@klarkxy/dsh-safe-auto 0.2.3 → 0.3.0

package/locale/en.json

@@ -1,6 +1,6 @@
 {
   "meta": {
     "title": "Safe Auto",
-    "description": "An independent reviewer vets each sandbox escalation; only a pass auto-approves that one call."
+    "description": "A reviewer model answers approval requests; only calls that pass go ahead, one call at a time."
   }
 }

package/locale/zh.json

@@ -1,6 +1,6 @@
 {
   "meta": {
     "title": "安全自动",
-    "description": "沙箱提权请求由独立审核模型把关，通过才自动放行这一次调用。"
+    "description": "需要审批的请求交给审核模型判断，通过才放行这一次调用。"
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@klarkxy/dsh-safe-auto",
-  "version": "0.2.3",
-  "description": "Safe Auto: an independent reviewer vets each native sandbox escalation; only a pass auto-approves that one call.",
+  "version": "0.3.0",
+  "description": "Safe Auto: a reviewer model answers native approval requests, Codex auto-review style; only a pass approves that one call.",
   "icon": "./icon.svg",
   "type": "module",
   "main": "src/index.js",
@@ -23,7 +23,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "node --check src/config.js && node --check src/approval-review.js && node --check src/policy.js && node --check src/credential-paths.js && node --check src/credential-text.js && node --check src/credential-reads.js && node --check src/host-runtime.js && node --check src/review-paths.js && node --check src/shell-command.js && node --check src/model-route.js && node --check src/review-context.js && node --check src/execution-evidence.js && node --check src/human-approval.js && node --check src/reviewer.js && node --check src/gate.js && node --check src/index.js && node --check src/control.js && node --check src/ui-host.js && tsdown && node ../../scripts/editor-plugins/wrap-client.mjs @klarkxy/dsh-safe-auto",
+    "build": "node --check src/config.js && node --check src/dangerous.js && node --check src/transcript.js && node --check src/model-route.js && node --check src/reviewer.js && node --check src/index.js && node --check src/control.js && node --check src/ui-host.js && tsdown && node ../../scripts/editor-plugins/wrap-client.mjs @klarkxy/dsh-safe-auto",
     "test": "node --test test/*.test.js"
   },
   "engines": {
@@ -58,11 +58,7 @@
     }
   },
   "dependencies": {
-    "@klarkxy/dsh-plugin-kit": "0.3.3",
-    "jsonc-parser": "^3.3.1",
-    "toml-eslint-parser": "^1.0.3",
-    "unbash": "^5.0.0",
-    "yaml": "^2.9.1",
+    "@klarkxy/dsh-plugin-kit": "0.3.4",
     "zod": "^4.1.5"
   },
   "peerDependencies": {
@@ -78,7 +74,7 @@
     "@deepseek-ai/cordis": "4.0.4",
     "@deepseek-ai/dsh-client-ui-primitives": "0.2.0-rc.2",
     "@deepseek-ai/dsh-storage-domain": "0.2.0-rc.2",
-    "@klarkxy/dsh-model-route": "0.2.3",
+    "@klarkxy/dsh-model-route": "0.2.4",
     "jsdom": "29.1.1"
   },
   "publishConfig": {
@@ -86,6 +82,6 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dshRelease": {
-    "contentHash": "7c85e728f759aaf892513565487c9d552c50697009cd2b2cb7e26d7d3a6a5d53"
+    "contentHash": "4479e79ba77c55f0446e01d5ac8a9b2db9079aedde794debb60fea69e85221a0"
   }
 }

