIFIED');
+    if (!Number.isSafeInteger(args.timeoutMs) || args.timeoutMs <= 0 || args.timeoutMs > config.escalationMaxTimeoutMs) return verdict('ask', 'BOUNDED_TIMEOUT_REQUIRED');
+    target = args.command;
+  } else {
+    const allowed = call.tool === 'write'
+      ? ['file_path', 'content', 'sandbox_permissions', 'justification']
+      : ['file_path', 'old_string', 'new_string', 'replace_all', 'sandbox_permissions', 'justification'];
+    if (Object.keys(args).some(k => !allowed.includes(k))) return verdict('ask', 'UNREVIEWED_ARGUMENTS');
+    target = args.file_path;
+    if (typeof target !== 'string' || !isAbsolute(target) || resolve(target) !== target) return verdict('ask', 'EXACT_ABSOLUTE_PATH_REQUIRED');
+    if (SYSTEM_PATH.test(target)) return verdict('deny', 'SYSTEM_TARGET');
+    if (call.tool === 'write' ? typeof args.content !== 'string' :
+      typeof args.old_string !== 'string' || !args.old_string || typeof args.new_string !== 'string' ||
+      (args.replace_all !== undefined && typeof args.replace_all !== 'boolean')) return verdict('ask', 'INVALID_FILE_ARGUMENTS');
+    const path = inspectPath(dirname(target), target, call.tool === 'write');
+    if (path.kind !== 'allow') return path;
+    // edit also changes a file: its existing target must not be a hard link.
+    if (call.tool === 'edit' && lstatSync(target).nlink > 1) return verdict('ask', 'NONREGULAR_TARGET');
+    try { stamp = fileStamp(target); }
+    catch { return verdict('ask', 'PATH_UNAVAILABLE'); }
+  }
+  const matched = config.escalationCandidates.some(rule => rule.tool === call.tool && rule.cwd === root &&
+    rule.mode === args.sandbox_permissions && (call.tool === 'bash' ? rule.command : rule.filePath) === target);
+  if (!matched) return verdict('ask', 'OUTSIDE_ESCALATION_ENVELOPE');
+  return verdict('review', 'ENROLLED_ESCALATION', {
+    stamp,
+    action: { tool: call.tool, arguments: args, cwd: root,
+      permission: { from: call.sandbox.mode, to: args.sandbox_permissions, scope: 'this-call-only',
+        filesystemConfinement: 'removed-for-this-call', networkIsolation: 'not-provided-by-DSH-file-mode' } },
+  });
+}
+
+/** Both grant and request use the native helper's exact audited reason, not a prefix match. */
+export function escalationReason(call) {
+  return `escalate sandbox to ${call.args.sandbox_permissions}: ${call.args.justification}`;
+}
+
+export function bindingOf(call, assessment) {
+  return createHash('sha256').update(JSON.stringify({
+    tool: call.tool, args: call.args, cwd: call.cwd, sandbox: call.sandbox,
+    task: call.task, intent: call.intent, subagent: call.subagent, nested: call.nested,
+    localExecution: call.localExecution, jobsAvailable: call.jobsAvailable, shellConfined: call.shellConfined,
+    code: assessment.code, stamp: assessment.stamp,
+  })).digest('hex');
+}

package/src/gate.js

@@ -0,0 +1,64 @@
+import { assess } from './policy.js';
+import { assessEscalation } from './escalation.js';
+import { review } from './reviewer.js';
+import { resolveReviewRoutes, sameRoutes } from './model-route.js';
+
+/** Per-instance, per-session budgets. Model changes never reset the session budget. */
+export function createGate(config, { fetcher = globalThis.fetch, audit = () => {}, getLlm = () => undefined } = {}) {
+  const sessions = new WeakMap();
+  const abort = new AbortController();
+  function state(session, task) {
+    let s = sessions.get(session);
+    if (!s) {
+      s = { task, fastCalls: 0, deepCalls: 0, units: 0, reportedTokens: 0, consecutive: 0, denials: 0 };
+      sessions.set(session, s);
+    }
+    if (s.task !== task) {
+      s.task = task; s.fastCalls = 0; s.deepCalls = 0; s.consecutive = 0;
+      // Neither the session budget nor the total-denial fuse is reset by a new user message.
