@klarkxy/dsh-safe-auto 0.2.3 → 0.4.0

package/src/execution-evidence.js

@@ -1,115 +0,0 @@
-import { isAbsolute, relative, resolve } from 'node:path';
-import { createHash } from 'node:crypto';
-import { containsSecret, hardRisk } from './policy.js';
-import { redactCredentialText } from './credential-text.js';
-
-const MAX_FILES = 8;
-const MAX_FILE_BYTES = 6144;
-const MAX_BYTES = 12288;
-const digest = bytes => createHash('sha256').update(bytes).digest('hex');
-
-// This only locates possible evidence. It never interprets a shell, determines
-// permission, or constructs an executable command. Unsupported syntax stays in
-// the exact action for the reviewer. POSIX shell parsers would misread pwsh.
-function fileHints(text) {
-  return (text.match(/"[^"\r\n]*"|'[^'\r\n]*'|[^\s;&|<>]+/g) ?? [])
-    .map(value => value.replace(/^["']|["']$/g, ''))
-    .filter(value => /\.(?:[cm]?js|tsx?|ps1|sh)$/i.test(value) && !/[\x00-\x1f$`*?{}]/.test(value));
-}
-
-/** Read bounded local evidence through the host's canonical filesystem seam.
- * Repository code is evidence, never authority. No subprocesses or network.
- */
-export async function collectExecutionEvidence(call, fs, signal) {
-  const files = [], omissions = [], snapshots = [];
-  const unavailable = () => ({ data: { files, omissions: ['FILESYSTEM_EVIDENCE_UNAVAILABLE'], coverage: 'partial' }, verify: async () => true });
-  if (!['bash', 'pwsh'].includes(call.tool)) return { data: undefined, verify: async () => true };
-  if (!fs || ['resolve', 'contains', 'stat', 'readBytes', 'processPath'].some(key => typeof fs[key] !== 'function')) return unavailable();
-  const rootPath = call.sandbox?.workspaceRoot;
-  const workdir = call.reviewPaths?.workdir ?? call.args.workdir ?? call.cwd;
-  if (!isAbsolute(rootPath ?? '') || !isAbsolute(workdir ?? '')) return unavailable();
-  const root = await fs.resolve(rootPath, { signal });
-  const cwd = await fs.resolve(workdir, { signal });
-  if (!fs.contains(root, cwd)) return { data: { files, omissions: ['WORKDIR_OUTSIDE_WORKSPACE'], coverage: 'partial' }, verify: async () => true };
-  const canonicalRoot = fs.processPath(root), canonicalCwd = fs.processPath(cwd);
-  let bytes = 0;
-  const queued = new Set();
-  const queue = [];
-  const enqueue = (path, base = canonicalCwd) => {
-    const absolute = resolve(base, path);
-    if (queued.has(absolute)) return;
-    queued.add(absolute); queue.push(absolute);
-  };
-  enqueue('package.json');
-  if (canonicalCwd !== canonicalRoot) enqueue('package.json', canonicalRoot);
-  for (const path of fileHints(call.args.command)) enqueue(path);
-  // Manifests expose lifecycle hooks as well as script definitions. Follow only
-  // local file references in relevant scripts; no transitive dependency audit.
-  const scriptNames = new Set(call.args.command.match(/[A-Za-z0-9_:-]+/g) ?? []);
-  if (scriptNames.has('install')) for (const name of ['preinstall', 'postinstall', 'prepare']) scriptNames.add(name);
-  for (let i = 0; i < queue.length; i++) {
-    signal.throwIfAborted();
-    const path = queue[i];
-    if (snapshots.length >= MAX_FILES || bytes >= MAX_BYTES) { omissions.push('EVIDENCE_LIMIT'); break; }
-    if (hardRisk({ tool: 'read', args: { file_path: path } })) { omissions.push('PROTECTED_EVIDENCE'); continue; }
-    try {
-      const target = await fs.resolve(path, { signal });
-      const canonical = fs.processPath(target);
-      if (!fs.contains(root, target) || hardRisk({ tool: 'read', args: { file_path: canonical } })) { omissions.push('EVIDENCE_OUTSIDE_WORKSPACE_OR_PROTECTED'); continue; }
-      const before = await fs.stat(target, signal);
-      if (!before) { snapshots.push({ path, canonical, absent: true }); continue; }
-      if (before.type !== 'file') { omissions.push('EVIDENCE_NOT_REGULAR_FILE'); continue; }
-      const remaining = Math.min(MAX_FILE_BYTES, MAX_BYTES - bytes);
-      const contentBytes = await fs.readBytes(target, signal, remaining);
-      if (!(contentBytes instanceof Uint8Array) || contentBytes.byteLength > remaining) throw new Error('EVIDENCE_PROVIDER_UNBOUNDED');
-      const after = await fs.stat(target, signal);
-      if (after?.type !== 'file' || before.version !== after.version) throw new Error('EVIDENCE_CHANGED');
-      const hash = digest(contentBytes);
-      snapshots.push({ path, canonical, version: after.version, hash });
-      let content;
-      try { content = new TextDecoder('utf-8', { fatal: true }).decode(contentBytes); }
-      catch { omissions.push('NON_TEXT_EVIDENCE_WITHHELD'); continue; }
-      // UTF-16/NUL and other binary/control encodings must not bypass secret
-      // screening or make the model review a different source representation.
