dsh-codex-approval 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-codex-approval contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,113 @@
+# dsh-codex-approval
+
+> **仿照 OpenAI Codex CLI 审批模型的 AI 自动审批插件**，为 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（dsh）带来 Codex 式的智能审批体验。
+
+dsh 原生只有两种审批策略：模式级沙箱（`read-only` / `workspace-write` / `danger-full-access`）和一刀切的 `ask`/`never` 策略——**没有命令级规则，也没有 AI 风险评估**。本插件在 dsh 的 `approval/request` 应答者（answerer）seam 上实现了一个完整的自动审批决策链：
+
+```
+规则层（Codex approve-always / reject-always 风格）
+  → AI 审判层（Codex 三级风险 + 三级授权 + risk tolerance）
+  → 人类兜底（GUI 弹窗）
+```
+
+## 仿照 Codex 的什么
+
+| Codex CLI | 本插件 |
+|---|---|
+| `--approve-always 'Bash(git diff)'` / `--reject-always` | glob 规则（`Bash(git *)` / `reason:*curl*`），动作 `allow` / `ask` / `deny`，安全优先级 **deny > ask > allow** |
+| 工具风险分级 `low` / `medium` / `high` | AI 对每次审批请求输出 `risk: low\|medium\|high`（只读=low、有界修改=medium、破坏/泄密/系统级=high） |
+| 三级授权 | AI 输出 `authorization: allow\|ask\|deny`——直接放行 / 交人类 / 禁止 |
+| `risk_tolerance` 配置 | `riskTolerance: low\|medium\|high`：AI 判 ask 时按容忍度映射（风险 ≤ 容忍度 → 自动放行） |
+| `--permission-mode auto` 的"低风险自动、高风险询问" | 默认 `tolerance: medium`：low/medium 自动放行，high 交人类或由 AI 直接拒绝 |
+
+## 决策流程
+
+```
+approval/request 到达（toolName + callId + reason）
+├─ 1. 参数反查：按 callId 从会话日志恢复完整命令（bash/pwsh 取原始 command）
+├─ 2. 规则层（deny > ask > allow，命中即定，0ms）
+│     deny → 直接拒绝（AI 无权覆盖）│ allow → 静默放行 │ ask → 交人类
+├─ 3. AI 审判层（规则未命中时；默认 opencode-go / deepseek-v4-flash）
+│     LLM 裁决 {risk, authorization, reason}
+│     allow/deny 直接生效；ask 按 riskTolerance 映射
+│     AI 报错/超时/输出非法 → failOpen（默认 ask → 人类）
+└─ 4. 兜底：fallback（默认 ask → GUI 弹窗）
+```
+
+每次决策写入一行 JSONL 审计日志（默认 `~/.dsh/logs/approval.jsonl`）：工具名、命令预览、reason、判定来源（rule / ai / ai-error / fallback）、风险、AI 理由、耗时。
+
+## 安装
+
+```bash
+dsh plugin --profile web add dsh-codex-approval
+# 重启 dsh web 生效
+```
+
+插件只在目标 profile 注册（推荐 web）；qqbot / headless 等 profile 不受影响。
+
+## 配置（~/.dsh/profiles/web/cordis.patch.yml）
+
+```yaml
+- id: dsh-codex-approval
+  config:
+    rules:
+      - match: 'Bash(git status*)'   # 命中即自动通过（Codex approve-always）
+        action: allow
+      - match: 'Bash(rm -rf /*)'     # 危险命令直接拒绝（Codex reject-always）
+        action: deny
+      - match: 'reason:*credential*' # 敏感场景强制询问
+        action: ask
+    ai:
+      enabled: true
+      provider: opencode-go          # 与主 agent 同一 provider（成本一致）
+      model: deepseek-v4-flash       # deepseek-chat 官方 API 已弃用
+      riskTolerance: medium          # low | medium | high（仿 Codex risk tolerance）
+      maxPromptChars: 2000
+      timeoutMs: 15000
+      maxTokens: 512                 # 含 reasoning 余量
+      failOpen: ask                  # AI 故障兜底：ask | deny | allow
+    fallback: ask                    # 无规则命中且 AI 关闭时：ask | deny | allow
+    logFile: ~/.dsh/logs/approval.jsonl
+```
+
+不配置即用内置默认：只读命令（git status/diff/log、ls、cat、pwd、which、echo）自动放行，破坏性命令（`rm -rf /`、`rm -rf ~`、`sudo rm`、`shutdown`、`reboot`、`mkfs`）直接拒绝，敏感词（secret/password/credential/token）询问。
+
+## 规则语法
+
