dsh-cc-permissions 0.1.0 → 0.2.2

package/README.md

@@ -13,6 +13,32 @@ through the shared [dsh-cc-loader](../cc-loader) parse layer and folds the rules
 - Read deny rules also gate Edit/Write tools and Bash file commands
   (`cat`, `head`, `tail`, `sed`…)
 - `ask` rules route through DSH's approval service
+- **`allow` rules answer the approval seam automatically** (see below)
+
+## Allow = run without asking (approval seam)
+
+In Claude Code an `allow` rule is the **complete gate**: the command runs without
+any further question. DSH has a second layer below the permission fold — the
+file sandbox. When `workspace-write` denies a file effect and the model retries
+with `sandbox_permissions`, an `approval/request` is raised for the escalation;
+without a bridge, that request would still hit the human answerer even though
+the user already allowed the exact command.
+
+`dsh-cc-permissions` bridges this: an `approval/request` (permission ask *or*
+sandbox escalation) whose underlying tool call matches a CC `allow` rule is
+answered `allowed-once` automatically — one-shot, rule-scoped, and read from
+the **real tool arguments** in the session log (`tool/call` by `callId`, never
+the model-written reason), mirroring the pattern of
+[dsh-auto-approval-plugin](https://github.com/StyxNether/dsh-auto-approval-plugin).
+
+- `Bash(pytest:*)` → the exact `pytest …` command may run outside the sandbox
+  when escalated (CC semantics restored)
+- deny/ask rules and unmatched calls always defer to the human answerer; the
+  module only ever auto-grants, never auto-denies
+- `enableAllProjectMcpServers: true` also covers project MCP tools
+  (`mcp__<server>__<tool>`, not `mcp__plugin_…`)
+
+Disable with `autoApproveAllowed: false` in the plugin config.
 
 ## Read-only bridge
 
@@ -35,6 +61,7 @@ dsh plugin --profile <name> add dsh-cc-permissions
 | `enabled` | `true` | Master switch |
 | `hideDeniedTools` | `true` | Bare-name deny → per-agent `ctx.tools.restrict` |
 | `enableDefaultMode` | `true` | `defaultMode=dontAsk` → approval policy `never` |
+| `autoApproveAllowed` | `true` | `allow` rules auto-answer `approval/request` (incl. sandbox escalation) |
 | `homeDir` | `<home>` | Home dir for `~/.claude/settings.json` |
 | `projectRootMarkers` | `['.git']` | Project root discovery |
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-cc-permissions",
-  "version": "0.1.0",
-  "description": "Enforce Claude Code permission rules (.claude/settings.json allow/deny/ask, deny>ask>allow) in DSH via a tools/pre-execute gate. Reads CC settings as a read-only source; DSH-side approvals never write back to .claude.",
+  "version": "0.2.2",
+  "description": "Enforce Claude Code permission rules (.claude/settings.json allow/deny/ask, deny>ask>allow) in DSH via a tools/pre-execute gate; CC allow rules auto-answer the approval/request seam (incl. sandbox escalation). Reads CC settings as a read-only source; DSH-side approvals never write back to .claude.",
   "type": "module",
   "main": "src/index.js",
   "exports": {
@@ -26,18 +26,18 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "dsh-cc-loader": "^0.1.0"
+    "dsh-cc-loader": "^0.1.0",
+    "@deepseek-ai/schemastery": "^3.18.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.1"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "*",
-    "@deepseek-ai/schemastery": "*"
+    "@deepseek-ai/cordis": "*"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
       "optional": true
-    },
-    "@deepseek-ai/schemastery": {
-      "optional": true
     }
   },
   "engines": {