-      if (/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(content)) { omissions.push('NON_TEXT_EVIDENCE_WITHHELD'); continue; }
-      if (containsSecret(content) || redactCredentialText(content, canonical).redacted) { omissions.push('SENSITIVE_EVIDENCE_WITHHELD'); continue; }
-      // JSON keys can use escape sequences: screen their decoded form too.
-      let manifest;
-      if (path.endsWith('package.json')) {
-        manifest = JSON.parse(content);
-        if (containsSecret(JSON.stringify(manifest))) { omissions.push('SENSITIVE_EVIDENCE_WITHHELD'); continue; }
-      }
-      bytes += Buffer.byteLength(content);
-      files.push({ path: relative(canonicalRoot, canonical), content, sha256: hash });
-      if (path.endsWith('package.json')) {
-        for (const [name, command] of Object.entries(manifest.scripts ?? {})) {
-          if (!scriptNames.has(name) || typeof command !== 'string') continue;
-          for (const hint of fileHints(command)) enqueue(hint, resolve(path, '..'));
-        }
-      }
-    } catch (error) {
-      signal.throwIfAborted();
-      if (['EVIDENCE_CHANGED', 'EVIDENCE_PROVIDER_UNBOUNDED'].includes(error.message)) throw error;
-      omissions.push(error.code === 'FS_TOO_LARGE' ? 'EVIDENCE_TOO_LARGE' : 'EVIDENCE_UNREADABLE');
-    }
-  }
-  const data = { files, omissions: [...new Set(omissions)], coverage: 'partial' };
-  return { data, async verify(signalForVerification = signal) {
-    const signal = signalForVerification;
-    signal.throwIfAborted();
-    // Re-resolve containment and reread digests, including previously absent
-    // manifests. Stat versions alone are not a content identity guarantee.
-    const nextRoot = await fs.resolve(rootPath, { signal });
-    const nextCwd = await fs.resolve(workdir, { signal });
-    if (fs.processPath(nextRoot) !== canonicalRoot || fs.processPath(nextCwd) !== canonicalCwd || !fs.contains(nextRoot, nextCwd)) return false;
-    for (const saved of snapshots) {
-      const target = await fs.resolve(saved.path, { signal });
-      if (fs.processPath(target) !== saved.canonical || !fs.contains(nextRoot, target)) return false;
-      const info = await fs.stat(target, signal);
-      if (saved.absent) { if (info) return false; continue; }
-      if (info?.type !== 'file' || info.version !== saved.version) return false;
-      if (digest(await fs.readBytes(target, signal, MAX_FILE_BYTES)) !== saved.hash) return false;
-    }
-    return true;
-  } };
-}

package/src/gate.js

@@ -1,81 +0,0 @@
-import { assessApproval } from './approval-review.js';
-import { review } from './reviewer.js';
-import { resolveReviewRoute, sameRoute } from './model-route.js';
-const REVIEW_FAILURES = new Set(['REVIEW_TIMEOUT', 'REVIEW_CANCELLED', 'REVIEW_BUDGET_EXHAUSTED',
-  'REVIEW_INPUT_TOO_LARGE', 'NATIVE_REVIEWER_UNAVAILABLE', 'CONVERSATION_MODEL_UNAVAILABLE',
-  'MISSING_OR_SENSITIVE_AUTHORITY', 'SENSITIVE_REVIEW_CONTEXT', 'SENSITIVE_ACTION', 'SENSITIVE_REVIEWER_PROMPT']);
-const failureCode = error => REVIEW_FAILURES.has(error?.message) ? error.message
-  : /^(?:INVALID_|MISSING_COMPLETION|UNEXPECTED_|INCONSISTENT_|DUPLICATE_|REVIEW_RESPONSE_TOO_LARGE)/.test(error?.message ?? '')
-    ? 'INVALID_REVIEW_RESPONSE' : 'REVIEW_UNAVAILABLE';
-
-/** Per-instance, per-session budgets. Model changes never reset the ledger. */
-export function createGate(config, { audit = () => {}, getLlm = () => undefined } = {}) {
-  const sessions = new WeakMap();
-  const abort = new AbortController();
-  function state(session, task) {
-    let s = sessions.get(session);
-    if (!s) {
-      s = { task, reviews: 0, consecutive: 0, reportedTokens: 0 };
-      sessions.set(session, s);
-    }
-    // A new direct user message resets the per-task budget and the denial streak.