+- 匹配对象（任一表面命中即中，大小写不敏感）：
+  - `ToolName(args preview)` — 如 `Bash(git status)`（bash/pwsh 为原始命令）
+  - `reason:<文本>` — 审批 reason（如沙箱升级的 justification）
+- 通配：`*` 任意序列、`?` 单字符
+- 优先级：**deny > ask > allow**（与列表顺序无关）；同优先级内按列表顺序取首个
+
+## AI 审判输入/输出
+
+**输入**：固定系统提示（审批员角色 + risk/authorization 定义 + 只输出 JSON 约束）+ `{"toolName", "command", "reason"}`（命令截断 2000 字符，无其他上下文）。
+
+**输出**：`{"risk":"low|medium|high","authorization":"allow|ask|deny","reason":"一句话"}`；解析策略：整体 JSON → ```json``` 代码块 → 平衡花括号扫描；枚举校验失败按 AI 故障处理。
+
+## 安全注意事项
+
+- **deny 规则永远最先求值**，AI 无权覆盖显式拒绝
+- AI 输出只映射为三种结果之一，不存在注入面；命令文本进 prompt 前截断
+- AI 调用有超时上限（默认 15s），失败默认交还人类（fail-open，不会静默全拒）
+- 审批审计对（approval/asked + approval/decided）由 dsh 审批服务持久化，插件只追加自己的决策日志
+- `danger-full-access` 模式下沙箱不拒绝任何操作，审批请求不会发生，插件自然空闲
+- 单次 AI 审批成本约 0.3~0.7 分钱（官方价估算），仅规则未命中时产生
+
+## 成本
+
+| 场景 | 单次 Token | 单次成本（官方高峰价） |
+|---|---|---|
+| 典型（短命令） | ~400-500 | ≈ 0.003 元 |
+| 最坏（命令 2000 字符） | ~1,500 | ≈ 0.007 元 |
+
+## 开发与测试
+
+```bash
+node --test        # 55 个单测：规则匹配 / 参数反查 / AI 裁决解析 / 决策流
+```
+
+## License
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,4 @@
+# dsh-codex-approval bundle layer: insert the plugin row into the profile.
+- insert:
+    - id: dsh-codex-approval
+      name: dsh-codex-approval

package/enrich.js

@@ -0,0 +1,68 @@
+/**
+ * dsh-codex-approval — enrich.js
+ *
+ * Best-effort recovery of the full tool-call arguments behind an approval
+ * request. The approval seam hands answerers only `{ toolName, callId,
+ * reason }`, but the session log's latest `assistant/message` contains the
+ * complete `tool-call` content part (id, name, arguments JSON) — so by
+ * `callId` we can recover e.g. the exact bash command that triggered a
+ * sandbox escalation, which is what rule matching and the AI judge see.
+ *
+ * Everything here is defensive: any shape drift or missing data returns
+ * null / a degraded preview, never throws.
+ */
+
+/**
+ * Find the parsed tool-call arguments for a callId in a session event list.
+ * @param events - session.events (or any event array)
+ * @param callId - the approval request's callId
+ * @returns the parsed arguments object, or null when unrecoverable.
+ */
+export function findToolCallArgs(events, callId) {
+	if (!Array.isArray(events) || callId === undefined) return null;
+	for (let i = events.length - 1; i >= 0; i -= 1) {
+		const event = events[i];
+		if (event === null || typeof event !== "object" || event.type !== "assistant/message") continue;
+		const content = event.data?.message?.content;
+		if (!Array.isArray(content)) continue;
+		for (let j = content.length - 1; j >= 0; j -= 1) {
+			const part = content[j];
+			if (part === null || typeof part !== "object" || part.type !== "tool-call") continue;
+			if (part.id !== callId) continue;
+			try {
+				return JSON.parse(part.arguments ?? "null");
+			} catch {
+				return null;
+			}
+		}
+	}
+	return null;
+}
+
+/**
+ * Build the Codex-style args preview used for rule matching and the AI
+ * prompt: the raw command for bash/pwsh, compact JSON otherwise.