package/src/approval.js

@@ -0,0 +1,115 @@
+// cc-permissions — CC allow rules answer the DSH approval seam.
+//
+// Claude Code semantics: an `allow` rule (e.g. `Bash(pytest:*)`) is the
+// COMPLETE gate — the command runs without any further question. DSH has a
+// second layer below the permission fold: the file sandbox. A call that
+// passes pre-execute still runs under `workspace-write`, and when the sandbox
+// denies a file effect the model retries with `sandbox_permissions`, which
+// raises an `approval/request` (the escalation seam). Without this module,
+// that request hits the human answerer even though the user already allowed
+// the exact command in `.claude/settings.json`.
+//
+// This module bridges the gap: an `approval/request` whose underlying tool
+// call matches a CC `allow` rule is answered `allowed-once` automatically
+// (the user pre-consented; CC allow = run without asking). Deny/ask rules and
+// unmatched calls pass through to the deployment's human answerer untouched —
+// the module only ever auto-grants, never auto-denies, and it never answers
+// a call the CC fold did not explicitly allow.
+//
+// The request itself carries no arguments (`{agent, toolName, callId,
+// reason}`), so the real tool arguments are recovered from the session log:
+// the `tool/call` event keyed by `callId` (`data.arguments` is JSON text).
+
+import { evaluateCall } from 'dsh-cc-loader'
+
+/**
+ * Locate the recorded `tool/call` event for one approval request. The
+ * session log is scanned newest-first; the latest event matching the call id
+ * (and, when given, the tool name) wins — same shape as
+ * dsh-auto-approval-plugin's findToolCall.
+ * @param {unknown} events - the agent session's event log.
+ * @param {unknown} callId - the approval request's call id.
+ * @param {string} [toolName] - the approval request's tool name.
+ * @returns {{callId?: unknown, name?: string, arguments?: unknown}|undefined}
+ *   the matching tool call data, or undefined when absent.
+ */
+export function findToolCall(events, callId, toolName) {
+  if (typeof callId !== 'string' || callId === '') return undefined
+  if (!Array.isArray(events)) return undefined
+  for (let index = events.length - 1; index >= 0; index -= 1) {
+    const event = events[index]
+    if (event === null || typeof event !== 'object' || event.type !== 'tool/call') continue
+    const data = event.data
+    if (data === undefined || data === null || typeof data !== 'object') continue
+    if (data.callId !== callId) continue
+    if (toolName !== undefined && data.name !== undefined && data.name !== toolName) continue
+    return data
+  }
+  return undefined
+}
+
+/**
+ * Parse recorded tool arguments: the session log stores them as JSON text
+ * (lossless materialization), but object form is tolerated for fixtures.
+ * @param {unknown} raw - the recorded `tool/call` arguments.
+ * @returns {Record<string, unknown>|null} the parsed arguments, `{}` when
+ *   absent, or `null` when the text is unparseable (caller defers).
+ */
+export function parseArguments(raw) {
+  if (raw === undefined || raw === null) return {}
+  if (typeof raw === 'string') {
+    try {
+      return JSON.parse(raw)
+    } catch {
+      return null
+    }
+  }
+  return typeof raw === 'object' ? raw : null
+}
+
+/**
+ * Decide whether one approval request may be auto-granted from CC rules.
+ *
+ * Combines the session-log call lookup with the cc-loader rule fold
+ * (`evaluateCall`): only an explicit `allow` match — or an
+ * `enableAllProjectMcpServers`-covered project MCP tool on a no-rule call —
+ * yields `'allow'`. A deny or ask decision on the same call defers (the fold
+ * order deny > ask > allow is preserved; ask still asks the human).
+ *
+ * @param {object} input
+ * @param {unknown} input.events - the agent session's event log.
+ * @param {unknown} input.callId - the approval request's call id.
+ * @param {string} input.toolName - the approval request's tool name.
+ * @param {object} input.parsed - `parseRulesFor` output for the session.
+ * @param {object} input.env - `{ cwd, homeDir, projectRoot }` evaluation env.
+ * @param {boolean} [input.enableAllProjectMcpServers] - settings flag.
+ * @param {(name: string) => boolean} [input.isProjectMcpTool] - project MCP
+ *   tool predicate (plugin MCP tools are never covered).
+ * @returns {'allow'|'defer'} whether to answer `allowed-once`.
+ */
+export function decideApproval({
+  events,
+  callId,
+  toolName,
+  parsed,
+  env,
+  enableAllProjectMcpServers = false,
+  isProjectMcpTool = () => false,
+}) {
+  const call = findToolCall(events, callId, toolName)
+  if (call === undefined) return 'defer'
+  // No recorded arguments → no verification possible → defer ("no data, no
+  // auto-approval"); unparseable text defers too.
+  if (call.arguments === undefined || call.arguments === null) return 'defer'
+  const args = parseArguments(call.arguments)
+  if (args === null) return 'defer'
+  const name = typeof call.name === 'string' ? call.name : toolName
+  const result = evaluateCall(parsed, { tool: name, args }, env)
+  if (result.decision === 'allow') return 'allow'
+  if (result.decision === 'none'
+    && enableAllProjectMcpServers === true
+    && isProjectMcpTool(name)) {
+    return 'allow'
+  }
+  return 'defer'
+}