-    if (s.task !== task) {
-      s.task = task; s.reviews = 0; s.consecutive = 0;
-    }
-    return s;
-  }
-  return {
-    dispose() { abort.abort(); },
-    humanAllowed(call) {
-      const s = sessions.get(call.session);
-      if (s?.task === call.task) s.consecutive = 0;
-    },
-    async decide(call, currentConfig = config) {
-      // One ledger survives reviewer preference changes; settings edits do not refill budgets.
-      const config = currentConfig;
-      const start = Date.now();
-      let result = assessApproval(call, config);
-      let s;
-      if (result.kind === 'review') {
-        if (!call.session || call.subagent) result = { kind: 'ask', code: 'NO_DIRECT_USER_AUTHORITY' };
-        else {
-          s = state(call.session, call.task);
-          if (s.consecutive >= config.consecutiveDenials) {
-            result = { kind: 'ask', code: 'CIRCUIT_OPEN' };
-          } else {
-            const oldTask = s.task;
-            try {
-              const signal = AbortSignal.any([call.signal, abort.signal]);
-              const route = resolveReviewRoute(config, call);
-              const llm = getLlm();
-              const verdict = await review(config, result.action, call.intent, s, signal, { route, llm,
-                authorizationContext: call.authorizationContext, executionEvidence: call.executionEvidence });
-              const details = { risk: verdict.risk, authorization: verdict.authorization, bounded: verdict.bounded, reason: verdict.reason };
-              if (signal.aborted || s.task !== oldTask) result = { kind: 'deny', code: 'STALE_REVIEW' };
-              else if (verdict.decision === 'deny') result = { kind: 'deny', code: 'MODEL_NOT_ALLOWED', ...details };
-              else if (!sameRoute(route, resolveReviewRoute(config, call)) || llm !== getLlm()) {
-                result = { kind: 'ask', code: 'REVIEW_MODEL_CHANGED' };
-              } else result = { kind: verdict.decision, code: verdict.decision === 'allow' ? 'MODEL_ALLOWED' : 'REVIEW_NEEDS_CONFIRMATION', ...details,
-                ...(verdict.decision === 'allow' ? { reviewRoute: route, reviewLlm: llm } : {}),
-              };
-            } catch (error) { result = { kind: 'ask', code: failureCode(error) }; }
-            // Missing evidence or a transport failure is not a semantic denial.
-            // Reservations remain charged, so repeated uncertainty is bounded.
-            if (result.kind === 'deny') s.consecutive++;
-            else s.consecutive = 0;
-          }
-        }
-      }
-      if (call.signal.aborted || abort.signal.aborted) result = { kind: 'cancel', code: 'CANCELLED' };
-      // Audit failures cannot accidentally grant permission. Do not include arguments, intent or errors.
-      try { audit({ phase: 'assessment', tool: call.tool, callId: call.callId, decision: result.kind, code: result.code,
-        durationMs: Date.now() - start,
-        // Rationale is kept in the result, not logs: a model can echo raw commands or secrets.