+ * @param args - parsed tool arguments (or null)
+ * @param toolName - the tool that was called
+ * @param maxChars - preview length cap
+ */
+export function argsPreview(args, toolName, maxChars) {
+	let preview;
+	if (args !== null && typeof args === "object") {
+		if ((toolName === "bash" || toolName === "pwsh") && typeof args.command === "string") {
+			preview = args.command;
+		} else {
+			try {
+				preview = JSON.stringify(args);
+			} catch {
+				preview = String(args);
+			}
+		}
+	} else if (args === undefined || args === null) {
+		preview = "";
+	} else {
+		preview = String(args);
+	}
+	if (preview.length > maxChars) preview = `${preview.slice(0, maxChars)}…`;
+	return preview;
+}

package/index.js

@@ -0,0 +1,240 @@
+/**
+ * dsh-codex-approval — index.js
+ *
+ * Codex-style approval autopilot for DeepSeek Harness. Registers an
+ * `approval/request` answerer (waterfall listener) that decides each request:
+ *
+ *   1. enrich — recover the full tool arguments by callId from the session log
+ *   2. rules   — ordered glob rules with safety-first priority deny > ask > allow
+ *   3. AI judge — LLM verdict {risk, authorization} mapped through riskTolerance
+ *   4. fallback — delegate to the next answerer (the human GUI prompt)
+ *
+ * Returning an outcome ("allowed-once"/"rejected") claims the request;
+ * calling next() delegates. The approval service owns the audit pair
+ * (approval/asked + approval/decided), this plugin only adds its own
+ * decision log file.
+ *
+ * Safety properties:
+ * - deny rules are always evaluated first and can never be overridden.
+ * - AI errors/timeouts fail open to the configured failOpen (default ask).
+ * - The AI output is only ever mapped onto the three outcomes — no injection.
+ */
+
+import { appendFile, mkdir } from "node:fs/promises";
+import { mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+
+import { evaluateRules } from "./rules.js";
+import { findToolCallArgs, argsPreview } from "./enrich.js";
+import { judgeWith, decideAuthorization } from "./judge.js";
+
+export const name = "dsh-codex-approval";
+
+/**
+ * Declarative dependency on the approval service. Cordis loads plugin entries
+ * in parallel, so a runtime `ctx.get("approval")` check at apply time could
+ * observe the service before it registers and silently no-op the plugin;
+ * `inject` guarantees the service is ready before apply runs (fails loud at
+ * load when the composition has no approval service).
+ */
+export const inject = ["approval", "llm"];
+
+/** Default configuration — tune via the profile patch id-targeted config. */
+export const DEFAULT_CONFIG = {
+	enabled: true,
+	rules: [
+		// read-only / harmless commands: auto-approve
+		{ match: "Bash(git status*)", action: "allow" },
+		{ match: "Bash(git diff*)", action: "allow" },
+		{ match: "Bash(git log*)", action: "allow" },
+		{ match: "Bash(ls *)", action: "allow" },
+		{ match: "Bash(cat *)", action: "allow" },
+		{ match: "Bash(pwd)", action: "allow" },
+		{ match: "Bash(which *)", action: "allow" },
+		{ match: "Bash(echo *)", action: "allow" },
+		// destructive: always deny, never ask, never judged by AI
+		{ match: "Bash(rm -rf /*)", action: "deny" },
+		{ match: "Bash(rm -rf ~*)", action: "deny" },
+		{ match: "Bash(sudo rm*)", action: "deny" },
+		{ match: "Bash(shutdown*)", action: "deny" },
+		{ match: "Bash(reboot)", action: "deny" },
+		{ match: "Bash(mkfs*)", action: "deny" },
+		// sensitive: always ask a human
+		{ match: "reason:*secret*", action: "ask" },
+		{ match: "reason:*password*", action: "ask" },