+    }
+    return s;
+  }
+  return {
+    dispose() { abort.abort(); },
+    async decide(call, phase = 'preflight') {
+      const start = Date.now();
+      let result = phase === 'escalation' ? assessEscalation(call, config) : assess(call, config);
+      let s;
+      if (result.kind === 'review') {
+        if (!call.session || call.subagent) result = { kind: 'ask', code: 'NO_DIRECT_USER_AUTHORITY' };
+        else {
+          s = state(call.session, call.task);
+          if (s.consecutive >= config.consecutiveDenials || s.denials >= config.totalDenials) {
+            result = { kind: 'ask', code: 'CIRCUIT_OPEN' };
+          } else {
+            const oldTask = s.task;
+            try {
+              const signal = AbortSignal.any([call.signal, abort.signal]);
+              const routes = resolveReviewRoutes(config, call);
+              const llm = routes.fast.transport === 'dsh' ? getLlm() : undefined;
+              const kind = await review(config, result.action, call.intent, s, signal, fetcher, { routes, llm });
+              if (signal.aborted || s.task !== oldTask) result = { kind: 'deny', code: 'STALE_REVIEW' };
+              else if (kind === 'deny') result = { kind: 'deny', code: 'MODEL_NOT_ALLOWED' };
+              else if (!sameRoutes(routes, resolveReviewRoutes(config, call)) || (llm && llm !== getLlm())) {
+                result = { kind: 'ask', code: 'REVIEW_MODEL_CHANGED' };
+              } else result = { kind, code: kind === 'allow' ? 'MODEL_ALLOWED' : 'MODEL_NOT_ALLOWED',
+                ...(kind === 'allow' ? { reviewRoutes: routes, reviewLlm: llm } : {}),
+              };
+            } catch { result = { kind: 'ask', code: 'REVIEW_UNAVAILABLE' }; }
+            if (result.kind === 'allow') s.consecutive = 0;
+            else { s.consecutive++; s.denials++; }
+          }
+        }
+      }
+      if (call.signal.aborted || abort.signal.aborted) result = { kind: 'cancel', code: 'CANCELLED' };
+      if (config.mode === 'unattended' && result.kind === 'ask') result = { ...result, kind: 'deny' };
+      // Audit failures cannot accidentally grant permission. Do not include arguments, intent, endpoint or errors.
+      try { audit({ phase: 'assessment', gate: phase, tool: call.tool, callId: call.callId, decision: result.kind, code: result.code,
+        mode: config.mode, durationMs: Date.now() - start,
+        ...(s ? { reservedUnits: s.units, reportedTokens: s.reportedTokens, fastCalls: s.fastCalls, deepCalls: s.deepCalls } : {}),
+      }); } catch { result = { kind: 'deny', code: 'AUDIT_UNAVAILABLE' }; }
+      return result;
+    },
+  };
+}

package/src/index.js

@@ -0,0 +1,198 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { parseConfig } from './config.js';
+import { assess } from './policy.js';
+import { createGate } from './gate.js';
+import { assessEscalation, bindingOf, escalationReason, isNativeEscalation } from './escalation.js';
+import { resolveReviewRoutes, sameRoutes } from './model-route.js';
+export { Config } from './config.js';
+
+export const name = 'dsh-safe-auto';
+export const inject = ['tools', 'sandboxPolicy'];
+
+/** Do not turn assistant/tool/subagent text into user authority, even when it resembles an approval. */
+export function authority(session) {
+  const events = session?.snapshotEvents?.();
+  if (!Array.isArray(events)) return {};
+  for (let i = events.length - 1; i >= 0; i--) {
+    const e = events[i];
+    if (e?.type !== 'user/message' || e.data?.source?.kind !== 'user') continue;
+    const blocks = e.data.content;
+    if (!Array.isArray(blocks) || blocks.some(b => b?.type !== 'text' || typeof b.text !== 'string')) return { task: e.seq ?? i };
+    return { task: e.seq ?? i, intent: blocks.map(b => b.text).join('\n') };
+  }
+  return {};
+}
+
+/** Public DSH seams only. Standing sandbox policy is NEVER written or temporarily switched. */
+export function apply(ctx, raw = {}) {
+  const config = parseConfig(raw);
+  if (config.mode === 'off') return;
+  if (typeof ctx.tools?.guard !== 'function' || typeof ctx.sandboxPolicy?.resolve !== 'function') throw new Error('DSH Safe Auto requires tools.guard and sandboxPolicy.resolve');
+  const decisions = new Map();
+  const execution = new AsyncLocalStorage();
+  const lifetime = new AbortController();
+  let llm;
+  // Optional dependency: losing a model service must NOT unload the safety guards.