-        ...(result.risk ? { risk: result.risk, authorization: result.authorization, bounded: result.bounded,
-          reason: '[reviewer rationale withheld from audit]' } : {}),
-        ...(s ? { reviews: s.reviews, reportedTokens: s.reportedTokens } : {}),
-      }); } catch { result = { kind: 'deny', code: 'AUDIT_UNAVAILABLE' }; }
-      return result;
-    },
-  };
-}

package/src/host-runtime.js

@@ -1,159 +0,0 @@
-import { lstatSync, realpathSync } from 'node:fs';
-import { isAbsolute, normalize } from 'node:path';
-
-const DEPENDENCIES_TOOL = 'load_workspace_dependencies';
-const MAX_PATH = 4096;
-const MAX_COMMAND = 32768;
-const attestations = new WeakMap();
-const record = value => value !== null && typeof value === 'object' && !Array.isArray(value);
-const pathKey = value => process.platform === 'win32' ? normalize(value).toLowerCase() : normalize(value);
-const absolutePath = value => typeof value === 'string' && value.length > 0 && value.length <= MAX_PATH &&
-  !/[\x00-\x1f]/.test(value) && isAbsolute(value) && !value.startsWith('\\\\') && !value.startsWith('//') &&
-  !value.split(/[\\/]/).includes('..');
-
-/** Local host paths only. A symlink/junction alias is not an attested entry.
- * This checks file identity, not executable safety, and grants no permission.
- * No directory traversal or executable hashing is performed.
- */
-export function snapshotHostRuntimeFile(path) {
-  if (!absolutePath(path)) return undefined;
-  try {
-    const canonical = realpathSync.native(path);
-    const stat = lstatSync(path, { bigint: true });
-    if (!stat.isFile() || stat.isSymbolicLink() || pathKey(canonical) !== pathKey(path)) return undefined;
-    return Object.freeze({ path, identity: [canonical, stat.dev, stat.ino, stat.size, stat.mtimeNs, stat.ctimeNs, stat.mode].join(':') });
-  } catch { return undefined; }
-}
-
-function dependencyPair(value) {
-  if (!record(value) || Object.keys(value).some(key => !['python', 'node', 'pnpm', 'pythonPackages', 'nodePackages', 'pythonDistributions'].includes(key))) return undefined;
-  if (![value.python, value.pythonPackages, value.node, value.pnpm].every(absolutePath) ||
-      value.nodePackages !== undefined && !absolutePath(value.nodePackages) || !record(value.pythonDistributions)) return undefined;
-  if (pathKey(value.node) === pathKey(value.pnpm)) return undefined;
-  return { node: value.node, pnpm: value.pnpm };
-}
-
-/** Observe the native tools pipeline, never transcript/content text or replay.
- * begin is called from tools/pre-execute; observe from tools/result; get from
- * the shell guard. tools.get(global) and tools.get(agent) must be the SAME
- * pinned definition throughout. Scope shadows and registration changes fail
- * closed. Host plugins themselves remain part of the trusted host boundary.
- */
-export function createHostRuntimeRegistry(tools, { snapshot = snapshotHostRuntimeFile } = {}) {
-  let owner = tools?.get?.(DEPENDENCIES_TOOL);
-  let disposed = false;
-  const pending = new Map(), sessions = new WeakMap();
-  const definitionMatches = agent => !disposed && !!owner && tools?.get?.(DEPENDENCIES_TOOL) === owner &&
-    tools?.get?.(DEPENDENCIES_TOOL, agent) === owner;
-  const forgetPending = token => {
-    const item = pending.get(token);
-    if (item) { pending.delete(token); item.signal?.removeEventListener('abort', item.abort); }
-    return item;
-  };
-  const valid = (agent, entry) => {
-    if (sessions.get(agent) !== entry || !definitionMatches(agent)) return false;
-    try {
-      return entry.files.every(file => snapshot(file.path)?.identity === file.identity);
-    } catch { return false; }
-  };
-  return {
-    begin(exec) {
-      if (disposed) return;
-      if (exec?.name !== DEPENDENCIES_TOOL || !record(exec.agent) || typeof exec.token !== 'symbol' || exec.signal?.aborted) return;
-      forgetPending(exec.token);
-      owner ??= tools?.get?.(DEPENDENCIES_TOOL);
-      if (!definitionMatches(exec.agent) || !record(exec.arguments) || Object.keys(exec.arguments).length) return;
-      // Bound interrupted-call retention without relying on a lifecycle event.