package/src/config.js

@@ -3,24 +3,26 @@ import { validateModelConfig } from './model-route.js';
 const defaults = Object.freeze({
   enabled: true,
   provider: '', model: '', reasoningEffort: '', reviewerPrompt: '',
-  timeoutMs: 30000, maxInputBytes: 32768, outputTokens: 1024,
-  humanApprovalTimeoutMs: 60000,
-  maxReviewsPerTask: 20, consecutiveDenials: 3,
-  staticReadonly: true,
+  timeoutMs: 90000, outputTokens: 4096, maxTranscriptBytes: 48000,
 });
 const limits = {
-  timeoutMs: [100, 120000], maxInputBytes: [512, 32768], outputTokens: [64, 2048],
-  maxReviewsPerTask: [1, 100], consecutiveDenials: [1, 20],
-  humanApprovalTimeoutMs: [0, 300000],
+  timeoutMs: [1000, 300000], outputTokens: [256, 16384], maxTranscriptBytes: [4096, 200000],
 };
+// Fields from the 0.2 reviewer-only design. Profiles written by older releases
+// still carry them; they are accepted and ignored so an upgrade does not
+// unload the plugin.
+const RETIRED = new Set(['maxInputBytes', 'humanApprovalTimeoutMs', 'maxReviewsPerTask', 'consecutiveDenials', 'staticReadonly']);
 
 /** Immutable, load-time policy. Unknown keys fail rather than silently disabling a control. */
 export function parseConfig(raw = {}) {
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('config must be an object');
-  for (const key of Object.keys(raw)) if (!Object.hasOwn(defaults, key)) throw new Error(`unknown config field: ${key}`);
-  const c = { ...defaults, ...raw };
+  const c = { ...defaults };
+  for (const [key, value] of Object.entries(raw)) {
+    if (RETIRED.has(key)) continue;
+    if (!Object.hasOwn(defaults, key)) throw new Error(`unknown config field: ${key}`);
+    c[key] = value;
+  }
   if (typeof c.enabled !== 'boolean') throw new Error('enabled must be a boolean');
-  if (typeof c.staticReadonly !== 'boolean') throw new Error('staticReadonly must be a boolean');
   for (const key of ['provider', 'model', 'reasoningEffort', 'reviewerPrompt']) {
     if (typeof c[key] !== 'string' || c[key].length > 4096) throw new Error(`${key} must be a string`);
   }
@@ -32,7 +34,6 @@ export function parseConfig(raw = {}) {
 }
 
 // Cordis accepts StandardSchemaV1. No runtime schema dependency or provider SDK is needed.
-// This schema intentionally has no volatile form metadata; edits require a plugin reload.
 export const Config = Object.freeze({ '~standard': Object.freeze({
   version: 1, vendor: 'dsh-safe-auto',
   validate(value) {

package/src/control.js

@@ -5,6 +5,9 @@ export const CHANNEL = '/dsh-safe-auto';
 export const REVIEW_FIELDS = ['provider', 'model', 'reasoningEffort', 'reviewerPrompt'];
 export const SETTINGS_FIELDS = REVIEW_FIELDS;
 const modes = new Set(['read-only', 'workspace-write', 'danger-full-access']);
+/** The only events that can change a session's effective permission state. The optimistic-lock revision tracks these; ordinary turn activity (steps, tool calls, messages) must not invalidate the client's view. */
+const PERMISSION_EVENTS = new Set(['permission/preset', 'sandbox/mode', 'approval/policy']);
+export const isPermissionEvent = event => PERMISSION_EVENTS.has(event?.type);
 