+  // HTTP-only profiles and deterministic checks remain usable without a native adapter.
+  if (!config.endpoint && typeof ctx.inject === 'function') ctx.inject(['llm'], scope => {
+    const active = scope.llm;
+    llm = active;
+    scope.effect(() => () => { if (llm === active) llm = undefined; });
+  });
+  const gate = createGate(config, { getLlm: () => llm, audit: row => ctx.logger.info('safe-auto %s', JSON.stringify(row)) });
+  ctx.effect(() => () => { lifetime.abort(); gate.dispose(); decisions.clear(); execution.disable(); });
+
+  function callOf(exec, includeAuthority = false) {
+    const session = exec.agent?.session;
+    const sandbox = ctx.sandboxPolicy.resolve({ session });
+    const info = includeAuthority ? authority(session) : {};
+    const call = { tool: exec.name, args: exec.arguments, callId: String(exec.callId), session, agent: exec.agent,
+      cwd: session?.header?.cwd, sandbox, signal: exec.signal,
+      subagent: Boolean(session?.header?.parentSession) || session?.header?.origin === 'subagent',
+      nested: exec.parent !== undefined, ...info };
+    if (isNativeEscalation(call)) {
+      // These are optional capability reads, not model assertions about its environment.
+      const fs = ctx.get?.('fs');
+      const shell = ctx.get?.('shell');
+      const paths = [call.cwd, ...(call.tool === 'bash' ? [] : [call.args.file_path])];
+      call.localExecution = paths.every(p => typeof p === 'string' && fs?.processPathFromHostPath?.(p) === p);
+      call.jobsAvailable = typeof ctx.get !== 'function' || ctx.get('jobs') !== undefined;
+      call.shellConfined = ['read-only', 'workspace-write', 'danger-full-access'].includes(shell?.sandboxMode);
+    }
+    return call;
+  }
+
+  function currentEscalation(exec, saved) {
+    const call = callOf(exec, true);
+    const assessment = assessEscalation(call, config);
+    return { call, assessment, unchanged: bindingOf(call, assessment) === saved.binding };
+  }
+
+  function sameReviewer(exec, decision) {
+    if (!decision.reviewRoutes) return true;
+    return sameRoutes(decision.reviewRoutes, resolveReviewRoutes(config, callOf(exec))) &&
+      (decision.reviewRoutes.fast.transport !== 'dsh' || decision.reviewLlm === llm);
+  }
+
+  ctx.tools.guard(exec => {
+    if (config.mode === 'shadow') return undefined;
+    if (exec.signal.aborted || lifetime.signal.aborted) return 'safe-auto: CANCELLED';
+    try {
+      const hard = assess(callOf(exec), config);
+      if (hard.kind === 'deny') return `safe-auto: ${hard.code}`;
+      const saved = decisions.get(exec.token);
+      if (!saved) return 'safe-auto: PREFLIGHT_NOT_RUN';
+      if (!sameReviewer(exec, saved)) return 'safe-auto: REVIEW_MODEL_CHANGED';
+      if (saved.kind === 'escalation') {
+        const current = currentEscalation(exec, saved);
+        if (current.assessment.kind === 'deny') return `safe-auto: ${current.assessment.code}`;
+        if (!current.unchanged) return 'safe-auto: ESCALATION_CHANGED';
+        return undefined;
+      }
+      if (saved.kind === 'allow' && hard.kind === 'ask') return 'safe-auto: POLICY_CHANGED';
+      if (saved.kind === 'deny' || saved.kind === 'cancel') return `safe-auto: ${saved.code}`;
+    } catch { return 'safe-auto: POLICY_UNAVAILABLE'; }
+    return undefined;
+  });
+
+  ctx.on('tools/pre-execute', async (exec, next) => {
+    let decision;
+    try {
+      if (decisions.size >= 1024) decision = { kind: 'deny', code: 'TOO_MANY_PENDING_CALLS' };
+      else {
+        const call = callOf(exec);
+        if (isNativeEscalation(call)) {
+          Object.assign(call, authority(call.session));
+          const assessed = assessEscalation(call, config);
+          decision = assessed.kind === 'deny' ? assessed : {
+            kind: 'escalation', code: assessed.code, binding: bindingOf(call, assessed), signal: exec.signal,
+          };
+        } else {
