@try-works/dsh-righthand 0.1.2 → 0.1.3

package/README.md

@@ -6,6 +6,8 @@ tool guard. Every tool is built on the harness's own services
 (`storageDomain`, `credentials`, `settings`, `subprocess`, `jobs`, `tools`),
 not hand-rolled primitives.
 
+The plugin also ships **blueprint guidance** — ten named recipes for the agent-built tools this plugin exists to compose (see [Blueprints](#blueprints) below) — plus a packaged skill, a settings namespace, and an optional tool guard.
+
 ## Install
 
 ```bash
@@ -46,6 +48,13 @@ dsh --profile <profile> --patch ./cordis.patch.yml
 Guard modes: `allow` (pass through), `deny` (block with an error), `ask`
 (defer to the policy function). Omitted rules leave the guard inert.
 
+Rules may also declare `destructive: true` — a documentation flag for
+irreversible effects (deploy, delete, DNS change). It does not change
+enforcement; it records *why* the prefix is gated, and
+`tests/permissions.golden` records every `rh_*` tool's derived guard facts so
+guard changes are never silent (run `UPDATE_GOLDEN=1 pnpm test` to
+re-baseline deliberately).
+
 ## Settings
 
 Namespace "righthand" (registered by the secrets family):
@@ -59,6 +68,73 @@ Namespace "righthand" (registered by the secrets family):
 `rh_settings_get` returns the resolved values; `rh_settings_set` merges a
 partial patch (persisted by the harness settings provider).
 
+## Blueprints
+
+Blueprint guidance lives under `experiments/<blueprint>/` — each a
+`blueprint.json` spec plus a runnable template kit (`run.ts` + `test.ts`,
+`LEARNINGS.md`, and for the cloud-tested ones a `cloud/` Worker). They
+describe the tools this plugin composes; the daily-digest kit is the
+canonical example of the current DSH-native form (tool-to-tool via
+`ctx.tools.execute`, synthesis via `ctx.llm`, deliverables via `ctx.fs`).
+
+| Blueprint | What it builds |
+|---|---|
+| `blueprint/daily-digest` | Collect sources, summarize, send on a schedule — extractive locally, LLM synthesis as escalation |
+| `blueprint/research-radar` | Multi-source research over a rolling window (Reddit, X, YouTube, HN, Polymarket, web): score, dedupe, synthesize with citations |
+| `blueprint/web-scraper` | Fetch a page, extract title/headings/links/text, make it searchable — static HTML first, render/vision as escalation |
+| `blueprint/vision-worker` | Cloudflare Worker exposing kimi-k2.6 vision: route image requests for text-only models, return a versioned `VisionEnvelope` |
+| `blueprint/vision-qa-assistant` | Answer questions about images for a text-only model — hash-cache locally, Workers AI vision as the semantic path |
+| `blueprint/inbound-webhook-pipeline` | Receive → validate → run job → store → notify, with idempotency-key dedupe as the load-bearing invariant |
+| `blueprint/event-sourced-store` | Tool store where every mutation is an event: govern, checksum, append offset-addressable events, catch up by version |
+| `blueprint/governed-registry` | Register a tool format; every write runs the governed flow: validate → normalize → checksum → index → summarize |
+| `blueprint/mcp-tool-surface` | Deterministic + AI-backed tools behind a stateless MCP surface with normalized LLM output |
+| `blueprint/session-watcher` | Poll DSH sessions, evaluate a condition (new publish / builder idle / cadence), message a target session |
+
+Analyses of the [micro.mu](https://github.com/micro/mu) project this plugin
+learns from: [`docs/agent-tool-catalog.md`](docs/agent-tool-catalog.md) (tool
+families worth adding, from the tools catalogue + permission commit) and
+[`docs/mu-repo-analysis.md`](docs/mu-repo-analysis.md) (architecture lessons
+from the whole repo — single-source specs, golden permissions, layering,
+held-state gates, SSRF guarding).
+
+## Packaged skill
+
+The plugin ships the `dsh-righthand` skill
+(`skills/dsh-righthand/SKILL.md`, the dsh-plugin packaged-skill standard):
+tool-reference tables, store/credential/settings semantics, guard modes, and
+service availability. It registers via `ctx.skills` on mount, so the agent's
+skill catalog lists it automatically.