 /** UI writes only reviewer preferences. The enable switch and budgets remain operator-owned profile config. */
 export function createControl(base, { table, presets, sandboxPolicy, sessions, platform = process.platform, onChange = () => {}, onSettingsChanged = () => {} }) {
@@ -12,6 +15,7 @@ export function createControl(base, { table, presets, sandboxPolicy, sessions, p
   let tail = Promise.resolve();
   const lifetime = new AbortController();
   const selections = new WeakMap();
+  const permissionMarks = new WeakMap();
   let generation = 0;
   const effective = () => parseConfig({ ...base, ...settings.values });
   function active(session) {
@@ -19,7 +23,7 @@ export function createControl(base, { table, presets, sandboxPolicy, sessions, p
     const selected = session && selections.get(session);
     if (!selected || selected.enabled === false) return false;
     const events = session.snapshotEvents();
-    const changed = events.slice(selected.fromSeq).some(e => ['permission/preset', 'sandbox/mode', 'approval/policy'].includes(e.type));
+    const changed = events.slice(selected.fromSeq).some(e => PERMISSION_EVENTS.has(e.type));
     let native;
     try { native = presets.resolve(presets.current(session)); } catch { native = {}; }
     if (changed || sessions.get(session.id) !== session || isSubagentSession(session) ||
@@ -47,22 +51,39 @@ export function createControl(base, { table, presets, sandboxPolicy, sessions, p
     const c = effective();
     return { available: base.enabled && Boolean(workspaceOption()), platform,
       policyLimits: { readonly: true, sandbox: 'workspace-write', approval: 'ask', rootSessionsOnly: true,
-        escalationScope: 'this-call-only', timeoutMs: c.timeoutMs, maxInputBytes: c.maxInputBytes,
-        outputTokens: c.outputTokens, maxReviewsPerTask: c.maxReviewsPerTask, consecutiveDenials: c.consecutiveDenials,
-        humanApprovalTimeoutMs: c.humanApprovalTimeoutMs } };
+        escalationScope: 'this-call-only', timeoutMs: c.timeoutMs, outputTokens: c.outputTokens,
+        maxTranscriptBytes: c.maxTranscriptBytes } };
   }
   function settingsView() {
     const c = effective();
     return { revision: settings.revision, values: Object.fromEntries(REVIEW_FIELDS.map(k => [k, c[k] ?? ''])), ...policyView() };
   }
+  /** Optimistic-lock watermark: one past the last permission event. Mid-turn conversation activity leaves it untouched, so switching while a turn runs applies at once. */
+  function permissionMark(session) {
+    const seq = session.seq;
+    let cached = permissionMarks.get(session);
+    if (!cached || cached.scanned > seq) cached = { scanned: 0, mark: 0 };
+    if (cached.scanned < seq) {
+      const fresh = session.snapshotEvents(cached.scanned);
+      const base = seq - fresh.length;
+      for (let i = 0; i < fresh.length; i++) {
+        const at = base + i;
+        if (at < cached.scanned) continue;
+        if (PERMISSION_EVENTS.has(fresh[i]?.type)) cached.mark = at + 1;
+      }
+      cached.scanned = seq;
+      permissionMarks.set(session, cached);
+    }
+    return cached.mark;
+  }
   function sessionView(session) {
     const catalog = presets.catalog();
     const policy = policyView();
     const available = policy.available;
     const enabled = active(session);
     const current = enabled ? 'safe-auto' : presets.current(session);
-    return { revision: `${session.seq}:${selections.get(session)?.generation ?? 0}`, current, safeAuto: enabled, ...policy,
-      options: [...catalog.options.filter(o => o.value !== 'safe-auto'), ...(available ? [{ value: 'safe-auto', name: 'Safe Auto', description: 'Workspace Write with bounded per-call review' }] : [])] };
+    return { revision: `${permissionMark(session)}:${selections.get(session)?.generation ?? 0}`, current, safeAuto: enabled, ...policy,
+      options: [...catalog.options.filter(o => o.value !== 'safe-auto'), ...(available ? [{ value: 'safe-auto', name: 'Safe Auto', description: 'Workspace Write; a reviewer model answers approval requests' }] : [])] };
   }
   function getSession(id) {
     if (typeof id !== 'string' || !id || id.length > 200) throw new Error('Invalid session');