-      if (pending.size >= 64) forgetPending(pending.keys().next().value);
-      const item = { agent: exec.agent, signal: exec.signal, abort: () => forgetPending(exec.token) };
-      pending.set(exec.token, item);
-      exec.signal?.addEventListener('abort', item.abort, { once: true });
-    },
-    observe(exec, result) {
-      if (disposed) return;
-      if (exec?.name !== DEPENDENCIES_TOOL || !record(exec.agent)) return;
-      const started = forgetPending(exec.token);
-      sessions.delete(exec.agent);
-      if (!started || started.agent !== exec.agent || exec.signal?.aborted || result?.isError !== false || !definitionMatches(exec.agent)) return;
-      const pair = dependencyPair(result.value);
-      if (!pair) return;
-      let files;
-      try { files = [snapshot(pair.node), snapshot(pair.pnpm)]; } catch { return; }
-      if (files.some(file => !file || typeof file.identity !== 'string')) return;
-      const runtime = Object.freeze({ ...pair, identity: Object.freeze(files.map(file => file.identity)) });
-      const entry = { runtime, files };
-      sessions.set(exec.agent, entry);
-      attestations.set(runtime, () => valid(exec.agent, entry));
-    },
-    get(exec) {
-      if (disposed) return undefined;
-      if (!record(exec?.agent) || exec.signal?.aborted) return undefined;
-      const entry = sessions.get(exec.agent);
-      if (!entry) return undefined;
-      if (!valid(exec.agent, entry)) { sessions.delete(exec.agent); return undefined; }
-      return entry.runtime;
-    },
-    dispose() {
-      disposed = true;
-      owner = undefined;
-      for (const token of pending.keys()) forgetPending(token);
-    },
-  };
-}
-
-/** A deliberately small single-invocation grammar, not a general shell parser.
- * No interpolation, escapes, concatenated quotes, wrappers, redirections,
- * pipelines, assignments or additional commands can earn an exemption.
- * Single-quoted content is literal in both shells. For PowerShell, doubled
- * quotes are deliberately unsupported; unsupported syntax keeps full policy.
- */
-function literalInvocation(command, tool) {
-  if (typeof command !== 'string' || !command.length || command.length > MAX_COMMAND || /[\x00-\x1f]/.test(command)) return undefined;
-  const powershell = tool === 'pwsh';
-  if (!powershell && tool !== 'bash') return undefined;
-  let cursor = 0;
-  const spaces = () => { while (command[cursor] === ' ') cursor++; };
-  spaces();
-  let callOperator = false;
-  if (powershell && command[cursor] === '&') { callOperator = true; cursor++; spaces(); }
-  const tokens = [];
-  while (cursor < command.length) {
-    const start = cursor, quote = command[cursor];
-    let value;
-    if (quote === "'" || quote === '"') {
-      cursor++;
-      const from = cursor;
-      while (cursor < command.length && command[cursor] !== quote) cursor++;
-      if (cursor === command.length) return undefined;
-      value = command.slice(from, cursor++);
-      if (quote === '"' && (powershell ? /[$`]/ : /[$`\\]/).test(value)) return undefined;
-      if (powershell && tokens.length === 0 && !callOperator) return undefined;
-      if (cursor < command.length && command[cursor] !== ' ') return undefined;
-    } else {
-      while (cursor < command.length && command[cursor] !== ' ') cursor++;
-      value = command.slice(start, cursor);
-      if (!(powershell ? /^[A-Za-z0-9_.\/:\\=-]+$/ : /^[A-Za-z0-9_.\/:=-]+$/).test(value)) return undefined;
-    }
-    tokens.push({ start, end: cursor, value });
-    spaces();
-  }
-  return tokens.length >= 2 ? tokens : undefined;
-}
-
-/** Return a screening-only projection. NEVER execute it or send it for review.
- * Only the attested Node argv[0] + pnpm argv[1] pair is removed; every data
- * argument remains verbatim. This does not classify pnpm or its scripts safe.
- */
-export function commandForPolicy(call) {
-  const command = call?.args?.command;
-  const runtime = call?.trustedRuntime;
-  const validate = runtime && attestations.get(runtime);
-  if (!validate || !validate()) return command;
-  const tokens = literalInvocation(command, call.tool);
-  if (!tokens || tokens[0].value !== runtime.node || tokens[1].value !== runtime.pnpm) return command;
-  // The validated PowerShell call operator is omitted from this projection:
-  // the policy's refusal decoder parses POSIX commands and otherwise misses
-  // quoted sensitive operands after a leading '&'. The real call is intact.
-  return '__DSH_HOST_NODE__' +
-    command.slice(tokens[0].end, tokens[1].start) + '__DSH_HOST_PNPM__' + command.slice(tokens[1].end);
-}

package/src/human-approval.js

@@ -1,64 +0,0 @@
-import { randomUUID } from 'node:crypto';
-
-/** Runtime-local single-use requests. Only the authenticated UI route answers
- * them; no automatic approval waterfall or model tool is consulted. The client
- * and other same-process plugins remain trusted, not a physical-human proof.