+
+## Use cases
+
+Everything below runs through the harness's own services; nothing is
+hand-rolled.
+
+**Durable agent memory / task board.** Store task cards under `task:<slug>`
+and let `rh_store_list` enumerate them across restarts and context
+compaction — no project files touched. Complete by overwriting, clean up
+with `rh_store_delete`.
+
+**Pre-deploy gate.** Before any deploy: `rh_credential_describe` asserts the
+API token exists, `rh_settings_get` asserts the account/zone, `rh_run` runs
+tests + build, `rh_store_put` records a deploy receipt, and a guard rule
+gates the actual deploy tool behind `mode: 'ask'`.
+
+**Secret onboarding.** `rh_credential_set` stores a key through the
+credential provider (the value is never echoed back); `rh_credential_describe`
+reports configured state + source; rotation is unset-then-set.
+
+**Daily digests.** The agent fetches sources and stores them under
+`digest:<date>` (see `blueprint/daily-digest`), diffing days with
+`rh_store_get` and rendering MDX deliverables through `ctx.fs`.
+
+**CI-lite.** `rh_run_bg` starts a long build as an owner-scoped background
+job; its id + status live in the store so a later turn can poll and collect.
+
+**Governed exec.** Any high-impact command can be fronted by a guard rule
+(`deny` to block a prefix, `ask` to require a policy function's approval),
+so the agent cannot deploy or destroy without the gate.
+
 ## Service availability
 
 The store family needs `ctx.storageDomain`, which the web profile provides

package/lib/guard-tools.d.ts

@@ -3,6 +3,14 @@
  * Demonstrates the §4.4 allow/deny/ask gate the righthand plugin uses to
  * gate high-impact deploy/invoke tools. Built on ctx.on('tools/pre-execute'),
  * not a hand-rolled wrapper.
+ *
+ * Rules are prefix-based. A rule may also declare `destructive: true` — a
+ * pure documentation flag saying the gated tools have irreversible effects
+ * (deploy, delete, DNS change): the kind of surface a tool *description*
+ * (attacker-controlled text) could talk the agent into. The flag does not
+ * change enforcement — `mode` does — it records WHY the prefix is guarded,
+ * and `tests/permissions.golden` records it so guard changes are never
+ * silent.
  * @module dsh-righthand/guard-tools
  */
 import type { Context } from '@deepseek-ai/cordis';
@@ -13,9 +21,30 @@ export interface GuardRule {
     toolPrefix: string;
     /** 'allow' passes through; 'deny' blocks; 'ask' defers to a policy function. */
     mode: 'allow' | 'deny' | 'ask';
+    /**
+     * Documentation flag: the gated tools have irreversible effects nobody
+     * asked for (a deploy, a delete, a DNS change). Declarative only —
+     * enforcement is the rule's `mode`. Default false.
+     */
+    destructive?: boolean;
     /** Only consulted when mode is 'ask'. Return true to allow. */
     ask?: (args: unknown) => boolean;
 }
+/**
+ * The guard facts a tool name resolves to: the mode the first matching rule
+ * enforces (or 'none' when no rule matches) and whether that rule marks the
+ * prefix destructive. This is the SINGLE lookup both the enforcement hook
+ * and the permissions golden use, so the recorded facts cannot drift from
+ * what the gate actually does.