+          if (assess(call, config).kind === 'review') Object.assign(call, authority(call.session));
+          decision = await gate.decide(call);
+          const latest = assess(callOf(exec), config);
+          if (latest.kind === 'deny' || (decision.kind === 'allow' && latest.kind === 'ask')) decision = latest;
+          if (call.intent !== undefined) {
+            const current = authority(call.session);
+            if (current.task !== call.task || current.intent !== call.intent) decision = { kind: 'ask', code: 'AUTHORITY_CHANGED' };
+          }
+        }
+      }
+    } catch { decision = { kind: 'ask', code: 'POLICY_UNAVAILABLE' }; }
+    if (exec.signal.aborted || lifetime.signal.aborted) decision = { kind: 'cancel', code: 'CANCELLED' };
+    if (config.mode === 'unattended' && decision.kind === 'ask') decision = { ...decision, kind: 'deny' };
+    if (config.mode === 'shadow') return next();
+    if (decisions.size < 1024) decisions.set(exec.token, decision);
+    if (decision.kind === 'deny') return { kind: 'deny', reason: `safe-auto: ${decision.code}` };
+    if (decision.kind === 'cancel') return { kind: 'cancel' };
+    const downstream = await next();
+    if (downstream.kind !== 'allow' || decision.kind === 'allow' || decision.kind === 'escalation') return downstream;
+    return { kind: 'ask', reason: `safe-auto: ${decision.code}` };
+  }, { prepend: true });
+
+  // Bind the approval to the active execution, never a process-wide visible callId cache.
+  ctx.on('tools/execute', async (exec, next) => {
+    if (config.mode === 'shadow') return next();
+    const saved = decisions.get(exec.token);
+    if (saved?.kind !== 'escalation') return next();
+    const store = { exec, saved, active: true, claimed: false };
+    try { return await execution.run(store, next); }
+    finally { store.active = false; }
+  }, { prepend: true });
+
+  ctx.on('tools/result', (exec, result) => {
+    decisions.delete(exec.token);
+    ctx.logger.info('safe-auto %s', JSON.stringify({ phase: 'result', tool: exec.name,
+      callId: String(exec.callId), isError: result?.isError, mode: config.mode }));
+  });
+
+  ctx.on('approval/request', async (req, next) => {
+    if (config.mode === 'shadow') return next();
+    const store = execution.getStore();
+    if (!store) return config.mode === 'unattended' ? (req.signal?.aborted ? 'cancelled' : 'rejected') : next();
+    const { exec, saved } = store;
+    if (!store.active || store.claimed) return 'rejected';
+    if (typeof req.reason !== 'string' || !req.reason.startsWith('escalate sandbox to ')) {
+      return config.mode === 'unattended' ? 'rejected' : next();
+    }
+    if (req.agent !== exec.agent || req.toolName !== exec.name || req.callId !== exec.callId ||
+        req.signal !== exec.signal || req.reason !== escalationReason(callOf(exec))) return 'rejected';
+    store.claimed = true;
+    const signal = AbortSignal.any([saved.signal, exec.signal, req.signal, lifetime.signal]);
+    const started = performance.now();
+    const requestReason = req.reason;
+    let reviewed;
+    function stillBound() {
+      if (signal.aborted || !store.active || decisions.get(exec.token) !== saved) return false;
+      if (req.agent !== exec.agent || req.toolName !== exec.name || req.callId !== exec.callId ||
+          req.signal !== exec.signal || req.reason !== requestReason) return false;
+      try { return currentEscalation(exec, saved).unchanged && (!reviewed || sameReviewer(exec, reviewed)); }
+      catch { return false; }
+    }
+    function finish(outcome, source, code) {
+      if (signal.aborted) outcome = 'cancelled';
+      else if (!stillBound()) outcome = 'rejected';
+      try {
+        ctx.logger.info('safe-auto %s', JSON.stringify({ phase: 'escalation', tool: exec.name,
+          callId: String(exec.callId), decision: outcome, source, code,