- */
-export function createHumanApprovals({ now = () => performance.now(), wallNow = Date.now } = {}) {
-  const pending = new Map();
-  let closed = false;
-  function current(row) {
-    if (row.signal.aborted) return { kind: 'cancel', code: 'HUMAN_APPROVAL_CANCELLED' };
-    if (now() >= row.deadline) return { kind: 'deny', code: 'HUMAN_APPROVAL_EXPIRED' };
-    try { if (!row.valid()) return { kind: 'deny', code: 'GRANT_INVALIDATED' }; }
-    catch { return { kind: 'deny', code: 'GRANT_INVALIDATED' }; }
-    return undefined;
-  }
-  function settle(row, decision) {
-    if (pending.get(row.id) !== row) return false;
-    pending.delete(row.id);
-    clearInterval(row.timer);
-    row.signal.removeEventListener('abort', row.onAbort);
-    row.resolve(decision);
-    return true;
-  }
-  return {
-    request({ session, action, review, signal, timeoutMs, valid }) {
-      if (closed || pending.size >= 32) return Promise.resolve({ kind: 'deny', code: 'HUMAN_APPROVAL_UNAVAILABLE' });
-      return new Promise(resolve => {
-        const id = randomUUID(), deadline = now() + timeoutMs;
-        const row = { id, session, signal, valid, resolve, deadline,
-          view: { id, action: structuredClone(action), review: structuredClone(review), expiresAt: wallNow() + timeoutMs } };
-        row.onAbort = () => settle(row, { kind: 'cancel', code: 'HUMAN_APPROVAL_CANCELLED' });
-        pending.set(id, row);
-        row.timer = setInterval(() => { const invalid = current(row); if (invalid) settle(row, invalid); }, Math.min(250, timeoutMs));
-        signal.addEventListener('abort', row.onAbort, { once: true });
-        const invalid = current(row); if (invalid) settle(row, invalid);
-      });
-    },
-    list(session) {
-      const requests = [];
-      for (const row of pending.values()) {
-        const invalid = current(row);
-        if (invalid) { settle(row, invalid); continue; }
-        if (row.session === session) requests.push({ ...structuredClone(row.view), remainingMs: Math.max(0, row.deadline - now()) });
-      }
-      return { requests };
-    },
-    answer(session, id, outcome) {
-      if (typeof id !== 'string' || !['allow', 'deny'].includes(outcome)) throw new Error('Invalid approval response');
-      const row = pending.get(id);
-      if (!row || row.session !== session) throw new Error('Approval expired or is no longer pending');
-      const invalid = current(row);
-      if (invalid) { settle(row, invalid); throw new Error('Approval expired or invalidated'); }
-      // Claim synchronously before any asynchronous verification. A second tab
-      // or response never grants this request a second time.
-      settle(row, { kind: outcome, code: outcome === 'allow' ? 'HUMAN_ALLOWED' : 'HUMAN_REJECTED', deadline: row.deadline });
-      return { accepted: true };
-    },
-    invalidate() { for (const row of pending.values()) { const invalid = current(row); if (invalid) settle(row, invalid); } },
-    cancelAll() { for (const row of pending.values()) settle(row, { kind: 'cancel', code: 'HUMAN_APPROVAL_CANCELLED' }); },
-    dispose() { closed = true; this.cancelAll(); },
-    beforeDeadline(decision) { return typeof decision.deadline === 'number' && now() < decision.deadline; },
-  };
-}

package/src/policy.js

@@ -1,58 +0,0 @@
-import { analyzeShell, isReadonly, isSafeStaticExposure, shellRefusals } from './shell-command.js';
-import { commandForPolicy } from './host-runtime.js';
-import { credentialSourcePath, isCredentialPath, isMutationProtectedPath } from './credential-paths.js';
-
-const SHELL_TOOLS = new Set(['shell', 'bash', 'pwsh']);
-const READ_TOOLS = new Set(['read', 'read_image', 'grep']);
-const DANGEROUS_PROGRAM = /^(?:sudo|su|doas|rm|rmdir|del|erase|mkfs(?:\..*)?|shutdown|reboot|curl|wget|nc|ncat|ssh|scp|sftp|powershell|pwsh|bash|sh|eval|exec|env|xargs)$/i;
-const SECRET = /\b(?:sk-|ghp_|github_pat_|xox[baprs]-)[A-Za-z0-9_-]{8,}|\bBearer\s+\S+|(?:password|api[_-]?key|token|secret)["']?\s*[:=]\s*\S+/i;
-const verdict = (kind, code) => ({ kind, code });
-export const containsSecret = text => SECRET.test(text);
-
-// These files mix normal settings with possible secrets. Native read can
-// sanitize values; raw shell content readers cannot. Directory metadata and
-// literal output remain usable, and package.json/generic JSON are not denied.