+ */
+export interface GuardFacts {
+    mode: 'allow' | 'deny' | 'ask' | 'none';
+    destructive: boolean;
+    /** The matched rule, when one matched — the enforcement hook's ask path needs it. */
+    rule: GuardRule | undefined;
+}
+/** Resolve one tool name to its guard facts. Rules match in order, first wins. */
+export declare function guardFactsFor(toolName: string, rules: readonly GuardRule[]): GuardFacts;
 /** Apply a guard over a set of tool-name prefixes. */
 export declare function apply(ctx: Context, config?: {
     rules?: GuardRule[];

package/lib/guard-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-tools.d.ts","sourceRoot":"","sources":["../src/guard-tools.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,eAAO,MAAM,IAAI,oBAAoB,CAAA;AACrC,eAAO,MAAM,MAAM,UAAY,CAAA;AAE/B,MAAM,WAAW,SAAS;IACxB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;IAC9B,+DAA+D;IAC/D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAA;CACjC;AAED,sDAAsD;AACtD,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,EAAE,CAAA;CAAO,GAAG,IAAI,CAgB9E"}
+{"version":3,"file":"guard-tools.d.ts","sourceRoot":"","sources":["../src/guard-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,eAAO,MAAM,IAAI,oBAAoB,CAAA;AACrC,eAAO,MAAM,MAAM,UAAY,CAAA;AAE/B,MAAM,WAAW,SAAS;IACxB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAA;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAA;IACvC,WAAW,EAAE,OAAO,CAAA;IACpB,qFAAqF;IACrF,IAAI,EAAE,SAAS,GAAG,SAAS,CAAA;CAC5B;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,UAAU,CAIvF;AAED,sDAAsD;AACtD,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,EAAE,CAAA;CAAO,GAAG,IAAI,CAa9E"}

package/lib/guard-tools.js

@@ -3,26 +3,38 @@
  * Demonstrates the §4.4 allow/deny/ask gate the righthand plugin uses to
  * gate high-impact deploy/invoke tools. Built on ctx.on('tools/pre-execute'),
  * not a hand-rolled wrapper.
+ *
+ * Rules are prefix-based. A rule may also declare `destructive: true` — a
+ * pure documentation flag saying the gated tools have irreversible effects
+ * (deploy, delete, DNS change): the kind of surface a tool *description*
+ * (attacker-controlled text) could talk the agent into. The flag does not
+ * change enforcement — `mode` does — it records WHY the prefix is guarded,
+ * and `tests/permissions.golden` records it so guard changes are never
+ * silent.
  * @module dsh-righthand/guard-tools
  */
 export const name = 'righthand-guard';
 export const inject = ['tools'];
+/** Resolve one tool name to its guard facts. Rules match in order, first wins. */
+export function guardFactsFor(toolName, rules) {
+    const rule = rules.find(r => toolName.startsWith(r.toolPrefix));
+    if (rule === undefined)
+        return { mode: 'none', destructive: false, rule: undefined };
+    return { mode: rule.mode, destructive: rule.destructive === true, rule };
+}
 /** Apply a guard over a set of tool-name prefixes. */
 export function apply(ctx, config = {}) {
     const rules = config.rules ?? [];
     ctx.on('tools/pre-execute', (exec, next) => {
-        const rule = rules.find(r => exec.name.startsWith(r.toolPrefix));
-        if (rule === undefined)
+        const facts = guardFactsFor(exec.name, rules);
+        if (facts.mode === 'none' || facts.mode === 'allow')
             return next();
-        if (rule.mode === 'deny') {
+        if (facts.mode === 'deny') {
             throw new Error(`tool ${exec.name} is denied by righthand guard`);
         }
-        if (rule.mode === 'ask') {
-            const allowed = rule.ask?.(exec.arguments) ?? false;
-            if (!allowed)
-                throw new Error(`tool ${exec.name} requires approval (ask returned false)`);
-            return next();
-        }
+        const allowed = facts.rule?.ask?.(exec.arguments) ?? false;
+        if (!allowed)
+            throw new Error(`tool ${exec.name} requires approval (ask returned false)`);
         return next();
     }, { prepend: true });
 }

package/lib/guard-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-tools.js","sourceRoot":"","sources":["../src/guard-tools.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,IAAI,GAAG,iBAAiB,CAAA;AACrC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;AAW/B,sDAAsD;AACtD,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAAkC,EAAE;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAA;IAEhC,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;QAChE,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,+BAA+B,CAAC,CAAA;QACnE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAA;YACnD,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,yCAAyC,CAAC,CAAA;YACzF,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;AACvB,CAAC"}