package/src/dangerous.js

@@ -0,0 +1,154 @@
+/**
+ * Small dangerous-command list for commands that run inside the sandbox.
+ *
+ * Modeled on Codex `shell-command/src/command_safety/is_dangerous_command.rs`
+ * and `windows_dangerous_commands.rs` (openai/codex, Apache-2.0): instead of
+ * proving commands read-only, flag the few patterns whose damage the
+ * workspace sandbox cannot contain, and send only those to review. A match
+ * never denies by itself; it turns an ordinary sandboxed call into a reviewed
+ * one. Parsing is best-effort tokenization, not a shell parser.
+ */
+
+const MAX_DEPTH = 8;
+const MAX_COMMAND = 32768;
+const SEGMENT_OPERATORS = new Set([';', '&', '&&', '|', '||', '\n']);
+const WRAPPERS = new Set(['sudo', 'doas', 'command', 'builtin', 'nohup', 'time', 'nice', 'xargs', 'exec']);
+const DELETE_CMDLETS = new Set(['remove-item', 'ri', 'rm', 'del', 'erase', 'rd', 'rmdir']);
+const LAUNCH_CMDLETS = new Set(['start-process', 'start', 'saps', 'invoke-item', 'ii']);
+const BROWSERS = new Set(['chrome', 'msedge', 'firefox', 'iexplore', 'brave', 'opera']);
+const SHELLS = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh', 'fish']);
+const POWERSHELLS = new Set(['pwsh', 'powershell']);
+const SOFT_SEPARATORS = /[{}()[\],]/;
+
+/** Program identity without directories, drive letters or Windows extensions. */
+export function programName(token) {
+  return String(token ?? '').split(/[\\/]/).pop().replace(/^[A-Za-z]:/, '').toLowerCase()
+    .replace(/\.(?:exe|cmd|bat|com|ps1)$/, '');
+}
+
+/**
+ * Split one command string into segments of words. Quotes group words and are
+ * removed; `$(...)` and backtick substitutions are returned separately so
+ * their contents are checked as commands too.
+ */
+export function tokenize(command) {
+  const segments = [[]];
+  const nested = [];
+  let word = '', inWord = false;
+  const push = () => { if (inWord) segments.at(-1).push(word); word = ''; inWord = false; };
+  const cut = () => { push(); if (segments.at(-1).length) segments.push([]); };
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (ch === "'" || ch === '"') {
+      const end = command.indexOf(ch, i + 1);
+      const body = end < 0 ? command.slice(i + 1) : command.slice(i + 1, end);
+      if (ch === '"') for (const match of body.matchAll(/\$\(([^()]*)\)/g)) nested.push(match[1]);
+      word += body; inWord = true; i = end < 0 ? command.length : end;
+      continue;
+    }
+    if (ch === '$' && command[i + 1] === '(') {
+      let depth = 0, j = i + 1;
+      for (; j < command.length; j++) {
+        if (command[j] === '(') depth++;
+        else if (command[j] === ')' && --depth === 0) break;
+      }
+      nested.push(command.slice(i + 2, j));
+      word += command.slice(i, j + 1); inWord = true; i = j;
+      continue;
+    }
+    if (ch === '`' && command.indexOf('`', i + 1) > i) {
+      const end = command.indexOf('`', i + 1);
+      nested.push(command.slice(i + 1, end));
+      i = end;
+      continue;
+    }
+    if (ch === '\n' || ch === '\r' || ch === ';') { cut(); continue; }
+    if (ch === '&' || ch === '|') {
+      if (command[i + 1] === ch) i++;
+      // `2>&1` and `>|` are redirections, not command separators.
+      if (ch === '&' && /[<>]$/.test(word)) { word += ch; inWord = true; continue; }
+      cut(); continue;
+    }
+    if (/\s/.test(ch)) { push(); continue; }
+    word += ch; inWord = true;
+  }
+  push();
+  return { segments: segments.filter(segment => segment.length), nested };
+}
+
+const hasUrl = words => words.some(word => /https?:\/\//i.test(word));
+const isForcedRm = args => args.some(arg => arg === '--force' || /^-[A-Za-z]*f[A-Za-z]*$/.test(arg) && !arg.startsWith('--'));
+
+/** Inner script of `bash -c`, `pwsh -Command` or `cmd /c`, if this is such an invocation. */