-const shellMixedConfigPath = path => /(?:^|\/)(?:\.env(?:\.[^/]*)?|\.npmrc|\.pypirc|\.gitconfig)$|(?:^|\/)\.(?:git|kube|aws)\/config$|(?:^|\/)\.docker\/config\.json$|(?:^|\/)\.(?:codex|dsh|claude|agents)\/(?:[^/]+\/)*(?:config|settings(?:\.local)?|cordis)\.(?:toml|ya?ml|jsonc?)$/.test(credentialSourcePath(path));
-const readAccess = call => READ_TOOLS.has(call?.tool) || call?.tool === 'str_replace_editor' && call?.args?.command === 'view';
-
-/** Narrow lexer, NOT a shell parser. Only used to recognize a bare dangerous program name. */
-export function simpleCommand(command) {
-  return typeof command === 'string' && command.length <= 4096 &&
-    /^[A-Za-z0-9_./:= -]+$/.test(command) && command === command.trim() &&
-    !command.includes('  ') && !command.split(' ').some(x => x === '..') &&
-    !command.split(' ')[0].includes('=') && !command.split(' ')[0].includes('/');
-}
-
-/** Hard refusals are evaluated before any review; a model verdict cannot soften these. */
-export function hardRisk(call) {
-  const args = call?.args ?? {};
-  for (const path of [args.file_path, args.path]) {
-    if (typeof path === 'string' && (isCredentialPath(path) || !readAccess(call) && isMutationProtectedPath(path))) {
-      return verdict('deny', 'PROTECTED_PATH');
-    }
-  }
-  if (SHELL_TOOLS.has(call?.tool) && typeof args.command === 'string') {
-    const screened = commandForPolicy(call);
-    if (containsSecret(args.command)) return verdict('deny', 'SENSITIVE_COMMAND');
-    const analysis = analyzeShell(screened), readonly = isReadonly(analysis);
-    const safeExposure = isSafeStaticExposure(analysis);
-    // Check decoded literal argv, assignment and redirect values, including
-    // quote concatenation. Refusal-only decoding also survives an unrelated
-    // dynamic fragment; it cannot establish safety or grant permission.
-    // Only attested runner entry positions differ; all data operands remain.
-    const refusals = shellRefusals(screened);
-    for (const value of [...screened.split(/\s+/), ...refusals.values]) {
-      const parts = [value, ...value.split(/[=:]/)];
-      if (containsSecret(value) || parts.some(isCredentialPath) ||
-          !readonly && parts.some(isMutationProtectedPath)) return verdict('deny', 'SENSITIVE_COMMAND');
-      if (readonly && !safeExposure && parts.some(shellMixedConfigPath)) return verdict('deny', 'USE_SAFE_READ');
-    }
-    // Known literal roots remain refusals even when their arguments are not
-    // statically provable. Unparseable commands keep the legacy bare check.
-    if (refusals.dangerousRoot !== undefined ||
-      simpleCommand(args.command) && DANGEROUS_PROGRAM.test(args.command.split(' ')[0])) {
-      return verdict('deny', 'DANGEROUS_PROGRAM');
-    }
-  }
-  return undefined;
-}

package/src/review-context.js

@@ -1,35 +0,0 @@
-import { isSubagentSession } from '@klarkxy/dsh-plugin-kit/contracts';
-import { containsSecret } from './policy.js';
-
-const MAX_AUTHORITY_BYTES = 12288;
-
-/** Keep direct-human messages in order, including later restrictions and revocations.
- * Never turn a summary, assistant claim or tool result into authority. No lossy
- * history selection: a missing constraint must not leave an older grant usable.