+{"version":3,"file":"guard-tools.js","sourceRoot":"","sources":["../src/guard-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,CAAC,MAAM,IAAI,GAAG,iBAAiB,CAAA;AACrC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;AA+B/B,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,KAA2B;IACzE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;IAC/D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACpF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,IAAI,EAAE,CAAA;AAC1E,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAAkC,EAAE;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAA;IAEhC,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,EAAE,CAAA;QAClE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,+BAA+B,CAAC,CAAA;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAA;QAC1D,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,yCAAyC,CAAC,CAAA;QACzF,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;AACvB,CAAC"}

package/lib/index.d.ts

@@ -45,4 +45,6 @@ export declare function apply(ctx: Context, config?: RighthandConfig): void;
 export { storeTools, secretsTools, execTools, guardTools, righthandSkills };
 export { SKILL_NAME, SKILL_DESCRIPTION, skillDirectory, skillBody } from './skills.ts';
 export type { GuardRule } from './guard-tools.ts';
+export { guardFactsFor } from './guard-tools.ts';
+export type { GuardFacts } from './guard-tools.ts';
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,eAAe,MAAM,aAAa,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEjD,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,iFAAiF;AACjF,eAAO,MAAM,MAAM,EAAE,MAAM,EAAO,CAAA;AAElC,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,KAAK,CAAC,EAAE,SAAS,EAAE,CAAA;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,GAAG,IAAI,CAMtE;AAGD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,CAAA;AAC3E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACtF,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,eAAe,MAAM,aAAa,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEjD,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,iFAAiF;AACjF,eAAO,MAAM,MAAM,EAAE,MAAM,EAAO,CAAA;AAElC,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,KAAK,CAAC,EAAE,SAAS,EAAE,CAAA;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,GAAG,IAAI,CAMtE;AAGD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,CAAA;AAC3E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACtF,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA"}

package/lib/index.js

@@ -44,4 +44,5 @@ export function apply(ctx, config = {}) {
 // Individual modules stay importable for selective mounting.
 export { storeTools, secretsTools, execTools, guardTools, righthandSkills };
 export { SKILL_NAME, SKILL_DESCRIPTION, skillDirectory, skillBody } from "./skills.js";
+export { guardFactsFor } from "./guard-tools.js";
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,eAAe,MAAM,aAAa,CAAA;AAG9C,MAAM,CAAC,MAAM,IAAI,GAAG,eAAe,CAAA;AAEnC,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAa,EAAE,CAAA;AAQlC;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAA0B,EAAE;IAC9D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACtB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrB,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAA;IACrD,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;AAC7B,CAAC;AAED,6DAA6D;AAC7D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,CAAA;AAC3E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,eAAe,MAAM,aAAa,CAAA;AAG9C,MAAM,CAAC,MAAM,IAAI,GAAG,eAAe,CAAA;AAEnC,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAa,EAAE,CAAA;AAQlC;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAA0B,EAAE;IAC9D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACtB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrB,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAA;IACrD,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;AAC7B,CAAC;AAED,6DAA6D;AAC7D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,CAAA;AAC3E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@try-works/dsh-righthand",
   "description": "DeepSeek Harness plugin: DSH-native righthand tools — durable KV store, credential/settings management, governed exec, and a tool guard",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/skills/dsh-righthand/SKILL.md

@@ -39,7 +39,9 @@ The righthand toolkit: DSH-native tools over the harness's own services. Use thi
 
 ## Guard policy
 
-Rules come from the plugin config (`rules: [{ toolPrefix, mode, ask? }]`). `deny` throws before dispatch; `ask` defers to the policy function (return true to allow); `allow` passes through. Tools matching no rule are unaffected.
+Rules come from the plugin config (`rules: [{ toolPrefix, mode, ask?, destructive? }]`). `deny` throws before dispatch; `ask` defers to the policy function (return true to allow); `allow` passes through. Tools matching no rule are unaffected. Prefixes match by prefix — `rh_run` also covers `rh_run_bg`.
+
+`destructive: true` is a documentation flag for irreversible effects (deploy, delete, DNS change); it never changes enforcement, only records why a prefix is gated. `tests/permissions.golden` records every tool's derived guard facts; a guard change that moves a fact fails the test until re-baselined (`UPDATE_GOLDEN=1 pnpm test`).