package/src/index.js

@@ -14,6 +14,7 @@ import { stat } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import z from '@deepseek-ai/schemastery'
 import { loadPermissions, evaluateCall } from 'dsh-cc-loader'
+import { decideApproval } from './approval.js'
 
 export const name = 'cc-permissions'
 
@@ -24,6 +25,11 @@ export const Config = z.object({
   hideDeniedTools: z.boolean().default(true),
   // Map CC defaultMode: dontAsk → approval policy never (per session).
   enableDefaultMode: z.boolean().default(true),
+  // Auto-answer approval/request (incl. sandbox escalation) when the call
+  // matches a CC allow rule — CC semantics: allow = run without asking.
+  // Granting is one-shot and rule-scoped; deny/ask rules and unmatched calls
+  // still reach the human answerer.
+  autoApproveAllowed: z.boolean().default(true),
   homeDir: z.string(),
   projectRootMarkers: z.array(z.string()).default(['.git']),
 })
@@ -100,6 +106,51 @@ export function apply(ctx, config = {}) {
     return next()
   })
 
+  // ── allow → approval seam: approval/request auto-answerer ─────────────────
+  // CC allow rules are the COMPLETE gate: an allowed command must not hit the
+  // human answerer, including when the file sandbox denies a file effect and
+  // the model retries with `sandbox_permissions` (which raises an
+  // approval/request for the escalation). This listener answers such requests
+  // `allowed-once` when the underlying tool call matches a CC allow rule; the
+  // real arguments come from the session log (`tool/call` by callId), never
+  // from the model-written reason. Deny/ask rules and unmatched calls defer.
+  if (config.autoApproveAllowed !== false) {
+    ctx.on('approval/request', async (req, next) => {
+      try {
+        const events = req.agent?.session?.events
+        if (!Array.isArray(events)) return next()
+        const cwd = req.agent?.session?.header?.cwd ?? process.cwd()
+        let loaded
+        try {
+          loaded = await permissionsFor(cwd)
+        } catch (error) {
+          ctx.logger.warn(`cc-permissions: approval auto-answer load failed: ${String(error)}`)
+          return next()
+        }
+        const perm = loaded.permissions
+        if (perm === undefined) return next()
+        if (perm.status !== 'DIRECT' && perm.enableAllProjectMcpServers !== true) return next()
+        const decision = decideApproval({
+          events,
+          callId: req.callId,
+          toolName: req.toolName,
+          parsed: perm.parsed,
+          env: { cwd: loaded.cwd, homeDir, projectRoot: loaded.projectRoot },
+          enableAllProjectMcpServers: perm.enableAllProjectMcpServers === true,
+          isProjectMcpTool: (name) => name.startsWith('mcp__') && !name.startsWith('mcp__plugin_'),
+        })
+        if (decision === 'allow') {
+          ctx.logger.info(`cc-permissions: AUTO-APPROVE ${req.toolName}${req.callId !== undefined ? ` call ${req.callId}` : ''} — matched a CC allow rule`)
+          return 'allowed-once'
+        }
+        return next()
+      } catch (error) {
+        ctx.logger.warn(`cc-permissions: approval auto-answer failed: ${String(error)}`)
+        return next()
+      }
+    }, { prepend: true })
+  }
+
   // ── bare-name deny → hide the tool from the model ─────────────────────────
   if (config.hideDeniedTools !== false) {
     ctx.on('agent/created', ({ agent }) => {