+		{ match: "reason:*credential*", action: "ask" },
+		{ match: "reason:*token*", action: "ask" }
+	],
+	ai: {
+		enabled: true,
+		provider: "opencode-go",
+		model: "deepseek-v4-flash",
+		riskTolerance: "medium",
+		maxPromptChars: 2000,
+		timeoutMs: 15000,
+		maxTokens: 512,
+		failOpen: "ask"
+	},
+	fallback: "ask",
+	logFile: join(homedir(), ".dsh", "logs", "approval.jsonl")
+};
+
+const ACTIONS = ["allow", "ask", "deny"];
+const TOLERANCES = ["low", "medium", "high"];
+
+function assertConfig(cfg) {
+	if (typeof cfg !== "object" || cfg === null) throw new TypeError("dsh-codex-approval: config must be an object");
+	if (typeof cfg.enabled !== "boolean") throw new TypeError("dsh-codex-approval: config.enabled must be a boolean");
+	if (!Array.isArray(cfg.rules)) throw new TypeError("dsh-codex-approval: config.rules must be an array");
+	for (const rule of cfg.rules) {
+		if (typeof rule.match !== "string" || rule.match === "") throw new TypeError("dsh-codex-approval: each rule needs a non-empty match");
+		if (!ACTIONS.includes(rule.action)) throw new TypeError(`dsh-codex-approval: rule action must be one of ${ACTIONS.join("/")}`);
+	}
+	if (typeof cfg.ai !== "object" || cfg.ai === null) throw new TypeError("dsh-codex-approval: config.ai must be an object");
+	if (typeof cfg.ai.enabled !== "boolean") throw new TypeError("dsh-codex-approval: config.ai.enabled must be a boolean");
+	if (!TOLERANCES.includes(cfg.ai.riskTolerance)) throw new TypeError(`dsh-codex-approval: config.ai.riskTolerance must be one of ${TOLERANCES.join("/")}`);
+	if (!ACTIONS.includes(cfg.ai.failOpen)) throw new TypeError("dsh-codex-approval: config.ai.failOpen must be allow/ask/deny");
+	if (!ACTIONS.includes(cfg.fallback)) throw new TypeError("dsh-codex-approval: config.fallback must be allow/ask/deny");
+	if (typeof cfg.logFile !== "string" || cfg.logFile === "") throw new TypeError("dsh-codex-approval: config.logFile must be a non-empty path");
+}
+
+/** Deep-merge user config over defaults (ai sub-object merged). */
+export function normalizeConfig(userConfig) {
+	const cfg = {
+		...DEFAULT_CONFIG,
+		...(userConfig ?? {}),
+		ai: { ...DEFAULT_CONFIG.ai, ...(userConfig?.ai ?? {}) },
+		rules: Array.isArray(userConfig?.rules) && userConfig.rules.length > 0 ? userConfig.rules : DEFAULT_CONFIG.rules
+	};
+	assertConfig(cfg);
+	return cfg;
+}
+
+function outcomeFor(action) {
+	if (action === "allow") return "allowed-once";
+	if (action === "deny") return "rejected";
+	return "pass";
+}
+
+/** The real LLM runner: ctx.llm.prepareCall + stream, bounded by timeout. */
+export function makeLlmRunner(llm, { provider, model, timeoutMs, maxTokens }) {
+	return async (messages, { signal } = {}) => {
+		const timeoutSignal = AbortSignal.timeout(timeoutMs);
+		const combined = signal !== undefined ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+		try {
+			const prepared = await llm.prepareCall({ provider, model, temperature: 0, maxTokens }, combined);
+			let text = "";
+			for await (const chunk of prepared.stream({ ...prepared.config, messages })) {
+				if (chunk.type === "text-delta") text += chunk.text;
+				else if (chunk.type === "finish" && (chunk.reason?.kind === "error" || chunk.reason?.kind === "aborted")) {
+					return { ok: false, error: `judge stream finished with ${chunk.reason.kind}` };
+				}
+			}
+			return { ok: true, text };
+		} catch (error) {
+			return { ok: false, error: String(error?.message ?? error) };
+		}
+	};
+}
+
+/**
+ * Create the approval/request handler with injected dependencies
+ * (unit-testable without a cordis ctx).