- */
-export function authority(session) {
-  if (isSubagentSession(session)) return {};
-  const events = session?.snapshotEvents?.();
-  if (!Array.isArray(events)) return {};
-  const messages = [];
-  let bytes = 0, task, intent, incomplete = false;
-  for (const [index, event] of events.entries()) {
-    // 约定禁例：source.kind === 'user' 不能当真人判据。此处安全依赖两道闸：
-    // 上方 isSubagentSession(session) 排除子线程，以及下游 assessApproval 再核授权。
-    // 宿主若改变事件来源语义，这道过滤会失效；若宿主把委派提示注入父会话为 user 事件，
-    // 此处授权面会扩大，评审模型 prompt 构建前必须复核。
-    if (event?.type !== 'user/message' || event.data?.source?.kind !== 'user') continue;
-    task = event.seq ?? index;
-    const blocks = event.data.content;
-    const valid = Array.isArray(blocks) && blocks.every(b => b?.type === 'text' && typeof b.text === 'string');
-    intent = valid ? blocks.map(b => b.text).join('\n') : undefined;
-    if (!valid || containsSecret(intent)) { incomplete = true; continue; }
-    bytes += Buffer.byteLength(intent);
-    if (bytes > MAX_AUTHORITY_BYTES) { incomplete = true; continue; }
-    messages.push({ seq: task, text: intent });
-  }
-  if (task === undefined) return {};
-  if (incomplete) return { task, authorityIncomplete: true };
-  return { task, intent,
-    ...(messages.length > 1 ? { authorizationContext: { directUserMessages: messages, complete: true } } : {}) };
-}

package/src/review-paths.js

@@ -1,53 +0,0 @@
-import path from 'node:path';
-
-const shellTools = new Set(['bash', 'pwsh']);
-const fileTools = new Set(['write', 'edit']);
-const pathText = value => typeof value === 'string' && Boolean(value.trim()) && !/[\x00-\x1f\x7f]/.test(value);
-
-/**
- * Resolve only the coordinates used for review, never execution arguments.
- * These are lexical absolute paths, NOT realpath/canonical filesystem identities.
- * Evidence collection must still use fs.resolve/processPath/contains before reads.
- *
- * Native tool-pwsh resolves relative workdir against header.cwd; tool-bash uses
- * sandboxPolicy.workspaceRoot first. File mutations pass that policy root as
- * fs.resolve's cwd. Keep these separate even when a normal session makes them equal.
- * processPathFromHostPath is an optional, synchronous host-world identity check;
- * it cannot establish locality when a provider translates or withholds a path.
- */
-export function resolveReviewPaths(call, fs, pathImpl = path) {
-  const unavailable = () => ({ localExecution: false });
-  try {
-    if (typeof fs?.processPathFromHostPath !== 'function') return unavailable();
-    const fullyAbsolute = value => pathText(value) && pathImpl.isAbsolute(value) &&
-      (pathImpl.sep !== '\\' || /^[A-Za-z]:[\\/]|^[\\/]{2}[^\\/]+[\\/][^\\/]+/.test(value));
-    const normalizeAbsolute = value => fullyAbsolute(value) ? pathImpl.normalize(value) : undefined;
-    const cwd = normalizeAbsolute(call?.cwd);
-    const root = normalizeAbsolute(call?.sandbox?.workspaceRoot ?? call?.cwd);
-    if (!cwd || !root) return unavailable();
-    const resolveFrom = (value, base) => {
-      if (!pathText(value)) return undefined;
-      if (pathImpl.isAbsolute(value)) return normalizeAbsolute(value);
-      // Windows drive-relative paths consult ambient per-drive cwd; do not infer it.
-      if (pathImpl.sep === '\\' && /^[A-Za-z]:/.test(value)) return undefined;
-      return pathImpl.resolve(base, value);
-    };
-    let result;
-    if (shellTools.has(call.tool)) {
-      const base = call.tool === 'pwsh' ? cwd : root;
-      const workdir = call.args?.workdir === undefined ? base : resolveFrom(call.args.workdir, base);
-      if (!workdir) return unavailable();
-      result = { workdir };
-    } else if (fileTools.has(call.tool)) {
-      const filePath = resolveFrom(call.args?.file_path, root);
-      if (!filePath) return unavailable();
-      result = { filePath };
-    } else return unavailable();
-    for (const value of [cwd, root, ...Object.values(result)]) {
-      if (fs.processPathFromHostPath(value) !== value) return unavailable();
-    }
-    return { localExecution: true, ...result };
-  } catch {
-    return unavailable();
-  }
-}