+          from: 'workspace-write', to: 'danger-full-access', scope: 'this-call-only',
+          binding: saved.binding, durationMs: Math.round(performance.now() - started) }));
+      } catch { return 'rejected'; }
+      return outcome;
+    }
+    if (!stillBound()) return finish('rejected', 'binding', 'ESCALATION_CHANGED');
+    let decision;
+    try { decision = await gate.decide({ ...callOf(exec, true), signal }, 'escalation'); }
+    catch { decision = { kind: 'ask', code: 'REVIEW_UNAVAILABLE' }; }
+    if (decision.kind === 'allow') reviewed = decision;
+    if (!stillBound()) return finish('rejected', 'binding', 'ESCALATION_CHANGED');
+    if (performance.now() - started > config.escalationApprovalTtlMs) decision = { kind: 'ask', code: 'ESCALATION_LEASE_EXPIRED' };
+    if (decision.kind === 'allow') return finish('allowed-once', 'reviewer', decision.code);
+    if (decision.kind === 'cancel') return finish('cancelled', 'reviewer', decision.code);
+    if (decision.kind === 'deny' || config.mode === 'unattended') return finish('rejected', 'policy', decision.code);
+    try {
+      const human = await next();
+      return finish(['allowed-once', 'rejected', 'cancelled', 'unavailable'].includes(human) ? human : 'unavailable', 'native', decision.code);
+    } catch { return finish('unavailable', 'native', 'APPROVAL_UNAVAILABLE'); }
+  }, { prepend: true });
+}

package/src/model-route.js

@@ -0,0 +1,110 @@
+/** Model selection is independent of the main agent's tools, transcript and sampling config. */
+const id = value => typeof value === 'string' && value.length > 0 && value.length <= 4096 &&
+  value === value.trim() && !/[\x00-\x1f\x7f]/.test(value);
+
+export function validateModelConfig(config) {
+  const { endpoint, fastProvider = '', fastModel, deepProvider = '', deepModel } = config;
+  for (const value of [fastProvider, fastModel, deepProvider, deepModel]) {
+    if (value !== '' && !id(value)) throw new Error('invalid reviewer provider/model identifier');
+  }
+  if (endpoint) {
+    if (fastProvider || deepProvider) throw new Error('HTTP endpoint cannot be combined with native reviewer providers');
+    if (!fastModel) throw new Error('endpoint requires fastModel');
+  } else {
+    if (Boolean(fastProvider) !== Boolean(fastModel)) throw new Error('fastProvider and fastModel must be configured together');
+    if (Boolean(deepProvider) !== Boolean(deepModel)) throw new Error('deepProvider and deepModel must be configured together');
+  }
+}
+
+/** Use the accepted request's route, not a deployment default or another session's model. */
+export function conversationRoute(owner = {}) {
+  const agent = owner.agent;
+  const session = owner.session ?? agent?.session;
+  const header = session?.requestHeader?.();
+  // A present but malformed header must not silently fall back to potentially unrelated options.
+  const selected = header == null ? agent?.options : header.config;
+  if (!id(selected?.provider) || !id(selected?.model)) throw new Error('CONVERSATION_MODEL_UNAVAILABLE');
+  return Object.freeze({ provider: selected.provider, model: selected.model });
+}
+
+/** Snapshot both stages once. No implicit fallback between providers or transports. */
+export function resolveReviewRoutes(config, owner) {
+  validateModelConfig(config);
+  if (config.endpoint) return Object.freeze({
+    fast: Object.freeze({ transport: 'http', endpoint: config.endpoint, model: config.fastModel }),
+    deep: config.deepModel ? Object.freeze({ transport: 'http', endpoint: config.endpoint, model: config.deepModel }) : null,
+  });
+  const selected = config.fastProvider ? { provider: config.fastProvider, model: config.fastModel } : conversationRoute(owner);
+  return Object.freeze({
+    fast: Object.freeze({ transport: 'dsh', ...selected }),
+    deep: config.deepModel ? Object.freeze({ transport: 'dsh', provider: config.deepProvider, model: config.deepModel }) : null,