+ * @param deps - { config, record, llmRunner }
+ * @returns async (req, next) => ApprovalOutcome
+ */
+export function createHandler({ config, record, llmRunner }) {
+	const cfg = config;
+	return async (req, next) => {
+		const started = Date.now();
+		if (req.signal?.aborted === true) return "cancelled";
+		if (!cfg.enabled) return next();
+
+		const args = findToolCallArgs(req.agent?.session?.events, req.callId);
+		const argsText = argsPreview(args, req.toolName, cfg.ai.maxPromptChars);
+		const matchReq = { toolName: req.toolName, argsText, reason: req.reason ?? "" };
+
+		let verdict;
+		const rule = evaluateRules(cfg.rules, matchReq);
+		if (rule !== null) {
+			verdict = { kind: "rule", action: rule.action, outcome: outcomeFor(rule.action), match: rule.match };
+		} else if (cfg.ai.enabled) {
+			const judged = await judgeWith({
+				runner: llmRunner,
+				input: { toolName: req.toolName, argsText, reason: req.reason ?? "" }
+			});
+			if (judged.ok) {
+				const authorization = decideAuthorization(judged.verdict, cfg.ai.riskTolerance);
+				verdict = {
+					kind: "ai",
+					action: authorization,
+					outcome: outcomeFor(authorization),
+					risk: judged.verdict.risk,
+					aiReason: judged.verdict.reason
+				};
+			} else {
+				verdict = {
+					kind: "ai-error",
+					action: cfg.ai.failOpen,
+					outcome: outcomeFor(cfg.ai.failOpen),
+					error: judged.error,
+					...judged.rawText !== void 0 ? { rawOutput: judged.rawText } : {}
+				};
+			}
+		} else {
+			verdict = { kind: "fallback", action: cfg.fallback, outcome: outcomeFor(cfg.fallback) };
+		}
+
+		await record({
+			ts: new Date().toISOString(),
+			sessionId: req.agent?.session?.id ?? req.agent?.id ?? "?",
+			toolName: req.toolName,
+			callId: req.callId,
+			argsPreview: argsText.slice(0, 300),
+			reason: (req.reason ?? "").slice(0, 500),
+			...verdict,
+			ms: Date.now() - started
+		});
+
+		return verdict.outcome === "pass" ? next() : verdict.outcome;
+	};
+}
+
+/** Fire-and-forget JSONL appender (never throws into the approval path). */
+export function makeRecorder(logFile) {
+	let dirChecked = false;
+	return async (entry) => {
+		try {
+			if (!dirChecked) {
+				mkdirSync(dirname(logFile), { recursive: true });
+				dirChecked = true;
+			}
+			await appendFile(logFile, `${JSON.stringify(entry)}\n`, "utf8");
+		} catch {
+			/* logging must never break an approval decision */
+		}
+	};
+}
+
+/** Cordis plugin entry: register the answerer when approval is composed. */
+export async function apply(ctx, userConfig) {
+	const cfg = normalizeConfig(userConfig);
+	const llmRunner = makeLlmRunner(ctx.llm, cfg.ai);
+	const handler = createHandler({ config: cfg, record: makeRecorder(cfg.logFile), llmRunner });
+	ctx.on("approval/request", handler);
+	// Self-proving startup record: this line in the log after a restart proves
+	// the plugin loaded (decision records follow it). Awaited so a boot that
+	// cannot even write its own log fails loud instead of silently degrading.
+	await makeRecorder(cfg.logFile)({
+		ts: new Date().toISOString(),
+		event: "plugin-loaded",
+		sessionId: "boot",
+		rules: cfg.rules.length,
+		ai: cfg.ai.enabled,
+		tolerance: cfg.ai.riskTolerance,
+		fallback: cfg.fallback
+	});
+	ctx.logger?.info?.("[dsh-codex-approval] answerer registered — rules=%d ai=%s tolerance=%s log=%s",
+		cfg.rules.length, cfg.ai.enabled ? "on" : "off", cfg.ai.riskTolerance, cfg.logFile);
+}

package/judge.js

@@ -0,0 +1,147 @@
+/**
+ * dsh-codex-approval — judge.js
+ *
+ * The AI approval judge: builds a strict prompt from the request, runs it
+ * through an injected LLM runner, parses the verdict, and maps
+ * risk × tolerance onto the allow/ask/deny authorization (Codex-style).
+ *
+ * The LLM runner is injected so tests can drive deterministic verdicts
+ * without any model; index.js supplies the real ctx.llm-backed runner.
+ */
+
+export const RISKS = ["low", "medium", "high"];
+export const AUTHORIZATIONS = ["allow", "ask", "deny"];
+export const RISK_RANK = { low: 0, medium: 1, high: 2 };
+
+const SYSTEM_PROMPT = `You are the automated approval judge for an AI coding agent's command-execution requests.
+
+Classify the tool call on two axes:
+1. risk: "low" (safe, read-only, reversible) | "medium" (modifies state, bounded and recoverable) | "high" (destructive, irreversible, credential-exposing, or system-wide impact).
+2. authorization: "allow" (proceed without asking) | "ask" (a human must confirm) | "deny" (must not run).
+
+Rules of thumb:
+- Reading files, git status/diff/log, listing, help output: low.
+- Writes inside a project, installs, network fetches: medium.