 
 ## Service availability
 

package/src/guard-tools.ts

@@ -3,6 +3,14 @@
  * Demonstrates the §4.4 allow/deny/ask gate the righthand plugin uses to
  * gate high-impact deploy/invoke tools. Built on ctx.on('tools/pre-execute'),
  * not a hand-rolled wrapper.
+ *
+ * Rules are prefix-based. A rule may also declare `destructive: true` — a
+ * pure documentation flag saying the gated tools have irreversible effects
+ * (deploy, delete, DNS change): the kind of surface a tool *description*
+ * (attacker-controlled text) could talk the agent into. The flag does not
+ * change enforcement — `mode` does — it records WHY the prefix is guarded,
+ * and `tests/permissions.golden` records it so guard changes are never
+ * silent.
  * @module dsh-righthand/guard-tools
  */
 
@@ -16,25 +24,49 @@ export interface GuardRule {
   toolPrefix: string
   /** 'allow' passes through; 'deny' blocks; 'ask' defers to a policy function. */
   mode: 'allow' | 'deny' | 'ask'
+  /**
+   * Documentation flag: the gated tools have irreversible effects nobody
+   * asked for (a deploy, a delete, a DNS change). Declarative only —
+   * enforcement is the rule's `mode`. Default false.
+   */
+  destructive?: boolean
   /** Only consulted when mode is 'ask'. Return true to allow. */
   ask?: (args: unknown) => boolean
 }
 
+/**
+ * The guard facts a tool name resolves to: the mode the first matching rule
+ * enforces (or 'none' when no rule matches) and whether that rule marks the
+ * prefix destructive. This is the SINGLE lookup both the enforcement hook
+ * and the permissions golden use, so the recorded facts cannot drift from
+ * what the gate actually does.
+ */
+export interface GuardFacts {
+  mode: 'allow' | 'deny' | 'ask' | 'none'
+  destructive: boolean
+  /** The matched rule, when one matched — the enforcement hook's ask path needs it. */
+  rule: GuardRule | undefined
+}
+
+/** Resolve one tool name to its guard facts. Rules match in order, first wins. */
+export function guardFactsFor(toolName: string, rules: readonly GuardRule[]): GuardFacts {
+  const rule = rules.find(r => toolName.startsWith(r.toolPrefix))
+  if (rule === undefined) return { mode: 'none', destructive: false, rule: undefined }
+  return { mode: rule.mode, destructive: rule.destructive === true, rule }
+}
+
 /** Apply a guard over a set of tool-name prefixes. */
 export function apply(ctx: Context, config: { rules?: GuardRule[] } = {}): void {
   const rules = config.rules ?? []
 
   ctx.on('tools/pre-execute', (exec, next) => {
-    const rule = rules.find(r => exec.name.startsWith(r.toolPrefix))
-    if (rule === undefined) return next()
-    if (rule.mode === 'deny') {
+    const facts = guardFactsFor(exec.name, rules)
+    if (facts.mode === 'none' || facts.mode === 'allow') return next()
+    if (facts.mode === 'deny') {
       throw new Error(`tool ${exec.name} is denied by righthand guard`)
     }
-    if (rule.mode === 'ask') {
-      const allowed = rule.ask?.(exec.arguments) ?? false
-      if (!allowed) throw new Error(`tool ${exec.name} requires approval (ask returned false)`)
-      return next()
-    }
+    const allowed = facts.rule?.ask?.(exec.arguments) ?? false
+    if (!allowed) throw new Error(`tool ${exec.name} requires approval (ask returned false)`)
     return next()
   }, { prepend: true })
-}
+}

package/src/index.ts

@@ -58,4 +58,6 @@ export function apply(ctx: Context, config: RighthandConfig = {}): void {
 export { storeTools, secretsTools, execTools, guardTools, righthandSkills }
 export { SKILL_NAME, SKILL_DESCRIPTION, skillDirectory, skillBody } from './skills.ts'
 export type { GuardRule } from './guard-tools.ts'
+export { guardFactsFor } from './guard-tools.ts'
+export type { GuardFacts } from './guard-tools.ts'