+  });
+}
+
+export const sameRoutes = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+
+function usageTotal(usage) {
+  if (!usage || typeof usage !== 'object') return undefined;
+  if (Number.isSafeInteger(usage.totalTokens) && usage.totalTokens >= 0) return usage.totalTokens;
+  const fields = [usage.inputTokens, usage.outputTokens, usage.cacheReadTokens ?? 0, usage.cacheWriteTokens ?? 0];
+  if (!fields.every(value => Number.isSafeInteger(value) && value >= 0)) return undefined;
+  const total = fields.reduce((a, b) => a + b, 0);
+  return Number.isSafeInteger(total) ? total : undefined;
+}
+
+/** Bounded native DSH one-shot. It never constructs an Agent or runs returned tools. */
+export async function nativeCompletion(llm, route, system, input, maxTokens, signal) {
+  if (typeof llm?.stream !== 'function') throw new Error('NATIVE_REVIEWER_UNAVAILABLE');
+  signal.throwIfAborted();
+  const options = {
+    provider: route.provider, model: route.model,
+    system, messages: [{ role: 'user', content: [{ type: 'text', text: input }] }],
+    tools: [], maxTokens, signal,
+  };
+  const blocks = new Map();
+  let size = 0;
+  let finish;
+  let usage;
+  let chunks = 0;
+  for await (const chunk of llm.stream(options)) {
+    signal.throwIfAborted();
+    if (++chunks > 16384 || !chunk || typeof chunk !== 'object' || finish !== undefined) throw new Error('INVALID_NATIVE_STREAM');
+    if (chunk.type === 'finish') {
+      if (chunk.reason?.kind !== 'stop') throw new Error('INVALID_COMPLETION');
+      finish = chunk.reason.kind;
+      continue;
+    }
+    if (chunk.type === 'usage') { usage = usageTotal(chunk.usage); continue; }
+    if (!Number.isSafeInteger(chunk.index) || chunk.index < 0 || chunk.index > 255) throw new Error('INVALID_NATIVE_BLOCK');
+    if (chunk.type === 'block-start') {
+      if (!['text', 'reasoning'].includes(chunk.blockType)) throw new Error('UNEXPECTED_REVIEWER_TOOL');
+      if (blocks.has(chunk.index)) throw new Error('DUPLICATE_NATIVE_BLOCK');
+      blocks.set(chunk.index, { type: chunk.blockType, text: '', ended: false, hasDelta: false });
+    } else if (chunk.type === 'text-delta' || chunk.type === 'reasoning-delta') {
+      const type = chunk.type === 'text-delta' ? 'text' : 'reasoning';
+      if (typeof chunk.text !== 'string') throw new Error('INVALID_NATIVE_DELTA');
+      const block = blocks.get(chunk.index) ?? { type, text: '', ended: false, hasDelta: false };
+      if (block.type !== type || block.ended) throw new Error('INVALID_NATIVE_BLOCK');
+      size += Buffer.byteLength(chunk.text);
+      if (size > 32768) throw new Error('REVIEW_RESPONSE_TOO_LARGE');
+      block.text += chunk.text;
+      block.hasDelta = true;
+      blocks.set(chunk.index, block);
+    } else if (chunk.type === 'block-end') {
+      if (!['text', 'reasoning'].includes(chunk.block?.type) || typeof chunk.block.text !== 'string') throw new Error('UNEXPECTED_REVIEWER_TOOL');
+      const prior = blocks.get(chunk.index);
+      if (prior && (prior.ended || prior.type !== chunk.block.type || (prior.hasDelta && prior.text !== chunk.block.text))) throw new Error('INCONSISTENT_NATIVE_BLOCK');
+      if (!prior?.hasDelta) size += Buffer.byteLength(chunk.block.text);
+      blocks.set(chunk.index, { ...chunk.block, ended: true });
+    } else {
+      throw new Error('UNEXPECTED_REVIEWER_CHUNK');
+    }
+    if (size > 32768) throw new Error('REVIEW_RESPONSE_TOO_LARGE');
+  }
+  signal.throwIfAborted();
+  if (finish !== 'stop' || [...blocks.values()].some(block => !block.ended)) throw new Error('MISSING_COMPLETION');
+  const text = [...blocks.entries()].sort(([a], [b]) => a - b)
+    .filter(([, block]) => block.type === 'text').map(([, block]) => block.text).join('');
+  if (!text || Buffer.byteLength(text) > 2048) throw new Error('INVALID_COMPLETION');
+  return { text, totalTokens: usage };
+}