+- Deleting data, overwriting configs, exposing secrets, privilege changes, formatting disks, anything touching credentials: high.
+- When uncertain, prefer "ask". Prefer "deny" for destructive or credential-exposing actions.
+
+Reply with ONLY one JSON object, no prose, no markdown fences:
+{"risk":"low|medium|high","authorization":"allow|ask|deny","reason":"one short sentence"}`;
+
+/** Build the messages array for the judge call. */
+export function buildJudgeMessages({ toolName, argsText, reason }) {
+	const user = JSON.stringify({
+		toolName,
+		command: argsText === "" ? null : argsText,
+		reason: reason ?? null
+	});
+	return [{
+		role: "user",
+		content: [{ type: "text", text: `${SYSTEM_PROMPT}\n\n${user}` }]
+	}];
+}
+
+/**
+ * Parse a judge verdict out of model output. Tries, in order:
+ *   1. whole-string JSON (models that emit pure JSON)
+ *   2. a fenced ```json ... ``` block
+ *   3. a balanced-brace scan from the first `{` (robust against prose,
+ *      multiple objects, and nested braces inside string values)
+ * The first candidate that parses AND passes the closed-enum validation
+ * wins. Returns null when nothing qualifies.
+ */
+export function parseVerdict(text) {
+	if (typeof text !== "string") return null;
+	const candidates = [];
+	const trimmed = text.trim();
+	if (trimmed.startsWith("{")) candidates.push(trimmed);
+	const fence = trimmed.match(/```(?:json)?\s*([\s\S]*?)```/i);
+	if (fence !== null) candidates.push(fence[1].trim());
+	const start = text.indexOf("{");
+	if (start !== -1) {
+		let depth = 0;
+		let inString = false;
+		let escaped = false;
+		for (let i = start; i < text.length; i += 1) {
+			const ch = text[i];
+			if (inString) {
+				if (escaped) escaped = false;
+				else if (ch === "\\") escaped = true;
+				else if (ch === '"') inString = false;
+				continue;
+			}
+			if (ch === '"') {
+				inString = true;
+				continue;
+			}
+			if (ch === "{") {
+				depth += 1;
+				continue;
+			}
+			if (ch === "}") {
+				depth -= 1;
+				if (depth === 0) {
+					candidates.push(text.slice(start, i + 1));
+					break;
+				}
+			}
+		}
+	}
+	for (const candidate of candidates) {
+		let parsed;
+		try {
+			parsed = JSON.parse(candidate);
+		} catch {
+			continue;
+		}
+		if (parsed === null || typeof parsed !== "object") continue;
+		const { risk, authorization, reason } = parsed;
+		if (!RISKS.includes(risk) || !AUTHORIZATIONS.includes(authorization)) continue;
+		return {
+			risk,
+			authorization,
+			reason: typeof reason === "string" ? reason.slice(0, 200) : ""
+		};
+	}
+	return null;
+}
+
+/**
+ * Map an AI verdict onto the final authorization under a risk tolerance.
+ * A direct allow/deny verdict is respected; an "ask" verdict falls back to
+ * the tolerance comparison (risk <= tolerance → allow, else ask).
+ * @param verdict - parsed AI verdict {risk, authorization}
+ * @param tolerance - "low" | "medium" | "high"
+ * @returns "allow" | "ask" | "deny"
+ */
+export function decideAuthorization(verdict, tolerance) {
+	if (verdict.authorization === "allow" || verdict.authorization === "deny") return verdict.authorization;
+	const riskRank = RISK_RANK[verdict.risk] ?? 2;
+	const toleranceRank = RISK_RANK[tolerance] ?? 1;
+	return riskRank <= toleranceRank ? "allow" : "ask";
+}
+
+/**
+ * Run the judge through an injected runner.