+function innerScript(name, args) {
+  if (SHELLS.has(name)) {
+    const index = args.findIndex(arg => /^-[A-Za-z]*c[A-Za-z]*$/.test(arg));
+    return index >= 0 && args[index + 1] !== undefined ? { script: args[index + 1], shell: 'bash' } : undefined;
+  }
+  if (POWERSHELLS.has(name)) {
+    const index = args.findIndex(arg => /^[-/](?:c|command)$/i.test(arg));
+    if (index >= 0) return { script: args.slice(index + 1).join(' '), shell: 'pwsh' };
+    const inline = args.find(arg => /^[-/]command:/i.test(arg));
+    return inline ? { script: inline.slice(inline.indexOf(':') + 1), shell: 'pwsh' } : undefined;
+  }
+  if (name === 'cmd') {
+    const index = args.findIndex(arg => /^[-/][cr]$/i.test(arg));
+    return index >= 0 ? { script: args.slice(index + 1).join(' '), shell: 'cmd' } : undefined;
+  }
+  return undefined;
+}
+
+function matchSegment(words, shell, depth) {
+  let index = 0;
+  // Leading assignments (`FOO=1 cmd`) and transparent wrappers do not change the program.
+  while (index < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[index])) index++;
+  let name = programName(words[index]);
+  while (WRAPPERS.has(name) || name === 'env') {
+    index++;
+    while (index < words.length && (words[index].startsWith('-') || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[index]))) index++;
+    name = programName(words[index]);
+  }
+  const args = words.slice(index + 1);
+  if (!name) return undefined;
+  const inner = innerScript(name, args);
+  if (inner) return scan(inner.script, inner.shell, depth + 1);
+  if (name === 'rm' && isForcedRm(args)) return 'forced-rm';
+  if ((name === 'del' || name === 'erase') && args.some(arg => /^\/f$/i.test(arg))) return 'force-delete';
+  if ((name === 'rd' || name === 'rmdir') && args.some(arg => /^\/s$/i.test(arg)) && args.some(arg => /^\/q$/i.test(arg))) return 'force-delete';
+  if (shell === 'pwsh') {
+    // PowerShell script blocks and parentheses can hide the cmdlet inside one segment.
+    const atoms = words.flatMap(word => word.split(SOFT_SEPARATORS)).map(atom => atom.trim().toLowerCase()).filter(Boolean);
+    if (atoms.some(atom => DELETE_CMDLETS.has(atom)) && atoms.some(atom => atom === '-force' || atom.startsWith('-force:'))) return 'force-delete';
+    if (hasUrl(words) && atoms.some(atom => LAUNCH_CMDLETS.has(atom) || atom.includes('shellexecute') || atom.includes('shell.application'))) return 'url-launch';
+  }
+  if (name === 'start' && hasUrl(args)) return 'url-launch';
+  if ((name === 'explorer' || name === 'mshta' || BROWSERS.has(name)) && hasUrl(args)) return 'url-launch';
+  if (name === 'rundll32' && args.some(arg => /url\.dll,fileprotocolhandler/i.test(arg)) && hasUrl(args)) return 'url-launch';
+  return undefined;
+}
+
+function scan(command, shell, depth) {
+  if (depth > MAX_DEPTH) return 'nesting-too-deep';
+  const { segments, nested } = tokenize(command);
+  for (const words of segments) {
+    const hit = matchSegment(words, shell, depth);
+    if (hit) return hit;
+  }
+  for (const inner of nested) {
+    const hit = scan(inner, shell, depth + 1);
+    if (hit) return hit;
+  }
+  return undefined;
+}
+
+/**
+ * Dangerous-command rule matched by one shell tool command, or undefined.
+ * @param {string} command - the exact `command` argument.
+ * @param {'bash' | 'pwsh'} tool - the shell tool that will run it.
+ * @returns {string | undefined} rule id such as `forced-rm`, `force-delete` or `url-launch`.
+ */
+export function dangerousCommand(command, tool) {
+  if (typeof command !== 'string' || !command.trim()) return undefined;
+  if (command.length > MAX_COMMAND) return 'command-too-long';
+  return scan(command, tool === 'pwsh' ? 'pwsh' : 'bash', 0);
+}