+ * @param runner - async (messages, { signal }) => Promise<{ ok: boolean, text: string }>
+ * @param input - { toolName, argsText, reason }
+ * @param config - { maxPromptChars } (unused here; kept for symmetry)
+ * @returns { ok: true, verdict } | { ok: false, error }
+ */
+export async function judgeWith({ runner, input, signal }) {
+	const messages = buildJudgeMessages(input);
+	let result;
+	try {
+		result = await runner(messages, { signal });
+	} catch (error) {
+		return { ok: false, error: String(error?.message ?? error) };
+	}
+	if (result === null || result.ok !== true) {
+		return { ok: false, error: result?.error ?? "judge runner failed" };
+	}
+	const verdict = parseVerdict(result.text);
+	if (verdict === null) {
+		return { ok: false, error: "unparseable judge output", rawText: result.text.slice(0, 500) };
+	}
+	return { ok: true, verdict };
+}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "dsh-codex-approval",
+  "version": "0.1.0",
+  "description": "Codex-style approval autopilot for DeepSeek Harness: ordered glob rules (allow/ask/deny) plus an AI risk judge (low/medium/high) mapped through a risk tolerance, as an approval answerer.",
+  "type": "module",
+  "main": "index.js",
+  "files": [
+    "index.js",
+    "rules.js",
+    "enrich.js",
+    "judge.js",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "approval",
+    "codex",
+    "risk"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/040822/dsh-codex-approval.git"
+  },
+  "engines": {
+    "node": ">=22.19"
+  }
+}

package/rules.js

@@ -0,0 +1,90 @@
+/**
+ * dsh-codex-approval — rules.js
+ *
+ * Codex-style rule matching. A rule matches a request via a single glob
+ * pattern over the "matchable text": `ToolName(args preview) reason:<reason>`.
+ * Examples:
+ *   - `Bash(git *)`      — the recovered bash command starts with "git "
+ *   - `Bash(rm -rf /*)`  — destructive command
+ *   - `reason:*curl*`    — the approval reason mentions curl
+ *
+ * Evaluation priority is safety-first regardless of list order:
+ *   deny  >  ask  >  allow
+ * (an explicit ask or deny can never be overridden by a blanket allow,
+ * mirroring Codex where ask/reject rules take precedence over auto-approve).
+ */
+
+/** Classic glob match: `*` = any sequence (incl. empty), `?` = one char. Case-insensitive. */
+export function wildcardMatch(pattern, text) {
+	if (typeof pattern !== "string" || typeof text !== "string") return false;
+	pattern = pattern.toLowerCase();
+	text = text.toLowerCase();
+	let pi = 0;
+	let ti = 0;
+	let star = -1;
+	let mark = 0;
+	while (ti < text.length) {
+		if (pi < pattern.length && (pattern[pi] === "?" || pattern[pi] === text[ti])) {
+			pi += 1;
+			ti += 1;
+		} else if (pi < pattern.length && pattern[pi] === "*") {
+			star = pi;
+			pi += 1;
+			mark = ti;
+		} else if (star !== -1) {
+			pi = star + 1;
+			ti = mark + 1;
+			mark += 1;
+		} else {
+			return false;
+		}
+	}
+	while (pi < pattern.length && pattern[pi] === "*") pi += 1;
+	return pi === pattern.length;
+}
+
+/**
+ * Build the single string rules match against.
+ * @param req - { toolName, argsText, reason }
+ */
+export function matchableText(req) {
+	const bits = [];
+	if (req.toolName) bits.push(`${req.toolName}(${req.argsText ?? ""})`);
+	if (req.reason) bits.push(`reason:${req.reason}`);
+	return bits.join(" ");
+}
+
+/**
+ * The surfaces a rule pattern is tested against, in order: the tool call
+ * alone (`ToolName(args)`), the reason alone (`reason:...`), then the
+ * combined string. This lets `Bash(git *)` match regardless of an appended
+ * reason, and `reason:*curl*` match the reason alone.
+ */
+export function matchSurfaces(req) {
+	const surfaces = [];
+	if (req.toolName) surfaces.push(`${req.toolName}(${req.argsText ?? ""})`);
+	if (req.reason) surfaces.push(`reason:${req.reason}`);
+	const combined = surfaces.join(" ");
+	if (!surfaces.includes(combined)) surfaces.push(combined);
+	return surfaces.filter((surface) => surface !== "");
+}
+
+/**
+ * Evaluate an ordered rule list against one request.
+ * @param rules - [{ match: string, action: "allow"|"ask"|"deny" }]
+ * @param req - { toolName, argsText, reason }
+ * @returns the first matching rule under deny > ask > allow priority, or null.
+ */
+export function evaluateRules(rules, req) {
+	const surfaces = matchSurfaces(req);
+	if (surfaces.length === 0) return null;
+	for (const action of ["deny", "ask", "allow"]) {
+		for (const rule of rules) {
+			if (rule.action !== action) continue;
+			for (const surface of surfaces) {
+				if (wildcardMatch(rule.match, surface)) return rule;
+			}
+		}
+	}
+	return null;
+}